[abrichr]

Summary

PR 2 of the decomposition plan (packages/flow/docs/design/DECOMPOSITION.md, section 4.3): the replayer's step pipeline and strategies. Draft; it grows by chunk. replayer.py is down from 18,300 to 10,926 lines, with behavior unchanged.

1. runtime.core, behind import contracts

• runtime/core/actions.py: ActionContext carries the step, the backend, and two gates.
  • authorize() runs delivery authorization, then the qualification-environment check, in the replayer's original order.
  • deliver() is the replayer's own delivery bookkeeping.
  • KEY, HOTKEY and WAIT now run here.
• runtime/core/render.py: render scale and layout drift. Moved; its host reads no governance state.
• packages/flow/.importlinter, checked by lint-imports in flow core lint:
  • Direct contract: core imports no runner, hosted, approval_mode, jit, replayer or qualification* module. Kept with no exceptions.
  • Indirect contract: the same through every import chain, except 45 listed edges. A core module that imports only ir, backend and the resolver reaches 249 of 562 modules today (section 2.4).
• tests/test_import_boundaries.py keeps the forbidden list complete and proves every ActionKind has exactly one executor.

2. Move-only extraction into runtime/replay/ (mixins)

• _shared.py: the 49 module-level constants, helpers and small types. replayer.py re-exports them, so imports such as _DURABLE_RESUME_AUTHORITY and _ProgramHalt get the same objects.
• One mixin module per concern: qualification faults, consequential delivery, effect checks and read-back, the API tier, acting by kind, settling, confirming, surfaces and overlay, assets and healing.
• Each module comes from scripts/extract_mixin.py. Method bodies are cut verbatim. Each mixin gets a host class that declares, for mypy only, what the code reads from self, using the replayer's own types.
• A plain class, not a Protocol, and why, is in DECOMPOSITION.md section 4.1.
• scripts/verify_moved_code.py (from test: safety net for decomposing the largest files (PR 1) #1510) checks every move commit: 185 units moved, no edits, no new logic.

Not moved yet, because open PRs change them

• Identity checks: feat(flow): count look-alike rows on native and remote surfaces #1518, fix(flow): halt when another shown row has the same identity #1504.
• _resolve_step: fix(flow): halt when another shown row has the same identity #1504.
• Postconditions and step evidence: Duplicate check asks the system of record (FHIR/REST, SQL fallback) instead of the screen list #1516, Relabel repair, a duplicate check that reads the match list, ISO dates at intake, and two re-admission and approval fixes #1514.
• Starting-state settle and the qualification boundary: WIP flow: write-fenced learned dismissals and re-observation bridge #1449.
• The run and step drivers.
• Two methods that name Replayer.

Test changes

Two tests patched module globals that moved code now reads from its new module. They now patch them there as well:

• resolve, in replay.acting and replay.settling;
• _DIALOG_WAIT_S, in replay.acting.

The verifier now flags that case (#1510).

Checks (local, at most 2 workers)

• tests/test_core_key_actions.py, committed before the first move: real Playwright; key event and submit, HOTKEY modifiers, refusal of a key step with no key, WAIT sends nothing.
• 3,149 tests across the 146 files that import the replayer, plus test_record_compile_replay, test_perturbation and test_replayer (144).
  • One environment-only failure on macOS: test_layout_drift.py::test_real_render[font_size_changed] fails identically on unmodified code (font rendering).
• Strict mypy on runtime/core, runtime/replay and replayer.py; package-wide mypy (575 files); both import contracts; ruff.
• Golden runs (Linux) come with test: safety net for decomposing the largest files (PR 1) #1510. CI checks this PR against them once both are on main.

🤖 Generated with Claude Code