ADR-0045 W9: migrate WeezTerm to the canonical toolkit

AGENTS.md

@@ -150,6 +150,13 @@ The following checks run in CI on every PR to `main`. All must pass before merge
 The **`windows`** job is the required status check for merge. The other jobs
 are informational but should also pass.
 
+`nix flake check` (or `nix build .#checks.<system>.cargo-fmt` /
+`.#checks.<system>.cargo-clippy` individually) additionally runs hermetic
+format/lint checks against `nix build .#source`'s exact pinned src, patches,
+and vendored `Cargo.lock` (including the `d2b`/`d2b-toolkit` git dependencies
+pinned via the `d2b`/`d2b-toolkit` flake inputs) -- no ambient rustup or
+cargo-nextest assumed.
+
 ### If `make` is available
 
 `make precommit` runs format + check + tests but does NOT cross-build for Linux:
@@ -162,6 +169,12 @@ cargo nextest run -p wezterm-escape-parser
 
 Prefer `ci/build-cross.sh` which covers both platforms.
 
+**In a `nix develop` shell**, `make precommit` is hermetic: the dev shell
+pins `cargo-nextest` directly, and `make fmt` falls back to bare `cargo fmt`
+(which resolves to that same pinned nightly rustfmt) because there is no
+`rustup` to satisfy the `+nightly` toolchain selector. Rustup-based
+checkouts are unaffected and keep using `cargo +nightly fmt`.
+
 **Important**: The Linux/WSL build uses a separate Rust toolchain and can
 surface warnings/errors that don't appear on Windows (e.g., unused code
 warnings that trigger rustc ICEs on certain Linux compiler versions). Always

CHANGELOG.md

@@ -7,6 +7,68 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Pinned explicit `d2b` and `d2b-toolkit` `flake = false` inputs (matching
+  the exact `Cargo.lock` git revisions) in `flake.nix`/`nix/flake.nix`, and
+  threaded their locked `narHash` into `sourcePackage.cargoLock.outputHashes`
+  for the `d2b-client`, `d2b-contracts`, `d2b-session`, and
+  `d2b-client-toolkit` crates. `nix build .#source` now vendors those four
+  crates through the hermetic `fetchgit` fixed-output-derivation path with
+  `flake.lock` as the narHash authority, instead of relying solely on
+  `cargoLock.allowBuiltinFetchGit`'s impure fallback for them.
+  `allowBuiltinFetchGit` remains set for the seam's other, unrelated git
+  dependencies (`xcb-imdkit`, `finl_unicode`).
+- Added hermetic `checks.cargo-fmt` and `checks.cargo-clippy` flake outputs
+  that reuse `sourcePackage`'s pinned src/patches/vendored `cargoLock` (no
+  second fetch), giving `nix build .#source`/`nix flake check` attached
+  lint/format coverage without changing the existing full source build.
+  `cargo-fmt` checks `cargo fmt --all -- --check` across the whole tree.
+  `cargo-clippy` runs `cargo clippy -p config --all-targets --no-deps --
+  --cap-lints=warn` (no `|| true`, so a genuine compilation or tooling
+  failure fails the check), which caps every lint severity to at most a
+  warning so only that kind of real failure — never lint severity — can
+  make the `cargo clippy` invocation itself fail. The resulting
+  `--message-format=json` diagnostics are then filtered by the new
+  `nix/clippy-scope-filter.sh` helper (with a `--self-test` regression
+  mode covering finding/no-finding/malformed/empty-input cases), which
+  hard-fails only on findings inside `config/src/d2b.rs`, the file this
+  seam wholly owns, and also hard-fails if the diagnostics can't be
+  parsed/filtered rather than silently treating that as "no findings".
+  The vendored upstream `wezterm`/`config` tree carries pre-existing
+  clippy findings outside this seam's ownership that this check
+  intentionally does not enforce, consistent with never reformatting or
+  rewriting upstream files.
+
+### Changed
+
+- Migrated d2b configuration to the canonical v2 `TargetInput` workload type
+  re-exported by `d2b-client-toolkit` 2.0.0. Workload domains now retain the
+  canonical shell-service target without defining a local service DTO.
+- Pinned the toolkit facade to the frozen daemon, guest, terminal, and user
+  service client inventory while keeping endpoint acquisition and integrated
+  workload routing disabled.
+- Aligned the d2b client distribution name and packaged source layout with
+  `share/d2b-client-toolkit/{distribution,d2b}`.
+- Advanced the pinned `d2b-client-toolkit` distribution revision to
+  `926de54e7320599c373524a10b65aaf13b6ff422`. The canonical d2b source
+  revision and fingerprint the facade re-exports are unchanged.
+- Made `nix develop --command make precommit` hermetic: the pinned Nix dev
+  shell now provides `cargo-nextest` directly, and `make fmt` falls back to
+  bare `cargo fmt` (which resolves to that same pinned nightly rustfmt) when
+  no `rustup` is present instead of failing on `cargo +nightly fmt`.
+- d2b domain configuration errors for an invalid canonical `realm_id` or
+  `workload_id` now name the configured domain (`name`), so a multi-domain
+  config points at the right `[[d2b_domains]]` entry. The rejected
+  `realm_id`/`workload_id` value itself is still never echoed back.
+
+### Removed
+
+- Removed the legacy public-socket hello, JSON shell DTO, seqpacket framing,
+  target-alias, session-picker, and terminal-bridge integration. Native d2b
+  discovery and persistent-shell attachment remain unavailable until canonical
+  workload-to-shell routing is integrated.
+
 ## [0.7.2] - 2026-07-13
 
 ### Fixed