@hassangameryt/freeflow 0.7.2 → 0.7.3

package/pi-extension/tests/cognitive-routing-v2/render.test.js

@@ -14,6 +14,12 @@ test("evidence inspection renders metadata and gaps without source previews", ()
         kind: "toolResult",
         producer: "executor",
         toolName: "read",
+        locator: {
+          callRef: "ctx:call-source",
+          toolCallId: "call-1",
+          label: "read: evidence.txt (offset 1, limit 20)",
+          truncated: false,
+        },
         assignment: "a1",
         selected: true,
         active: false,
@@ -30,7 +36,15 @@ test("evidence inspection renders metadata and gaps without source previews", ()
     .render(100)
     .join("\n");
   assert.doesNotMatch(rendered, /SOURCE_BODY_MUST_NOT_APPEAR|undefined/);
-  for (const value of ["ctx:old", "executor", "read", "assignment a1", "Required image unsupported"])
+  for (const value of [
+    "ctx:old",
+    "executor",
+    "read",
+    "read: evidence.txt (offset 1, limit 20)",
+    "call-1 (ctx:call-source)",
+    "assignment a1",
+    "Required image unsupported",
+  ])
     assert.ok(rendered.includes(value));
 });
 

package/pi-extension/tests/cognitive-routing-v2/runtime.test.js

@@ -8,10 +8,19 @@ import { RoutingRuntime } from "../../dist/cognitive-routing-v2/runtime.js";
 import { EventStore } from "../../dist/session-sources/events.js";
 import { replay } from "../../dist/cognitive-routing-v2/state.js";
 
+const modelIds = ["coordinator", "helper", "executor", "coordinator-fast", "helper-fast", "executor-cheap"];
 const models = Object.fromEntries(
-  ["coordinator", "executor"].map((id) => [
+  modelIds.map((id) => [
     id,
-    { id, provider: "fixture", api: "fixture", input: ["text"], contextWindow: 100000, maxTokens: 1000 },
+    {
+      id,
+      provider: "fixture",
+      api: "fixture",
+      input: ["text"],
+      reasoning: true,
+      contextWindow: 100000,
+      maxTokens: 1000,
+    },
   ]),
 );
 const cap = {
@@ -19,10 +28,17 @@ const cap = {
   enabled: true,
   projection: false,
   profiles: Object.fromEntries(
-    Object.keys(models).map((id) => [id, { provider: "fixture", model: id, thinking: "off" }]),
+    ["coordinator", "executor"].map((id) => [id, { provider: "fixture", model: id, thinking: "off" }]),
   ),
   blockingReason: { code: "", message: "" },
 };
+const helperCap = {
+  ...cap,
+  delegation: "helper",
+  profiles: Object.fromEntries(
+    ["coordinator", "helper"].map((id) => [id, { provider: "fixture", model: id, thinking: "off" }]),
+  ),
+};
 async function environment(run) {
   const root = await mkdtemp(join(tmpdir(), "routing-runtime-"));
   let active;
@@ -41,6 +57,8 @@ async function environment(run) {
       sessionManager: manager,
       model: models.coordinator,
       thinkingLevel: "off",
+      failNextModelId: undefined,
+      failNextThinkingLevel: undefined,
       modelRegistry: { find: (_p, id) => models[id], getApiKeyAndHeaders: async () => ({ ok: true }) },
       getSystemPrompt: () => "",
       isIdle: () => true,
@@ -50,10 +68,18 @@ async function environment(run) {
   const pi = {
     appendEntry: (type, data) => active.sessionManager.appendCustomEntry(type, data),
     setModel: async (model) => {
+      if (active.failNextModelId === model.id) {
+        active.failNextModelId = undefined;
+        return false;
+      }
       active.model = model;
       return true;
     },
     setThinkingLevel: (level) => {
+      if (active.failNextThinkingLevel === level) {
+        active.failNextThinkingLevel = undefined;
+        throw new Error("fixture thinking application failed");
+      }
       active.thinkingLevel = level;
     },
     getAllTools: () => [],
@@ -114,6 +140,32 @@ test("delayed old control cannot change or poison a newly bound session", async
     }
   }));
 
+for (const [name, firstCapability, heldWorker, secondCapability] of [
+  ["Helper to Executor", helperCap, "helper", cap],
+  ["Executor to Helper", cap, "executor", helperCap],
+]) {
+  test(`binding a fresh ${name} session does not inherit the prior manual hold`, async () =>
+    environment(async ({ runtime, make, activate }) => {
+      const first = make(`${name}-first`);
+      activate(first);
+      await runtime.bind(first, firstCapability);
+      assert.equal((await runtime.setManualProfile(heldWorker)).status, "active");
+      const firstEntryCount = first.sessionManager.getEntries().length;
+
+      const second = make(`${name}-second`);
+      activate(second);
+      await runtime.bind(second, secondCapability);
+
+      assert.equal(runtime.state().runtimeStatus, "active");
+      assert.equal(runtime.state().controlMode, "automatic");
+      assert.equal(runtime.state().activeProfile, "coordinator");
+      assert.equal(second.model.id, "coordinator");
+      assert.equal(first.sessionManager.getEntries().length, firstEntryCount);
+      assert.equal(replay(first.sessionManager.getBranch()).control, "manual");
+      assert.equal(replay(first.sessionManager.getBranch()).profile, heldWorker);
+    }));
+}
+
 test("settled unbound attempt is retired truthfully and next request has a new identity", async () =>
   environment(async ({ runtime, make, activate }) => {
     const ctx = make("interrupt");
@@ -151,3 +203,221 @@ test("settled unbound attempt is retired truthfully and next request has a new i
     assert.notEqual(executions[1].id, old.id);
     assert.notEqual(executions[1].basisUserEntryId, old.basisUserEntryId);
   }));
+
+test("session profile overrides apply only to the selected pair and restore configured pairs", async () =>
+  environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-profile");
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    assert.equal(ctx.model.id, "coordinator");
+
+    const coordinatorOverride = await runtime.setSessionProfileOverride("coordinator", {
+      provider: "fixture",
+      modelId: "coordinator-fast",
+      thinking: "high",
+    });
+    assert.equal(coordinatorOverride.status, "active");
+    assert.equal(ctx.model.id, "coordinator-fast");
+    assert.equal(ctx.thinkingLevel, "high");
+    assert.deepEqual(replay(ctx.sessionManager.getBranch()).profileOverrides.get("coordinator"), {
+      provider: "fixture",
+      modelId: "coordinator-fast",
+      thinking: "high",
+    });
+
+    const executorOverride = await runtime.setSessionProfileOverride("executor", {
+      provider: "fixture",
+      modelId: "executor-cheap",
+      thinking: "low",
+    });
+    assert.equal(executorOverride.status, "stored");
+    assert.equal(ctx.model.id, "coordinator-fast");
+    assert.equal(ctx.thinkingLevel, "high");
+
+    runtime.unbind();
+    ctx.model = models.coordinator;
+    ctx.thinkingLevel = "off";
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    assert.equal(ctx.model.id, "coordinator-fast");
+    assert.equal(ctx.thinkingLevel, "high");
+
+    const held = await runtime.setManualProfile("executor");
+    assert.equal(held.status, "active");
+    assert.equal(ctx.model.id, "executor-cheap");
+    assert.equal(ctx.thinkingLevel, "low");
+
+    ctx.model = models.executor;
+    ctx.thinkingLevel = "off";
+    await runtime.ancestryChanged(ctx, false);
+    assert.equal(ctx.model.id, "executor-cheap");
+    assert.equal(ctx.thinkingLevel, "low");
+    assert.equal(runtime.state().controlMode, "manual-executor");
+
+    const inheritedExecutor = await runtime.setSessionProfileOverride("executor", null);
+    assert.equal(inheritedExecutor.status, "active");
+    assert.equal(ctx.model.id, "executor");
+    assert.equal(ctx.thinkingLevel, "off");
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.has("coordinator"), true);
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.has("executor"), false);
+
+    const reset = await runtime.resetSessionProfileOverrides();
+    assert.equal(reset.status, "stored");
+    assert.equal(ctx.model.id, "executor");
+    assert.equal(ctx.thinkingLevel, "off");
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.size, 0);
+    assert.equal(runtime.state().controlMode, "manual-executor");
+
+    runtime.unbind();
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    assert.equal(ctx.model.id, "executor");
+  }));
+
+test("Helper session presets apply through the same guarded profile path", async () =>
+  environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-helper-profile");
+    activate(ctx);
+    await runtime.bind(ctx, helperCap);
+    const helperOverride = { provider: "fixture", modelId: "helper-fast", thinking: "high" };
+    assert.equal((await runtime.setSessionProfileOverride("helper", helperOverride)).status, "stored");
+    assert.equal(ctx.model.id, "coordinator");
+    assert.equal((await runtime.setManualProfile("helper")).status, "active");
+    assert.equal(ctx.model.id, "helper-fast");
+    assert.equal(ctx.thinkingLevel, "high");
+    assert.deepEqual(replay(ctx.sessionManager.getBranch()).profileOverrides.get("helper"), helperOverride);
+    assert.equal((await runtime.resetSessionProfileOverrides()).status, "active");
+    assert.equal(ctx.model.id, "helper");
+    assert.equal(ctx.thinkingLevel, "off");
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.size, 0);
+    assert.equal(runtime.state().controlMode, "manual-helper");
+  }));
+
+test("manual control rejects a disabled worker without poisoning routing", async () =>
+  environment(async ({ runtime, make, activate }) => {
+    const ctx = make("disabled-manual-worker");
+    activate(ctx);
+    await runtime.bind(ctx, helperCap);
+    const result = await runtime.setManualProfile("executor");
+    assert.equal(result.status, "blocked");
+    assert.match(result.reason, /not enabled/);
+    assert.equal(runtime.state().runtimeStatus, "active");
+    assert.equal(runtime.state().activeProfile, "coordinator");
+    assert.equal(ctx.model.id, "coordinator");
+  }));
+
+test("invalid session profile overrides preserve the native pair and routing state", async () =>
+  environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-invalid");
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    const beforeEntries = ctx.sessionManager.getEntries().length;
+    const result = await runtime.setSessionProfileOverride("coordinator", {
+      provider: "fixture",
+      modelId: "missing-model",
+      thinking: "high",
+    });
+    assert.equal(result.status, "blocked");
+    assert.equal(ctx.model.id, "coordinator");
+    assert.equal(ctx.thinkingLevel, "off");
+    assert.equal(ctx.sessionManager.getEntries().length, beforeEntries);
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.size, 0);
+  }));
+
+test("rebind rejects a persisted session override when its model is unavailable", async () =>
+  await environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-stale");
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    assert.equal(
+      (
+        await runtime.setSessionProfileOverride("coordinator", {
+          provider: "fixture",
+          modelId: "coordinator-fast",
+          thinking: "high",
+        })
+      ).status,
+      "active",
+    );
+    runtime.unbind();
+    const saved = models["coordinator-fast"];
+    delete models["coordinator-fast"];
+    try {
+      ctx.model = models.coordinator;
+      ctx.thinkingLevel = "off";
+      activate(ctx);
+      await runtime.bind(ctx, cap);
+      assert.equal(runtime.state().runtimeStatus, "blocked");
+      assert.match(runtime.state().runtimeReason, /profile_unavailable|Model unavailable/);
+    } finally {
+      models["coordinator-fast"] = saved;
+    }
+    const corrected = await runtime.setSessionProfileOverride("coordinator", null);
+    assert.equal(corrected.status, "active");
+    assert.equal(runtime.state().runtimeStatus, "active");
+    assert.equal(ctx.model.id, "coordinator");
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.size, 0);
+  }));
+
+test("failed active session override restores the prior pair and event state", async () =>
+  await environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-rollback");
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    assert.equal(
+      (
+        await runtime.setSessionProfileOverride("coordinator", {
+          provider: "fixture",
+          modelId: "coordinator-fast",
+          thinking: "high",
+        })
+      ).status,
+      "active",
+    );
+    ctx.failNextModelId = "coordinator";
+    const result = await runtime.setSessionProfileOverride("coordinator", null);
+    assert.equal(result.status, "blocked");
+    assert.equal(ctx.model.id, "coordinator-fast");
+    assert.equal(ctx.thinkingLevel, "high");
+    assert.deepEqual(replay(ctx.sessionManager.getBranch()).profileOverrides.get("coordinator"), {
+      provider: "fixture",
+      modelId: "coordinator-fast",
+      thinking: "high",
+    });
+  }));
+
+test("active session reset restores the configured pair and control mode", async () =>
+  await environment(async ({ runtime, make, activate }) => {
+    const ctx = make("session-active-reset");
+    activate(ctx);
+    await runtime.bind(ctx, cap);
+    const override = { provider: "fixture", modelId: "coordinator-fast", thinking: "high" };
+    assert.equal((await runtime.setSessionProfileOverride("coordinator", override)).status, "active");
+    const result = await runtime.resetSessionProfileOverrides();
+    assert.equal(result.status, "active");
+    assert.equal(ctx.model.id, "coordinator");
+    assert.equal(ctx.thinkingLevel, "off");
+    assert.equal(replay(ctx.sessionManager.getBranch()).profileOverrides.size, 0);
+    assert.equal(runtime.state().controlMode, "automatic");
+  }));
+
+for (const operation of ["clear", "reset"]) {
+  test(`partial active ${operation} failure restores the prior native pair and override`, async () =>
+    await environment(async ({ runtime, make, activate }) => {
+      const ctx = make(`session-partial-${operation}`);
+      activate(ctx);
+      await runtime.bind(ctx, cap);
+      const override = { provider: "fixture", modelId: "coordinator-fast", thinking: "high" };
+      assert.equal((await runtime.setSessionProfileOverride("coordinator", override)).status, "active");
+      ctx.failNextThinkingLevel = "off";
+      const result =
+        operation === "clear"
+          ? await runtime.setSessionProfileOverride("coordinator", null)
+          : await runtime.resetSessionProfileOverrides();
+      assert.equal(result.status, "blocked");
+      assert.equal(ctx.model.id, "coordinator-fast");
+      assert.equal(ctx.thinkingLevel, "high");
+      assert.deepEqual(replay(ctx.sessionManager.getBranch()).profileOverrides.get("coordinator"), override);
+      assert.equal(runtime.state().runtimeStatus, "blocked");
+    }));
+}

package/pi-extension/tests/cognitive-routing-v2/state.test.js

@@ -100,6 +100,64 @@ function started() {
   m.apply({ type: "handoff-state", handoffId: "d-a1", state: "configured", observedPair: pair });
   return m;
 }
+const recoveryRequest = (assignmentId = "a1") => ({
+  type: "recovery-request-accepted",
+  recovery: {
+    id: "recovery",
+    assignmentId,
+    assessmentHandoffId: "return",
+    baseReportRevision: 1,
+    request: "recover evidence",
+    requestedPaths: ["recovery.txt"],
+    paths: ["/tmp/recovery.txt"],
+    state: "requested",
+    requestHandoffId: "recovery-request",
+    supplementRevision: 0,
+  },
+  handoff: {
+    id: "recovery-request",
+    kind: "recovery-request",
+    assignmentId,
+    text: "recover evidence",
+    from: "coordinator",
+    to: "executor",
+    executionId: "e3",
+    toolCallId: "recover-call",
+    basisUserEntryId: "user",
+    state: "pending",
+    reportRevision: 0,
+    limitations: [],
+  },
+});
+const recoverySupplement = (revision = 1) => ({
+  type: "recovery-supplement-accepted",
+  recoveryId: "recovery",
+  handoff: {
+    id: "recovery-return",
+    kind: "recovery-return",
+    assignmentId: "a1",
+    text: "recovered evidence",
+    from: "executor",
+    to: "coordinator",
+    executionId: "e4",
+    toolCallId: "supplement-call",
+    basisUserEntryId: "user",
+    state: "pending",
+    reportRevision: revision,
+    outcome: "completed",
+    limitations: [],
+  },
+});
+function recoveryReady() {
+  const m = started();
+  m.apply(opened("e2", "executor", "a1"));
+  m.apply(returned());
+  m.apply(bound("e2"));
+  m.apply({ type: "handoff-state", handoffId: "return", state: "configured", observedPair: pair });
+  m.apply(opened("e3", "coordinator", "a1"));
+  m.apply(recoveryRequest());
+  return m;
+}
 const reservation = (revision) => ({
   id: "reservation",
   selectionRevision: revision,
@@ -183,7 +241,7 @@ test("replacement retains old assignment and requires old execution to be resolv
   });
   assert.throws(
     () => m.apply(replacement),
-    (e) => e.code === "unresolved_executor_execution",
+    (e) => e.code === "unresolved_worker_execution",
   );
   m.apply(bound("e2"));
   m.apply(replacement);
@@ -192,6 +250,144 @@ test("replacement retains old assignment and requires old execution to be resolv
   assert.equal(m.state.assignments.get("a1").contract, "fixture contract");
   assert.equal(m.state.assignmentId, "a2");
 });
+test("worker identity rejects foreign returns and recovery requests", () => {
+  const m = machine();
+  m.apply(control("coordinator"));
+  m.apply(opened("e1", "coordinator"));
+  const helperDelegate = delegated();
+  helperDelegate.handoff.to = "helper";
+  m.apply(helperDelegate);
+  m.apply(bound("e1"));
+  m.apply({ type: "handoff-state", handoffId: "d-a1", state: "configured", observedPair: pair });
+  m.apply(opened("e2", "helper", "a1"));
+  const foreignReturn = returned();
+  assert.throws(
+    () => m.apply(foreignReturn),
+    (error) => error.code === "return_identity_mismatch",
+  );
+  const helperReturn = returned();
+  helperReturn.handoff.from = "helper";
+  m.apply(helperReturn);
+  m.apply(bound("e2"));
+  m.apply({ type: "handoff-state", handoffId: "return", state: "configured", observedPair: pair });
+  m.apply(opened("e3", "coordinator", "a1"));
+  const foreignRecovery = recoveryRequest();
+  assert.throws(
+    () => m.apply(foreignRecovery),
+    (error) => error.code === "recovery_not_available",
+  );
+  foreignRecovery.handoff.to = "helper";
+  m.apply(foreignRecovery);
+  assert.equal(m.state.recoveryId, "recovery");
+  assert.equal(m.state.handoffs.get("recovery-request").to, "helper");
+});
+
+test("wrong-worker return, selection, supplement, and retry events are symmetric and state-preserving", () => {
+  const startedFor = (worker) => {
+    const m = machine();
+    m.apply(control("coordinator"));
+    m.apply(opened("e1", "coordinator"));
+    const delegation = delegated();
+    delegation.handoff.to = worker;
+    m.apply(delegation);
+    m.apply(bound("e1"));
+    m.apply({ type: "handoff-state", handoffId: "d-a1", state: "configured", observedPair: pair });
+    return m;
+  };
+  const returnFrom = (worker) => {
+    const value = returned();
+    value.handoff.from = worker;
+    return value;
+  };
+  const requestTo = (worker) => {
+    const value = recoveryRequest();
+    value.handoff.to = worker;
+    return value;
+  };
+  const supplementFrom = (worker) => {
+    const value = recoverySupplement();
+    value.handoff.from = worker;
+    return value;
+  };
+
+  for (const [worker, foreign] of [
+    ["executor", "helper"],
+    ["helper", "executor"],
+  ]) {
+    const returning = startedFor(worker);
+    returning.apply(opened("e2", worker, "a1"));
+    const beforeReturn = returning.state;
+    assert.throws(
+      () => returning.apply(returnFrom(foreign)),
+      (error) => error.code === "return_identity_mismatch",
+    );
+    assert.equal(returning.state, beforeReturn);
+    assert.equal(returning.state.assignments.get("a1").state, "outstanding");
+
+    const selecting = startedFor(worker);
+    selecting.apply(control(foreign));
+    const beforeSelection = selecting.state;
+    assert.throws(
+      () =>
+        selecting.apply({
+          type: "selection-changed",
+          assignmentId: "a1",
+          selection: { revision: 1, selected: [], unresolved: [], withdrawals: [] },
+        }),
+      (error) => error.code === "selection_wrong_phase",
+    );
+    assert.equal(selecting.state, beforeSelection);
+    assert.equal(selecting.state.selections.has("a1"), false);
+
+    const retrying = startedFor(worker);
+    retrying.apply(opened("e2", worker, "a1"));
+    retrying.apply(returnFrom(worker));
+    retrying.apply({ type: "handoff-state", handoffId: "return", state: "blocked", reason: "fixture gap" });
+    retrying.apply(control(foreign));
+    const beforeRetry = retrying.state;
+    assert.throws(
+      () =>
+        retrying.apply({
+          type: "handoff-retry-requested",
+          handoffId: "return",
+          attemptId: "retry",
+          executionId: "e2",
+          toolCallId: "retry-call",
+          reportRevision: 1,
+          selectionRevision: 0,
+        }),
+      (error) => error.code === "invalid_return_retry",
+    );
+    assert.equal(retrying.state, beforeRetry);
+    assert.equal(retrying.state.handoffs.get("return").state, "blocked");
+    assert.equal(retrying.state.attempts.has("return"), false);
+
+    const supplementing = startedFor(worker);
+    supplementing.apply(opened("e2", worker, "a1"));
+    supplementing.apply(returnFrom(worker));
+    supplementing.apply(bound("e2"));
+    supplementing.apply({ type: "handoff-state", handoffId: "return", state: "configured", observedPair: pair });
+    supplementing.apply(opened("e3", "coordinator", "a1"));
+    supplementing.apply(requestTo(worker));
+    supplementing.apply(bound("e3"));
+    supplementing.apply({
+      type: "handoff-state",
+      handoffId: "recovery-request",
+      state: "configured",
+      observedPair: pair,
+    });
+    supplementing.apply(opened("e4", worker, "a1"));
+    const beforeSupplement = supplementing.state;
+    assert.throws(
+      () => supplementing.apply(supplementFrom(foreign)),
+      (error) => error.code === "recovery_not_returnable",
+    );
+    assert.equal(supplementing.state, beforeSupplement);
+    assert.equal(supplementing.state.recoveries.get("recovery").state, "reading");
+    assert.equal(supplementing.state.handoffs.has("recovery-return"), false);
+  }
+});
+
 test("saved report revisions and retries preserve exact earlier events", () => {
   const m = started();
   m.apply(opened("e2", "executor", "a1"));
@@ -213,6 +409,86 @@ test("saved report revisions and retries preserve exact earlier events", () => {
   assert.equal([...m.state.events.values()].find((e) => e.eventId === first.eventId).data.handoff.text, "exact report");
   assert.equal(m.state.assignments.size, 1);
 });
+test("recovery transitions preserve the original report and reject foreign identities", () => {
+  const ready = () => {
+    const m = started();
+    m.apply(opened("e2", "executor", "a1"));
+    m.apply(returned());
+    m.apply(bound("e2"));
+    m.apply({ type: "handoff-state", handoffId: "return", state: "configured", observedPair: pair });
+    m.apply(opened("e3", "coordinator", "a1"));
+    return m;
+  };
+  const foreign = ready();
+  assert.throws(
+    () => foreign.apply(recoveryRequest("foreign")),
+    (error) => error.code === "recovery_not_available",
+  );
+
+  const m = ready();
+  const base = structuredClone(m.state.handoffs.get("return"));
+  const request = m.apply(recoveryRequest());
+  m.set(request);
+  assert.equal(m.state.recoveries.size, 1, "exact event replay is idempotent");
+  m.apply(bound("e3"));
+  m.apply({ type: "handoff-state", handoffId: "recovery-request", state: "configured", observedPair: pair });
+  assert.equal(m.state.recoveries.get("recovery").state, "reading");
+  m.apply(opened("e4", "executor", "a1"));
+  m.apply(recoverySupplement());
+  assert.equal(m.state.recoveries.get("recovery").state, "returning");
+  assert.deepEqual(m.state.handoffs.get("return"), base, "the base report remains immutable");
+  assert.throws(
+    () => m.apply(recoverySupplement(3)),
+    (error) => error.code === "invalid_report_revision",
+  );
+});
+
+test("assessment cannot resume while attached recovery remains unsettled", () => {
+  const m = recoveryReady();
+  const before = m.state;
+  assert.throws(
+    () =>
+      m.apply({
+        type: "assessment-resumed",
+        handoffId: "return",
+        basisUserEntryId: "new-user",
+      }),
+    (error) => error.code === "recovery_outstanding",
+  );
+  assert.equal(m.state, before);
+  assert.equal(m.state.assessment.view, "suspended");
+  assert.equal(m.state.recoveryId, "recovery");
+});
+
+for (const outcome of ["cancelled", "deferred"]) {
+  test(`${outcome} unit closure atomically disposes attached recovery`, () => {
+    const m = recoveryReady();
+    m.apply({ type: "unit-closed", unitId: "u1", outcome, assessment: `${outcome} with recovery` });
+    assert.equal(m.state.unitId, undefined);
+    assert.equal(m.state.assignmentId, undefined);
+    assert.equal(m.state.pendingId, undefined);
+    assert.equal(m.state.recoveryId, undefined);
+    assert.equal(m.state.recoveries.get("recovery").state, "cancelled");
+    assert.equal(m.state.recoveries.get("recovery").cancellationReason, `${outcome} with recovery`);
+    assert.equal(m.state.handoffs.get("recovery-request").state, "superseded");
+    assert.equal(m.state.handoffs.get("return").text, "exact report");
+    m.apply(opened(`e-${outcome}`, "coordinator"));
+    m.apply(delegated(`a-${outcome}`, `u-${outcome}`, [`a-${outcome}`], `e-${outcome}`));
+    assert.equal(m.state.unitId, `u-${outcome}`);
+  });
+}
+
+test("accepted unit closure rejects attached recovery without changing state", () => {
+  const m = recoveryReady();
+  const before = m.state;
+  assert.throws(
+    () => m.apply({ type: "unit-closed", unitId: "u1", outcome: "accepted", assessment: "incorrect" }),
+    (error) => error.code === "unfinished_work",
+  );
+  assert.equal(m.state, before);
+  assert.equal(m.state.recoveryId, "recovery");
+});
+
 test("assessment resumption rejects stale selection and preserves suspension on failure", () => {
   const m = started();
   m.apply(opened("e2", "executor", "a1"));
@@ -273,3 +549,38 @@ test("accepted closure cannot conceal work; later work creates a new unit", () =
   assert.equal(m.state.unitId, "u2");
   assert.equal(m.state.units.size, 2);
 });
+test("profile override events are complete-pair, branch-replayable session state", () => {
+  const m = machine();
+  const coordinator = { provider: "fixture", modelId: "coordinator-fast", thinking: "high" };
+  const executor = { provider: "fixture", modelId: "executor-cheap", thinking: "low" };
+  m.apply({
+    type: "profile-overrides",
+    overrides: { coordinator },
+    reason: "fixture session override",
+  });
+  assert.deepEqual(m.state.profileOverrides.get("coordinator"), coordinator);
+  assert.equal(m.state.profileOverrides.has("executor"), false);
+  m.apply({
+    type: "profile-overrides",
+    overrides: { executor },
+    reason: "fixture session override",
+  });
+  assert.deepEqual(m.state.profileOverrides.get("executor"), executor);
+  m.apply({
+    type: "profile-overrides",
+    overrides: { coordinator: null, executor: null },
+    reason: "fixture reset",
+  });
+  assert.equal(m.state.profileOverrides.size, 0);
+  assert.throws(
+    () =>
+      parseRoutingEvent(
+        m.event({
+          type: "profile-overrides",
+          overrides: { coordinator: { provider: "fixture", modelId: "bad", thinking: "unknown" } },
+          reason: "invalid",
+        }),
+      ),
+    (e) => e.code === "invalid_profile_overrides",
+  );
+});