test(FEAT-025): pin the export slice with baseline-captured goldens and gates

Behaviour preservation is proven rather than claimed. Four goldens were captured
from the pre-refactor implementation at `3f3aa9ed7` by dispatching frozen
fixtures through the baseline public `/export` seam in a scratch worktree:

- authoritative transcript with no restore repository (header, every content
  variant, D9 omission markers, redaction, ANSI stripping),
- the turn handoff,
- the visible-history fallback over a workspace with recorded restore points,
- correlation against recorded restore points (table, newest-first order,
  `tool` snapshots listed but not correlated, the ambiguous double match, and the
  no-match line).

Only genuinely clock-derived fields are normalised (the export stamp, the turn
header stamp, and - for the recorded states - the snapshot id and `Recorded
(UTC)` cell, because `git commit-tree` uses a wall-clock date). A unit test pins
the normaliser so it cannot quietly widen. Everything else is byte-compared.

Also here: the exhaustive `ContextParts` assertion that makes "no unrelated
facet" a compile-time guarantee, the shared host-bound test-support module, the
token-aware extraction audits plus their own unit test, and the boundary gate
extension that keeps `codewhale-secrets` free of any TUI edge.

Carries one unrelated, disclosed repair: a bounded retry for a fork/exec
`ETXTBSY` race in the `wl-paste` regression, kept because the configured
workspace gate was intermittently red without it.

Generated with CodeWhale

Author: Paulo Aboim Pinto

crates/tui/src/commands/fixtures/export_conversation_baseline.md

@@ -0,0 +1,129 @@
+# Codewhale conversation export
+
+- Exported: 2026-09-11T13:31:54Z
+- Session: session-
+- Provider: deepseek
+- Model: deepseek-v4-pro
+- Mode: Act
+- Workspace: example
+- Messages: 8
+
+> Hidden instructions, internal reasoning, and reasoning signatures are omitted. Secret-like values and credential-bearing URLs are redacted as a defense in depth; review the export before sharing it.
+
+## Restore points
+
+No workspace restore points are recorded for this workspace, so nothing in this export can be correlated to a restorable workspace state. Snapshots may be disabled, or no turn has taken one yet.
+
+## 1. system
+
+[internal context omitted]
+
+## 2. user
+
+### Content 1: Text
+
+Please inspect this output
+
+## 3. assistant
+
+### Content 1: Internal reasoning
+
+[internal reasoning and signature omitted]
+
+### Content 2: Tool call
+
+- ID: call-1
+- Name: fetch_url
+- Caller type: code_execution_20250825
+- Caller tool ID: server-tool-1
+
+Input:
+
+```json
+{
+  "url": "https://***:***@example.com/path?token=***&ok=1",
+  "api_key": "[redacted]",
+  "nested": {
+    "authorization": "[redacted]"
+  }
+}
+```
+
+## 4. user
+
+### Content 1: Tool result
+
+- Tool call ID: call-1
+- Error: false
+
+Result:
+
+Authorization: [redacted]
+result ok
+
+Structured result blocks:
+
+```json
+[
+  {
+    "type": "image",
+    "mime_type": "image/png",
+    "omission_code": "inline_or_local_image_payload",
+    "omitted_base64_bytes": 25
+  },
+  {
+    "session_token": "[redacted]",
+    "note": "keep me"
+  }
+]
+```
+
+## 5. assistant
+
+### Content 1: Image attachment
+
+- Reference: https://example.com/visible.png?token=***
+
+### Content 2: Image attachment
+
+- Reference omitted (inline or local image payload)
+
+## 6. assistant
+
+### Content 1: Server tool call
+
+- ID: srv-1
+- Name: web_search
+
+Input:
+
+```json
+{
+  "query": "secret token"
+}
+```
+
+## 7. user
+
+### Content 1: Tool-search result
+
+- Tool call ID: srv-1
+
+```json
+{
+  "results": []
+}
+```
+
+## 8. assistant
+
+### Content 1: Code-execution result
+
+- Tool call ID: srv-2
+
+```json
+{
+  "stdout": "ok"
+}
+```
+

crates/tui/src/commands/fixtures/export_correlation_recorded_baseline.md

@@ -0,0 +1,47 @@
+# Codewhale conversation export
+
+- Exported: 2026-09-11T14:39:58Z
+- Session: session-
+- Provider: deepseek
+- Model: deepseek-v4-pro
+- Mode: Act
+- Workspace: f025-golden-workspace
+- Messages: 3
+
+> Hidden instructions, internal reasoning, and reasoning signatures are omitted. Secret-like values and credential-bearing URLs are redacted as a defense in depth; review the export before sharing it.
+
+## Restore points
+
+The 3 most recent workspace restore points, newest first. `/restore <N>` restores by the index in this table and `/restore list` shows the live list.
+
+> The index is the position at export time. Every new turn records another restore point and shifts it, so re-check `/restore list` before restoring from an older export. The snapshot id does not shift.
+
+| N | Restore point | Recorded (UTC) | Label |
+| --- | --- | --- | --- |
+| 1 | `3d0ad76f0222` | 2026-09-11T14:39:58Z | pre-turn:3: Fix the login test |
+| 2 | `6a3bc0698866` | 2026-09-11T14:39:58Z | tool:call-1 |
+| 3 | `e24e175a7a57` | 2026-09-11T14:39:58Z | pre-turn:2: Fix the login test |
+
+## 1. user
+
+### Content 1: Text
+
+Fix the login test
+
+- Restore points: N1 `3d0ad76f0222` (pre-turn turn 3), N3 `e24e175a7a57` (pre-turn turn 2)
+  - More than one restore point carries this prompt snippet, so the match is ambiguous; compare the recorded times above before restoring.
+
+## 2. assistant
+
+### Content 1: Text
+
+Working on it.
+
+## 3. user
+
+### Content 1: Text
+
+unrelated question
+
+- Restore points: none recorded for this message within the listed window.
+

crates/tui/src/commands/fixtures/export_history_fallback_recorded_baseline.md

@@ -0,0 +1,34 @@
+# Codewhale conversation export
+
+- Exported: 2026-09-11T14:39:58Z
+- Session: session-
+- Provider: deepseek
+- Model: deepseek-v4-pro
+- Mode: Act
+- Workspace: f025-golden-workspace
+- Messages: 2
+
+> Hidden instructions, internal reasoning, and reasoning signatures are omitted. Secret-like values and credential-bearing URLs are redacted as a defense in depth; review the export before sharing it.
+
+## Restore points
+
+The 3 most recent workspace restore points, newest first. `/restore <N>` restores by the index in this table and `/restore list` shows the live list.
+
+> The index is the position at export time. Every new turn records another restore point and shifts it, so re-check `/restore list` before restoring from an older export. The snapshot id does not shift.
+
+| N | Restore point | Recorded (UTC) | Label |
+| --- | --- | --- | --- |
+| 1 | `3d0ad76f0222` | 2026-09-11T14:39:58Z | pre-turn:3: Fix the login test |
+| 2 | `6a3bc0698866` | 2026-09-11T14:39:58Z | tool:call-1 |
+| 3 | `e24e175a7a57` | 2026-09-11T14:39:58Z | pre-turn:2: Fix the login test |
+
+> Structured API messages were unavailable; the entries below are a sanitized visible-history fallback.
+
+## 1. user
+
+Fix the login test
+
+## 2. assistant
+
+Done.
+

crates/tui/src/commands/fixtures/export_turn_baseline.md

@@ -0,0 +1,23 @@
+# Turn handoff
+_Status: completed · generated 2026-09-11 15:31:54_
+
+## Intent
+Fix the flaky login test
+
+## Files changed
+—
+
+## Turn timeline
+- 1. user prompt: Fix the flaky login test
+- 2. assistant result: Fixed the login test. — done
+- 3. checkpoint: unavailable — no numbered turn snapshot yet · action: e export handoff
+
+## Tests / verifier
+—
+
+## Model route + tokens/cost
+- Route: DeepSeek · deepseek-v4-pro
+
+## Result / status
+- Status: completed
+- Result: Fixed the login test.

crates/tui/src/commands/mod.rs

@@ -34,6 +34,16 @@ mod session_acceptance;
 #[cfg(test)]
 mod session_control_regression_tests;
 #[cfg(test)]
+mod session_export_regression_tests;
+// FEAT-025 Phase 5: public command-surface parity lives at the `commands` root
+// for the same extraction reason as the host regressions above.
+#[cfg(test)]
+mod session_export_surface_tests;
+// FEAT-025 audit hardening: shared host-bound test support for both export
+// test suites (timestamp normalisation and the exhaustive envelope check).
+#[cfg(test)]
+mod session_export_test_support;
+#[cfg(test)]
 mod session_lifecycle_regression_tests;
 
 use std::sync::OnceLock;