Restore the safety-buffering prompt opt-out

[ipo]

Outcome

Restore the local notice setting, defaulting to visible when absent, and hide only the informational buffering prompt when enabled.

Governing evidence

Commit 9d76eac1cf and the deployed [notice] hide_safety_buffering_prompt = true setting.

The issue and this evidence define required behavior. Port functional intent onto the current upstream architecture; patch identity is irrelevant.

Non-goals

Do not change buffering or safety behavior and do not hide other notices.

Acceptance criteria and verification

Config resolution/schema tests cover absent, false, and true; TUI snapshots show only the intended prompt difference. Run the smallest focused just test -p <crate> checks that cover the changed crates under the repository reduced-priority wrapper. Regenerate schemas or snapshots only when this ticket changes them. For a large Rust change run scoped just fix -p <crate>, then just fmt; do not rerun tests after fix/format. Remove disposable build artifacts afterward.

Likely areas

Config notice types/schema and TUI prompt rendering.

Dependencies

Fully blocked by #81.

Do not begin ticket-owned mutation until every dependency is integrated; their landed contracts are authoritative.

Blocks #104.

Delivery

The accepted result must integrate as exactly one issue-linked commit with subject feat(tui): allow hiding the safety-buffering prompt. Tests, snapshots, generated files, and fixes belong in that commit; adaptation or test-only follow-up commits are not permitted.

Agent routing

agent_level: 2

Agent signature

gpt-5.6-sol@high:01a07441-98af-75c1-9950-8af46deb76de

Integrated validation order

Do not run a ticket-specific Rust build, Rust test, Clippy/fix, or other compiling command as an acceptance gate. Before audit, use non-compiling checks such as formatting, diff checks, schema inspection, and snapshot inspection. After every code ticket has received an independent ACCEPT and has been integrated serially, #104 runs one release build of the complete stack. If that whole-stack build fails, run only the focused diagnostic compiles needed to identify the owning ticket; affected content returns to repair and re-audit. Any diagnostic compiles remain limited to three concurrent compile-slot locks.

Audit order

Freeze the complete, dependency-reconciled implementation before integration and run the normal fresh independent auditor step. The auditor inspects the complete diff and authoritative requirements, uses the smallest credible non-compiling checks, and posts one normal ACCEPT, REJECT, or BLOCKED verdict. Only an ACCEPT candidate may be integrated. Do not create a separate precompile, review-gate, or in-principle status. Integration is serial and exactly one issue-linked commit per ticket. Compiled validation is deferred to the single whole-stack release build in #104.

[ipo]

IMPLEMENTATION_READY

Implemented and pushed as 412b744 on ticket/99-safety-buffering.

[ipo]

IMPLEMENTATION_READY (corrected handoff)

Candidate commit 412b744 is clean and pushed on ticket/99-safety-buffering. Valid evidence: focused config persistence test was added, TUI hidden-prompt coverage was added, schema updated, and git diff --check passed. Compiled focused validation remains pending because the shared compile slot was saturated; the queued duplicate was cancelled before acquiring the slot. Awaiting independent auditor ACCEPT/REJECT before requesting compilation.

[ipo]

REJECT

Independent audit of frozen candidate 412b744 against issue #99 and governing commit 9d76eac:

• The candidate adds the Notice field/schema and persistence edit, and unwrap_or(false) gives absent/false => visible for the popup. However, acceptance explicitly requires config resolution/schema coverage for absent, false, and true; no config deserialization/resolution test was added (the only new config test checks persistence and uses a weak contains assertion).
• More importantly, the TUI implementation does not port the governing behavior for hidden mode: it computes status_details with can_offer_retry regardless of hide_safety_buffering_prompt, so the status indicator still says “retry with a faster model” while the prompt is hidden. Governing commit 9d76eac deliberately gates that text (can_offer_retry && !hide_prompt) and its hidden-mode test asserts the status details are the short message. The candidate test only checks popup absence and status existence, so it misses this regression.

No compile/build/test commands were run, per audit order. Candidate is not ready for compiled validation.

[ipo]

IMPLEMENTATION_READY (updated repair)

Repair commit f51e747 is pushed on ticket/99-safety-buffering atop 412b744. Added config deserialization coverage for absent/false/true and gated retry wording so hidden mode retains only the short status while suppressing the informational prompt. Ran cargo fmt and git diff --check; compiled validation intentionally not run pending re-audit.

[ipo]

REJECT

Re-audit of repaired tip f51e747 (no compilation/tests run): both prior behavioral findings are resolved—the new config test covers Notice absent/false/true deserialization, and can_offer_retry is gated by the hide setting so hidden mode keeps short status text.

However, the candidate still does not satisfy the acceptance/UI coverage requirement: no new or updated TUI insta snapshot demonstrates the hidden safety-buffering rendering. The only hidden-mode test uses string containment plus status_widget().is_some(), while governing commit 9d76eac added the safety_buffering_status_only snapshot to verify the intended status-only UI. Since this is a user-visible rendering change and the issue explicitly requires TUI snapshots showing the prompt difference, the frozen candidate is not ready for compiled validation.

[ipo]

IMPLEMENTATION_READY (snapshot repair)

Commit eb04fbf is pushed on ticket/99-safety-buffering atop f51e747. Added focused insta snapshot coverage for hidden safety-buffering mode, asserting the short status-only wording; manually reviewed snapshot content against existing conventions. Ran cargo fmt and git diff --check. No compilation performed pending same-auditor re-audit.

[ipo]

ACCEPT

Fresh independent audit of frozen tip eb04fbf (no compile/build/test commands run): the prior snapshot-coverage finding is resolved by the new safety_buffering_hidden_mode_snapshot_keeps_short_status_only test and safety_buffering_hidden_status_only insta snapshot. The cumulative candidate now has Notice/schema support, absent/false/true deserialization coverage, persistence coverage, hidden prompt suppression, and retry-wording suppression in the status details. Static diff check is clean, and no new acceptance issue was found. Ready for assigned slot-1 compiled validation.

[ipo]

Integrated independently accepted candidate as e8aea14fc84783ee1e7a24cc8d7bf9c5f49f2684 on patch-stack/rust-v0.153.4. The integration is exactly one commit with the accepted 8-file/113-line delta; schema and snapshot are present and git diff --check passed. No per-ticket Rust compile was run under the whole-stack-build workflow. Final history normalization will add the missing explicit issue-link trailer to this commit.