@north-light/crouter 0.3.154

package/dist/core/__tests__/full/broker-dialogs.test.js

@@ -0,0 +1,180 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-dialogs.test.ts
+//
+// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
+// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
+//
+// Broker dialog handling under MULTI-WRITER attachments — the T8 attach gates
+// G5/G5b/G6 cover fan-out + first-response settlement, mid-dialog attach replay,
+// and attended-dialog timeout behavior.
+//
+// 3-PART HEADER (headless):
+//  (1) CONTRACT — every client whose `hello` claimed the writable role is fanned a
+//      blocking dialog as extension_ui_request; the FIRST extension_ui_response
+//      settles it with that answer (not the default), every fanned client receives
+//      the correlated extension_ui_dismiss, and a later peer response for the same
+//      id is a silent no-op (G5). A dialog stays pending through a peer's detach and
+//      is handed to any writable client attaching mid-dialog via
+//      welcome.pending_dialog; observers never receive an answerable dialog (G5b).
+//      An attended dialog nobody answers resolves on the short per-dialog timeout
+//      with the default answer and a correlated dismiss to EVERY writable peer (G6).
+//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the dialog round-trip is an async
+//      promise inside makeBrokerUiContext, fanned out and answered over view.sock to
+//      the production ViewSocketClient. The real broker process provides the
+//      uiContext and timeout machinery without a tmux pane, window, or pi-session
+//      read.
+//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine raises real
+//      confirm() dialogs through the broker, and the tests assert on the frames of
+//      several concurrently attached clients plus the value and latency recorded in
+//      fake-pi.dialog.jsonl.
+//
+// One shared broker is booted in before() and reused across all three gates. Because
+// fake-pi.dialog.jsonl is append-only across the shared broker, each gate snapshots
+// the count before it drives (`base`) and asserts on its newly appended entry. Role
+// is fixed by `hello` and never reassigned, so every writable attach is a plain
+// attach — there is no control handoff to wait out.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { isPidAlive } from '../../canvas/pid.js';
+import { createAttachKit } from '../helpers/broker-clients.js';
+let h;
+let id; // ONE shared broker, reused across G5/G5b/G6 (1 real boot, not 3)
+const kit = createAttachKit(() => h);
+const { attach, attachUntil } = kit;
+// Attach a writable client. Every `hello` claiming `controller` is admitted
+// writable — attaching a peer never demotes an already-attached one.
+const writer = async (cid) => {
+    const a = await attach(id, 'controller', cid);
+    assert.equal(a.welcome.role, 'controller', `${cid}: admitted writable, not demoted by an existing peer`);
+    return a;
+};
+const observer = async (cid) => {
+    const a = await attach(id, 'observer', cid);
+    assert.equal(a.welcome.role, 'observer', `${cid}: an observer hello stays read-only`);
+    return a;
+};
+// The broker handles one client's frames in order, so an `ack` for a get_commands
+// sent AFTER some other frame proves that earlier frame was already processed.
+// Used to make "a late peer answer changed nothing" a deterministic assertion
+// instead of a sleep.
+const barrier = async (c, label) => {
+    c.send({ type: 'get_commands' });
+    await c.waitFrame((f) => f.type === 'ack' && f.for === 'get_commands', label);
+};
+const isRequest = (f) => f.type === 'extension_ui_request';
+const dismissFor = (reqId) => (f) => f.type === 'extension_ui_dismiss' && f.id === reqId;
+// dialog.jsonl is append-only across the shared broker — snapshot the count, then
+// wait for AT LEAST `want` new entries and return the full (cumulative) array.
+const dialogCount = () => h.dialogResults(id).length;
+const awaitDialogs = (atLeast, label) => h.waitFor(() => (h.dialogResults(id).length >= atLeast ? h.dialogResults(id) : null), { label, timeoutMs: 15_000 });
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkdlg' });
+    const root = h.spawnRoot('broker-dialogs suite root');
+    id = await h.spawnHeadlessChild(root, 'headless worker — dialog gates');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+afterEach(() => {
+    kit.closeAll();
+});
+const brokerPid = () => h.node(id).pi_pid;
+// ---------------------------------------------------------------------------
+// G5 — fan-out + first-response settlement. Guards: ONE blocking dialog reaches
+// EVERY writable client (never a single owner), the first answer unblocks the
+// engine with ITS value (not the default), every fanned client gets the correlated
+// extension_ui_dismiss, and a peer answering afterwards is a no-op. Failure modes:
+// a dialog only one viewer can see (the others sit blind), peers left holding an
+// overlay nothing can answer, or a late peer answer re-settling a dead dialog.
+// ---------------------------------------------------------------------------
+test('G5 — one dialog fans out to both writable clients, the first response settles it, both are dismissed, and a late peer response is a no-op', async () => {
+    const base = dialogCount();
+    const a = await writer('g5-A');
+    const b = await writer('g5-B');
+    const obs = await observer('g5-obs'); // must never be fanned an answerable dialog
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: a writable client answers first
+    const reqA = await a.waitFrame(isRequest, 'G5 dialog fanned out to writable A');
+    const reqB = await b.waitFrame(isRequest, 'G5 dialog fanned out to writable B');
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G5: both writable clients were fanned the SAME dialog id, not two dialogs');
+    assert.equal(reqA.method, 'confirm', 'G5: the fanned dialog is the confirm() the engine raised');
+    // A answers first — the engine must proceed with A's true, not the false default.
+    a.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
+    await a.waitFrame(dismissFor(reqId), 'G5 answerer A receives the correlated dismiss');
+    await b.waitFrame(dismissFor(reqId), 'G5 peer B receives the correlated dismiss for the dialog it never answered');
+    const results = await awaitDialogs(base + 1, 'G5 dialog settled by the first response');
+    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the first answer (true), not the default (false)');
+    // The observer was attached the whole time: it saw the broadcast dismiss but was
+    // never handed the answerable request.
+    await obs.waitFrame(dismissFor(reqId), 'G5 observer sees the broadcast dismiss (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5: an observer is never fanned an answerable dialog');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5: an observer welcome never carries a pending dialog');
+    // B answers the already-settled dialog. The broker deleted the entry on the first
+    // response, so this finds nothing and is a silent no-op: no second engine
+    // resolution, and the recorded answer stays A's.
+    b.send({ type: 'extension_ui_response', id: reqId, confirmed: false });
+    await barrier(b, 'G5 broker processed B late response (ordered ack)');
+    const settled = h.dialogResults(id);
+    assert.equal(settled.length, base + 1, 'G5: the late peer response resolved nothing — no second dialog entry');
+    assert.equal(settled[base].resolved, true, "G5: the late peer response did not overwrite the first answerer's value");
+    assert.equal(isPidAlive(brokerPid()), true, 'G5: the late no-op response did not fault the broker');
+});
+// ---------------------------------------------------------------------------
+// G5b (mid-dialog attach) — Guards: a pending dialog survives a writable peer's
+// detach (M2) and is handed to a writable client that attaches MID-dialog via
+// welcome.pending_dialog, which makes it a full peer in the race to answer. An
+// observer attaching mid-dialog gets nothing answerable. Failure modes: a pending
+// dialog lost when the raising viewer detaches, a late-joining writable viewer
+// blind to an in-flight dialog, or an observer handed one it cannot answer.
+// ---------------------------------------------------------------------------
+test('G5b — a writable client attaching MID-dialog receives the pending dialog; an observer does not', async () => {
+    const base = dialogCount();
+    const a = await writer('g5b-A');
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the late attach
+    const reqA = await a.waitFrame(isRequest, 'G5b dialog fanned out to writable A');
+    const reqId = reqA.id;
+    a.send({ type: 'bye' });
+    a.close(); // M2: a writable peer detaching does NOT cancel the pending dialog
+    // An observer attaching mid-dialog is never handed it.
+    const obs = await observer('g5b-obs');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5b: an observer attaching mid-dialog gets no pending dialog');
+    // A writable client attaching mid-dialog IS handed it (retry covers the beat
+    // between the raise and this attach) and can settle it.
+    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b writable B attaches mid-dialog and is handed the pending dialog');
+    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised while A was attached');
+    assert.equal(b.welcome.pending_dialog.method, 'confirm', 'G5b: the pending dialog is the confirm()');
+    b.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
+    const results = await awaitDialogs(base + 1, 'G5b dialog settled by the mid-dialog joiner');
+    assert.equal(results[base].resolved, true, 'G5b: the mid-dialog joiner answered and the engine proceeded');
+    await obs.waitFrame(dismissFor(reqId), 'G5b dismiss broadcast follows the settlement (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5b: the observer was never fanned the dialog it saw dismissed');
+});
+// ---------------------------------------------------------------------------
+// G6 — anti-deadlock. An ATTENDED dialog NO writable client answers resolves on a
+// SHORT per-dialog broker timeout, and every fanned peer is dismissed by id.
+// Guards: the engine never hangs on a dialog whose viewers all stay silent.
+// Failure mode: a forever-blocked turn, or overlays left up on every viewer.
+// ---------------------------------------------------------------------------
+test('G6 — an attended dialog no writable client answers resolves on the broker timeout and dismisses every peer', async () => {
+    const pid = brokerPid();
+    const base = dialogCount();
+    // Two writable clients attached but silent → the broker resolves on the SHORT
+    // explicit per-dialog timeout (800ms), never the 120s default. On timeout it
+    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so
+    // EVERY peer's overlay (none has an independent timer) is torn down by id.
+    const a = await writer('g6-A');
+    const b = await writer('g6-B');
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 800 });
+    const reqA = await a.waitFrame(isRequest, 'G6 dialog fanned out to writable A'); // received, deliberately NOT answered
+    const reqB = await b.waitFrame(isRequest, 'G6 dialog fanned out to writable B'); // received, deliberately NOT answered
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G6: both silent peers hold the SAME dialog id');
+    const dismissA = await a.waitFrame(dismissFor(reqId), 'G6 broker emits a correlated dismiss to A on timeout');
+    await b.waitFrame(dismissFor(reqId), 'G6 broker emits the same correlated dismiss to peer B');
+    assert.equal(dismissA.id, reqId, 'G6: the dismiss frame carries the timed-out dialog id, not another');
+    const results = await awaitDialogs(base + 1, 'G6 attended dialog resolved on timeout');
+    assert.equal(results[base].resolved, false, 'G6: a dialog no writable client answered resolves to the default (deny)');
+    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
+    assert.equal(isPidAlive(pid), true, 'G6: the engine made forward progress (still alive)');
+});

package/dist/core/__tests__/full/broker-display-snapshot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/full/broker-display-snapshot.test.js

@@ -0,0 +1,75 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-display-snapshot.test.ts
+//
+// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
+// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
+//
+// 3-PART HEADER (headless):
+//  (1) CONTRACT — catch-up is ONE atomic frame. `ctx.ui.setStatus/setWidget/
+//      setTitle` are LEVELS with no pi getter, so the broker is their only holder;
+//      it ships that held state as `welcome.snapshot.display` and sends NO
+//      `display_*` frames after the welcome. A late joiner therefore renders
+//      complete chrome on its FIRST paint.
+//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the retention lives in the real
+//      broker process (displayStatuses/displayWidgets/displayTitle, painted through
+//      the real makeBrokerUiContext relay) and the catch-up shape is a wire fact on
+//      view.sock. No tmux pane, window, or pi-session read is involved.
+//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine paints through
+//      the broker's REAL uiContext with NO viewer attached (so nothing is observed
+//      live and only retention can carry it), then a viewer attaches and we assert
+//      on its welcome payload and on the ABSENCE of any post-welcome display frame.
+//
+// This is the regression guard for the pre-2026-07-24 shape, where `sendWelcome`
+// re-emitted N synthetic `display_*` edge frames after the snapshot: catch-up was
+// non-atomic, the viewer had to clear-and-rebuild (painting blank chrome in the
+// gap), and `applySnapshot(welcome) === fold(reduce, events)` was false by
+// construction. Deleting the replay without adding `snapshot.display` would drop
+// the chrome entirely; adding `snapshot.display` without deleting the replay would
+// leave catch-up non-atomic. Both halves fail this test.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { createAttachKit, delay } from '../helpers/broker-clients.js';
+let h;
+let id;
+const kit = createAttachKit(() => h);
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkdisp' });
+    const root = h.spawnRoot('broker-display-snapshot suite root');
+    id = await h.spawnHeadlessChild(root, 'headless worker — display catch-up');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+afterEach(() => {
+    kit.closeAll();
+});
+/** The three display METHODS of pi's uniform `extension_ui_request` envelope. */
+const DISPLAY_METHODS = new Set(['setStatus', 'setWidget', 'setTitle']);
+const isDisplayFrame = (f) => f.type === 'extension_ui_request' && f.method !== undefined && DISPLAY_METHODS.has(f.method);
+test('retained extension display state rides IN welcome.snapshot.display — and no display edge follows', async () => {
+    // Paint with ZERO viewers attached: the only path from here to a viewer is the
+    // broker's retained last-value, so nothing about this test can pass by luck of
+    // having observed the live edge.
+    h.fakeCmd(id, { cmd: 'display', text: 'crtr-brief', reason: 'painted while detached' });
+    const a = await kit.attachUntil(id, 'observer', 'disp-late-joiner', (at) => at.welcome.snapshot.display?.statuses['crtr-brief'] !== undefined, 'welcome.snapshot.display carries the retained status');
+    const display = a.welcome.snapshot.display;
+    assert.equal(display.statuses['crtr-brief'], 'painted while detached', 'setStatus level survived in the snapshot');
+    assert.deepEqual(display.widgets['crtr-brief'], { lines: ['painted while detached'], placement: 'aboveEditor' }, 'setWidget level survived in the snapshot, placement included');
+    assert.equal(display.title, 'painted while detached', 'setTitle level survived in the snapshot');
+    // Atomicity: the welcome is COMPLETE. Give the broker a generous beat to emit a
+    // replay it must not emit, then assert nothing display-shaped arrived at all.
+    await delay(500);
+    assert.deepEqual(a.frames.filter((f) => isDisplayFrame(f)).map((f) => f.method), [], 'catch-up is the welcome alone — no synthetic display edges replayed after it');
+    // A LIVE paint still arrives as an edge frame: the snapshot replaces the replay,
+    // not the ongoing relay.
+    h.fakeCmd(id, { cmd: 'display', text: 'crtr-live', reason: 'painted while attached' });
+    const live = (await a.waitFrame((f) => f.type === 'extension_ui_request' && f.statusKey === 'crtr-live', 'a live setStatus still relays as an extension_ui_request edge'));
+    assert.equal(live.method, 'setStatus');
+    assert.equal(live.statusText, 'painted while attached');
+    // And a viewer attaching AFTER that sees the union of both keys in one frame.
+    const b = await kit.attachUntil(id, 'observer', 'disp-second-joiner', (at) => at.welcome.snapshot.display?.statuses['crtr-live'] !== undefined, 'the second welcome carries both retained keys');
+    const bDisplay = b.welcome.snapshot.display;
+    assert.equal(bDisplay.statuses['crtr-brief'], 'painted while detached');
+    assert.equal(bDisplay.statuses['crtr-live'], 'painted while attached');
+});

package/dist/core/__tests__/full/broker-dormant-wake.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/full/broker-dormant-wake.test.js

@@ -0,0 +1,130 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-dormant-wake.test.ts
+//
+// Full-tier model-less broker coverage: a real model-less boot receives auth and
+// re-drives launch through the broker's login path.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { join } from 'node:path';
+import { readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { createHarness } from '../helpers/harness.js';
+import { createAttachKit } from '../helpers/broker-clients.js';
+let h;
+const kit = createAttachKit(() => h);
+const { attachUntil } = kit;
+before(async () => {
+    h = await createHarness({ headless: true, sessionPrefix: 'crtr-brkdorm' });
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+afterEach(() => {
+    kit.closeAll();
+});
+// The zero-auth test seam: while <CRTR_HOME>/fake-pi.no-auth exists, the fake
+// engine's modelRegistry reports a GENUINE zero-auth boot (nothing registered,
+// nothing authenticated). HOME-global (not per-node-dir) is deliberate — the
+// test arms it BEFORE spawning (race-free vs the broker's boot-time registry
+// read), and DELETING it mid-test flips auth ON, which a reload_auth
+// modelRegistry.refresh() re-reads live. See fake-engine.ts createAgentSessionServices.
+const noAuthSentinel = () => join(h.home, 'fake-pi.no-auth');
+// The node's recorded model (fake-pi.model.json, written by the fake's
+// recordModel) — `null` for a model-less boot. A disk read, so it survives the
+// broker exiting after its kickoff turn idle-releases.
+function model(id) {
+    return JSON.parse(readFileSync(join(h.home, 'nodes', id, 'fake-pi.model.json'), 'utf8'));
+}
+// Every fired lifecycle event lands in fake-pi.events.jsonl. A kickoff turn is a
+// session.prompt → emitTurn, which fires one 'agent_start'; counting them proves
+// whether the deferred kickoff ran. Also a disk read (survives broker exit).
+function agentStartCount(id) {
+    try {
+        return readFileSync(join(h.home, 'nodes', id, 'fake-pi.events.jsonl'), 'utf8')
+            .split('\n')
+            .filter((l) => {
+            try {
+                return JSON.parse(l).event === 'agent_start';
+            }
+            catch {
+                return false;
+            }
+        }).length;
+    }
+    catch {
+        return 0;
+    }
+}
+// ===========================================================================
+// REAL-BOOT (tsx source broker, fake engine). Tier-3 model-less launch + the
+// reload_auth re-drive that resolves a model once auth arrives. These lock the
+// two broker.ts launch-model fixes:
+//   0b (unknown-stub detection) — the real SDK gives a model-less session an
+//      unknown-stub model (never `undefined`); sessionHasNoModel() must treat it
+//      as no-model so the kickoff DEFERS instead of prompting a keyless engine.
+//   0a (self-healing model-less registry) — the construction-time mask that
+//      suppresses the SDK's own findInitialModel MUST reveal() the instant
+//      construction returns, or list_models/cycle_model stay broken forever for
+//      a model-less-booted node even after a /login resolves a model.
+// ===========================================================================
+// login/reload re-drive. Two proofs, ordered to dodge the kickoff-shutdown race:
+//   (0a self-heal, list_models) — the construction-time mask reveal()s the SAME
+//     retained proxy the instant construction returns, so getAvailable() passes
+//     through LIVE. We prove it by flipping auth ON and querying list_models
+//     BEFORE any reload_auth: the broker is still model-less-idle (no turn has
+//     run, so it hasn't idle-released) and definitely alive. With the persistent
+//     mask (reveal() removed) getAvailable()→[] forever, so availableIds stays []
+//     even after the flip — the ONLY assertion here that discriminates the bug.
+//   (re-drive) — reload_auth then re-runs the SAME launch policy against the
+//     now-authenticated registry: a model resolves and the deferred kickoff
+//     fires. Those are disk reads (fake-pi.model.json / .events.jsonl), so they
+//     hold even after the kickoff turn ends and the broker idle-releases — no
+//     dependence on the socket surviving.
+//
+// MODEL CHOICE — the child is pinned to `fake/fake-model`, a NON-managed provider
+// and this is deliberate. The
+// zero-auth sentinel gates the fake registry's find/getAll/getAvailable AND its
+// hasConfiguredAuth, so removing it is a genuine, LIVE auth-on flip for a
+// non-managed model: resolveLaunchModel authenticates a non-managed candidate off
+// hasConfiguredAuth(), which the sentinel controls. A MANAGED pin (anthropic)
+// instead authenticates off subscription-pool OCCUPANCY (readSubscriptionPool),
+// which the fake registry cannot express and which the test process cannot seed —
+// the pool file is `homedir()/.pi/agent/...` frozen at import, and the test
+// process keeps the REAL HOME while the broker runs under the harness's tmpHome,
+// so a seed would land in the wrong file (and pollute real user state). The
+// re-drive mechanism under test (reload_auth re-runs resolveLaunchModel → adopts
+// the model → fires the deferred kickoff) is provider-agnostic; the managed
+// subscription-pool auth path is out of this test's scope (covered by
+// broker-launch-candidates / broker-sdk-wiring). fake/fake-model is a faithful
+// analog: a node pinned to model X boots before X's auth exists, then X's auth
+// arrives and the re-drive resolves X.
+test('login re-drive → list_models self-heals (0a) and reload_auth resolves a model + fires the deferred kickoff', async () => {
+    writeFileSync(noAuthSentinel(), '1');
+    try {
+        const parent = h.spawnRoot('login re-drive parent');
+        const child = await h.spawnHeadlessChild(parent, 'login re-drive', { model: 'fake/fake-model' });
+        assert.equal(model(child), null, 'boots model-less under zero-auth');
+        assert.equal(agentStartCount(child), 0, 'kickoff deferred at boot');
+        const c = await attachUntil(child, 'controller', 'redrive-ctrl', (a) => a.welcome.role === 'controller', 'redrive controller admitted');
+        // A read-op reply is a correlated `data` frame the client swallows into
+        // request()'s by-id resolver (NEVER a generic 'frame'), so we MUST use
+        // client.request(), not send()+waitFrame.
+        // Baseline: under zero-auth the registry reports nothing available.
+        const lm0 = await c.client.request({ type: 'list_models' });
+        assert.ok(lm0.kind === 'list_models' && lm0.availableIds.length === 0, 'zero-auth: no models available');
+        // FLIP AUTH ON, then re-query while the broker is still alive (no turn has run
+        // yet). getAvailable() flows through the revealed construction proxy →
+        // NON-empty. With the mask never revealed it would still be [].
+        rmSync(noAuthSentinel(), { force: true });
+        const lm1 = await c.client.request({ type: 'list_models' });
+        assert.ok(lm1.kind === 'list_models' && lm1.availableIds.length > 0, 'auth on: list_models reports an available model (0a self-heal — the construction mask revealed)');
+        // reload_auth re-drives the launch policy → resolves a model and fires the
+        // deferred kickoff. Disk reads, so they survive the broker idle-releasing
+        // once that kickoff turn ends.
+        c.send({ type: 'reload_auth' });
+        await h.waitFor(() => model(child) !== null, { label: 're-drive selected a model' });
+        await h.waitFor(() => agentStartCount(child) >= 1, { label: 'deferred kickoff fired after re-drive' });
+    }
+    finally {
+        rmSync(noAuthSentinel(), { force: true });
+    }
+});

package/dist/core/__tests__/full/broker-model-changed-broadcast.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/full/broker-model-changed-broadcast.test.js

@@ -0,0 +1,57 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-model-changed-broadcast.test.ts
+//
+// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process,
+// so it lives in full/ (CI), not the fast local loop.
+//
+// BUG-REGRESSION (real, observed 2026-06-11 in `crtr surface attach`): switching the
+// model (/model <provider/id> or the picker) visibly did nothing — the viewer's
+// status bar kept showing the OLD model until some unrelated event happened to
+// arrive.
+//
+// 3-PART HEADER:
+//  (1) BUG IT LOCKS — pi emits no AgentSessionEvent for a model switch, and the
+//      broker's `set_model`/`cycle_model` handlers replied with only a bare ack
+//      to the REQUESTING client. The new model reached no viewer at all: the
+//      broker now broadcasts a `model_changed` frame (mirroring
+//      snapshot.state.model) to every client after the engine accepts the switch.
+//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE — the regression is pure frame-plumbing
+//      on view.sock: a controller `set_model` in, an ack + `model_changed`
+//      fan-out. No tmux pane or TUI is involved, so the lock holds headlessly
+//      (createHeadlessHarness + the fake engine, whose registry stub resolves
+//      any `provider/id` and whose setModel stores what it is handed).
+//  (3) HOW IT FAILS ON REGRESSION — pre-fix, NO `model_changed` frame ever
+//      arrives at either the controller or the observer (both waits time out);
+//      the ack alone still passing would not satisfy the broadcast asserts.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { createAttachKit } from '../helpers/broker-clients.js';
+let h;
+let id;
+const kit = createAttachKit(() => h);
+const { attachUntil } = kit;
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkmodel' });
+    const root = h.spawnRoot('model-changed-broadcast suite root');
+    id = await h.spawnHeadlessChild(root, 'headless worker — model_changed broadcast gate');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+afterEach(() => {
+    kit.closeAll();
+});
+test('set_model acks the requester and broadcasts model_changed to every viewer', async () => {
+    const c = await attachUntil(id, 'controller', 'model-ctrl', (a) => a.welcome.role === 'controller', 'model-ctrl admitted controller');
+    const o = await attachUntil(id, 'observer', 'model-obs', (a) => a.welcome.role === 'observer', 'model-obs admitted observer');
+    c.send({ type: 'set_model', model: 'anthropic/fake-fable' });
+    const ack = await c.waitFrame((f) => f.type === 'ack' && f.for === 'set_model', 'set_model ack');
+    assert.ok(ack.type === 'ack' && ack.ok, 'set_model acked ok');
+    // BOTH the requester and the observer hear the switch. Pre-fix: no
+    // model_changed frame exists, so neither wait ever resolves.
+    const cm = await c.waitFrame((f) => f.type === 'model_changed', 'controller receives model_changed');
+    assert.ok(cm.type === 'model_changed' && cm.model?.id === 'fake-fable', 'controller sees the new model id');
+    const om = await o.waitFrame((f) => f.type === 'model_changed', 'observer receives model_changed');
+    assert.ok(om.type === 'model_changed' && om.model?.id === 'fake-fable', 'observer sees the new model id');
+});

package/dist/core/__tests__/full/broker-navigate-tree-rewelcome.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/full/broker-navigate-tree-rewelcome.test.js

@@ -0,0 +1,80 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-navigate-tree-rewelcome.test.ts
+//
+// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process,
+// so it lives in full/ (CI), not the fast local loop.
+//
+// BUG-REGRESSION (real, observed 2026-06-11 in `crtr surface attach`): double-Esc (or
+// /tree) opened the session-tree picker, but SELECTING an entry visibly did
+// nothing — the viewer stayed on the old transcript instead of traveling back
+// to the chosen point in time.
+//
+// 3-PART HEADER:
+//  (1) BUG IT LOCKS — the broker's `navigate_tree` handler called
+//      session.navigateTree() (which rewinds IN-PLACE: same session file, new
+//      leaf, NO relayed AgentSessionEvent) and then only acked. Unlike the
+//      session-replacing ops (new_session/switch_session/fork → runReplacement
+//      → reWelcomeAll), it never re-snapshotted the viewers, so every attached
+//      client kept rendering the abandoned branch. The navigated-to user
+//      message's `editorText` (pi parity: the tree navigator restores it to the
+//      editor) was dropped on the floor too.
+//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE — the regression is pure frame-plumbing
+//      on view.sock: a controller `navigate_tree` in, a re-`welcome` fan-out +
+//      ack.detail out. No tmux pane or TUI is involved, so the lock holds
+//      headlessly (createHeadlessHarness + the fake engine, whose navigateTree
+//      pops the last accrued turn and returns `rewound-to:<targetId>`).
+//  (3) HOW IT FAILS ON REGRESSION — pre-fix, NO second welcome ever arrives
+//      (the re-welcome waits time out) and the navigate_tree ack carries no
+//      detail; the rewound-history assert (the turn token gone from the new
+//      snapshot) also goes red if the re-welcome serves a stale snapshot.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { createAttachKit, frameHas, tok } from '../helpers/broker-clients.js';
+let h;
+let id;
+const kit = createAttachKit(() => h);
+const { attachUntil } = kit;
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brknav' });
+    const root = h.spawnRoot('navigate-tree-rewelcome suite root');
+    id = await h.spawnHeadlessChild(root, 'headless worker — navigate-tree rewelcome gate');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+afterEach(() => {
+    kit.closeAll();
+});
+const welcomes = (frames) => frames.filter((f) => f.type === 'welcome');
+test('navigate_tree re-welcomes every viewer onto the rewound transcript and acks the editor text', async () => {
+    const c = await attachUntil(id, 'controller', 'nav-ctrl', (a) => a.welcome.role === 'controller', 'nav-ctrl admitted controller');
+    // Accrue one observable turn so the rewind has something to drop.
+    const token = tok('NAV-TURN');
+    c.send({ type: 'prompt', text: token });
+    await c.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'turn relayed before navigate');
+    // The observer attaches AFTER the turn so its first welcome deterministically
+    // holds the token (the pre-navigate baseline) — same accrual trick as G3.
+    const o = await attachUntil(id, 'observer', 'nav-obs', (a) => frameHas(a.welcome, token), 'observer welcome holds the pre-navigate turn');
+    c.send({ type: 'navigate_tree', targetId: 'entry-x' });
+    // The ack carries the navigated-to user message's text in detail (the viewer
+    // restores it to the editor). Pre-fix: ack had no detail.
+    const ack = await c.waitFrame((f) => f.type === 'ack' && f.for === 'navigate_tree', 'navigate_tree ack');
+    assert.ok(ack.type === 'ack' && ack.ok, 'navigate_tree acked ok');
+    assert.equal(ack.type === 'ack' ? ack.detail : undefined, 'rewound-to:entry-x', 'ack.detail carries the rewound-to editor text');
+    // BOTH viewers get re-welcomed onto the rewound history. Pre-fix: no second
+    // welcome ever arrives (navigate_tree only acked).
+    await h.waitFor(() => (welcomes(c.frames).length >= 2 ? true : null), {
+        label: 'controller re-welcomed after navigate_tree',
+    });
+    await h.waitFor(() => (welcomes(o.frames).length >= 2 ? true : null), {
+        label: 'observer re-welcomed after navigate_tree',
+    });
+    // The re-welcome serves the REWOUND transcript: the fake's navigateTree popped
+    // the last accrued turn, so the token present in the observer's first welcome
+    // must be gone from its second.
+    const [first, second] = welcomes(o.frames);
+    assert.ok(frameHas(first, token), 'pre-navigate welcome holds the turn');
+    assert.ok(!frameHas(second, token), 're-welcome serves the rewound transcript (turn dropped)');
+    assert.equal(second.snapshot.messages.length, first.snapshot.messages.length - 2, 're-welcome history is exactly one turn shorter (a turn = user + assistant = 2 tree messages)');
+});

package/dist/core/__tests__/full/broker-pane-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};