@north-light/crouter 0.3.157 → 0.3.158

package/dist/clients/web/web-client/shared/protocol.d.ts

@@ -78,10 +78,10 @@ export interface SessionStatsSummary {
     assistant_messages: number;
     cost?: number;
 }
-/** Viewer/controller presence for a node. */
+/** Viewer presence for a node — a truthful count of attached views. There is
+ *  no owner: every live interactive view is writable at the same time. */
 export interface Presence {
     viewers: number;
-    controller: string | null;
 }
 /** Git working-tree change counts for the meta strip. */
 export interface GitStatus {
@@ -276,7 +276,9 @@ export interface ResolveDeckResponse {
  * `isStreaming` (spec C.10).
  */
 export type SessionState = RpcSessionState;
-/** Web role of one browser tab's session connection. */
+/** Fixed capability of one browser tab's session connection, stated by the
+ *  broker's `welcome`: `controller` is writable, `observer` is read-only. It is
+ *  a per-client capability, never ownership of a shared slot. */
 export type WebRole = 'observer' | 'controller';
 /** Upstream broker connectivity, surfaced to the tab (spec §6.2). */
 export type BrokerStatus = 'connected' | 'reconnecting' | 'down' | 'revived';

package/dist/commands/node.js

@@ -808,7 +808,7 @@ const nodeBashBackground = defineLeaf({
             { name: 'jobs', type: 'object[]', required: true, constraint: 'Per handed-off job {job_id, elapsed_ms} — the foreground elapsed time in milliseconds at the moment of handoff.' },
         ],
         outputKind: 'object',
-        effects: ['Signals every foreground bash command currently running for the node to return from its tool call immediately while its detached supervisor keeps the command running.', 'Each handed-off command retains its log under the node context jobs directory and sends the node an inbox message when it exits.'],
+        effects: ['Signals every foreground bash command currently running for the node to return from its tool call immediately while its detached supervisor keeps the command running.', 'Each handed-off command retains its log under the node context jobs directory and sends the node an urgent inbox message when it exits, which steers the node mid-turn.'],
     },
     run: async (input) => {
         const pane = input['pane'] ?? process.env['TMUX_PANE'];

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -240,16 +240,16 @@ test('C3h — a cooling managed launch target boots model-less rather than falli
 // `<project_context>` block is environment-only. Covered by
 // context-intro.test.ts's environment-only regression.)
 // ===========================================================================
-// C2 — zero-viewer dialogs resolve to deny/cancel IMMEDIATELY (noOp), never
+// C2 — zero-writable dialogs resolve to deny/cancel IMMEDIATELY (noOp), never
 // hanging the turn and never waiting on a per-dialog timeout. Drives the REAL
 // makeBrokerUiContext (the exact ExtensionUIContext the SDK hands extensions),
-// with a controller() that reports zero viewers.
+// with a writable() snapshot that reports zero writable viewers.
 // ===========================================================================
-test('C2 — zero-viewer UI context resolves dialogs to deny/cancel immediately (noOp, no hang)', async () => {
+test('C2 — zero-writable UI context resolves dialogs to deny/cancel immediately (noOp, no hang)', async () => {
     const ctx = makeBrokerUiContext({
-        controller: () => null, // ZERO viewers attached
+        writable: () => [], // ZERO writable viewers attached
         forward: () => {
-            throw new Error('C2: must NOT forward a dialog when no controller is attached');
+            throw new Error('C2: must NOT forward a dialog when no writable viewer is attached');
         },
         pending: new Map(),
         broadcast: () => { },
@@ -274,7 +274,7 @@ test('C2 — zero-viewer UI context resolves dialogs to deny/cancel immediately
 test('broker UI exposes the live provider pin policy to package extensions', () => {
     let pinned = false;
     const ctx = makeBrokerUiContext({
-        controller: () => null,
+        writable: () => [],
         forward: () => { },
         pending: new Map(),
         broadcast: () => { },
@@ -291,36 +291,36 @@ test('broker UI exposes the live provider pin policy to package extensions', ()
 });
 // ===========================================================================
 // M2 (review mq5wkqep / T4) — REPLACES the Wave-0 M-1 cancel-on-detach. A dialog
-// forwarded to a controller that then DETACHES must NOT be cancelled: it stays
-// pending so a brief detach/reattach (or a handoff to another controller) does
-// not lose an answerable dialog. The broker-side default timeout is the ONLY
+// forwarded to a writable viewer that then DETACHES must NOT be cancelled: it
+// stays pending so a brief detach/reattach (or another writable viewer joining)
+// does not lose an answerable dialog. The broker-side default timeout is the ONLY
 // non-answer resolution (proven here with a short per-dialog timeout standing in
 // for the 120s default). Guards against regressing to the over-eager cancel.
 // ===========================================================================
-test('M2 — a forwarded dialog stays pending on controller detach, resolving only on the broker-side timeout', async () => {
+test('M2 — a forwarded dialog stays pending when its writable viewer detaches, resolving only on the broker-side timeout', async () => {
     const pending = new Map();
     let attached = true;
     const ctx = makeBrokerUiContext({
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        controller: () => (attached ? { id: 'c1' } : null),
+        writable: () => (attached ? [{ id: 'c1' }] : []),
         forward: () => {
-            /* a real controller would receive the request over its socket */
+            /* a real writable viewer would receive the request over its socket */
         },
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         pending: pending,
         broadcast: () => { },
     });
-    // Controller attached → confirm() forwards + registers a pending dialog (with the
-    // request retained for welcome.pending_dialog / re-route, T4) and does NOT
-    // resolve yet. A short per-dialog timeout stands in for the 120s broker default.
+    // A writable viewer attached → confirm() forwards + registers a pending dialog
+    // (with the request retained for welcome.pending_dialog / replay, T4) and does
+    // NOT resolve yet. A short per-dialog timeout stands in for the 120s broker default.
     const p = ctx.confirm('proceed?', 'really?', { timeout: 80 });
-    assert.equal(pending.size, 1, 'M2: a forwarded dialog is pending while a controller is attached');
+    assert.equal(pending.size, 1, 'M2: a forwarded dialog is pending while a writable viewer is attached');
     const entry = [...pending.values()][0];
     assert.ok(entry.request, 'M2: the pending entry retains the request (welcome/re-route need it)');
     assert.equal(entry.cancel, undefined, 'M2: there is no cancel-on-detach path anymore');
-    // Controller detaches → the dialog STAYS pending (the broker no longer cancels it).
+    // The writable viewer detaches → the dialog STAYS pending (the broker no longer cancels it).
     attached = false;
-    assert.equal(pending.size, 1, 'M2: detach does NOT cancel the in-flight dialog');
+    assert.equal(pending.size, 1, 'M2: writable-viewer detach does NOT cancel the in-flight dialog');
     // Only the broker-side timeout resolves it, to the SAFE default (deny).
     const resolved = await Promise.race([
         p,

package/dist/core/__tests__/chat-view-reconnect.test.js

@@ -41,23 +41,16 @@ test('local invalid/no-node stream failures close asynchronously after the chann
         assert.equal(events[1]?.startsWith('close:'), true, `${target}: follows with streamClose`);
     }
 });
-test('control_changed demotion updates reconnect intent without clobbering an explicit controller request', () => {
-    let current = {
-        target: 'n1',
-        desiredRole: 'controller',
-        channel: null,
-        clientId: 'client-1',
-        conn: 'open',
-        role: 'controller',
-        controllerId: 'client-1',
-        session: null,
-        transcript: [],
-        draft: '',
-        notices: [],
-        pendingDialog: null,
-        queued: [],
-        contextTokens: undefined,
-    };
+test('reconnect keeps the requested role while welcome and read_only remain authoritative', () => {
+    let current = core.init({ target: 'n1', role: 'controller' });
+    const sent = [];
+    const requestedRoles = [];
+    const closed = [];
+    const channels = [
+        { id: 'first-channel', send(frame) { sent.push(frame); }, close() { closed.push('first-channel'); } },
+        { id: 'replacement-channel', send(frame) { sent.push(frame); }, close() { closed.push('replacement-channel'); } },
+    ];
+    let nextChannel = 0;
     const ctx = {
         get state() {
             return current;
@@ -65,6 +58,13 @@ test('control_changed demotion updates reconnect intent without clobbering an ex
         set(next) {
             current = typeof next === 'function' ? next(current) : next;
         },
+        connect(_stream, opts) {
+            requestedRoles.push(opts.role);
+            return channels[nextChannel++];
+        },
+        dispatch(intent) {
+            return core.intents[intent](ctx);
+        },
         signal: {
             clearBanner() { },
             setBanner() { },
@@ -74,11 +74,32 @@ test('control_changed demotion updates reconnect intent without clobbering an ex
             quit() { },
         },
     };
-    core.intents.streamFrame(ctx, { type: 'control_changed', controller_id: 'other-client' });
-    assert.equal(current.role, 'observer');
-    assert.equal(current.desiredRole, 'observer');
-    current = { ...current, role: 'observer', desiredRole: 'controller' };
-    core.intents.streamFrame(ctx, { type: 'control_changed', controller_id: 'other-client' });
-    assert.equal(current.role, 'observer');
+    core.intents.refresh(ctx);
+    const firstChannel = current.channel;
+    assert.equal(current.desiredRole, 'controller');
+    assert.equal(current.conn, 'connecting');
+    assert.deepEqual(requestedRoles, ['controller']);
+    core.intents.streamOpen(ctx, firstChannel);
+    core.intents.streamFrame(ctx, { type: 'welcome', role: 'controller', snapshot: { state: {}, messages: [] } });
+    assert.equal(current.role, 'controller');
+    assert.equal(current.conn, 'open');
+    core.intents.reconnect(ctx);
+    assert.deepEqual(closed, ['first-channel']);
     assert.equal(current.desiredRole, 'controller');
+    assert.equal(current.channel?.id, 'replacement-channel');
+    assert.deepEqual(requestedRoles, ['controller', 'controller']);
+    const replacementChannel = current.channel;
+    core.intents.streamOpen(ctx, replacementChannel);
+    core.intents.streamFrame(ctx, { type: 'welcome', role: 'observer', snapshot: { state: {}, messages: [] } });
+    assert.equal(current.role, 'observer', 'welcome.role is authoritative for the active connection');
+    assert.equal(current.desiredRole, 'controller', 'the requested controller role survives reconnect');
+    assert.equal(current.conn, 'open');
+    core.intents.streamClose(ctx, { channelId: 'first-channel', reason: 'closed' });
+    assert.equal(current.channel, replacementChannel, 'a stale close cannot clear the replacement channel');
+    assert.equal(current.conn, 'open');
+    core.intents.streamFrame(ctx, { type: 'error', code: 'read_only' });
+    core.intents.setDraft(ctx, 'hello');
+    core.intents.submitDraft(ctx);
+    assert.deepEqual(sent, [], 'read-only welcome state prevents writes');
+    assert.match(current.notices.at(-1).text, /read-only — sending is disabled/);
 });

package/dist/core/__tests__/full/broker-attach-limits.test.js

@@ -3,27 +3,32 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
 // (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
 //
-// T8 — the `crtr surface attach` acceptance gate for G4/G7/G8: controller
-// arbitration, decoder overflow isolation, and backpressure shedding.
+// T8 — the `crtr surface attach` acceptance gate for G4/G7/G8: multi-writer
+// admission, decoder overflow isolation, and backpressure shedding.
 //
 // 3-PART HEADER (headless):
-//  (1) CONTRACT — the first client is the controller and a second client is an
-//      admitted read-only observer; observer prompts are rejected while both
-//      clients receive relay frames (G4). An oversized client line is capped and
-//      dropped with frame_overflow while the broker and other clients continue
-//      operating (G7). A stalled non-reading viewer is shed at the 32 MiB
-//      backpressure HWM while the broker and fast viewers remain unaffected (G8).
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — arbitration, decoder limits, and
-//      the backpressure HWM are broker-process and view.sock contracts. They are
-//      exercised over a pure Unix socket using the production ViewSocketClient and
-//      raw node:net peers, with a real broker process and no tmux pane or window.
+//  (1) CONTRACT — every client that hellos as `controller` is welcomed writable,
+//      simultaneously and independently; each writable client may submit, and
+//      every connected client (both writers plus a read-only observer) receives
+//      the merged stream of both submissions, while a client that hellos as
+//      `observer` is rejected with error{read_only} when it tries to drive (G4).
+//      An oversized client line is capped and dropped with frame_overflow while
+//      the broker and other clients continue operating (G7). A stalled
+//      non-reading viewer is shed at the 32 MiB backpressure HWM while the
+//      broker and fast viewers remain unaffected (G8).
+//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — role admission, decoder limits,
+//      and the backpressure HWM are broker-process and view.sock contracts. They
+//      are exercised over a pure Unix socket using the production ViewSocketClient
+//      and raw node:net peers, with a real broker process and no tmux pane or
+//      window.
 //  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the real socket responses
-//      provide the G4 welcome roles and relay frames, the G7 frame-overflow drop
-//      and broker survival, and the G8 HWM-shed log line and broker survival.
+//      provide the G4 welcome roles, per-writer relay frames and the read-only
+//      rejection, the G7 frame-overflow drop and broker survival, and the G8
+//      HWM-shed log line and broker survival.
 //
-// One shared broker is booted in before() and reused across all three gates. Gates
-// whose first attach must hold control use attachUntil(controller) so a prior gate's
-// controller-detach handoff settles deterministically before they drive.
+// One shared broker is booted in before() and reused across all three gates. There
+// is no writer slot to hand off, so every gate simply attaches at the role it
+// wants.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -32,9 +37,7 @@ import { createAttachKit, delay, tok, frameHas, brokerLogText, } from '../helper
 let h;
 let id; // ONE shared broker, reused across G4/G7/G8 (1 real boot, not 3)
 const kit = createAttachKit(() => h);
-const { attach, attachUntil, connectRaw } = kit;
-// Admit a controller, waiting out any prior gate's controller-detach handoff.
-const ctrl = (cid) => attachUntil(id, 'controller', cid, (a) => a.welcome.role === 'controller', `${cid} admitted controller`);
+const { attach, connectRaw } = kit;
 before(async () => {
     h = await createHeadlessHarness({ sessionPrefix: 'crtr-brklim' });
     const root = h.spawnRoot('broker-attach-limits suite root');
@@ -49,23 +52,44 @@ afterEach(() => {
 });
 const brokerPid = () => h.node(id).pi_pid;
 // ---------------------------------------------------------------------------
-// G4 — arbitration + observer read. Guards: 2nd client is admitted observer, an
-// observer prompt is rejected not_controller, BOTH clients receive the relay.
-// Failure mode: two controllers, or an observer driving the engine, or fan-out
-// that misses a viewer.
+// G4 — multi-writer admission + read-only gating. Guards: two simultaneous
+// `controller` hellos are BOTH welcomed writable, each one's own submission
+// reaches the engine, and every connected client sees BOTH turns; an explicit
+// observer that tries to drive is rejected with error{read_only}.
+// Failure mode: a singleton writer slot demoting the second client, a writer
+// whose prompt is silently dropped, fan-out that misses a viewer, or a
+// read-only client that can drive the engine.
 // ---------------------------------------------------------------------------
-test('G4 — second client is observer; observer prompt → error{not_controller}; both receive the stream', async () => {
-    const c1 = await ctrl('g4-ctrl');
-    assert.equal(c1.welcome.role, 'controller', 'first client holds control');
-    const c2 = await attach(id, 'controller', 'g4-second'); // requests control; held → observer
-    assert.equal(c2.welcome.role, 'observer', 'second client is admitted read-only observer (first-attach-wins)');
-    c2.send({ type: 'prompt', text: 'observer must not drive' });
-    const err = await c2.waitFrame((f) => f.type === 'error', 'G4 observer prompt rejected');
-    assert.equal(err.code, 'not_controller', 'G4: observer prompt → error{not_controller}');
-    const token = tok('G4-BROADCAST');
-    c1.send({ type: 'prompt', text: token });
-    await c1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G4 controller received the stream');
-    await c2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G4 observer ALSO received the stream');
+test('G4 — two simultaneous clients are both welcomed controller, each submits, and both see both turns; an observer drive → error{read_only}', async () => {
+    const [w1, w2] = await Promise.all([
+        attach(id, 'controller', 'g4-writer-1'),
+        attach(id, 'controller', 'g4-writer-2'),
+    ]);
+    assert.equal(w1.welcome.role, 'controller', 'first client is welcomed writable');
+    assert.equal(w2.welcome.role, 'controller', 'second SIMULTANEOUS client is ALSO welcomed writable (no singleton slot)');
+    const observer = await attach(id, 'observer', 'g4-observer');
+    assert.equal(observer.welcome.role, 'observer', 'an explicit observer hello stays read-only');
+    // A read-only client may not drive the engine — the role is per-client and
+    // fixed by its own hello, so this rejection is independent of who else is
+    // attached.
+    observer.send({ type: 'prompt', text: 'a read-only client must not drive' });
+    const err = await observer.waitFrame((f) => f.type === 'error', 'G4 observer prompt rejected');
+    assert.equal(err.code, 'read_only', 'G4: observer prompt → error{read_only}');
+    // Each writer submits its OWN token. Submissions are sequenced (a prompt sent
+    // mid-stream routes as a steer and produces no second turn), so each turn is
+    // driven to its terminal agent_end before the next writer submits.
+    const tokenA = tok('G4-WRITER-1');
+    w1.send({ type: 'prompt', text: tokenA });
+    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 1 saw its own turn');
+    const tokenB = tok('G4-WRITER-2');
+    w2.send({ type: 'prompt', text: tokenB });
+    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 2 saw its own turn');
+    // The merged stream: EVERY connected client — both writers and the read-only
+    // observer — receives BOTH writers' turns.
+    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 2 ALSO received writer 1 turn');
+    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 1 ALSO received writer 2 turn');
+    await observer.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 observer received writer 1 turn');
+    await observer.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 observer received writer 2 turn');
 });
 // ---------------------------------------------------------------------------
 // G7 — decoder overflow (guards C5 OOM). A client line over BROKER_READ_CAPS is

package/dist/core/__tests__/full/broker-attach-stream.test.js

@@ -32,9 +32,9 @@
 // The engine is hosted IN-PROCESS by the broker, so engine pid == broker pid ==
 // node.pi_pid == boot.pid; "engine pid unchanged" == broker pid unchanged + no new
 // boot. ONE shared broker is booted in before() and reused across all three gates
-// (each just attaches fresh clients) — 1 real boot total, not 3. A gate whose
-// first attach must hold control uses attachUntil(controller) so the prior gate's
-// controller-detach handoff settles deterministically before it drives.
+// (each just attaches fresh clients) — 1 real boot total, not 3. Each gate attaches
+// a fresh writable client; afterEach closes prior sockets before the next gate begins,
+// and each client's role remains fixed for its socket.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -44,7 +44,7 @@ let h;
 let id; // ONE shared broker, reused across G1/G1b/G2 (1 real boot, not 3)
 const kit = createAttachKit(() => h);
 const { attach, attachUntil } = kit;
-// Admit a controller, waiting out any prior gate's controller-detach handoff.
+// Attach a writable client for the gate; its role remains fixed for this socket.
 const ctrl = (cid) => attachUntil(id, 'controller', cid, (a) => a.welcome.role === 'controller', `${cid} admitted controller`);
 before(async () => {
     h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkstrm' });

package/dist/core/__tests__/full/broker-dialogs.test.js

@@ -3,31 +3,35 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
 // (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
 //
-// Broker dialog handling — the T8 attach gates G5/G5b/G6 cover retained answers,
-// controller handoff, and attended-dialog timeout behavior.
+// Broker dialog handling under MULTI-WRITER attachments — the T8 attach gates
+// G5/G5b/G6 cover fan-out + first-response settlement, mid-dialog attach replay,
+// and attended-dialog timeout behavior.
 //
 // 3-PART HEADER (headless):
-//  (1) CONTRACT — a controller receives a blocking dialog as
-//      extension_ui_request, and extension_ui_response unblocks the engine with
-//      the controller's answer rather than the default (G5). A dialog raised under
-//      one controller remains pending through its detach and reaches the next
-//      controller through welcome.pending_dialog (G5b). An attended dialog that is
-//      not answered resolves on the short per-dialog timeout with the default answer
-//      and a correlated extension_ui_dismiss (G6).
+//  (1) CONTRACT — every client whose `hello` claimed the writable role is fanned a
+//      blocking dialog as extension_ui_request; the FIRST extension_ui_response
+//      settles it with that answer (not the default), every fanned client receives
+//      the correlated extension_ui_dismiss, and a later peer response for the same
+//      id is a silent no-op (G5). A dialog stays pending through a peer's detach and
+//      is handed to any writable client attaching mid-dialog via
+//      welcome.pending_dialog; observers never receive an answerable dialog (G5b).
+//      An attended dialog nobody answers resolves on the short per-dialog timeout
+//      with the default answer and a correlated dismiss to EVERY writable peer (G6).
 //  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the dialog round-trip is an async
-//      promise inside makeBrokerUiContext, forwarded and answered over view.sock to
+//      promise inside makeBrokerUiContext, fanned out and answered over view.sock to
 //      the production ViewSocketClient. The real broker process provides the
 //      uiContext and timeout machinery without a tmux pane, window, or pi-session
 //      read.
 //  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the fake engine raises real
-//      confirm() dialogs through the broker, and the tests assert on controller
-//      frames plus the value and latency recorded in fake-pi.dialog.jsonl.
+//      confirm() dialogs through the broker, and the tests assert on the frames of
+//      several concurrently attached clients plus the value and latency recorded in
+//      fake-pi.dialog.jsonl.
 //
 // One shared broker is booted in before() and reused across all three gates. Because
 // fake-pi.dialog.jsonl is append-only across the shared broker, each gate snapshots
-// the count before it drives (`base`) and asserts on its newly appended entry. Gates
-// whose first attach must hold control use attachUntil(controller) to settle a prior
-// gate's controller-detach handoff.
+// the count before it drives (`base`) and asserts on its newly appended entry. Role
+// is fixed by `hello` and never reassigned, so every writable attach is a plain
+// attach — there is no control handoff to wait out.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -36,9 +40,29 @@ import { createAttachKit } from '../helpers/broker-clients.js';
 let h;
 let id; // ONE shared broker, reused across G5/G5b/G6 (1 real boot, not 3)
 const kit = createAttachKit(() => h);
-const { attachUntil } = kit;
-// Admit a controller, waiting out any prior gate's controller-detach handoff.
-const ctrl = (cid) => attachUntil(id, 'controller', cid, (a) => a.welcome.role === 'controller', `${cid} admitted controller`);
+const { attach, attachUntil } = kit;
+// Attach a writable client. Every `hello` claiming `controller` is admitted
+// writable — attaching a peer never demotes an already-attached one.
+const writer = async (cid) => {
+    const a = await attach(id, 'controller', cid);
+    assert.equal(a.welcome.role, 'controller', `${cid}: admitted writable, not demoted by an existing peer`);
+    return a;
+};
+const observer = async (cid) => {
+    const a = await attach(id, 'observer', cid);
+    assert.equal(a.welcome.role, 'observer', `${cid}: an observer hello stays read-only`);
+    return a;
+};
+// The broker handles one client's frames in order, so an `ack` for a get_commands
+// sent AFTER some other frame proves that earlier frame was already processed.
+// Used to make "a late peer answer changed nothing" a deterministic assertion
+// instead of a sleep.
+const barrier = async (c, label) => {
+    c.send({ type: 'get_commands' });
+    await c.waitFrame((f) => f.type === 'ack' && f.for === 'get_commands', label);
+};
+const isRequest = (f) => f.type === 'extension_ui_request';
+const dismissFor = (reqId) => (f) => f.type === 'extension_ui_dismiss' && f.id === reqId;
 // dialog.jsonl is append-only across the shared broker — snapshot the count, then
 // wait for AT LEAST `want` new entries and return the full (cumulative) array.
 const dialogCount = () => h.dialogResults(id).length;
@@ -57,65 +81,100 @@ afterEach(() => {
 });
 const brokerPid = () => h.node(id).pi_pid;
 // ---------------------------------------------------------------------------
-// G5 — dialog forward + answer. Guards: a blocking dialog reaches the controller
-// as extension_ui_request and the controller's extension_ui_response unblocks the
-// engine with ITS answer (not the default). Failure mode: a dialog the controller
-// can't see/answer (silent deadlock).
+// G5 — fan-out + first-response settlement. Guards: ONE blocking dialog reaches
+// EVERY writable client (never a single owner), the first answer unblocks the
+// engine with ITS value (not the default), every fanned client gets the correlated
+// extension_ui_dismiss, and a peer answering afterwards is a no-op. Failure modes:
+// a dialog only one viewer can see (the others sit blind), peers left holding an
+// overlay nothing can answer, or a late peer answer re-settling a dead dialog.
 // ---------------------------------------------------------------------------
-test('G5 — controller receives an extension_ui_request, answers it, and the engine proceeds with that answer', async () => {
+test('G5 — one dialog fans out to both writable clients, the first response settles it, both are dismissed, and a late peer response is a no-op', async () => {
     const base = dialogCount();
-    const c = await ctrl('g5-ctrl');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: the controller answers first
-    const req = await c.waitFrame((f) => f.type === 'extension_ui_request', 'G5 dialog forwarded to controller');
-    assert.equal(req.method, 'confirm', 'G5: the forwarded dialog is the confirm() the engine raised');
-    const reqId = req.id;
-    c.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    const results = await awaitDialogs(base + 1, 'G5 dialog resolved by the controller');
-    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the controller answer (true), not the default (false)');
+    const a = await writer('g5-A');
+    const b = await writer('g5-B');
+    const obs = await observer('g5-obs'); // must never be fanned an answerable dialog
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 20_000 }); // generous: a writable client answers first
+    const reqA = await a.waitFrame(isRequest, 'G5 dialog fanned out to writable A');
+    const reqB = await b.waitFrame(isRequest, 'G5 dialog fanned out to writable B');
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G5: both writable clients were fanned the SAME dialog id, not two dialogs');
+    assert.equal(reqA.method, 'confirm', 'G5: the fanned dialog is the confirm() the engine raised');
+    // A answers first — the engine must proceed with A's true, not the false default.
+    a.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
+    await a.waitFrame(dismissFor(reqId), 'G5 answerer A receives the correlated dismiss');
+    await b.waitFrame(dismissFor(reqId), 'G5 peer B receives the correlated dismiss for the dialog it never answered');
+    const results = await awaitDialogs(base + 1, 'G5 dialog settled by the first response');
+    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the first answer (true), not the default (false)');
+    // The observer was attached the whole time: it saw the broadcast dismiss but was
+    // never handed the answerable request.
+    await obs.waitFrame(dismissFor(reqId), 'G5 observer sees the broadcast dismiss (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5: an observer is never fanned an answerable dialog');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5: an observer welcome never carries a pending dialog');
+    // B answers the already-settled dialog. The broker deleted the entry on the first
+    // response, so this finds nothing and is a silent no-op: no second engine
+    // resolution, and the recorded answer stays A's.
+    b.send({ type: 'extension_ui_response', id: reqId, confirmed: false });
+    await barrier(b, 'G5 broker processed B late response (ordered ack)');
+    const settled = h.dialogResults(id);
+    assert.equal(settled.length, base + 1, 'G5: the late peer response resolved nothing — no second dialog entry');
+    assert.equal(settled[base].resolved, true, "G5: the late peer response did not overwrite the first answerer's value");
+    assert.equal(isPidAlive(brokerPid()), true, 'G5: the late no-op response did not fault the broker');
 });
 // ---------------------------------------------------------------------------
-// G5 (mid-dialog attach) — Guards: a dialog raised under a prior controller stays
-// pending across that controller's detach (M2) and is delivered to whoever takes
-// control next via welcome.pending_dialog. Failure mode: a pending dialog lost on
-// controller handoff.
+// G5b (mid-dialog attach) — Guards: a pending dialog survives a writable peer's
+// detach (M2) and is handed to a writable client that attaches MID-dialog via
+// welcome.pending_dialog, which makes it a full peer in the race to answer. An
+// observer attaching mid-dialog gets nothing answerable. Failure modes: a pending
+// dialog lost when the raising viewer detaches, a late-joining writable viewer
+// blind to an in-flight dialog, or an observer handed one it cannot answer.
 // ---------------------------------------------------------------------------
-test('G5 — a controller attaching MID-dialog receives the pending dialog via welcome.pending_dialog', async () => {
+test('G5b — a writable client attaching MID-dialog receives the pending dialog; an observer does not', async () => {
     const base = dialogCount();
-    const a = await ctrl('g5b-A');
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the handoff
-    const reqA = await a.waitFrame((f) => f.type === 'extension_ui_request', 'G5b dialog forwarded to controller A');
+    const a = await writer('g5b-A');
+    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // stays pending long enough for the late attach
+    const reqA = await a.waitFrame(isRequest, 'G5b dialog fanned out to writable A');
     const reqId = reqA.id;
     a.send({ type: 'bye' });
-    a.close(); // M2: detach frees control but does NOT cancel the pending dialog
-    // Controller B takes control (retry covers the close→controllerId=null beat) and
-    // its welcome carries the still-pending dialog.
-    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b controller B takes control with the pending dialog');
-    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised under A');
+    a.close(); // M2: a writable peer detaching does NOT cancel the pending dialog
+    // An observer attaching mid-dialog is never handed it.
+    const obs = await observer('g5b-obs');
+    assert.equal(obs.welcome.pending_dialog, null, 'G5b: an observer attaching mid-dialog gets no pending dialog');
+    // A writable client attaching mid-dialog IS handed it (retry covers the beat
+    // between the raise and this attach) and can settle it.
+    const b = await attachUntil(id, 'controller', 'g5b-B', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5b writable B attaches mid-dialog and is handed the pending dialog');
+    assert.equal(b.welcome.pending_dialog.id, reqId, 'G5b: welcome.pending_dialog is the same dialog raised while A was attached');
     assert.equal(b.welcome.pending_dialog.method, 'confirm', 'G5b: the pending dialog is the confirm()');
     b.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    const results = await awaitDialogs(base + 1, 'G5b dialog resolved by controller B');
-    assert.equal(results[base].resolved, true, 'G5b: controller B answered the handed-off dialog and the engine proceeded');
+    const results = await awaitDialogs(base + 1, 'G5b dialog settled by the mid-dialog joiner');
+    assert.equal(results[base].resolved, true, 'G5b: the mid-dialog joiner answered and the engine proceeded');
+    await obs.waitFrame(dismissFor(reqId), 'G5b dismiss broadcast follows the settlement (ordering barrier)');
+    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5b: the observer was never fanned the dialog it saw dismissed');
 });
 // ---------------------------------------------------------------------------
-// G6 — anti-deadlock. An ATTENDED dialog the controller never answers resolves on
-// a SHORT per-dialog broker timeout. Guards: the engine never hangs on a dialog
-// with no answerer. Failure mode: a forever-blocked turn.
+// G6 — anti-deadlock. An ATTENDED dialog NO writable client answers resolves on a
+// SHORT per-dialog broker timeout, and every fanned peer is dismissed by id.
+// Guards: the engine never hangs on a dialog whose viewers all stay silent.
+// Failure mode: a forever-blocked turn, or overlays left up on every viewer.
 // ---------------------------------------------------------------------------
-test('G6 — an unanswered attended dialog resolves on the broker timeout', async () => {
+test('G6 — an attended dialog no writable client answers resolves on the broker timeout and dismisses every peer', async () => {
     const pid = brokerPid();
     const base = dialogCount();
-    // A controller attached but silent → the broker resolves on the SHORT explicit
-    // per-dialog timeout (800ms), never the 120s default. On timeout the broker also
-    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so the
-    // controller's overlay (which has no independent timer) is torn down by id.
-    const c = await ctrl('g6-ctrl');
+    // Two writable clients attached but silent → the broker resolves on the SHORT
+    // explicit per-dialog timeout (800ms), never the 120s default. On timeout it
+    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so
+    // EVERY peer's overlay (none has an independent timer) is torn down by id.
+    const a = await writer('g6-A');
+    const b = await writer('g6-B');
     h.fakeCmd(id, { cmd: 'dialog', timeout: 800 });
-    const req = await c.waitFrame((f) => f.type === 'extension_ui_request', 'G6b dialog forwarded to controller'); // received, deliberately NOT answered
-    const reqId = req.id;
-    const dismiss = await c.waitFrame((f) => f.type === 'extension_ui_dismiss' && f.id === reqId, 'G6b broker emits a correlated extension_ui_dismiss on timeout');
-    assert.equal(dismiss.id, reqId, 'G6b: the dismiss frame carries the timed-out dialog id, not another');
-    const results = await awaitDialogs(base + 1, 'G6b attended dialog resolved on timeout');
-    assert.equal(results[base].resolved, false, 'G6b: an unanswered attended dialog resolves to the default (deny)');
-    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6b: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
+    const reqA = await a.waitFrame(isRequest, 'G6 dialog fanned out to writable A'); // received, deliberately NOT answered
+    const reqB = await b.waitFrame(isRequest, 'G6 dialog fanned out to writable B'); // received, deliberately NOT answered
+    const reqId = reqA.id;
+    assert.equal(reqB.id, reqId, 'G6: both silent peers hold the SAME dialog id');
+    const dismissA = await a.waitFrame(dismissFor(reqId), 'G6 broker emits a correlated dismiss to A on timeout');
+    await b.waitFrame(dismissFor(reqId), 'G6 broker emits the same correlated dismiss to peer B');
+    assert.equal(dismissA.id, reqId, 'G6: the dismiss frame carries the timed-out dialog id, not another');
+    const results = await awaitDialogs(base + 1, 'G6 attended dialog resolved on timeout');
+    assert.equal(results[base].resolved, false, 'G6: a dialog no writable client answered resolves to the default (deny)');
+    assert.ok(results[base].ms >= 600 && results[base].ms < 5000, `G6: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${results[base].ms}ms`);
     assert.equal(isPidAlive(pid), true, 'G6: the engine made forward progress (still alive)');
 });