Delete every knob the fixed profiles cannot honor

The CLI still advertised --model, --steps, --guidance-scale, --device and a
deprecated --auto. Each pinned a value the two surviving profiles fix -- the
model stack, the per-stage distilled schedule, CFG 1.0, CUDA -- so the only
outcome any of them had was an error raised several frames below the caller,
under a message naming an internal profile. A flag whose sole result is a
refusal is worse than no flag: it advertises a capability that does not exist,
and it lets a wrapper thread a value that will silently do nothing. They are
gone from the parser, from InvisibleEngine, and from WatermarkRemover, so the
failure is now a TypeError or a Click "No such option" at the point the caller
can act on.

The install hint was wrong in the same way. is_available() checked torch and
diffusers, then told the user to install [diffusion] -- which contains neither
DiffSynth nor the Z-Image face stage both profiles run. Following the advice
produced a second, different failure. The module list and the extra name now
live once in watermark_profiles (REMOVAL_MODULES, INVISIBLE_EXTRA) and are read
by both the CLI gate and the remover's precondition, which cannot drift apart
because they are the same tuple.

The adaptive-polish default moved out of the argument parser. It was resolved by
reading Click's parameter source, which put per-profile data in the CLI layer,
left the engine declaring the opposite default (False vs True) so a library
caller and a CLI caller on one profile got different output, and lost the polish
entirely for anything that supplies the flag non-interactively. The flag is now
tri-state (default=None) and resolve_adaptive_polish owns the per-profile
answer. The seed follows the same rule: the CLI stopped pre-resolving it.

Dead code removed with it: six scan_*_video wrappers and the _scan_video helper
none of them had a caller for, PNG_METADATA_KEYS, feather_region_composite and
the remover region path that was only reachable from a no-caller convenience
wrapper, remove_watermark_batch on both layers, try_empty_device_cache, the
_generate/_run_qwen_zimage pass-through pair, self.model_id, and the _internal
PEP 562 shim that no caller ever went through. get_device now answers cuda or
cpu only: mps and xpu travelled one frame to the same CUDA-only refusal while
costing a device probe each, and that refusal now names the resolved device, so
device=None on a CUDA-less host says 'cpu' rather than 'None'. The XPU wheel
index went with them.

Docs: README, cli, installation, python-api, supported-signals,
known-limitations and module-internals all still described the removed profiles,
the CPU/MPS/XPU ladder, a `default`->`sdxl` alias, and the wrong extra.
known-limitations still listed the retired SDXL strength ladder as current.
scripts/smoke_matrix.py and real_examples_e2e.py drove --device mps.

Next release is 0.25.0, not a patch: this removes public parameters and
narrows a published extra on top of the released 0.24.0.

pre-commit: 1) maintain.sh - exit 0 (1091 tests, Pyright 0 errors, no
vulnerabilities); 2) /simplify - 4 agents, 11 findings applied, 2 skipped
(dropping the `device` parameter entirely, which raiw-app pins; folding
diffsynth into the `diffusion` extra, which video-only callers do not need);
3) docs sync - grepped every removed identifier across README, docs/, scripts/,
.claude/; updated 9 docs; 4) CLAUDE.md - added the no-error-only-knobs rule to
.claude/rules/development.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_platform.py

@@ -1,7 +1,7 @@
-"""Tests for cross-platform and cross-device compatibility.
+"""Tests for device detection, profile resolution, and platform-specific paths.
 
-Verifies that device detection, MPS fallback, and platform-specific
-code paths work correctly on CPU, MPS (macOS), and CUDA (Linux/Windows).
+Invisible-watermark removal is CUDA-only, so the device tests here assert a binary
+answer and a clean refusal rather than a fallback ladder.
 """
 
 from __future__ import annotations
@@ -27,34 +27,38 @@ from remove_ai_watermarks._internal.watermark_remover import get_device, is_wate
 
 
 class TestDeviceDetection:
-    """Tests for get_device() across platforms."""
+    """get_device() is binary: CUDA, or the "cpu" that names its absence."""
 
-    def test_returns_valid_device(self):
-        device = get_device()
-        assert device in ("cpu", "mps", "cuda", "xpu")
+    def test_answer_is_cuda_or_cpu(self):
+        """No mps/xpu answer exists. Both would travel one frame to the same refusal.
 
-    def test_cpu_fallback_when_no_gpu(self):
-        """On CI / machines without GPU, should fall back to cpu or mps."""
-        device = get_device()
-        # Just verify it doesn't crash and returns a valid string
-        assert isinstance(device, str)
+        Reporting them anyway cost a device probe each and let a caller believe the
+        library had an Apple-silicon or Intel-GPU path that it does not.
+        """
+        assert get_device() in ("cpu", "cuda")
 
     @patch("remove_ai_watermarks._internal.watermark_remover._HAS_TORCH", False)
     def test_no_torch_returns_cpu(self):
         assert get_device() == "cpu"
 
-    def test_xpu_selected_when_available(self):
-        """An XPU-enabled torch (no CUDA) routes to the Intel GPU backend.
+    def test_working_cuda_is_selected_and_probed(self):
+        """A reported CUDA device is smoke-tested before it is returned.
 
-        The whole torch module is mocked so the smoke-test ops succeed without
-        any real device; cuda must read False so the cuda branch is skipped.
+        torch.cuda.is_available() can be True on a build whose CUDA backend then
+        raises on the first real op; without the probe that surfaced much later.
         """
         fake_torch = MagicMock()
-        fake_torch.cuda.is_available.return_value = False
-        fake_torch.xpu.is_available.return_value = True
+        fake_torch.cuda.is_available.return_value = True
         with patch("remove_ai_watermarks._internal.watermark_remover.torch", fake_torch):
-            assert get_device() == "xpu"
-        fake_torch.tensor.assert_called_with([1.0], device="xpu")
+            assert get_device() == "cuda"
+        fake_torch.tensor.assert_called_with([1.0], device="cuda")
+
+    def test_broken_cuda_backend_falls_back_to_cpu(self):
+        fake_torch = MagicMock()
+        fake_torch.cuda.is_available.return_value = True
+        fake_torch.tensor.side_effect = RuntimeError("no kernel image")
+        with patch("remove_ai_watermarks._internal.watermark_remover.torch", fake_torch):
+            assert get_device() == "cpu"
 
     def test_non_cuda_devices_are_refused_at_construction(self):
         """CUDA is a precondition of the object, not of the run.
@@ -78,21 +82,21 @@ class TestDeviceDetection:
         assert remover.device == "cuda"
         assert remover.torch_dtype == torch.bfloat16
 
+    def test_the_refusal_names_the_resolved_device_not_a_bare_none(self):
+        """``device=None`` on a CUDA-less host must report "cpu", not "None".
 
-class TestEmptyDeviceCache:
-    """try_empty_device_cache is all that remains of the img2img runner.
+        The message used to interpolate the raw argument, so the common auto-detect
+        path told the user that ``'None'`` cannot run the removal.
+        """
+        if not is_watermark_removal_available():
+            pytest.skip("torch/diffusers not installed")
+        from remove_ai_watermarks._internal import watermark_remover as module
 
-    Its module lost run_img2img and the MPS fallback along with the CPU/MPS profiles;
-    both surviving profiles are CUDA-only, so there is no MPS failure left to recover
-    from. The helper must stay silent on a backend that cannot empty a cache, because
-    it runs in cleanup paths where a raise would replace the real error.
-    """
-
-    def test_unknown_backend_is_a_silent_no_op(self):
-        from remove_ai_watermarks._internal.watermark_remover import try_empty_device_cache
-
-        try_empty_device_cache("cpu")
-        try_empty_device_cache("definitely-not-a-backend")
+        with (
+            patch.object(module, "get_device", return_value="cpu"),
+            pytest.raises(ValueError, match="'cpu' cannot run it"),
+        ):
+            module.WatermarkRemover(device=None)
 
 
 class TestModelProfiles:
@@ -116,6 +120,26 @@ class TestModelProfiles:
             assert normalize_profile(retired) not in PROFILE_CHOICES
 
 
+class TestResolveAdaptivePolish:
+    """The polish default is per-profile data, not a CLI parameter-source inference."""
+
+    def test_unset_follows_the_profile(self):
+        from remove_ai_watermarks._internal.watermark_profiles import resolve_adaptive_polish
+
+        # qwen-zimage already matches the input's detail level, so polishing it only
+        # moves the output away from upstream. An SDXL global pass leaves the softer
+        # result the polish exists for.
+        assert resolve_adaptive_polish(None, "qwen-zimage") is False
+        assert resolve_adaptive_polish(None, "sdxl-zimage") is True
+        assert resolve_adaptive_polish(None, "qwen_zimage") is False
+
+    def test_an_explicit_choice_always_wins(self):
+        from remove_ai_watermarks._internal.watermark_profiles import resolve_adaptive_polish
+
+        assert resolve_adaptive_polish(True, "qwen-zimage") is True
+        assert resolve_adaptive_polish(False, "sdxl-zimage") is False
+
+
 class TestNoReembeddedWatermark:
     """F2 regression: the SDXL global stage must disable the diffusers watermarker.