Findings

• Major: docs/adding-a-domain.md still documents the pre-Remove per-command --json flags (cli-common output-and-rendering §2) #144 rule. It says output.go must contain printJSON() and every leaf command must have --json/-j, with binary download exemptions. That directly contradicts the new architecture test and will steer future domains back toward the removed surface. Update that section to require text-only resource leaves and no package-local printJSON() helper, with JSON reserved for control-plane commands outside domain resource packages.

Everything else I checked lines up with the intended boundary: no residual resource command --json flags/branches showed up in internal/cmd, refresh --json and config show --json remain, and the helper cleanup removed the dead per-domain JSON paths.

Verification run: GOCACHE=/private/tmp/gro144-gocache CLANG_MODULE_CACHE_PATH=/private/tmp/gro144-clang-cache go test ./internal/architecture ./internal/cmd/refreshcmd ./internal/cmd/config ./internal/noleak passed.

Findings

• Minor: docs/architecture.md:67 still says domain output.go contains printJSON(). That now contradicts the Remove per-command --json flags (cli-common output-and-rendering §2) #144 architecture and could guide future domain work to recreate the helper. Update it to say client interface, ClientFactory, and text formatters only.

• Nit: internal/output/output.go:19 still references “existing per-domain printJSON() callers”. Those callers are intentionally gone; reword this around control-plane JSONStdout callers or remove the sentence.

Verified targeted tests pass: internal/architecture, internal/cmd/refreshcmd, internal/cmd/config, internal/noleak.

TDD Coverage Assessment

Coverage of new behavior: The PR's core invariant (resource-surface leaves declare no --json flag) is genuinely enforced by TestResourceLeavesHaveNoJSONFlag at internal/architecture/architecture_test.go:238 — it walks cobra.Command.Flags().Lookup("json") on every leaf reachable from the five domain root commands, which is the right structural assertion. The two carve-outs (refresh --json, config show --json) are kept out of domainCommands() by construction, so the guard cannot false-positive on them. refresh --json is well-covered behaviorally by TestRefresh_Status_JSONEnvelope and TestRefresh_JSONEnvelope_Success (internal/cmd/refreshcmd/refresh_test.go:103,132), which unmarshal the envelope and assert the resources[] shape. bulk.Result.Print()'s signature change is covered by the two updated tests in internal/bulk/result_test.go:9,18 — adequate since Print() is now text-only and a 10-line function. The 1954-deletion-vs-147-addition ratio is consistent with a removal-shaped change where the absence is what needs guarding, and the inverted structural test does that job.

Gaps:

• internal/architecture/architecture_test.go:23-37 — domainPackages and domainCommands() are a hardcoded closed set of five packages. A future resource leaf registered under a sixth top-level command (e.g. gro tasks <leaf>) would silently slip past TestResourceLeavesHaveNoJSONFlag. Add a guard that asserts the rootCmd's subtree (minus an explicit {refresh, config, init, set-credential, version, help} carve-out list) has zero --json flags, so adding a new domain without updating domainCommands() fails closed.
• No file — there is no end-to-end cobra-level assertion that gro mail search "x" --json actually returns Error: unknown flag: --json. The PR body lists this as a test invariant but only the structural guard tests it. Add a table-driven test (e.g. in internal/cmd/root/root_test.go or a new internal/architecture/json_rejection_test.go) that calls rootCmd.SetArgs([]string{"mail", "search", "x", "--json"}), runs Execute(), and asserts the returned error contains unknown flag. This catches the user-observable contract directly, not just the structural precondition.
• internal/cmd/config/config_test.go:34-56 — TestConfigShowCommand does not exercise --json at all. The only config show --json coverage is TestConfigShowNeverLeaks at internal/noleak/noleak_test.go:79, which only asserts secrets are absent, not that the JSON shape (fields, structure) is preserved. A regression that broke the config show --json envelope's field set or made it invalid JSON would not be caught. Add TestConfigShow_JSONEnvelope that runs show --json and json.Unmarshals the output into the expected struct, mirroring TestRefresh_Status_JSONEnvelope.

Redundancy: None observed. The deleted Test*_JSON functions exercised JSON helpers (printJSON, me.RenderJSON, the jsonOneLiner/jsonIDOnly/jsonExtended structs) whose production code was deleted in the same PR — they tested the shape of code that no longer exists, so removing them is correct, not a coverage loss. The me-package TestMeNeverLeaks at internal/noleak/noleak_test.go:124 correctly dropped its --json / --id --json variants because those flag combos no longer parse; the surviving {} and {"--extended"} cases still cover the smoke path.

Risk level: Low

No findings.

The daemon edits look aligned with #144: stale docs/comments were cleaned up, config show --json is explicitly protected as a carve-out, and the new end-to-end resource-leaf check is a narrow complement to the structural walk. I don’t see the carve-out criteria widening resource JSON back in.

Verified with targeted search and tests:
go test ./internal/architecture ./internal/cmd/config ./internal/cmd/refreshcmd ./internal/output ./internal/noleak