@north-light/crouter 0.3.170 → 0.3.172

package/dist/core/runtime/broker.js

@@ -32,6 +32,8 @@ import { operationIdContext } from '../events/operation-id.js';
 import { findMissingPackagePaths } from './package-health.js';
 import { SessionListCache } from './session-list-cache.js';
 import { getNode, updateNode } from '../canvas/index.js';
+import { readConfig } from '../config.js';
+import { atomicWriteJson, readJsonIfExists } from '../fs-utils.js';
 import { buildRefInventory } from '../memory/inline-ref-inventory.js';
 import { buildGuidance } from '../memory/inline-ref-guidance.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
@@ -44,16 +46,33 @@ import { PoolCredentialStore } from '../pool-credential-store.js';
 import { clearFault, isModelNotFoundError, isProviderUnconfiguredError, readFault, recordFault, recordFaultForCurrentNode } from './fault.js';
 import { clearCleanAbort, markBusy, markCleanAbort } from './busy.js';
 import { extractCoolingDeadline } from './managed-provider-cooling.js';
-import { AUTH_FAULT_RECOVERY_BODY, CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY } from './fault-recovery-nudge.js';
+import { AUTH_FAULT_RECOVERY_BODY, CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY, formatModelFallbackRecovery, generatedContextText, } from '../../shared/generated-context.js';
+import { assistantVisibleText, isTrueUserMessage, normalizeToolGroupSummaryRecord, } from '../../shared/tool-groups.js';
+import { headlessToolGroupSummary, serializeToolGroup } from './tool-group-summary.js';
 import { markFatalOnExhaust, nextFaultRetry, policyFor } from './fault-recovery.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
-import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages } from './session-cycles.js';
+import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages, withoutYieldAbort } from './session-cycles.js';
+import { boundaryRootedTree, REVIEW_BOUNDARY_CUSTOM_TYPE, visibleMessages } from './session-visibility.js';
 import { BUILTIN_SLASH_COMMANDS, piSessionsRoot } from './pi-vendored.js';
 import { StreamWatchdog, resolveStreamWatchdogMs, releaseKnownStreamWait, KNOWN_STREAM_WAIT_UI } from './stream-watchdog.js';
 import { isDeterministicCommandExpansion } from './command-expansion.js';
+import { DEFAULT_WORKING_ACTIVITY, randomWorkingActivity } from '../../shared/working-activity.js';
 import { isManagedProvider, readSubscriptionPool, resolveProviderCandidates } from '../subscription-state.js';
-import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../model-routes.js';
+import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability, selectInitialModelRoute } from '../model-routes.js';
 import { encodeFrame, FrameDecoder, FrameOverflowError, BROKER_READ_CAPS, } from './broker-protocol.js';
+/** A review companion may only navigate or fork within a branch whose ancestry
+ * has crossed its durable transcript boundary. The broker sends this typed local
+ * failure as a dedicated error frame without invoking pi's tree mutation. */
+export const REVIEW_BOUNDARY_NAVIGATION_CODE = 'review_boundary_navigation';
+export class ReviewBoundaryNavigationError extends Error {
+    targetId;
+    code = REVIEW_BOUNDARY_NAVIGATION_CODE;
+    constructor(targetId) {
+        super(`review companion cannot navigate before the visible transcript boundary (target: ${targetId})`);
+        this.targetId = targetId;
+        this.name = 'ReviewBoundaryNavigationError';
+    }
+}
 const THINKING_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
 /**
  * pi 0.82 made `ModelRuntime` the canonical model/auth surface and demoted
@@ -174,6 +193,13 @@ export function isLeadingEngineCommand(text, session) {
     }
     return false;
 }
+/** A `steer` frame normally maps directly to pi's steer queue. Engine commands,
+ * skills, and templates must instead pass through prompt()'s leading-command
+ * preflight; with streamingBehavior:'steer', ordinary expanded text still lands
+ * in the same queue. */
+export function resolveSteerCall(text, session) {
+    return isLeadingEngineCommand(text, session) ? 'prompt' : 'steer';
+}
 /**
  * Enumerate every leading-token STRING this session's engine would
  * independently consume as a leading command/skill/template dispatch BEFORE
@@ -399,6 +425,23 @@ const REPLACEMENT_DEADLINE_MS = 30_000;
  *  the budget elapses before the runtime promise settles — never compared via
  *  string matching. */
 const REPLACEMENT_DEADLINE_EXCEEDED = Symbol('replacement-deadline-exceeded');
+const PENDING_TOOL_SUMMARY_KEY_MAX_CHARS = 1_000;
+const PENDING_TOOL_SUMMARY_SEGMENT_MAX_CHARS = 10_000;
+function normalizePendingToolGroupSummary(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).sort().join(',') !== 'key,segment,version')
+        return null;
+    if (record.version !== 1 || typeof record.key !== 'string' || typeof record.segment !== 'string')
+        return null;
+    if (record.key.length === 0 ||
+        record.key.length > PENDING_TOOL_SUMMARY_KEY_MAX_CHARS ||
+        record.segment.length === 0 ||
+        record.segment.length > PENDING_TOOL_SUMMARY_SEGMENT_MAX_CHARS)
+        return null;
+    return { version: 1, key: record.key, segment: record.segment };
+}
 // ---------------------------------------------------------------------------
 // M3 (scout mq5thyli): the active engine session, exposed so broker-cli's FATAL
 // handlers (uncaughtException / unhandledRejection / the runBroker reject) can
@@ -521,6 +564,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // that does not expose the replacement API (the fake-engine fixture).
     // eslint-disable-next-line prefer-const
     let { session, services, resuming, runtime } = await buildBrokerSession(engine, cfg);
+    // Review identity is immutable for the broker's lifetime. Snapshot producers
+    // close over this one construction-time classification rather than re-reading
+    // canvas metadata for every welcome or session replacement.
+    const reviewCompanion = getNode(nodeId)?.review_binding != null;
     // M3: name the boot session as the process-fatal disposal target immediately —
     // enqueueRebind reassigns this on every later replacement, but without this
     // initial assignment `activeSession` stays null (and disposeActiveSession() a
@@ -588,7 +635,28 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     const displayStatuses = new Map();
     const displayWidgets = new Map();
     let displayTitle;
+    let workingActivity = DEFAULT_WORKING_ACTIVITY;
+    const toolSummariesPath = join(jobDir(nodeId), 'tool-summaries.json');
+    const pendingToolSummaryPath = join(jobDir(nodeId), 'pending-tool-summary.json');
+    const toolGroupSummaries = new Map();
+    try {
+        const persisted = readJsonIfExists(toolSummariesPath);
+        for (const [key, summary] of Object.entries(normalizeToolGroupSummaryRecord(persisted))) {
+            toolGroupSummaries.set(key, summary);
+        }
+    }
+    catch {
+        // A malformed sidecar merely withholds summaries; transcript tools remain visible.
+    }
+    const summaryAttempted = new Set(toolGroupSummaries.keys());
+    const generatingToolGroups = new Map();
+    const toolGroupsByCallId = new Map();
+    const summaryTasks = new Set();
+    let openToolGroup;
+    let lastToolGroupBoundaryProse = '';
+    let sawAssistantProse = false;
     let disposed = false;
+    let disposePending = false;
     let agentRunActive = false;
     let shutdownRequested = false;
     let server;
@@ -729,6 +797,224 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         }
         broadcast(frame);
     };
+    /** Record and asynchronously summarize the maximal non-boundary region between
+     * visible prose messages. A boundary can land while a tool is still running,
+     * so closed groups retain their call ids until every result has joined the
+     * same serialized segment; only then may they become collapsible. */
+    const ensureOpenToolGroup = () => {
+        if (openToolGroup === undefined) {
+            openToolGroup = {
+                toolCount: 0,
+                pieces: [],
+                boundaryProse: lastToolGroupBoundaryProse,
+                pendingToolIds: new Set(),
+                closed: false,
+                summarizeWhenSettled: false,
+            };
+        }
+        return openToolGroup;
+    };
+    const clearPendingToolGroupSummary = (input) => {
+        try {
+            const persisted = normalizePendingToolGroupSummary(readJsonIfExists(pendingToolSummaryPath));
+            if (persisted?.key === input.key && persisted.segment === input.segment)
+                unlinkSync(pendingToolSummaryPath);
+        }
+        catch {
+            // The durable summary is already authoritative. A stale handoff may cost a
+            // no-op read on the next boot, but must not revoke the recap just written.
+        }
+    };
+    const generateToolGroupSummary = (input) => {
+        const { key, segment } = input;
+        if (summaryAttempted.has(key) || generatingToolGroups.has(key))
+            return;
+        summaryAttempted.add(key);
+        generatingToolGroups.set(key, input);
+        let task;
+        task = headlessToolGroupSummary(segment)
+            .then((summary) => {
+            if (summary === null)
+                return;
+            toolGroupSummaries.set(key, summary);
+            try {
+                atomicWriteJson(toolSummariesPath, Object.fromEntries(toolGroupSummaries));
+            }
+            catch {
+                // A delivery without durable state would disappear on reattach, so do
+                // not advertise it. The calls remain folded normally instead.
+                toolGroupSummaries.delete(key);
+                return;
+            }
+            clearPendingToolGroupSummary(input);
+            broadcast({ type: 'tool_group_summary', key, summary });
+        })
+            .catch(() => undefined)
+            .finally(() => {
+            generatingToolGroups.delete(key);
+            summaryTasks.delete(task);
+        });
+        summaryTasks.add(task);
+    };
+    const generateSettledToolGroup = (group) => {
+        if (!group.closed || group.pendingToolIds.size > 0 || group.key === undefined || !group.summarizeWhenSettled)
+            return;
+        generateToolGroupSummary({
+            version: 1,
+            key: group.key,
+            segment: serializeToolGroup(group.boundaryProse, group.pieces),
+        });
+    };
+    try {
+        const pending = normalizePendingToolGroupSummary(readJsonIfExists(pendingToolSummaryPath));
+        if (pending === null) {
+            if (existsSync(pendingToolSummaryPath)) {
+                unlinkSync(pendingToolSummaryPath);
+                emitEvent({
+                    level: 'warn',
+                    event: 'broker.startup.warning',
+                    fields: { stage: 'pending_tool_summary', message: 'removed an invalid pending tool summary' },
+                });
+            }
+        }
+        else if (toolGroupSummaries.has(pending.key)) {
+            unlinkSync(pendingToolSummaryPath);
+        }
+        else {
+            generateToolGroupSummary(pending);
+        }
+    }
+    catch (error) {
+        emitEvent({
+            level: 'warn',
+            event: 'broker.startup.warning',
+            fields: {
+                stage: 'pending_tool_summary',
+                message: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+    const finishOpenToolGroup = (settleInterruptedTools = false) => {
+        const group = openToolGroup;
+        openToolGroup = undefined;
+        if (group === undefined)
+            return;
+        group.closed = true;
+        // An abort is itself the visible evidence that any pending calls did not
+        // finish. Their recorded arguments still belong to the recap, and Ctrl+O
+        // retains the full rows, so let the completed pre-abort span summarize.
+        if (settleInterruptedTools) {
+            for (const id of group.pendingToolIds)
+                toolGroupsByCallId.delete(id);
+            group.pendingToolIds.clear();
+        }
+        // Configuration is read at the boundary, not when a slow tool later settles.
+        group.summarizeWhenSettled = readConfig('user').summarize_tool_calls;
+        generateSettledToolGroup(group);
+    };
+    const visibleBoundary = (prose) => {
+        finishOpenToolGroup();
+        lastToolGroupBoundaryProse = prose;
+    };
+    const observeToolGroupEvent = (event) => {
+        // The viewer turns every compaction_end into a summary, cancellation, or
+        // error line, each of which is a hard transcript seam.
+        if (event.type === 'compaction_end') {
+            finishOpenToolGroup();
+            return;
+        }
+        // A failed automatic retry is rendered as ChatView's visible error line.
+        // Successful retries only clear activity and remain within the same group.
+        if (event.type === 'auto_retry_end' && event.success !== true) {
+            finishOpenToolGroup();
+            return;
+        }
+        // The attach viewer renders aborted and errored assistant endings as visible
+        // transcript seams. Close and settle the pre-abort group here so pending tool
+        // arguments can be summarized without pulling the seam into the recap.
+        if (event.type === 'message_end') {
+            const message = event.message;
+            if (message !== null && typeof message === 'object') {
+                const item = message;
+                if (item.role === 'assistant' && (item.stopReason === 'aborted' || item.stopReason === 'error')) {
+                    finishOpenToolGroup(true);
+                }
+            }
+            return;
+        }
+        if (event.type === 'tool_execution_start') {
+            const group = ensureOpenToolGroup();
+            const id = typeof event.toolCallId === 'string' ? event.toolCallId : '';
+            if (group.key === undefined && id !== '')
+                group.key = id;
+            if (id !== '') {
+                group.pendingToolIds.add(id);
+                toolGroupsByCallId.set(id, group);
+            }
+            group.toolCount += 1;
+            group.pieces.push({ type: 'tool', name: typeof event.toolName === 'string' ? event.toolName : 'tool', args: event.args });
+            return;
+        }
+        if (event.type === 'tool_execution_end') {
+            const id = typeof event.toolCallId === 'string' ? event.toolCallId : '';
+            const group = id === '' ? openToolGroup : toolGroupsByCallId.get(id);
+            if (group !== undefined) {
+                group.pieces.push({
+                    type: 'result',
+                    name: typeof event.toolName === 'string' ? event.toolName : 'tool',
+                    result: event.result,
+                    isError: event.isError === true,
+                });
+                if (id !== '') {
+                    group.pendingToolIds.delete(id);
+                    toolGroupsByCallId.delete(id);
+                }
+                generateSettledToolGroup(group);
+            }
+            return;
+        }
+        if (event.type !== 'message_start' && event.type !== 'message_update')
+            return;
+        const message = event.message;
+        if (message === null || typeof message !== 'object')
+            return;
+        const item = message;
+        const role = item.role;
+        if (role === 'assistant') {
+            if (event.type === 'message_start')
+                sawAssistantProse = false;
+            const prose = assistantVisibleText(item);
+            if (!sawAssistantProse && prose.trim() !== '') {
+                sawAssistantProse = true;
+                visibleBoundary(prose);
+            }
+            return;
+        }
+        if (event.type !== 'message_start')
+            return;
+        if (role === 'compactionSummary' || role === 'branchSummary' || role === 'bashExecution' || role === 'status' || role === 'error' || item.customType === 'crtr-cycle-divider') {
+            finishOpenToolGroup();
+            return;
+        }
+        if (isTrueUserMessage(item)) {
+            visibleBoundary(generatedContextText(item));
+            return;
+        }
+        if (item.display === false)
+            return;
+        const text = generatedContextText(item);
+        const isBearingsOrRevive = item.customType === 'crtr-context' || (role === 'user' && text.startsWith('You have been revived fresh after a context refresh'));
+        if (isBearingsOrRevive) {
+            if (openToolGroup !== undefined && text !== '')
+                openToolGroup.pieces.push({ type: 'text', text });
+            return;
+        }
+        // Generated inbox/situational/nudge and visible custom output are part of
+        // the between-message activity and may begin a group before its first tool.
+        const group = ensureOpenToolGroup();
+        if (text !== '')
+            group.pieces.push({ type: 'text', text });
+    };
     // ---------------------------------------------------------------------------
     // F2: message_update coalescing. `relayEvent` is the single entry point for
     // engine events headed to viewers: a message_update is held (latest wins) and
@@ -797,9 +1083,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // behavior.
     let kickoffPending;
     let kickoffInFlight = false;
-    // Guards the reload_auth re-drive (below) against overlapping /login frames
-    // re-running resolveLaunchModel + setModel + kickoff concurrently; the
-    // reload/refresh/ack/broadcast ahead of it stay idempotent and always run.
+    // One /login can fan the same reload into this broker through several clients.
+    // Coalesce those frames onto one local auth refresh + route reconciliation so
+    // an idle prompt can await the exact work promised by the reload ack.
     let reloadAuthInFlight = null;
     // A fresh auth reload is also the explicit recovery trigger for a turn parked
     // on a fatal provider-auth fault. Keep at most one rewind + prompt in flight
@@ -951,9 +1237,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             // node from reviving straight back into fault-recovery chrome.
             if (unconfigured)
                 clearFault(nodeId, { link: 'pi→provider' });
-            await operationIdContext.fresh(() => session.prompt(unconfigured
-                ? `The previous model (${currentSpec}) had no usable provider credential, so you were automatically switched to ${resolved}. Continue the task from where the failed turn left off.`
-                : `The previous model (${currentSpec}) was unavailable (provider 404 not_found), so you were automatically switched to ${resolved}. Continue the task from where the failed turn left off.`));
+            await operationIdContext.fresh(() => session.prompt(formatModelFallbackRecovery(currentSpec, resolved, unconfigured ? 'credential' : 'not-found')));
         })()
             .catch((err) => {
             emitEvent({
@@ -1158,6 +1442,15 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         maybeFallbackOnUnusableModel(event);
         const type = event.type;
         if (type === 'agent_start') {
+            try {
+                workingActivity = randomWorkingActivity(readConfig('user').working_gerunds);
+            }
+            catch {
+                workingActivity = DEFAULT_WORKING_ACTIVITY;
+            }
+            // Announce the selected label before relaying pi's verbatim agent_start so
+            // every viewer paints this turn with the same random choice.
+            broadcast({ type: 'working_activity', activity: workingActivity });
             notifyTurnAccepted();
             emitStartupMilestone('broker.startup.agent_start', formatModelSpec(session.model, session.thinkingLevel));
         }
@@ -1208,24 +1501,33 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             return;
         }
         // Any non-update event: flush the held update FIRST so a viewer never sees
-        // (e.g.) message_end before the update it supersedes — then relay verbatim.
+        // (e.g.) message_end before the update it supersedes. A refresh-yield aborts
+        // its own turn; the visible cycle divider names that boundary, so do not also
+        // render it as an operation failure.
         flushPendingUpdate();
+        if (type === 'message_end' && getNode(nodeId)?.intent === 'refresh') {
+            const messageEnd = event;
+            broadcast({ ...messageEnd, message: withoutYieldAbort(messageEnd.message) });
+            return;
+        }
         broadcast(event);
     };
-    // Persist a live model switch into the node's durable launch recipe so it
-    // survives a yield/revive. pi's `/model` (→ set_model/cycle_model) only
-    // mutates the in-memory engine; without this the node reverts to its
-    // persona/spawn model on the next revive. We write the full `provider/id`
-    // (which normalizeModel passes through unchanged) to BOTH model_override (so
+    // Persist the live model + thinking level into the node's durable launch
+    // recipe so a daemon restart/revive recreates the settings the user sees.
+    // pi's model/thinking controls only mutate the in-memory engine; without this
+    // the node reverts to its persona/spawn settings on the next broker boot. We
+    // write the full `provider/id:thinking` spec to BOTH model_override (so
     // polymorphs preserve it via buildLaunchSpec) and launch.model (the recipe
     // buildPiArgv replays on revive). Best-effort: a degenerate/ephemeral node
     // with no canvas row just skips persistence. CRTR_NODE_ID is set in the
     // broker's own env (merged by piInvocationToSdkConfig at boot).
     // `pinnedOverride`, when passed, is the durable launch-recipe decision for
-    // an explicit model change, derived from its raw pre-normalize token. Omitted
-    // algorithmic changes retain the existing recipe field through the spread;
-    // route expansion, rather than a mutable broker pin, selects retry recovery.
-    const persistModelChoice = (pinnedOverride, explicit = false) => {
+    // an explicit model change, derived from its raw pre-normalize token. A
+    // `userSelected` change also clears the older logical route intent: otherwise
+    // resolveLaunchModel ignores the newly persisted concrete spec at reboot and
+    // resolves the persona's original family/strength again. Algorithmic provider
+    // fallback leaves that intent intact.
+    const persistModelChoice = (pinnedOverride, userSelected = false) => {
         const nodeId = process.env['CRTR_NODE_ID'];
         const spec = formatModelSpec(session.model, session.thinkingLevel);
         if (nodeId === undefined || nodeId === '' || spec === null)
@@ -1236,7 +1538,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                 return;
             const launch = meta.launch === undefined
                 ? undefined
-                : explicit
+                : userSelected
                     ? (() => {
                         const { modelIntent: _modelIntent, env, ...rest } = meta.launch;
                         const { CRTR_MODEL_INTENT: _intentEnv, ...remainingEnv } = env;
@@ -1248,7 +1550,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                         };
                     })()
                     : { ...meta.launch, model: spec, ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}) };
-            if (explicit) {
+            if (userSelected) {
                 delete process.env['CRTR_MODEL_INTENT'];
                 cfg.model = spec;
             }
@@ -1262,13 +1564,13 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // set_model/cycle_model the broker announces it itself — otherwise the new
     // model reaches no viewer (the requester gets only a bare ack) and every
     // footer shows the stale model until the next unrelated event.
-    const broadcastModelChanged = (persist = true, pinnedOverride, explicit = false) => {
+    const broadcastModelChanged = (persist = true, pinnedOverride, userSelected = false) => {
         if (persist)
-            persistModelChoice(pinnedOverride, explicit);
+            persistModelChoice(pinnedOverride, userSelected);
         broadcast({ type: 'model_changed', model: isUnknownModel(session.model) ? undefined : session.model, spec: formatModelSpec(session.model, session.thinkingLevel) });
     };
     const buildSnapshot = () => ({
-        messages: snapshotMessages(session),
+        messages: snapshotMessages(session, reviewCompanion),
         stats: session.getSessionStats(),
         // pi's `get_state` (rpc-mode.js), field for field, from the same getters.
         // The ONE divergence: a model-less session (undefined OR the SDK
@@ -1295,6 +1597,8 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             widgets: Object.fromEntries([...displayWidgets].map(([k, w]) => [k, { lines: [...w.lines], placement: w.placement }])),
             title: displayTitle,
         },
+        toolGroupSummaries: Object.fromEntries(toolGroupSummaries),
+        workingActivity,
     });
     // Send a client its catch-up snapshot. welcome.pending_dialog carries a single
     // still-in-flight dialog to a WRITABLE client attaching mid-dialog; an observer
@@ -1337,10 +1641,28 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // The single exit helper (plan §0): dispose the engine, close + unlink the
     // socket, exit 0. Idempotent — every trigger converges here.
     // -------------------------------------------------------------------------
-    const disposeAndExit = (_reason, status = 0) => {
+    const completeExit = (status) => {
         if (disposed)
             return;
         disposed = true;
+        // Daemon teardown cannot wait for a recap's 45-second model timeout. Preserve
+        // exactly the newest already-capped input so the successor broker can finish
+        // it, persist the normal summary, and remove the handoff record.
+        const pendingSummary = [...generatingToolGroups.values()].at(-1);
+        if (pendingSummary !== undefined) {
+            try {
+                atomicWriteJson(pendingToolSummaryPath, pendingSummary);
+            }
+            catch (error) {
+                emitEvent({
+                    level: 'warn',
+                    event: 'broker.runtime.diagnostic',
+                    fields: {
+                        message: `failed to persist pending tool summary: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                });
+            }
+        }
         streamWatchdog.reset();
         // disposeActiveSession atomically clears the process-global pointer before
         // disposing — whichever engine session (committed or an in-flight rebind
@@ -1381,6 +1703,34 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         }
         process.exit(status);
     };
+    const disposeAndExit = (reason, status = 0) => {
+        if (disposed)
+            return;
+        const graceful = reason === 'shutdown-hook' || reason === 'shutdown-after-settle';
+        // A graceful shutdown (yield, dormancy, daemon restart) is the final
+        // boundary of the conversation's last tool group. Group state lives only in
+        // this process, so a group left open here is unsummarizable forever and its
+        // calls render raw in every future view of the transcript. Close it now —
+        // generateSettledToolGroup registers its task synchronously, so the wait
+        // below covers the summary it launches. Any pending tool arguments are
+        // included without inventing a result; the visible abort remains outside
+        // the recap and Ctrl+O retains every underlying call row.
+        if (graceful)
+            finishOpenToolGroup(true);
+        // A normal terminal shutdown follows a visible boundary that may have just
+        // launched a capped (45s) headless summary. Keep the broker and its child
+        // alive until those already-started tasks persist/broadcast, rather than
+        // process.exit() orphaning pi and losing the sidecar. Abrupt failures and
+        // signals retain their existing immediate teardown behavior.
+        if (graceful && summaryTasks.size > 0) {
+            if (disposePending)
+                return;
+            disposePending = true;
+            void Promise.allSettled([...summaryTasks]).finally(() => completeExit(status));
+            return;
+        }
+        completeExit(status);
+    };
     // A stophook can request shutdown while pi is still unwinding a completed
     // turn. Let that turn reach agent_settled first: inbox delivery commits its
     // durable cursor there, and only there. Explicit operator shutdown and OS
@@ -1491,6 +1841,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     return;
                 }
             }
+            observeToolGroupEvent(event);
             relayEvent(event, generation);
             if (event.type === 'agent_settled')
                 scheduleFaultRetry();
@@ -1526,6 +1877,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             providerFallbackInFlight = null;
             notFoundFallbackInFlight = null;
             reloadAuthInFlight = null;
+            openToolGroup = undefined;
+            toolGroupsByCallId.clear();
+            sawAssistantProse = false;
             await candidateSession.bindExtensions({
                 uiContext,
                 // 'rpc' — NOT 'print'. Per pi docs/rpc.md:1078 this is exactly our shape:
@@ -1689,6 +2043,36 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             failure = err;
             sendFrame(client, { type: 'error', code: 'engine_error', message: String(err) });
         };
+        // `prompt { interrupt: true }` is one atomic viewer intention: end whatever
+        // is producing now, then start this as a new turn. A normal mid-stream
+        // prompt deliberately steers into pi's queue; the whip must not.
+        if (frame.type === 'prompt' && frame.interrupt === true) {
+            return (async () => {
+                if (session.isBashRunning) {
+                    session.abortBash();
+                }
+                else {
+                    // A prompt can be in pi's async setup before isStreaming flips. Match
+                    // the correlated interrupt's guard so a whip cannot silently miss it.
+                    if (!session.isStreaming && pendingPromptDispatches > 0) {
+                        const deadline = Date.now() + 5_000;
+                        while (Date.now() < deadline && !session.isStreaming && pendingPromptDispatches > 0) {
+                            await new Promise((resolve) => setTimeout(resolve, 25));
+                        }
+                    }
+                    if (session.isStreaming)
+                        await session.abort();
+                }
+                return driveEngine(client, {
+                    type: 'prompt',
+                    text: frame.text,
+                    ...(frame.images !== undefined ? { images: frame.images } : {}),
+                });
+            })().catch((err) => {
+                relayError(err);
+                return failure;
+            });
+        }
         // Hidden `crtr-memory-refs` guidance rides ALONGSIDE the human frame's own
         // engine call, never rewriting `frame.text` — see resolveFrameGuidance /
         // chooseGuidanceDeliveryMode above. A failed SEND (as opposed to a failed
@@ -1710,38 +2094,65 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                 // before the caught promise resolves, so reading it after the chain is
                 // the call's verdict.
                 const settle = (p) => p.then(() => failure);
-                const route = resolveEngineRoute(frame, session.isStreaming);
-                const guidance = resolveFrameGuidance(frame.text);
-                if (guidance === null) {
+                const dispatch = () => {
+                    const route = resolveEngineRoute(frame, session.isStreaming);
+                    const guidance = resolveFrameGuidance(frame.text);
+                    if (guidance === null) {
+                        if (route.call === 'prompt') {
+                            // A routed prompt STARTS a turn — including an idle follow_up
+                            // escalated by m-C — so it gets a fresh operation id. A true
+                            // (mid-stream) followUp rides the current turn's operation, like
+                            // steer.
+                            return settle(trackPromptDispatch(operationIdContext.fresh(() => session.prompt(frame.text, route.options).catch(relayError))));
+                        }
+                        // C1: pi's followUp() takes images as a POSITIONAL 2nd arg (`followUp(text, images?)`).
+                        return settle(session.followUp(frame.text, frame.images).catch(relayError));
+                    }
+                    const deliverAs = chooseGuidanceDeliveryMode(frame.type, route.call, session.isStreaming);
                     if (route.call === 'prompt') {
-                        // A routed prompt STARTS a turn — including an idle follow_up
-                        // escalated by m-C — so it gets a fresh operation id. A true
-                        // (mid-stream) followUp rides the current turn's operation, like
-                        // steer.
-                        return settle(trackPromptDispatch(operationIdContext.fresh(() => session.prompt(frame.text, route.options).catch(relayError))));
+                        if (deliverAs === 'nextTurn') {
+                            // The ONLY ordering where guidance precedes the human call — pi's
+                            // prompt() reads+clears its pending-nextTurn queue synchronously
+                            // at call time, injecting it into the SAME turn as the new user
+                            // message. promptWithNextTurnGuidance queues the guidance and then
+                            // ATOMICALLY clears its own pending entry if prompt() settles
+                            // without ever reaching that drain (an early throw/return leaves
+                            // nothing stranded to leak into a later, unrelated turn).
+                            return settle(trackPromptDispatch(promptWithNextTurnGuidance(session, guidance, () => operationIdContext.fresh(() => session.prompt(frame.text, route.options))).catch(relayError)));
+                        }
+                        return settle(trackPromptDispatch(operationIdContext.fresh(() => session.prompt(frame.text, route.options).catch(relayError).then(() => sendGuidance(guidance, deliverAs)))));
                     }
-                    // C1: pi's followUp() takes images as a POSITIONAL 2nd arg (`followUp(text, images?)`).
-                    return settle(session.followUp(frame.text, frame.images).catch(relayError));
-                }
-                const deliverAs = chooseGuidanceDeliveryMode(frame.type, route.call, session.isStreaming);
-                if (route.call === 'prompt') {
-                    if (deliverAs === 'nextTurn') {
-                        // The ONLY ordering where guidance precedes the human call — pi's
-                        // prompt() reads+clears its pending-nextTurn queue synchronously
-                        // at call time, injecting it into the SAME turn as the new user
-                        // message. promptWithNextTurnGuidance queues the guidance and then
-                        // ATOMICALLY clears its own pending entry if prompt() settles
-                        // without ever reaching that drain (an early throw/return leaves
-                        // nothing stranded to leak into a later, unrelated turn).
-                        return settle(trackPromptDispatch(promptWithNextTurnGuidance(session, guidance, () => operationIdContext.fresh(() => session.prompt(frame.text, route.options))).catch(relayError)));
+                    // deliverAs is always 'followUp' here per chooseGuidanceDeliveryMode's
+                    // contract (a followUp routeCall never yields 'nextTurn').
+                    return settle(session.followUp(frame.text, frame.images).catch(relayError).then(() => sendGuidance(guidance, deliverAs)));
+                };
+                // /login acknowledges before its asynchronous local refresh completes.
+                // An idle turn must not overtake that refresh and launch on the stale
+                // route; true mid-stream follow-ups keep their immediate queue behavior.
+                const authReload = session.isStreaming ? undefined : reloadAuthInFlight?.promise;
+                if (authReload === undefined)
+                    return dispatch();
+                const waitingGeneration = installedGeneration;
+                const waitingSession = session;
+                return authReload.then(() => {
+                    if (installedGeneration !== waitingGeneration || session !== waitingSession) {
+                        relayError(new Error('session changed while prompt waited for authentication reload'));
+                        return failure;
                     }
-                    return settle(trackPromptDispatch(operationIdContext.fresh(() => session.prompt(frame.text, route.options).catch(relayError).then(() => sendGuidance(guidance, deliverAs)))));
-                }
-                // deliverAs is always 'followUp' here per chooseGuidanceDeliveryMode's
-                // contract (a followUp routeCall never yields 'nextTurn').
-                return settle(session.followUp(frame.text, frame.images).catch(relayError).then(() => sendGuidance(guidance, deliverAs)));
+                    return dispatch();
+                });
             }
             case 'steer': {
+                // A viewer submits ordinary text as `steer` while the agent is running,
+                // including a slash command injected by the tmux prefix menu. pi's
+                // steer() deliberately rejects registered extension commands because
+                // they cannot be queued; prompt() performs the command preflight first
+                // and executes it immediately even while streaming. It also expands a
+                // matching skill/template before applying the same steer behavior.
+                if (resolveSteerCall(frame.text, session) === 'prompt') {
+                    void session.prompt(frame.text, { images: frame.images, streamingBehavior: 'steer' }).catch(relayError);
+                    break;
+                }
                 const guidance = resolveFrameGuidance(frame.text);
                 // C1: pi's steer() takes images as a POSITIONAL 2nd arg (`steer(text, images?)`).
                 if (guidance === null) {
@@ -1810,6 +2221,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                 // Order before any held assistant message_update, so a `!` run mid-stream
                 // never renders ahead of the update it follows.
                 flushPendingUpdate();
+                // The live bash component is a visible transcript boundary, even though
+                // its persisted bashExecution message arrives later via the session.
+                finishOpenToolGroup();
                 broadcast({ type: 'bash_start', command, excludeFromContext: exclude });
                 void session
                     .executeBash(command, (chunk) => broadcast({ type: 'bash_output', chunk }), {
@@ -1867,6 +2281,16 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // pass no id (unchanged behavior).
         ...(id !== undefined ? { id } : {}),
     });
+    const isPreBoundaryReviewEntry = (entryId) => reviewCompanion &&
+        !session.sessionManager.getBranch(entryId).some((entry) => entry.type === 'custom_message' && entry.customType === REVIEW_BOUNDARY_CUSTOM_TYPE);
+    const reviewBoundaryRefusalTo = (client, targetId) => {
+        const refusal = new ReviewBoundaryNavigationError(targetId);
+        sendFrame(client, {
+            type: 'error',
+            code: refusal.code,
+            message: refusal.message,
+        });
+    };
     /** Resolve a `provider/id` model spec against the LIVE services registry (which
      *  carries any extension-registered providers). Pure: returns undefined on a
      *  malformed spec or an unknown model. */
@@ -2007,17 +2431,29 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     });
     const buildGetTreeData = (id) => {
         const sm = session.sessionManager;
-        const forkPoints = session.getUserMessagesForForking().map((u) => ({
+        const tree = reviewCompanion ? boundaryRootedTree(sm.getTree()) : sm.getTree();
+        const visibleEntryIds = new Set();
+        const collectEntryIds = (nodes) => {
+            for (const node of nodes) {
+                visibleEntryIds.add(node.entry.id);
+                collectEntryIds(node.children);
+            }
+        };
+        collectEntryIds(tree);
+        const forkPoints = session.getUserMessagesForForking()
+            .filter((u) => visibleEntryIds.has(u.entryId))
+            .map((u) => ({
             id: u.entryId,
             text: u.text,
             timestamp: sm.getEntry(u.entryId)?.timestamp,
         }));
+        const currentLeafId = sm.getLeafId();
         return {
             type: 'data',
             id,
             kind: 'get_tree',
-            tree: sm.getTree(),
-            currentLeafId: sm.getLeafId(),
+            tree,
+            currentLeafId: currentLeafId !== null && visibleEntryIds.has(currentLeafId) ? currentLeafId : null,
             forkPoints,
         };
     };
@@ -2365,7 +2801,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     .cycleModel(frame.direction)
                     .then(() => {
                     ackTo(client, 'cycle_model');
-                    broadcastModelChanged();
+                    broadcastModelChanged(true, undefined, true);
                 })
                     .catch(engineErrorTo(client));
                 break;
@@ -2414,7 +2850,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     if (nextSpec.thinkingLevel !== undefined)
                         session.setThinkingLevel(nextSpec.thinkingLevel);
                     ackTo(client, 'cycle_ladder');
-                    broadcastModelChanged();
+                    broadcastModelChanged(true, undefined, true);
                 })
                     .catch(engineErrorTo(client));
                 break;
@@ -2424,6 +2860,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     break;
                 try {
                     session.cycleThinkingLevel();
+                    persistModelChoice(undefined, true);
                     ackTo(client, 'cycle_thinking');
                 }
                 catch (err) {
@@ -2448,6 +2885,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     break;
                 try {
                     session.setThinkingLevel(frame.level);
+                    persistModelChoice(undefined, true);
                     ackTo(client, 'set_thinking_level');
                 }
                 catch (err) {
@@ -2602,6 +3040,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             case 'navigate_tree': {
                 if (notWritable(client, 'navigate the session tree'))
                     break;
+                if (isPreBoundaryReviewEntry(frame.targetId)) {
+                    reviewBoundaryRefusalTo(client, frame.targetId);
+                    break;
+                }
                 // navigateTree rewinds IN-PLACE (same session file, new leaf) and emits no
                 // relayed event, so every viewer must be re-snapshotted onto the rewound
                 // transcript — same reWelcomeAll the session-replacing ops use. The ack's
@@ -2672,6 +3114,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             case 'fork': {
                 if (notWritable(client, 'fork the session'))
                     break;
+                if (isPreBoundaryReviewEntry(frame.entryId)) {
+                    reviewBoundaryRefusalTo(client, frame.entryId);
+                    break;
+                }
                 runReplacement(client, 'fork', (rt) => rt.fork(frame.entryId));
                 break;
             }
@@ -2724,58 +3170,61 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             }
             case 'reload_auth': {
                 // Open to any client, observers included: reload_auth is an idempotent
-                // local re-read of the shared auth.json + a model-registry refresh. It
-                // does NOT steer the conversation, so there is nothing to role-gate —
-                // which is what lets the daemon's canvas-wide fan (one /login propagated
-                // to every live broker) ride an observer connection.
+                // local re-read of shared credentials + the runtime's availability
+                // snapshot. It does not steer the conversation, so the daemon's
+                // canvas-wide /login fan can ride an observer connection.
                 try {
-                    // pi 0.82: crouter's CredentialStore reads auth.json fresh under the
-                    // lock on every call, so there is no cached credential view left to
-                    // reload — only the runtime's models/availability snapshot has to be
-                    // recomputed, and that is asynchronous. Every consumer below awaits
-                    // the same promise so none of them reads a pre-login snapshot.
-                    const authRefreshed = registryOf(services).refresh().catch((err) => {
-                        emitEvent({ level: 'warn', event: 'broker.auth_reload.refresh_failed', error: err });
-                    });
                     ackTo(client, 'reload_auth');
-                    void authRefreshed.then(() => broadcastModelChanged());
-                    // Tier 3 re-drive: a model-less boot (no viable candidate at launch)
-                    // stays live so the user can /login; once auth actually changes,
-                    // re-run the SAME launch policy against the now-refreshed services
-                    // and, if a model now resolves, adopt it and fire the deferred
-                    // kickoff. handleFrame is not async (broker.ts) so this runs as a
-                    // detached IIFE, the same async-in-sync-switch pattern used above
-                    // for provider/not-found fallback.
                     const authGeneration = installedGeneration;
-                    if (sessionHasNoModel() && authGeneration !== undefined && reloadAuthInFlight === null) {
+                    const existingAuthReload = reloadAuthInFlight;
+                    let authReloadPromise;
+                    if (existingAuthReload !== null && existingAuthReload.generation === authGeneration) {
+                        authReloadPromise = existingAuthReload.promise;
+                    }
+                    if (authGeneration !== undefined && authReloadPromise === undefined) {
                         const authSession = session;
                         const authServices = services;
-                        reloadAuthInFlight = authGeneration;
-                        void (async () => {
-                            try {
-                                await authRefreshed;
+                        authReloadPromise = (async () => {
+                            // Credentials are read fresh by PoolCredentialStore; only the
+                            // ModelRuntime snapshot needs rebuilding. Authentication reloads
+                            // never fetch provider catalogs over the network.
+                            await authServices.modelRuntime.refresh({ allowNetwork: false });
+                            if (installedGeneration !== authGeneration || session !== authSession)
+                                return;
+                            const modelLess = authSession.model === undefined || isUnknownModel(authSession.model);
+                            const reconcilesLogicalRoute = cfg.modelExact !== true
+                                && cfg.modelProviderPinned !== true
+                                && (process.env['CRTR_MODEL_INTENT'] ?? '').trim() !== '';
+                            if (modelLess || reconcilesLogicalRoute) {
                                 const resolved = await resolveLaunchModel(authServices, cfg);
+                                if (installedGeneration !== authGeneration || session !== authSession)
+                                    return;
                                 if (resolved !== undefined) {
-                                    await authSession.setModel(resolved.model);
-                                    if (installedGeneration !== authGeneration || session !== authSession)
-                                        return;
-                                    authSession.setThinkingLevel((resolved.thinkingLevel ?? 'off'));
-                                    broadcastModelChanged();
-                                    drivePendingKickoff();
+                                    const currentSpec = formatModelSpec(authSession.model, authSession.thinkingLevel);
+                                    const resolvedSpec = formatModelSpec(resolved.model, resolved.thinkingLevel);
+                                    if (resolvedSpec !== null && resolvedSpec !== currentSpec) {
+                                        await authSession.setModel(resolved.model);
+                                        if (installedGeneration !== authGeneration || session !== authSession)
+                                            return;
+                                        authSession.setThinkingLevel((resolved.thinkingLevel ?? 'off'));
+                                    }
                                 }
                             }
-                            catch (err) {
-                                emitEvent({
-                                    level: 'error',
-                                    event: 'broker.auth_reload.redrive_failed',
-                                    error: err,
-                                });
-                            }
-                            finally {
-                                if (reloadAuthInFlight === authGeneration)
-                                    reloadAuthInFlight = null;
-                            }
-                        })();
+                            if (installedGeneration !== authGeneration || session !== authSession)
+                                return;
+                            // Persist an algorithmic route choice without clearing the logical
+                            // intent that makes future reconciliation possible.
+                            broadcastModelChanged();
+                            drivePendingKickoff();
+                        })().catch((err) => {
+                            emitEvent({ level: 'warn', event: 'broker.auth_reload.reconcile_failed', error: err });
+                        });
+                        const work = { generation: authGeneration, promise: authReloadPromise };
+                        reloadAuthInFlight = work;
+                        void authReloadPromise.finally(() => {
+                            if (reloadAuthInFlight === work)
+                                reloadAuthInFlight = null;
+                        });
                     }
                     const authFault = readFault(nodeId);
                     const authFaultGeneration = installedGeneration;
@@ -2787,6 +3236,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                         authFaultRedriveInFlight = true;
                         void (async () => {
                             try {
+                                if (authReloadPromise !== undefined)
+                                    await authReloadPromise;
+                                if (installedGeneration !== authFaultGeneration || session !== authFaultSession)
+                                    return;
                                 const anchorEntryId = authFault.anchorEntryId;
                                 if (anchorEntryId !== undefined) {
                                     try {
@@ -3000,12 +3453,13 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
 // conversation instead of just the post-yield window; single-cycle sessions and
 // the fake-engine fixture (no tree accessors) fall through to plain
 // `buildSessionContext().messages` unchanged.
-export function snapshotMessages(session) {
+export function snapshotMessages(session, reviewCompanion = false) {
     // Cast: the real SDK's `SessionEntry.data` is `unknown` (untyped custom-entry
     // payload), narrower than `CycleSessionManagerLike`'s structural read of the
     // `crtr-cycle` marker's `{cycle, fromLeaf}` shape — the fields we read off it
     // are ones ONLY this module's own `appendCustomEntry` call (above) ever writes.
-    return cycleAwareMessages(session.sessionManager);
+    const messages = cycleAwareMessages(session.sessionManager);
+    return visibleMessages(messages, { reviewCompanion });
 }
 // ---------------------------------------------------------------------------
 // resolveLaunchModel — the SOLE launch model-selection policy, module-scoped
@@ -3018,48 +3472,26 @@ export function snapshotMessages(session) {
 // alone on a failed re-drive attempt).
 // ---------------------------------------------------------------------------
 async function resolveLaunchModel(services, cfg) {
-    // Route declarations own preference order; the raw registry remains only a
-    // legacy tail for models a user did not declare.
     const routeRequest = modelRequestFromConfig(cfg.model, process.env['CRTR_MODEL_INTENT'], cfg.modelExact === true);
-    if (routeRequest !== undefined) {
-        const registry = registryOf(services);
-        const routes = expandModelCandidates(routeRequest, process.env['CRTR_NODE_CWD'] ?? cfg.cwd, process.env['CRTR_PROFILE_ID']);
-        const routeKeys = new Set(routes.map((candidate) => `${candidate.providerId}/${candidate.modelId}`));
-        // A concrete request may advance only through its declared same-model
-        // credential-source routes. The raw registry tail is logical-request legacy.
-        const tail = routeRequest.kind === 'logical'
-            ? registry.getAll()
-                .filter((model) => !routeKeys.has(`${model.provider}/${model.id}`))
-                .map((model, index) => ({ routeId: `registry:${model.provider}/${model.id}`, credentialSource: 'registry', family: model.provider, strength: 'strong', providerId: model.provider, modelId: model.id, rank: routes.length + index }))
-            : [];
-        const hasManagedAuthenticated = [...routes, ...tail].some((candidate) => {
-            const availability = probeRouteAvailability(candidate, registry);
-            return isManagedProvider(candidate.providerId) && availability.registered && availability.authenticated;
-        });
-        const selection = resolveProviderCandidates([...routes, ...tail].map((candidate) => ({
-            ...candidate,
-            ...probeRouteAvailability(candidate, registry),
-            automaticFallback: candidate.routeId.startsWith('registry:')
-                ? (isManagedProvider(candidate.providerId) || !hasManagedAuthenticated)
-                : true,
-        })), Date.now(), { pinnedToFirst: routeRequest.kind === 'exact' });
-        const selected = selection.candidates[0];
-        if (selected !== undefined) {
-            const model = registry.find(selected.providerId, selected.modelId);
-            if (model !== undefined) {
-                if ((selected.rank ?? 0) > 0)
-                    emitEvent({ level: 'warn', event: 'broker.model.launch_fallback', fields: { requested: cfg.model, selected: `${selected.providerId}/${selected.modelId}`, route_id: selected.routeId, credential_source: selected.credentialSource, rank: selected.rank } });
-                return { model, thinkingLevel: selected.thinkingLevel };
-            }
-        }
-        if (cfg.modelExact === true) {
-            const rejection = selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason}`).join('; ');
-            recordFaultForCurrentNode({ link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` });
-            throw new Error(`[broker] FATAL: exact-consult model '${cfg.model}' is unavailable`);
-        }
-        emitEvent({ level: 'warn', event: 'broker.model.none_viable', fields: { rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({ provider: candidate.providerId, model: candidate.modelId, reason, route_id: candidate.routeId, credential_source: candidate.credentialSource })), rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16) } });
+    if (routeRequest === undefined)
         return undefined;
+    const selection = selectInitialModelRoute(routeRequest, registryOf(services), {
+        cwd: process.env['CRTR_NODE_CWD'] ?? cfg.cwd,
+        profileId: process.env['CRTR_PROFILE_ID'],
+    });
+    const selected = selection.selected;
+    if (selected !== undefined) {
+        const candidate = selected.candidate;
+        if ((candidate.rank ?? 0) > 0)
+            emitEvent({ level: 'warn', event: 'broker.model.launch_fallback', fields: { requested: cfg.model, selected: `${candidate.providerId}/${candidate.modelId}`, route_id: candidate.routeId, credential_source: candidate.credentialSource, rank: candidate.rank } });
+        return { model: selected.model, thinkingLevel: candidate.thinkingLevel };
+    }
+    if (cfg.modelExact === true) {
+        const rejection = selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason}`).join('; ');
+        recordFaultForCurrentNode({ link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` });
+        throw new Error(`[broker] FATAL: exact-consult model '${cfg.model}' is unavailable`);
     }
+    emitEvent({ level: 'warn', event: 'broker.model.none_viable', fields: { rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({ provider: candidate.providerId, model: candidate.modelId, reason, route_id: candidate.routeId, credential_source: candidate.credentialSource })), rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16) } });
     return undefined;
 }
 /**