Two done. Retrying provider layer and launching remaining studies in parallel.All research done. Checking harness DESIGN.md for framing context, then writing notes.214 lines — over the 180 cap. Tightening.Wrote `harness/docs/PORTING-NOTES-crush.md` (180 lines), all six deliverables with file:line refs.

Key findings:
- MCP config format worth porting verbatim; tool naming is `mcp_<server>_<tool>` (single underscores); stdio children need process-group kill.
- Sessions are SQLite with read-time orphaned-tool_call repair — that pass, not the storage engine, is what makes `--continue` robust.
- LLM calls live in external `charm.land/fantasy` (not vendored); retries are fantasy-internal. The z.ai "Message content shorter than read bytes" truncation surfaces at `agent/agent.go:1067-1189` (transport error) and is detected headless at `app/app.go:414-416`.
- No `--print` flag: headless is `crush run [prompt...]` + stdin; exit codes are 0/1 only, cancellation exits 0.
- OAuth flows mapped (MCP auth-code+PKCE at `oauth/mcp/handler.go` is the one to port when needed); Anthropic subscription OAuth was removed upstream.
No screen session found.