Suspend the enrollment local-only picker pending redesign (LLP 0094)

[philcunliffe]

What

Disables the login-time local-only directory picker wholesale behind a single constant (ENROLLMENT_PICKER_ENABLED = false in src/core/cli/remote_commands.js), pending a redesign. Every login fork that would have prompted prints the durable hyp ignore --local-only hint instead.

Why

The first real-history fresh enroll after the #283 / #286 / #287 fixes still misfired, in a new way: the picker appeared but offered only a handful of directories when the cache holds 126 distinct captured cwds. The cause is structural, not tunable: waitForCapturedDirectories returns at the first non-empty enumeration ("has backfill started"), while the picker needs "has backfill settled". The daemon's first backfill streams ~119k rows over ~25s; the wait returned within a tick or two and its early snapshot was handed to the picker verbatim, never re-enumerated. That shows the user a race-ordered slice of their history presented as the whole thing, and invites a pick over a false picture.

The redesign on the table (enumerate from the clients' own on-disk logs via a plugin-contributed provider; searchable TUI instead of the 50-item cap) replaces both halves of the feature, so patching the wait a fourth time buys nothing.

Scope

• Suspended: the enrolling-login prompt, the capture wait, the freshenCaptureEnumeration kernel re-boot, and the pick-pending marker write (nothing pending to guard; LLP 0093 mechanism stays implemented + tested, dormant).
• Unchanged: hyp ignore --local-only / hyp unignore, the machine-local list, export-seam withholding of existing lists, and the picker module + its unit tests. Re-enabling is one flag flip alongside the redesign, recorded as a new decision.
• LLP 0094 (decision) records the suspension; Suspended-by forward-refs appended to LLP 0069 §trigger, 0072, 0080, and 0093.

Testing

• npm test: 2140 pass / 0 fail (login-flow tests reworked to pin the suspended behavior: no prompt, no wait, no re-boot, no marker, hint printed on every enrolling fork).
• npm run build:types: clean.

🤖 Generated with Claude Code

[philcunliffe]

Dual-agent review — approve

• Verdict: approve
• Risk class: low
• Auto-merge advisory: 👍 thumbs up — approve verdict, low blast radius, both reviewer artifacts present, no blocker/major findings

Advisory only: no merge was attempted.

Risk capstone

Cross-reference: reviewer findings vs high-risk surfaces

Source	Finding (severity, evidence)	Intersects
(none)	(none)	(none)

Codex review

Fix Validations

Fresh-enroll picker showed a partial backfill snapshot

• Status: correct
• Evidence: src/core/cli/remote_commands.js:160, src/core/cli/remote_commands.js:171, src/core/cli/remote_commands.js:340, src/core/cli/remote_commands.js:847
• Assessment: The old wait still returns on the first non-empty candidate list, matching the stated failure mode, but the login trigger now returns before invoking the picker and the fresh-enroll capture wait is gated off by ENROLLMENT_PICKER_ENABLED = false.

Pick-pending marker is dormant while the picker is suspended

• Status: correct
• Evidence: src/core/cli/remote_commands.js:758, llp/0093-pick-pending-export-hold.decision.md:100, test/core/remote-login-command.test.js:1044
• Assessment: Fresh enrolls no longer write the marker, and the tests assert it is absent before enrollment and after return. The sink-side TTL behavior remains in place if a marker exists from another source.

Findings

No new findings.

No Finding

1. Behavioral Correctness
2. Contract & Interface Fidelity
3. Change Impact / Blast Radius
4. Concurrency, Ordering & State Safety
5. Error Handling & Resilience
6. Security Surface
7. Resource Lifecycle & Cleanup
8. Release Safety
9. Test Evidence Quality
10. Architectural Consistency
11. Debuggability & Operability

Evidence Bundle

• Changed hot paths: runRemoteLogin browser enrollment flow, refineLocalOnly, fresh-enroll capture wait/freshen path, pick-pending marker write path, runLocalOnlyPicker hint export.
• Impacted callers: runRemoteLogin -> refineLocalOnly in --no-daemon at src/core/cli/remote_commands.js:783, daemon-install-failure at src/core/cli/remote_commands.js:797, fresh-enroll daemon path at src/core/cli/remote_commands.js:858 and src/core/cli/remote_commands.js:863, already-enrolled re-login at src/core/cli/remote_commands.js:894.
• Impacted tests: suspended prompt coverage at test/core/remote-login-command.test.js:749, fresh-enroll wait skip at test/core/remote-login-command.test.js:769, no-attach path at test/core/remote-login-command.test.js:794, daemon-failure path at test/core/remote-login-command.test.js:816, re-login path at test/core/remote-login-command.test.js:887, freshen skip at test/core/remote-login-command.test.js:922, marker dormant checks at test/core/remote-login-command.test.js:1044.
• Unresolved uncertainty: I did not run the test suite; this review is based on the supplied diff plus targeted caller/contract tracing.

Claude review

Claude review

No issues found.

Reviewed across five lenses (guidance compliance, shallow bug scan, historical
context, contracts/callers, comments/tests). The change gates the enrollment
local-only picker behind a single module constant ENROLLMENT_PICKER_ENABLED = false and applies it consistently at all three decision points:

• refineLocalOnly early-returns after printing DURABLE_HINT (the same hint
  the picker's own skip paths printed), so the capability stays discoverable.
• The pick-pending marker (LLP 0093) is never written:
  holdingExports = ENROLLMENT_PICKER_ENABLED ? await mark... : false, and its
  clear is correctly gated on holdingExports.
• The backfill wait + registry re-boot are skipped via
  canPromptPicker = ENROLLMENT_PICKER_ENABLED && isTty(...) && isTty(...).

Contracts: DURABLE_HINT is now exported from local_only.js and still used
internally there; no other caller of the picker/marker path is left dangling.
Style complies with CLAUDE.md (no semicolons, no em dashes, JSDoc types,
correct root-anchored context). The 61 tests in
test/core/remote-login-command.test.js were rewritten to pin the disabled
behavior and all pass locally. LLP 0094 is a well-formed Accepted decision;
all cross-links (0069/0070/0071/0072/0080/0081/0093) resolve, filename/type
match, and no [inferred] claim survives. The withholding/export-seam
invariants (LLP 0070/0071) and existing lists are untouched — only refinement
acquisition at enrollment is suspended, which the decision documents as an
intentional opt-in regression.

---

Reports: /Users/phil/workspace/hypaware/.git/worktrees/wt/dual-review/pr-289

[philcunliffe]

neutral review — round 1 · verdict: clean · adopted PR (LLP 0025, full-heal)

Reviewed head ab2312a (Codex + Claude, independent). No actionable findings. The change is a well-contained feature-flag suspension of the enrollment local-only picker pending redesign, and is consistent with its stated intent (LLP 0094).

Verified:

• Gate ENROLLMENT_PICKER_ENABLED = false applied consistently at all three decision points in src/core/cli/remote_commands.js — refineLocalOnly early-returns with the durable hint; the pick-pending marker write is gated so holdingExports is always false and its clear stays balanced; the backfill wait + kernel re-boot are skipped via canPromptPicker.
• DURABLE_HINT widened to an export from local_only.js, still used internally — no dangling consumers, no stray picker references left in src//bin/.
• No withholding/export-seam regression: the export-seam enforcement (LLP 0070) and machine-local exclusion list (LLP 0071) are untouched; only refinement acquisition at enrollment is suspended (an intentional, documented opt-in regression — users run hyp ignore --local-only).
• LLP hygiene solid: new llp/0094-enrollment-picker-suspended.decision.md is a well-formed Accepted decision (unique number, filename/Type match, no surviving [inferred], all cross-links resolve), with correct Suspended-by/Dormant forward-refs landed into 0069/0072/0080/0093.
• Style compliant (no semicolons, no em dashes, JSDoc types, @ref LLP 0094 [implements] present); the 61 rewritten tests in test/core/remote-login-command.test.js pin the disabled behavior and pass.

Benign edge (not a finding): with holdingExports always false, an enrolling fork no longer clears a pick-pending marker. A stale marker could only come from a pre-0094 crashed login and LLP 0093's TTL bounds it, so it self-heals.

Mergeable ∧ green ∧ reviewed-clean → approved. Held for you to merge — neutral does not merge or ready adopted PRs.