# Track Specification: Fix `mma_tier_usage` reset breaking `_flush_to_project` + 2 pre-existing bugs (2026-06-10)

## Overview

This track fixes **3 distinct pre-existing bugs** in `src/app_controller.py` that surfaced during the 2026-06-10 batch run:

1. **`mma_tier_usage` reset to empty dicts** (introduced in `fe240db4` 2026-06-09). `_handle_reset_session` zeroes the per-tier dicts to `{}`, but `_flush_to_project` does `d["model"]` and crashes with `KeyError`. This crashes the project save AND triggers an infinite re-switch loop in `_do_project_switch`'s finally block. Symptom: `test_context_sim_live` sees `ai_status = "error: 'model'"` (or "switching to: ... (stale ui - ops disabled)" in older runs) and times out at 60s.

2. **`self.context_preset_manager` is never initialized in `__init__`** (accidentally lost in `72f8f466` 2026-06-10). The line `self.context_preset_manager = ContextPresetManager()` was in the codebase at `c039fdbb` (2026-06-09) and got dropped when `_settable_fields` block was hand-edited. `save_context_preset` and `load_context_preset` both dereference `self.context_preset_manager.save_preset(...)` and `self.context_preset_manager.load_all(...)` — both crash with `AttributeError: 'NoneType' object has no attribute 'save_preset'` (or `'load_all'`). Symptom: `tests/test_context_presets_manager.py::test_app_controller_save_load` and `tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror` fail in tier-1.

3. **`__getattr__` short-circuits manager attributes to None, breaking `hasattr()`** (added 2026-06-08 in `c039fdbb`'s neighborhood). The `_LAZY_MANAGER_DEFAULTS` set in `AppController.__getattr__` (src/app_controller.py:1266-1275) returns `None` for `context_preset_manager`, `persona_manager`, `tool_preset_manager`, `preset_manager`, `vendor_state`, `perf_monitor`. The code comment claims "hasattr() still returns False for non-mocked access paths" but this is wrong — `__getattr__` returning None makes `hasattr()` return True. Symptom: `tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager` fails because it asserts `not hasattr(ctrl, "persona_manager")` for a fresh `AppController()`, but `__getattr__` returns None so `hasattr()` returns True.

The mma_tier_usage fix was the original ask. The 2 additional bugs surfaced when the user ran the full batch to verify the original fix. Including all 3 in this track is in-scope: they are all in the same file (`src/app_controller.py`), all pre-existing (not introduced by my changes), all block the test suite from going green, and all are 1-3 line surgical fixes.

## Bug 1 in detail: `mma_tier_usage` reset

`_handle_reset_session` (src/app_controller.py:3358) was changed in commit `fe240db4` to reset `mma_tier_usage` to `{'Tier 1': {}, 'Tier 2': {}, 'Tier 3': {}, 'Tier 4': {}}` — empty dicts. The downstream consumer `_flush_to_project` (line 2639) does `d["model"]` and crashes with `KeyError: 'model'` when iterating over the per-tier dicts.

This is the root cause of `test_context_sim_live` (and the 3 sibling sims) failing. The test sees the `ai_status` of `"error: 'model'"` (after the sim_context.py polling loop added an `"error" in s` check) because:

1. The test clicks `btn_reset` → `_handle_reset_session` zeroes `mma_tier_usage` to empty dicts.
2. The test clicks `btn_project_new_automated` → `_switch_project(path)` is called → sets `in_progress=True`, submits `_do_project_switch` to the io_pool, sets `ai_status = "switching to: ... (stale ui - ops disabled)"`.
3. The test clicks `btn_project_save` → `_cb_project_save` calls `_flush_to_project()` on the main render thread → CRASHES with `KeyError: 'model'`. The exception is silently swallowed by `_process_pending_gui_tasks`'s try/except.
4. **Concurrently** on the io_pool: `_do_project_switch` runs → calls `self._flush_to_project()` FIRST → CRASHES with the same `KeyError` → `finally` block runs → `in_progress=False` → `pending == active_project_path` is false (we never got to update `active_project_path`) → `_switch_project(pending)` is called recursively → resubmits → `in_progress=True` again → `_do_project_switch` crashes again → infinite re-switch loop.
5. After 60+ seconds of the re-switch loop, eventually some other worker call reaches `_handle_md_only` (the test's actual target). It crashes the same way, but the `except Exception as e: self.ai_status = f"error: {e}"` in `_handle_md_only`'s worker (line 3560) catches it and sets `ai_status = "error: 'model'"`.
6. Test polls `ai_status` and sees `"error: 'model'"`. The `"error" in s` branch in the sim polling loop (added to `sim_context.py` in the working tree) breaks early. The assertion fails with the message: `Expected 'md written' in status, got error: 'model'`.

The fix restores the pre-`fe240db4` behavior of `_handle_reset_session`: pre-populate `mma_tier_usage` with the full default values (input, output, provider, model, tool_preset) so that downstream consumers like `_flush_to_project` don't crash on missing keys.

The 3 regression tests in `tests/test_reset_session_clears_mma_and_rag.py` (added in the same `fe240db4` commit) check that the polluted `'model' = 'polluted'` value is cleared. They pass with the pre-populated defaults because `'gemini-3.1-pro-preview' != 'polluted'`. The goal of "no stale pollution" is preserved.

## Bug 2 in detail: missing `context_preset_manager` init

`git show c039fdbb:src/app_controller.py` shows the line was present at that commit:
```python
self.context_preset_manager  = ContextPresetManager()
```
right after the `_settable_fields` block and before `self.perf_monitor = ...`. `git show HEAD:src/app_controller.py` (after `72f8f466`) shows the line is gone. The diff between `c039fdbb` and `72f8f466` confirms it was the one line dropped:
```
-self.context_preset_manager  = ContextPresetManager()
```
during a hand-edited refactor of the `_settable_fields` block.

The fix is to re-add the line at the same position in `__init__`.

## Bug 3 in detail: `__getattr__` returns None for manager attrs

The `__getattr__` at src/app_controller.py:1226-1281 has a `_LAZY_MANAGER_DEFAULTS` set (lines 1266-1275) that includes `persona_manager`, `context_preset_manager`, `tool_preset_manager`, `preset_manager`, `vendor_state`, `perf_monitor`. When the controller is constructed without calling `init_state()` (some tests do this), accessing these attributes goes through `__getattr__` which returns `None`.

The comment on the set says:
> "hasattr() still returns False for non-mocked access paths because callers wrap in try/except for AttributeError when they need to distinguish 'lazy' from 'absent'."

This is **wrong**. `__getattr__` returning `None` makes `hasattr(obj, name)` return `True` (because `None` is a valid attribute value). The test `test_load_active_project_creates_persona_manager` is written correctly per Python semantics — it asserts that before `_load_active_project()` is called, the controller should not have `persona_manager`. But because `__getattr__` returns `None`, `hasattr(ctrl, "persona_manager")` is `True`, and the assertion fails.

The fix: remove `persona_manager` (and the other lazily-managed attrs) from `_LAZY_MANAGER_DEFAULTS`, so `__getattr__` raises `AttributeError` for them. Callers that want the lazy default can use `getattr(ctrl, "persona_manager", None)`. The comment should also be removed or updated to reflect the actual Python semantics.

`context_preset_manager` is also in this set, so removing it from `_LAZY_MANAGER_DEFAULTS` is necessary regardless (Bug 2's fix re-adds the init, so the lazy fallback is no longer needed for that one). For the other 5 names (`persona_manager`, `tool_preset_manager`, `preset_manager`, `vendor_state`, `perf_monitor`), the lazy fallback may or may not be load-bearing for other tests. The conservative fix is to remove `persona_manager` specifically (the one the test asserts on) and verify the other 5 don't have callers relying on the lazy default.

Actually, looking at the test that's failing more carefully:
- `test_load_active_project_creates_persona_manager` only asserts `not hasattr(ctrl, "persona_manager")` BEFORE `_load_active_project()`.
- The test in the same file `test_switch_project_preserves_global_preset` (line 150) explicitly sets `ctrl.persona_manager = PersonaManager(...)` BEFORE calling `_refresh_from_project()`. This works fine because `setattr` doesn't go through `__getattr__`.
- The test in the same file `test_load_context_preset_missing_raises_keyerror` (line 181) doesn't touch `persona_manager`.

The minimal fix is to remove `persona_manager` from `_LAZY_MANAGER_DEFAULTS`. The other 5 names can stay (they have similar semantics; whether other tests depend on the lazy default needs to be verified in the batch run). The track will verify no regressions in the batch.

## Current State Audit (as of `33d02bb1`)

### Already Implemented (DO NOT re-implement)

- `_handle_reset_session` (src/app_controller.py:3358) clears project state, MMA state, RAG state. Pre-populated `mma_tier_usage` defaults in `__init__` (line 952-957). 3 regression tests in `tests/test_reset_session_clears_mma_and_rag.py` verify the polluted state is cleared.
- `simulation/sim_base.py` `setup()` (line 78-99) waits for the project switch to complete via `wait_for_project_switch(expected_path=..., timeout=30.0)`.
- `simulation/sim_context.py` `run()` (line 17-30) waits for the project switch to complete again with `wait_for_project_switch(timeout=15.0)` before clicking `btn_md_only`. The polling loop also breaks early on `"error" in status` to surface terminal errors.
- `src/api_hooks.py` exposes `/api/project_switch_status` (line 2493) and `/api/gui/state` (line 309). The latter is the fallback used by `get_project_switch_status` in `api_hook_client.py:362-384` when the dedicated endpoint is missing.
- `src/app_controller.py:_switch_project` (line 2830) is non-blocking; submits `_do_project_switch` to `submit_io` (line 2303 → `_io_pool`).
- `src/app_controller.py:_do_project_switch` (line 2789) is the async worker. Its `try`/`finally` structure (line 2792-2822) sets `in_progress = False` in the `finally` and recursively re-queues via `_switch_project(pending)` if `pending != active_project_path`. The recursion is the infinite loop when the worker fails before setting `active_project_path`.

### Bugs

**Bug 1: Empty `mma_tier_usage` reset.** `src/app_controller.py:3409` (introduced in commit `fe240db4`):

```python
# Reset mma_tier_usage to pre-populated default (prior tests pollute it)
self.mma_tier_usage = {'Tier 1': {}, 'Tier 2': {}, 'Tier 3': {}, 'Tier 4': {}}
```

Comment says "pre-populated default" but the dicts are empty. `_flush_to_project` (line 2639) does:

```python
mma_sec["tier_models"] = {t: {"model": d["model"], "provider": d.get("provider", "gemini"), "tool_preset": d.get("tool_preset")} for t, d in self.mma_tier_usage.items()}
```

`d["model"]` raises `KeyError` when `d = {}`.

**Bug 2: Missing `context_preset_manager` init.** `src/app_controller.py:__init__` does not set `self.context_preset_manager`. The line `self.context_preset_manager = ContextPresetManager()` was in the codebase at commit `c039fdbb` (2026-06-09) but was dropped during a hand-edited refactor in `72f8f466` (2026-06-10). `save_context_preset` and `load_context_preset` both dereference `self.context_preset_manager` which is `None` (via `__getattr__`'s `_LAZY_MANAGER_DEFAULTS` short-circuit, see Bug 3) — both crash with `AttributeError`.

**Bug 3: `__getattr__` short-circuit breaks `hasattr()`.** `src/app_controller.py:1266-1281` has:

```python
_LAZY_MANAGER_DEFAULTS = {
  "context_preset_manager",
   "persona_manager",
   "tool_preset_manager",
   "preset_manager",
   "vendor_state",
   "perf_monitor",
}
if name in _LAZY_MANAGER_DEFAULTS:
  return None
```

The accompanying comment claims `hasattr()` still returns False for these, which is **wrong** — `__getattr__` returning `None` makes `hasattr()` return `True`. Test `test_load_active_project_creates_persona_manager` asserts `not hasattr(ctrl, "persona_manager")` for a fresh controller and fails.

### Gaps to Fill (This Track's Scope)

- **Gap 1 (Bug 1): `_handle_reset_session` should pre-populate `mma_tier_usage` with the full default shape** (matching `__init__` at line 952-957), not empty dicts. This restores the pre-`fe240db4` contract that downstream consumers rely on.
- **Gap 2 (Bug 1): `_flush_to_project` should be defensive** against missing `model` keys (use `.get("model", default)` instead of `["model"]`). Other code paths can produce partial `mma_tier_usage` entries (e.g. `_handle_mma_state_update` at line 484-497 does `controller.mma_tier_usage[tier] = data` with whatever data the caller sends). Defense in depth.
- **Gap 3 (Bug 2): Re-add `self.context_preset_manager = ContextPresetManager()` in `__init__`** at the original position (after the `_settable_fields` block, before `self.perf_monitor = ...`).
- **Gap 4 (Bug 3): Remove `persona_manager` from `_LAZY_MANAGER_DEFAULTS`** in `__getattr__`. The other 5 names stay (they may have lazy-default callers; verify in batch). Also fix or remove the misleading comment.

## Goals

1. **Goal A: `test_context_sim_live` passes in batch.** The sim tests in `tests/test_extended_sims.py` (4 of them) all pass. Specifically the test that was failing with `assert "md written" in status, f"Expected 'md written' in status, got {status}"` no longer times out.
2. **Goal B: The 3 regression tests in `tests/test_reset_session_clears_mma_and_rag.py` still pass.** They check that polluted `tier_usage` data is cleared; pre-populated defaults are not pollution.
3. **Goal C: `test_app_controller_save_load` passes.** Tier-1 test in `tests/test_context_presets_manager.py` that calls `controller.save_context_preset(preset)` and expects no crash.
4. **Goal D: `test_load_context_preset_missing_raises_keyerror` passes.** Tier-1 test in `tests/test_project_switch_persona_preset.py` that calls `controller.load_context_preset("NonexistentPreset")` and expects `KeyError` (which requires `self.context_preset_manager.load_all` to be callable).
5. **Goal E: `test_load_active_project_creates_persona_manager` passes.** Tier-1 test that asserts `not hasattr(ctrl, "persona_manager")` for a fresh controller.
6. **Goal F: No new failures in tier-1, tier-2, or tier-3 batches.** Match the `33d02bb1` baseline or improve on it.

### Non-Goals

- Refactoring `_switch_project` or `_do_project_switch` to use a state machine.
- Removing the `try/finally` recursive re-switch in `_do_project_switch` (that's a separate architectural concern; the contract is "if a switch fails, re-queue it", which is a valid design).
- Modifying the 3 regression tests in `tests/test_reset_session_clears_mma_and_rag.py`.
- Modifying `tests/test_context_presets_manager.py::test_app_controller_save_load`, `tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager`, or `tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror` (the test code is correct; the production code is wrong).
- Modifying `simulation/sim_base.py` or `simulation/sim_context.py`.
- Adding new audit scripts.
- Updating `docs/`.
- Filing follow-up tracks.
- Any "while we're at it" refactors.

## Functional Requirements

### FR1. Pre-populate `mma_tier_usage` on reset

**Where:** `src/app_controller.py:3409`

**What:** Replace the empty-dict reset with the full pre-populated default (matching the shape in `__init__` at line 952-957). The full shape is:
```python
{
  "Tier 1": {"input": 0, "output": 0, "provider": "gemini", "model": "gemini-3.1-pro-preview", "tool_preset": None},
  "Tier 2": {"input": 0, "output": 0, "provider": "gemini", "model": "gemini-3-flash-preview", "tool_preset": None},
  "Tier 3": {"input": 0, "output": 0, "provider": "gemini", "model": "gemini-2.5-flash-lite",  "tool_preset": None},
  "Tier 4": {"input": 0, "output": 0, "provider": "gemini", "model": "gemini-2.5-flash-lite",  "tool_preset": None},
}
```

**Why this shape:** It's the same shape `__init__` uses (line 952-957), so the controller's `mma_tier_usage` invariant is preserved across the reset boundary.

**Acceptance:**
- `tests/test_reset_session_clears_mma_and_rag.py::test_reset_session_clears_mma_tier_usage` still passes (the assertion `tier1.get('model') != 'polluted'` holds because `'gemini-3.1-pro-preview' != 'polluted'`).
- `tests/test_reset_session_clears_mma_and_rag.py::test_reset_session_clears_mma_status` still passes (untouched by the change).
- `tests/test_reset_session_clears_mma_and_rag.py::test_reset_session_clears_active_tier` still passes (untouched by the change).
- `tests/test_extended_sims.py::test_context_sim_live` passes.
- `tests/test_extended_sims.py::test_ai_settings_sim_live`, `test_tools_sim_live`, `test_execution_sim_live` pass.

### FR2. Make `_flush_to_project` defensive against missing `model`

**Where:** `src/app_controller.py:2639`

**What:** Change `d["model"]` to `d.get("model")` (or `d.get("model", "")`). The rest of the dict comprehension already uses `.get()` for `provider` and `tool_preset`; `model` is the only one that does a hard `[]` lookup.

**Why:** Defense in depth. Other code paths can produce partial `mma_tier_usage[tier]` dicts (e.g. `_handle_mma_state_update` at line 484-497 replaces the entry with whatever the caller sends). Even with FR1, future regressions that produce empty/partial dicts will not crash the project save.

**Acceptance:**
- `mma_sec["tier_models"]` is written successfully even if some tier's `mma_tier_usage[tier]` is missing the `model` key. The resulting TOML field would be `model = ""` (or the default value), not a crash.
- No existing tests break.

### FR3. Re-add `self.context_preset_manager = ContextPresetManager()` to `__init__`

**Where:** `src/app_controller.py:__init__` — between line 1183 (end of `_settable_fields` block) and line 1185 (`self.perf_monitor = ...`)

**What:** Insert the line `self.context_preset_manager = ContextPresetManager()` at the same position it occupied in commit `c039fdbb` (immediately before `self.perf_monitor            = performance_monitor.get_monitor()`).

**Why:** `save_context_preset` (line 3019) and `load_context_preset` (line 3023) both dereference `self.context_preset_manager`. The init line was lost in `72f8f466`. Without it, both methods crash with `AttributeError: 'NoneType' object has no attribute 'save_preset'`.

**Acceptance:**
- `tests/test_context_presets_manager.py::test_app_controller_save_load` passes (it calls `controller.save_context_preset(preset)` and asserts the project is updated).
- `tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror` passes (it calls `controller.load_context_preset("NonexistentPreset")` and expects `KeyError`; the KeyError can only be raised if `self.context_preset_manager.load_all(self.project)` is callable).
- No existing tests break.

### FR4. Remove `persona_manager` from `_LAZY_MANAGER_DEFAULTS` in `__getattr__`

**Where:** `src/app_controller.py:1266-1275` (the `_LAZY_MANAGER_DEFAULTS` set)

**What:** Remove the string `"persona_manager"` from the set. The other 5 names stay (verify in batch). Also fix or remove the misleading comment that says "hasattr() still returns False for non-mocked access paths because callers wrap in try/except for AttributeError when they need to distinguish 'lazy' from 'absent'" — this is incorrect.

**Why:** `__getattr__` returning `None` makes `hasattr()` return `True`. The test `test_load_active_project_creates_persona_manager` asserts `not hasattr(ctrl, "persona_manager")` for a fresh controller, which is the correct Python-semantics check. The comment justifying the lazy default is wrong.

**Acceptance:**
- `tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager` passes (the assertion `not hasattr(ctrl, "persona_manager")` holds for a fresh controller).
- After `_load_active_project()` is called, `hasattr(ctrl, "persona_manager")` is True and `ctrl.persona_manager` is a `PersonaManager` instance.
- No existing tests break. (The 5 other names in `_LAZY_MANAGER_DEFAULTS` may have lazy-default callers — verify in the batch run.)

## Non-Functional Requirements

- **NFR1: 1 import, no new functions, ~10 line changes total.** Surgical. Two file edits in `src/app_controller.py`.
- **NFR2: No regressions.** Tier-1 and tier-2 batch results must match the `33d02bb1` baseline.
- **NFR3: 2 atomic commits.** One per FR. Not batched.
- **NFR4: 1-space indent, CRLF, type hints.** Per project conventions.
- **NFR5: 1 regression test added.** A unit test that proves `KeyError: 'model'` no longer occurs in the post-reset flush path. The test must NOT be a copy of the existing 3 tests in `tests/test_reset_session_clears_mma_and_rag.py`; it must be a NEW test that exercises the specific code path that was crashing.

## Architecture Reference

- **`src/app_controller.py:952-957`** — `mma_tier_usage` default shape in `__init__`. This is the shape FR1 must match.
- **`src/app_controller.py:1183-1185`** — `__init__` end of `_settable_fields` block and start of `self.perf_monitor = ...`. FR3 inserts the missing `context_preset_manager` init between these.
- **`src/app_controller.py:1266-1281`** — `_LAZY_MANAGER_DEFAULTS` set and its consumer in `__getattr__`. FR4.
- **`src/app_controller.py:2639`** — `_flush_to_project` line that crashes. FR2.
- **`src/app_controller.py:3019-3023`** — `save_context_preset` and `load_context_preset`. FR3 ensures these have a non-None `context_preset_manager` to dereference.
- **`src/app_controller.py:3358-3409`** — `_handle_reset_session`. FR1.
- **`src/app_controller.py:2789-2822`** — `_do_project_switch`. NOT changed in this track; the recursive re-switch is a valid design; the bug is the upstream `_flush_to_project` crash, not the re-switch.
- **`src/app_controller.py:2830-2848`** — `_switch_project`. NOT changed.
- **`tests/test_reset_session_clears_mma_and_rag.py`** — 3 regression tests from `fe240db4`. Must continue to pass.
- **`tests/test_extended_sims.py`** — 4 sim tests that have been failing. FR1+FR2 unblock them.
- **`tests/test_context_presets_manager.py::test_app_controller_save_load`** — tier-1 test that fails due to Bug 2. FR3 unblocks it.
- **`tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager`** — tier-1 test that fails due to Bug 3. FR4 unblocks it.
- **`tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror`** — tier-1 test that fails due to Bug 2. FR3 unblocks it.

## Out of Scope

- Refactoring `_switch_project` to use a state machine
- Removing the recursive re-switch in `_do_project_switch`'s `finally`
- Modifying the 3 tests in `tests/test_reset_session_clears_mma_and_rag.py`
- Modifying `tests/test_context_presets_manager.py::test_app_controller_save_load`
- Modifying `tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager`
- Modifying `tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror`
- Refactoring `simulation/sim_base.py` or `simulation/sim_context.py`
- Removing the other 5 names (`context_preset_manager`, `tool_preset_manager`, `preset_manager`, `vendor_state`, `perf_monitor`) from `_LAZY_MANAGER_DEFAULTS` — only `persona_manager` is removed in FR4. Verify the others in the batch; if any of them break, file a follow-up.
- Adding new audit scripts
- Doc updates
- Follow-up tracks
- Any "while we're at it" refactors

## Verification Criteria

### Phase 1 (COMPLETE — verified 2026-06-10)

1. ✅ `src/app_controller.py:3409` pre-populates `mma_tier_usage` with the full default shape (model, provider, tool_preset, input, output for all 4 tiers).
2. ✅ `src/app_controller.py:2639` uses `d.get("model")` (or equivalent) instead of `d["model"]`.
3. ✅ `src/app_controller.py:__init__` contains `self.context_preset_manager = ContextPresetManager()` between the `_settable_fields` block and `self.perf_monitor = ...`.
4. ✅ `src/app_controller.py:1266-1275` does NOT contain `"persona_manager"` in `_LAZY_MANAGER_DEFAULTS`. The misleading comment is fixed or removed.
5. ✅ A new unit test in `tests/test_mma_tier_usage_reset_fix.py` verifies the post-reset flush doesn't crash.
6. ✅ `tests/test_reset_session_clears_mma_and_rag.py` (3 tests) still pass.
11. ✅ `tests/test_context_presets_manager.py::test_app_controller_save_load` passes.
12. ✅ `tests/test_project_switch_persona_preset.py::test_load_active_project_creates_persona_manager` passes.
13. ✅ `tests/test_project_switch_persona_preset.py::test_load_context_preset_missing_raises_keyerror` passes.
14. ✅ Tier-1 batch: 5/5 pass.
15. ✅ Tier-2 batch: 5/5 pass.
17. ✅ 4 atomic commits (one per FR).

### Phase 2 (PENDING — to be completed)

7. ❌ `tests/test_extended_sims.py::test_context_sim_live` passes in batch.
8. ✅ `tests/test_extended_sims.py::test_ai_settings_sim_live` passes in batch.
9. ✅ `tests/test_extended_sims.py::test_tools_sim_live` passes in batch.
10. ✅ `tests/test_extended_sims.py::test_execution_sim_live` passes in batch.
16. ❌ Tier-3 batch: 0 new failures vs `33d02bb1` baseline.

### Phase 2 Diagnosis (2026-06-10 full batch run)

The Phase 1 FRs fixed the original `KeyError: 'model'` from `_flush_to_project`. However, the full batch run (not the isolated test run) revealed a SEPARATE failure in the same test:

```
FAILED tests/test_extended_sims.py::test_context_sim_live
KeyError: 'paths'
simulation\sim_context.py:44: KeyError
```

The traceback shows the SECOND loop in `simulation/sim_context.py:41-47` (a redundant copy of the first loop) failing because `proj['project']['files']['paths']` is missing after the `post_project` round-trip. This loop is duplicated logic (the first loop at lines 32-37 already adds all `.py` files to `paths`; the second loop is supposed to add more, but the round-trip strips `paths`).

**Differences from original failure (which FR1+FR2 fixed):**
- Original (pre-fix): `KeyError: 'model'` from `_flush_to_project` at `src/app_controller.py:2639`
- New (post-fix): `KeyError: 'paths'` from `simulation/sim_context.py:44` (in the test code, not production)

**Root cause hypothesis:** The `post_project` hook strips empty/missing fields during the round-trip. In isolation, the first `post_project` succeeds and `paths` is preserved (probably because the first `proj` fetch already had a non-empty `paths` from prior session state). In batch, the live_gui subprocess state is different (different project setup path, prior tests' state has been cleared) and `paths` is empty/absent, so the re-fetch returns a project where `files['paths']` is missing entirely.

**Verification path for Phase 2:**
- Read the current `sim_context.py:run()` to understand the duplicated loop's intent
- Either: (a) remove the redundant second loop, (b) make the test handle missing `paths` key with `.setdefault('paths', [])`, (c) fix `_flush_to_project` to preserve empty `paths` lists
- Re-run the full batch to confirm all 4 sim tests pass
- Update the verification log

**Per AGENTS.md "Isolated-Pass Verification Fallacy":** the previous run that claimed "4/4 sim tests pass" was based on an isolated run. The full batch is the authoritative test. The track is NOT complete until Phase 2 verification passes.
