@north-light/crouter 0.3.173 → 0.3.174

package/dist/core/__tests__/{full → seam}/broker-attach-stream.test.js

@@ -1,11 +1,12 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-attach-stream.test.ts
+// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-attach-stream.test.ts
 //
-// FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
+// COMPILED SEAM (real-boot-bound): tmux-free, but it boots a REAL broker process
+// (~5s pi-SDK load), so it lives in seam/ (CI), not the fast local loop.
 //
 // T8 — the `crtr surface attach` acceptance gate, gates G1/G1b/G2 (controller drive,
-// relay/coalescing, detach survival). Split out of
-// broker-lifecycle.test.ts; the gates are the original acceptance gate, unchanged.
+// relay/coalescing, detach survival) plus the deliver ack's truthfulness (G3).
+// Split out of broker-lifecycle.test.ts; the gates are the original acceptance
+// gate, unchanged.
 //
 // 3-PART HEADER (headless-retarget):
 //  (1) BUG IT LOCKS — the broker's client fan-out: a controller `prompt` must run
@@ -22,7 +23,7 @@
 //      the lock holds headlessly (createHeadlessHarness, no tmux). It needs a REAL
 //      broker PROCESS (not just model state) because it proves the cross-process
 //      frame codec + fan-out + coalescer, which is why this file keeps ONE real
-//      boot — shared across all three gates to stay off the fast-tier long pole.
+//      boot shared across all three gates.
 //  (3) HOW THE HEADLESS DRIVE STILL FAILS ON REGRESSION — each gate attaches the
 //      PRODUCTION ViewSocketClient over the real socket and asserts on the frames
 //      the real broker relays (order, types, snapshot, pid stability). A broken
@@ -39,7 +40,8 @@ import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
 import { isPidAlive } from '../../canvas/pid.js';
-import { createAttachKit, delay, tok, frameHas } from '../helpers/broker-clients.js';
+import { createAttachKit, brokerLogText, delay, tok, frameHas } from '../helpers/broker-clients.js';
+import { REJECT_PROMPT_CALL } from '../fixtures/fake-engine.js';
 let h;
 let id; // ONE shared broker, reused across G1/G1b/G2 (1 real boot, not 3)
 const kit = createAttachKit(() => h);
@@ -131,3 +133,33 @@ test('G2 — detach (bye+close) leaves the broker alive + the engine still emitt
     assert.ok(o.welcome.snapshot.messages.length > 0, 'G2: the engine produced a message after the detach');
     assert.equal(isPidAlive(pid), true, 'G2: broker still alive after the post-detach turn');
 });
+// ---------------------------------------------------------------------------
+// G3 — the interactive `deliver` ack reports the ENGINE CALL's real outcome, not
+// the fact that a call was routed. A `session.prompt()` that REJECTS outright —
+// the shape a broker whose model resolved but whose provider has no installed
+// credential produces ("No API key found for anthropic") — used to still ack
+// ok:true, so crtrd returned `delivered:true, delivered_via:engine` for a message
+// the engine had refused and the one-shot client closed before the error frame
+// arrived: the message vanished with no trace. The ack now races acceptance (the
+// engine's own agent_start) against rejection and records
+// `broker.prompt.deliver_failed` in the node's job/log.jsonl. Shares this file's
+// one broker: the contract is two frames on an attached controller.
+// ---------------------------------------------------------------------------
+test('G3 — a deliver whose prompt rejects acks ok:false and records deliver_failed; a succeeding deliver acks ok:true via prompt', async () => {
+    // Both delivers must route as `prompt` (idle), never `steer` — the steer route
+    // legitimately acks at routing time — so attach only once the engine is idle.
+    const c = await attachUntil(id, 'controller', 'g3-ctrl', (a) => a.welcome.role === 'controller' && a.welcome.snapshot.state.isStreaming === false, 'G3 controller admitted while the engine is idle');
+    // FAILURE: the engine refuses the call itself. Before the fix this acked
+    // ok:true and the rejection left no trace in the node's log.
+    c.send({ type: 'deliver', id: 'd-fail', text: `do a thing ${REJECT_PROMPT_CALL}` });
+    const failAck = await c.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-fail', 'G3 rejected deliver ack');
+    assert.equal(failAck.type === 'ack' && failAck.ok, false, 'G3: a rejected prompt must not ack delivered:true');
+    assert.match((failAck.type === 'ack' ? failAck.detail : undefined) ?? '', /No API key found/, 'G3: the ack detail carries the engine rejection');
+    await h.waitFor(() => (brokerLogText(h, id).includes('broker.prompt.deliver_failed') ? true : null), { label: 'G3 broker.prompt.deliver_failed recorded in job/log.jsonl' });
+    // POSITIVE CONTROL: an ordinary deliver still acks ok:true from acceptance
+    // (the engine's agent_start), detail naming the prompt route.
+    c.send({ type: 'deliver', id: 'd-ok', text: 'an ordinary interactive message' });
+    const okAck = await c.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-ok', 'G3 accepted deliver ack');
+    assert.equal(okAck.type === 'ack' && okAck.ok, true, 'G3: an accepted prompt acks delivered:true');
+    assert.equal(okAck.type === 'ack' ? okAck.detail : undefined, 'prompt');
+});

package/dist/core/__tests__/{full → seam}/broker-crash-teardown.test.js

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-crash-teardown.test.ts
+// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-crash-teardown.test.ts
 //
 // Daemon-epoch broker ownership, real-process crash and teardown. The broker's
 // exit event is the sole death authority: a SIGTERM of a streaming broker
@@ -14,9 +14,9 @@
 // broker and reboots the node through THIS process's reviveNode, so every
 // broker below is harness-fleet-owned and every SIGKILL's REAL ChildProcess
 // exit drives policy automatically — no synthetic delivery, no tick, no grace.
-// Short-lived exits pay the real respawn backoff (5s, then 10s), so the one
-// broker lifecycle is split across two serial tests to fit the tier's
-// per-test budget.
+// Each crash has its own real broker setup, so either top-level test remains a
+// complete journey under name filtering and pays only its own first respawn
+// backoff.
 import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
@@ -28,10 +28,6 @@ import { RUNTIME_RESTART_CONTINUATION } from '../../runtime/kickoff.js';
 import { jobDir } from '../../canvas/paths.js';
 let h;
 let root;
-// One broker lifecycle threaded through the two serial tests below.
-let id;
-let boots;
-let idleRevivedPid;
 let priorHoldTurn;
 before(async () => {
     priorHoldTurn = process.env['PI_FAKE_ENGINE_HOLD_TURN'];
@@ -48,12 +44,12 @@ after(async () => {
         process.env['PI_FAKE_ENGINE_HOLD_TURN'] = priorHoldTurn;
 });
 // ===========================================================================
-// Items 4 + 5 + 6 — one real broker lifecycle:
-//   graceful busy teardown → strict resume + continuation → dirty interrupted-turn
-//   crash → recovery cycle → close.
+// Items 4 + 5 + 6 — two independent real-process journeys:
+//   graceful busy teardown → strict resume + continuation;
+//   dirty interrupted-turn crash → recovery cycle → close.
 // ===========================================================================
 test('SIGTERM of a busy broker aborts cleanly and resumes with a continuation', { timeout: 30_000 }, async () => {
-    id = await h.spawnHeadlessChild(root, 'headless worker — crash+teardown');
+    const id = await h.spawnHeadlessChild(root, 'headless worker — graceful crash recovery');
     const boot1 = await h.awaitBoot(id);
     const oldPid = h.node(id).pi_pid;
     assert.equal(oldPid, boot1.pid, 'canvas pid identifies the broker that booted the session');
@@ -61,7 +57,7 @@ test('SIGTERM of a busy broker aborts cleanly and resumes with a continuation',
     await h.waitFor(() => existsSync(h.brokerSock(id)), { label: 'broker socket bound' });
     await h.waitFor(() => existsSync(join(jobDir(id), 'busy')), { label: 'fixture turn is active before SIGTERM' });
     assert.equal(h.node(id).intent ?? null, null, 'fresh broker has a null intent (not refresh/idle-release)');
-    boots = h.bootCount(id);
+    const boots = h.bootCount(id);
     // SIGTERM exercises broker.ts's bounded session.abort() path. Its REAL child
     // exit sees the broker-written clean-abort certificate and resumes only after
     // the first-failure backoff; no synthetic fleet delivery is involved.
@@ -70,37 +66,42 @@ test('SIGTERM of a busy broker aborts cleanly and resumes with a continuation',
     assert.equal(existsSync(join(jobDir(id), 'clean-abort')), true, 'settled abort leaves durable clean-abort evidence before exit policy respawns');
     // This is the file's SECOND real broker boot (exit-event recovery), behind a
     // 5s short-lived-exit backoff, on an oversubscribed CI runner sharing the
-    // host with the other full-tier files' own broker spawns. Give it a wide,
+    // host with the other compiled-seam files' own broker spawns. Give it a wide,
     // still-bounded ceiling.
     const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
     assert.equal(boot2.resuming, true, 'clean-abort exit-event recovery RESUMES the saved .jsonl');
     assert.equal(boot2.prompt, RUNTIME_RESTART_CONTINUATION, 'the strict resume injects the runtime-restart continuation');
     assert.ok(!boot2.rawArgv.includes('--crtr-new-cycle'), 'clean abort never starts a recovery cycle');
-    idleRevivedPid = h.node(id).pi_pid;
-    assert.ok(idleRevivedPid != null && isPidAlive(idleRevivedPid), 'the revived broker pid is alive');
-    assert.notEqual(idleRevivedPid, oldPid, 'the revived pid is distinct from the crashed one');
+    const revivedPid = h.node(id).pi_pid;
+    assert.ok(revivedPid != null && isPidAlive(revivedPid), 'the revived broker pid is alive');
+    assert.notEqual(revivedPid, oldPid, 'the revived pid is distinct from the crashed one');
     assert.equal(isPidAlive(oldPid), false, 'one-writer: the crashed pid never resurrected');
 });
 test('SIGKILL of a busy broker stays a dirty recovery cycle; close tears down the replacement', { timeout: 30_000 }, async () => {
-    // A second crash occurs with only the durable busy marker — SIGKILL cannot run
-    // the abort handler or write clean-abort evidence. Strict resume would only
-    // reopen the transcript at an idle prompt; the policy must select resume:false
-    // and inject the normal fresh-cycle kickoff. This second short-lived exit pays
-    // the 10s backoff before the recovery cycle.
+    const id = await h.spawnHeadlessChild(root, 'headless worker — dirty crash+teardown');
+    const boot1 = await h.awaitBoot(id);
+    const boots = h.bootCount(id);
+    const busyPid = h.node(id).pi_pid;
+    assert.equal(busyPid, boot1.pid, 'canvas pid identifies the broker that owns the dirty-crash session');
+    assert.equal(isPidAlive(busyPid), true, 'busy broker is alive before SIGKILL');
+    // This broker has only the durable busy marker — SIGKILL cannot run the abort
+    // handler or write clean-abort evidence. Strict resume would only reopen the
+    // transcript at an idle prompt; policy must select resume:false and inject the
+    // normal fresh-cycle kickoff after this journey's first 5s backoff.
     markBusy(id);
-    process.kill(idleRevivedPid, 'SIGKILL');
-    await h.waitFor(() => !isPidAlive(idleRevivedPid), { label: 'mid-turn crashed broker pid is dead' });
-    const boot3 = await h.awaitBoot(id, { minCount: boots + 2, timeoutMs: 25_000 });
+    process.kill(busyPid, 'SIGKILL');
+    await h.waitFor(() => !isPidAlive(busyPid), { label: 'mid-turn crashed broker pid is dead' });
+    const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
     // The fake SessionManager reports `resuming=true` for ANY existing session
     // path, including a cycle; production distinguishes cycling with the argv
     // token and non-null kickoff. Assert those load-bearing inputs directly.
-    const recoveryArgv = boot3.rawArgv;
+    const recoveryArgv = boot2.rawArgv;
     assert.ok(recoveryArgv.includes('--crtr-new-cycle'), 'a surviving busy marker selects --crtr-new-cycle');
-    assert.match(boot3.prompt ?? '', /You have been revived fresh after a context refresh/, 'the recovery cycle receives a real roadmap\/feed\/context kickoff');
+    assert.match(boot2.prompt ?? '', /You have been revived fresh after a context refresh/, 'the recovery cycle receives a real roadmap\/feed\/context kickoff');
     const recoveryPid = h.node(id).pi_pid;
     assert.ok(recoveryPid != null && isPidAlive(recoveryPid), 'the recovery-cycle broker pid is alive');
-    assert.notEqual(recoveryPid, idleRevivedPid, 'the recovery cycle uses a distinct broker pid');
-    assert.equal(isPidAlive(idleRevivedPid), false, 'one-writer: the interrupted pid never resurrected');
+    assert.notEqual(recoveryPid, busyPid, 'the recovery cycle uses a distinct broker pid');
+    assert.equal(isPidAlive(busyPid), false, 'one-writer: the interrupted pid never resurrected');
     // --- Item 5: clean teardown of the (revived, live) broker. node lifecycle close marks
     //     canceled BEFORE teardown (crash-safe order), then hostFor(broker).teardown
     //     sends the `shutdown` frame → the broker disposes + exits, socket unlinked. ---

package/dist/core/__tests__/{full → seam}/broker-pane-resolution.test.js

@@ -1,10 +1,10 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-pane-resolution.test.ts
+// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-pane-resolution.test.ts
 //
 // REGRESSION — broker-hosted nodes were second-class in the tmux command
 // surface (audit: findings-headless-default.md, Gaps 1 + 3). Both regressions
-// are observable only with a REAL tmux pane, so this is a FULL-tier test.
+// are observable only with a REAL tmux pane, so this is a compiled-seam test.
 //
-// (1) Gap 1 — `nodeInPane()` (src/commands/node.ts) resolved a pane via
+// (1) Gap 1 — `nodeInPane()` (src/commands/surface/node/placement.ts) resolved a pane via
 //     window→node ONLY. A broker engine runs DETACHED with window=null, and its
 //     on-screen presence is a `crtr surface attach` VIEWER pane, so the window lookup
 //     never found it: viewer navigation and node lifecycle operations all
@@ -22,13 +22,23 @@
 //     node, the second reused IN PLACE (in_place=true). A focus() that always
 //     opened a fresh pane would yield two tagged panes (or crash on the UNIQUE
 //     constraint) — either way this goes RED.
+//
+// (4) `node lifecycle demote --detach` (the Alt+C → D menu path) CLOSES the
+//     node's viewer pane and its `@crtr_node` tag while the broker ENGINE keeps
+//     running untouched, reconnectable by a later focus. Only the pane-closing
+//     half needs tmux — "detach leaves the broker running" is already proved
+//     headlessly by broker-attach-stream G2 — so it rides this file's pane, tag
+//     helpers and budget instead of its own harness.
 import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { createHarness, hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
-import { taggedViewerPanes, waitForOneTaggedViewer } from '../helpers/viewer-panes.js';
+import { paneTag, taggedViewerPanes, waitForOneTaggedViewer } from '../helpers/viewer-panes.js';
 import { closeDb } from '../../canvas/db.js';
-import { nodeInPane } from '../../../commands/node.js';
+import { isPidAlive } from '../../canvas/pid.js';
+import { nodeInPane } from '../../../commands/surface/node/placement.js';
 let h;
 let root;
 before(async () => {
@@ -153,3 +163,42 @@ test('surface node focus reuses a viewer in another session instead of reopening
         spawnSync('tmux', ['kill-session', '-t', otherSession], { stdio: 'ignore', timeout: TMUX_TIMEOUT_MS });
     }
 });
+// 30s for the same reason as the two tests above: the viewer self-tags
+// asynchronously on connect, and this test waits for that tag before detaching.
+test('node lifecycle demote --detach closes the viewer pane + tag while the broker engine keeps running', { timeout: 30_000 }, async (t) => {
+    if (!hasTmux())
+        return t.skip('tmux unavailable');
+    const broker = await h.spawnHeadlessChild(root, 'detach while the broker keeps running');
+    closeDb();
+    // Make the node NON-EMPTY (it produced an assistant message) so `--detach`
+    // exercises the "close the viewer, broker survives" contract and NOT the
+    // reap-empty path, which tears an output-less shell down.
+    const sessionFile = h.node(broker).pi_session_file;
+    assert.ok(sessionFile != null, 'the node has a session file');
+    mkdirSync(join(sessionFile, '..'), { recursive: true });
+    writeFileSync(sessionFile, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
+    // Put the node genuinely on screen: one viewer pane beside a caller pane.
+    const caller = makePane();
+    const focused = h.cli(broker, ['surface', 'node', 'focus', broker, '--pane', caller]);
+    assert.equal(focused.code, 0, `surface node focus exit 0\n${focused.stderr}`);
+    const viewerPane = await waitForOneTaggedViewer(h.session, broker);
+    // The engine the detach must NOT disturb is the one serving the viewer that is
+    // now on screen, so read its pid here — a headless child that idle-released
+    // after its kickoff turn is revived BY the focus, under a new pid.
+    closeDb();
+    const brokerPid = h.node(broker).pi_pid;
+    assert.ok(isPidAlive(brokerPid), 'broker engine alive before the detach');
+    // Drive the REAL verb on the focused node (the Alt+C → D menu path).
+    const res = h.cli(broker, ['node', 'lifecycle', 'demote', '--node', broker, '--pane', viewerPane, '--detach']);
+    assert.equal(res.code, 0, `node lifecycle demote --detach exit 0\n${res.stderr}`);
+    assert.match(res.stdout, /viewer closed \(broker still running off-screen\)/, `the verb reports the viewer closed with the broker alive\n${res.stdout}`);
+    closeDb();
+    const after = h.node(broker);
+    assert.equal(after.status, 'active', 'detach does NOT end the node');
+    assert.equal(after.lifecycle, 'terminal', 'lifecycle flips terminal IN PLACE');
+    assert.equal(after.pi_pid, brokerPid, 'the broker pid is UNCHANGED (engine not killed or respawned)');
+    assert.equal(isPidAlive(brokerPid), true, 'the broker engine keeps running off-screen');
+    // The viewer pane is CLOSED and untagged — no orphaned/phantom viewport.
+    await h.waitFor(() => (taggedViewerPanes(h.session, broker).length === 0 ? true : null), { label: 'the detached viewer pane is gone from the tag registry' });
+    assert.equal(paneTag(viewerPane), '', 'NO phantom @crtr_node tag resolves on the closed viewer %id');
+});

package/dist/core/__tests__/{full → seam}/broker-provider-retry.test.js

@@ -1,8 +1,10 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-provider-retry.test.ts
+// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-provider-retry.test.ts
 //
-// Broker-level regression coverage for turn-time provider rotation. The fake
-// engine emits pi's actual auto_retry_start event over session.subscribe, so this
-// exercises runBroker's live retry handler rather than its helpers in isolation.
+// Broker-level regression coverage for turn-time provider rotation, context
+// overflow settlement, model-choice durability, and the model-less launch
+// re-drive. The fake engine emits pi's actual lifecycle events over
+// session.subscribe, so this exercises runBroker's live handlers rather than
+// its helpers in isolation.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
@@ -26,6 +28,7 @@ function resolvedModel(spec) {
 const OPENAI_STRONG = resolvedModel('openai/strong');
 let h;
 const kit = createAttachKit(() => h);
+const { attachUntil } = kit;
 function poolPath(provider) {
     const name = provider === 'anthropic' ? 'anthropic-subscriptions.json' : 'openai-codex-subscriptions.json';
     return join(h.agentHome, '.pi', 'agent', name);
@@ -38,9 +41,24 @@ function seedPool(provider, cooling) {
             rateLimitedUntil: cooling ? Date.now() + 60_000 : 0, lastAttemptAt: 0, lastRateLimitedAt: 0,
         }]));
 }
+// The node's recorded model (fake-pi.model.json, written by the fake's
+// recordModel) — `null` for a model-less boot. A disk read, so it survives the
+// broker exiting after its kickoff turn idle-releases.
 function model(id) {
     return JSON.parse(readFileSync(join(h.home, 'nodes', id, 'fake-pi.model.json'), 'utf8'));
 }
+// The fake engine records each settled overflow episode's outcome in
+// fake-pi.overflow.json, OVERWRITING it per episode. Two episodes on one broker
+// must therefore gate on the parsed `outcome`, never on file existence.
+function overflowOutcome(id) {
+    try {
+        const raw = readFileSync(join(h.home, 'nodes', id, 'fake-pi.overflow.json'), 'utf8');
+        return JSON.parse(raw).outcome ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 // Every fired lifecycle event is appended to fake-pi.events.jsonl. A broker
 // re-drive is a fresh session.prompt → emitTurn, which fires one 'agent_start';
 // counting them is the observable proof of how many times the turn was re-driven.
@@ -178,35 +196,20 @@ test('reload_auth leaves a parked auth fault with its original session when navi
     assert.equal(agentStartCount(child), baselineStarts, 'the replacement session receives no stale recovery prompt');
     controller.close();
 });
-test('successful compact-and-retry settles without a fatal fault or terminal transition', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('recovered overflow parent');
+// Both overflow outcomes on ONE broker, in order: Pi's compact-and-retry
+// recovers (nothing is committed, the child lives), and only then does a
+// definitive failure make the episode terminal.
+test('a recovered compact-and-retry commits nothing, while a definitive failure publishes one structured overflow fault and terminal notice', { timeout: 30_000 }, async () => {
+    const parent = h.spawnRoot('overflow parent');
     seedPool('anthropic', false);
     seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'recovered overflow child', { model: OPENAI_STRONG.spec });
+    const child = await h.spawnHeadlessChild(parent, 'overflow child', { model: OPENAI_STRONG.spec });
     h.fakeCmd(child, { cmd: 'overflow', outcome: 'recover' });
-    await h.waitFor(() => existsSync(join(h.home, 'nodes', child, 'fake-pi.overflow.json')), { label: 'recovered overflow reached agent_settled' });
+    await h.waitFor(() => overflowOutcome(child) === 'recover' ? true : null, { label: 'recovered overflow reached agent_settled' });
     await h.tick();
     assert.equal(readFault(child), null, 'raw overflow is never committed before Pi recovery settles');
     assert.notEqual(h.status(child), 'dead', 'a recovered child remains live');
     assert.doesNotMatch(h.inbox(parent).map((entry) => entry.label).join('\n'), /context window|will not recover/i, 'recovery publishes no fatal parent notice');
-});
-test('queued continuation success supersedes an earlier definitive compaction failure', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('continued overflow parent');
-    seedPool('anthropic', false);
-    seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'continued overflow child', { model: OPENAI_STRONG.spec });
-    h.fakeCmd(child, { cmd: 'overflow', outcome: 'failure-continued' });
-    await h.waitFor(() => existsSync(join(h.home, 'nodes', child, 'fake-pi.overflow.json')), { label: 'post-failure continuation reached agent_settled' });
-    await h.tick();
-    assert.equal(readFault(child), null, 'the final successful continuation owns the settled provider outcome');
-    assert.notEqual(h.status(child), 'dead', 'an earlier compaction failure cannot reap a recovered child');
-    assert.doesNotMatch(h.inbox(parent).map((entry) => entry.label).join('\n'), /context window|will not recover/i, 'the superseded compaction failure publishes no parent notice');
-});
-test('failed compact-and-retry publishes one structured overflow fault and terminal notice', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('failed overflow parent');
-    seedPool('anthropic', false);
-    seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'failed overflow child', { model: OPENAI_STRONG.spec });
     // A settled ordinary provider failure leaves an active daemon-owned retry
     // marker in place while the next turn runs. The later terminal overflow must
     // supersede that marker rather than lose to its priority in fault storage.
@@ -222,7 +225,7 @@ test('failed compact-and-retry publishes one structured overflow fault and termi
     }, { label: 'ordinary settled provider fault published' });
     assert.equal(autoFault.kind, 'rate-limit', 'ordinary settled provider failures retain broker-owned retry behavior');
     h.fakeCmd(child, { cmd: 'overflow', outcome: 'fail' });
-    await h.waitFor(() => existsSync(join(h.home, 'nodes', child, 'fake-pi.overflow.json')), { label: 'failed overflow reached agent_settled' });
+    await h.waitFor(() => overflowOutcome(child) === 'fail' ? true : null, { label: 'failed overflow reached agent_settled' });
     const fault = readFault(child);
     assert.equal(fault?.kind, 'context-overflow');
     assert.equal(fault?.op, 'context overflow recovery');
@@ -233,65 +236,53 @@ test('failed compact-and-retry publishes one structured overflow fault and termi
     const notices = h.inbox(parent).filter((entry) => /exceeded its model context window/i.test(entry.label));
     assert.equal(notices.length, 1, 'the parent receives exactly one structured overflow notice');
 });
-test('raw overflow settling without compaction terminates instead of hanging', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('uncompacted overflow parent');
-    seedPool('anthropic', false);
-    seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'uncompacted overflow child', { model: OPENAI_STRONG.spec });
-    h.fakeCmd(child, { cmd: 'overflow', outcome: 'uncompacted' });
-    await h.waitFor(() => existsSync(join(h.home, 'nodes', child, 'fake-pi.overflow.json')), { label: 'uncompacted overflow reached agent_settled' });
-    const fault = readFault(child);
-    assert.equal(fault?.kind, 'context-overflow', 'settlement makes a raw overflow terminal when recovery never began');
-    assert.equal(fault?.retry.disposition, 'fatal');
-    await h.tick();
-    assert.equal(h.status(child), 'dead', 'settled raw overflow cannot leave the child hanging');
-});
-test('an explicit picker choice pins and clears prior logical routing; an internal no-raw-token path preserves that decision', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('picker frame parent');
-    seedPool('anthropic', false);
-    seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'picker frame child', { model: 'openai/strong' }); // logical route boot
-    const ctrl = await kit.attach(child, 'controller', 'picker-test');
-    ctrl.send({ type: 'set_model', model: OPENAI_STRONG.spec }); // exactly what buildModelPicker sends — no `pinned`
-    await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'set_model', 'picker set_model acked');
-    let after = h.node(child);
-    assert.equal(after.launch?.modelProviderPinned, true, 'the omitted-pinned frame derives pinned from the real openai-codex registry namespace');
-    assert.equal(after.launch?.modelIntent, undefined, 'the explicit concrete choice clears the logical launch intent');
-    assert.equal(after.launch?.env.CRTR_MODEL_INTENT, undefined, 'a revive cannot restore the stale logical route intent');
-    // `cycle_ladder` — an internal no-raw-token path (no `model`/`pinned` on the
-    // frame at all) — reuses the SAME resolve+setModel machinery `set_model` does
-    // (real `nextLadderModel`/`resolveModelQuery`, the fake engine's real
-    // `session.setModel`), unlike `cycle_model` which the fake engine's session
-    // does not implement. `broadcastModelChanged()` is called here with no
-    // override, so the existing pin must survive verbatim.
-    ctrl.send({ type: 'cycle_ladder', direction: 'forward' });
-    await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'cycle_ladder acked');
-    after = h.node(child);
-    assert.equal(after.launch?.modelProviderPinned, true, 'an internal no-raw-token change (cycle_ladder) preserves the existing pin verbatim');
-    ctrl.close();
-});
-test("a user's Alt+M and Shift+Tab choices replace stale launch intent for restart replay", { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('session choice durability parent');
+// Two real logical launches keep both user paths non-vacuous: the picker first
+// proves an explicit concrete choice pins and clears routing, while Alt+M runs
+// directly against still-present logical intent before Shift+Tab and replay.
+test("picker and Alt+M choices each clear logical routing, and Alt+M / Shift+Tab become the durable restart recipe", { timeout: 30_000 }, async () => {
+    const parent = h.spawnRoot('model durability parent');
     seedPool('anthropic', false);
     seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'session choice durability child', { model: 'openai/strong' });
-    const before = h.node(child);
-    assert.deepEqual(before.launch?.modelIntent, { family: 'openai', strength: 'strong' }, 'fixture starts from a logical launch preference');
-    assert.equal(before.launch?.env.CRTR_MODEL_INTENT, 'openai/strong');
-    const ctrl = await kit.attach(child, 'controller', 'session-choice-durability');
-    ctrl.send({ type: 'cycle_ladder', direction: 'forward' });
-    await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'Alt+M cycle acked');
-    let after = h.node(child);
-    assert.equal(after.launch?.modelIntent, undefined, 'Alt+M replaces the old logical route intent');
-    assert.equal(after.launch?.env.CRTR_MODEL_INTENT, undefined, 'a restarted broker cannot resolve the old route over the selected rung');
+    const pickerNode = await h.spawnHeadlessChild(parent, 'picker durability child', { model: 'openai/strong' });
+    const pickerBefore = h.node(pickerNode);
+    assert.deepEqual(pickerBefore.launch?.modelIntent, { family: 'openai', strength: 'strong' }, 'picker fixture starts from a logical launch preference');
+    assert.equal(pickerBefore.launch?.env.CRTR_MODEL_INTENT, 'openai/strong');
+    const pickerCtrl = await kit.attach(pickerNode, 'controller', 'picker-durability-test');
+    pickerCtrl.send({ type: 'set_model', model: OPENAI_STRONG.spec }); // exactly what buildModelPicker sends — no `pinned`
+    await pickerCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'set_model', 'picker set_model acked');
+    let pickerState = h.node(pickerNode);
+    assert.equal(pickerState.launch?.modelProviderPinned, true, 'the omitted-pinned frame derives pinned from the real openai-codex registry namespace');
+    assert.equal(pickerState.launch?.modelIntent, undefined, 'the explicit concrete choice clears the logical launch intent');
+    assert.equal(pickerState.launch?.env.CRTR_MODEL_INTENT, undefined, 'a revive cannot restore the stale logical route intent');
+    // `cycle_ladder` carries no raw model/pin token. Running it after the picker
+    // proves that this internal change preserves the concrete provider pin.
+    pickerCtrl.send({ type: 'cycle_ladder', direction: 'forward' });
+    await pickerCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'post-picker Alt+M cycle_ladder acked');
+    pickerState = h.node(pickerNode);
+    assert.equal(pickerState.launch?.modelProviderPinned, true, 'an internal no-raw-token ladder change preserves the explicit picker pin');
+    pickerCtrl.close();
+    // A separate logical launch reaches Alt+M with BOTH intent representations
+    // still populated. This is the regression path: a user-selected ladder rung
+    // must clear them before a restart can resolve the stale route over it.
+    const ladderNode = await h.spawnHeadlessChild(parent, 'ladder durability child', { model: 'openai/strong' });
+    const ladderBefore = h.node(ladderNode);
+    assert.deepEqual(ladderBefore.launch?.modelIntent, { family: 'openai', strength: 'strong' }, 'Alt+M starts with durable logical modelIntent present');
+    assert.equal(ladderBefore.launch?.env.CRTR_MODEL_INTENT, 'openai/strong', 'Alt+M starts with the launch environment intent present');
+    const ladderCtrl = await kit.attach(ladderNode, 'controller', 'ladder-durability-test');
+    ladderCtrl.send({ type: 'cycle_ladder', direction: 'forward' });
+    await ladderCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'logical-launch Alt+M cycle_ladder acked');
+    let after = h.node(ladderNode);
+    assert.equal(after.launch?.modelIntent, undefined, 'Alt+M clears the durable logical launch intent');
+    assert.equal(after.launch?.env.CRTR_MODEL_INTENT, undefined, 'Alt+M clears the logical intent from the restart environment');
+    assert.equal(after.launch?.modelProviderPinned, ladderBefore.launch?.modelProviderPinned, 'Alt+M preserves the existing pin state verbatim');
     assert.equal(after.launch?.model, after.model_override, 'the selected model and thinking rung is the durable revive recipe');
     const rung = after.launch?.model;
     assert.ok(rung, 'Alt+M persisted a concrete model rung');
-    const thinkingFrameOffset = ctrl.frames.length;
-    ctrl.send({ type: 'cycle_thinking' });
-    const thinkingChanged = await h.waitFor(() => ctrl.frames.slice(thinkingFrameOffset).find((f) => f.type === 'thinking_level_changed') ?? null, { label: 'Shift+Tab thinking change relayed' });
-    await ctrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_thinking', 'Shift+Tab cycle acked');
-    after = h.node(child);
+    const thinkingFrameOffset = ladderCtrl.frames.length;
+    ladderCtrl.send({ type: 'cycle_thinking' });
+    const thinkingChanged = await h.waitFor(() => ladderCtrl.frames.slice(thinkingFrameOffset).find((f) => f.type === 'thinking_level_changed') ?? null, { label: 'Shift+Tab thinking change relayed' });
+    await ladderCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_thinking', 'Shift+Tab cycle acked');
+    after = h.node(ladderNode);
     const level = thinkingChanged.type === 'thinking_level_changed' ? thinkingChanged.level : 'off';
     const bareRung = rung.replace(/:(?:off|minimal|low|medium|high|xhigh|max)$/, '');
     const expected = `${bareRung}${level === 'off' ? '' : `:${level}`}`;
@@ -302,7 +293,7 @@ test("a user's Alt+M and Shift+Tab choices replace stale launch intent for resta
     assert.notEqual(modelArg, -1, 'a daemon revive replays a model argument');
     assert.equal(replay.argv[modelArg + 1], expected, 'the replayed model argument carries both choices');
     assert.equal(replay.env.CRTR_MODEL_INTENT, undefined, 'the stale logical intent is absent from the restarted broker environment');
-    ctrl.close();
+    ladderCtrl.close();
 });
 test('reload_auth restores a newly authenticated personal route before the next idle prompt', { timeout: 30_000 }, async () => {
     const personal = { provider: 'personal-anthropic', id: 'claude-personal' };
@@ -354,3 +345,64 @@ test('reload_auth restores a newly authenticated personal route before the next
         rmSync(userConfigPath, { force: true });
     }
 });
+// MODEL-LESS LAUNCH RE-DRIVE — MUST REMAIN THE LAST TEST IN THIS FILE. Its
+// zero-auth seam, <CRTR_HOME>/fake-pi.no-auth, is HOME-GLOBAL: while it exists
+// the fake engine's modelRegistry reports a genuine zero-auth boot, so no other
+// boot may overlap it. Arming it before the spawn is race-free against the
+// broker's boot-time registry read, and deleting it mid-test is a live auth-on
+// flip that reload_auth's modelRegistry.refresh() re-reads (fake-engine.ts,
+// createAgentSessionServices).
+//
+// Locks two broker.ts launch-model fixes:
+//   0b unknown-stub detection — the SDK hands a model-less session an
+//      unknown-stub model (never `undefined`), so sessionHasNoModel() must defer
+//      the kickoff instead of prompting a keyless engine.
+//   0a self-healing model-less registry — the construction-time mask that
+//      suppresses the SDK's findInitialModel must reveal() the instant
+//      construction returns, or list_models stays broken forever for a
+//      model-less-booted node even after a /login. The auth-on list_models
+//      assertion below is the ONLY one that discriminates that bug: with the
+//      mask never revealed, getAvailable() returns [] forever.
+//
+// The request is LOGICAL (`anthropic/medium`), deliberately. A CONCRETE pin can
+// never reach a model-less boot: both `node new`'s assertLaunchModelRegistered
+// and resolveLaunchModel's own unregisteredConcreteModel gate treat a concrete
+// spec absent from the serving registry as a FATAL model-not-found, and under
+// the zero-auth sentinel every spec is absent. A logical request skips both
+// gates by design, so the zero-auth window produces the tier-3 model-less boot
+// this test exists to cover. After the flip its candidate tail includes the
+// fake registry's non-managed `fake/fake-model`, whose hasConfiguredAuth() the
+// sentinel controls — so the re-drive resolves without needing managed
+// subscription-pool occupancy (broker-sdk-wiring's scope).
+test('login re-drive → list_models self-heals (0a) and reload_auth resolves a model + fires the deferred kickoff', { timeout: 30_000 }, async () => {
+    const noAuthSentinel = join(h.home, 'fake-pi.no-auth');
+    writeFileSync(noAuthSentinel, '1');
+    try {
+        const parent = h.spawnRoot('login re-drive parent');
+        const child = await h.spawnHeadlessChild(parent, 'login re-drive', { model: 'anthropic/medium' });
+        assert.equal(model(child), null, 'boots model-less under zero-auth');
+        assert.equal(agentStartCount(child), 0, 'kickoff deferred at boot');
+        const c = await attachUntil(child, 'controller', 'redrive-ctrl', (a) => a.welcome.role === 'controller', 'redrive controller admitted');
+        // A read-op reply is a correlated `data` frame the client swallows into
+        // request()'s by-id resolver (NEVER a generic 'frame'), so we MUST use
+        // client.request(), not send()+waitFrame.
+        // Baseline: under zero-auth the registry reports nothing available.
+        const lm0 = await c.client.request({ type: 'list_models' });
+        assert.ok(lm0.kind === 'list_models' && lm0.availableIds.length === 0, 'zero-auth: no models available');
+        // FLIP AUTH ON, then re-query while the broker is still alive (no turn has run
+        // yet). getAvailable() flows through the revealed construction proxy →
+        // NON-empty. With the mask never revealed it would still be [].
+        rmSync(noAuthSentinel, { force: true });
+        const lm1 = await c.client.request({ type: 'list_models' });
+        assert.ok(lm1.kind === 'list_models' && lm1.availableIds.length > 0, 'auth on: list_models reports an available model (0a self-heal — the construction mask revealed)');
+        // reload_auth re-drives the launch policy → resolves a model and fires the
+        // deferred kickoff. Disk reads, so they survive the broker idle-releasing
+        // once that kickoff turn ends.
+        c.send({ type: 'reload_auth' });
+        await h.waitFor(() => model(child) !== null, { label: 're-drive selected a model' });
+        await h.waitFor(() => agentStartCount(child) >= 1, { label: 'deferred kickoff fired after re-drive' });
+    }
+    finally {
+        rmSync(noAuthSentinel, { force: true });
+    }
+});

package/dist/core/__tests__/{full → seam}/broker-whip-interrupt.test.js

@@ -1,4 +1,4 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/full/broker-whip-interrupt.test.ts
+// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-whip-interrupt.test.ts
 //
 // A whip is a transport-level abort-then-prompt, not an ordinary steering queue
 // entry. This needs a real broker because the guarantee crosses the socket frame,
@@ -31,9 +31,20 @@ test('a whip aborts the active turn before starting its prompt', { timeout: 20_0
     const id = await h.spawnHeadlessChild(root, 'headless worker — held turn');
     const controller = await kit.attach(id, 'controller', 'whip-controller');
     assert.equal(controller.welcome.snapshot.state.isStreaming, true, 'the original turn is held active');
-    const startsBeforeWhip = controller.frames.filter((frame) => frame.type === 'agent_start').length;
+    const frameOffset = controller.frames.length;
     const message = 'Whip command must start after the active turn is interrupted';
     controller.send({ type: 'prompt', text: message, interrupt: true });
-    await h.waitFor(() => controller.frames.filter((frame) => frame.type === 'agent_start').length > startsBeforeWhip || null, { label: 'whip prompt started a new turn after the abort' });
-    assert.ok(controller.frames.some((frame) => frame.type === 'message_start' && JSON.stringify(frame).includes(message)), 'the whip message starts a fresh prompt rather than entering the steering queue');
+    const whipFrames = await h.waitFor(() => {
+        const frames = controller.frames.slice(frameOffset);
+        return frames.some((frame) => frame.type === 'agent_start') &&
+            frames.some((frame) => frame.type === 'message_start' && JSON.stringify(frame).includes(message))
+            ? frames
+            : null;
+    }, { label: 'whip prompt started a new turn after the abort' });
+    const settledIndex = whipFrames.findIndex((frame) => frame.type === 'agent_settled');
+    const whipStartIndex = whipFrames.findIndex((frame) => frame.type === 'agent_start');
+    const whipMessageIndex = whipFrames.findIndex((frame) => frame.type === 'message_start' && JSON.stringify(frame).includes(message));
+    assert.ok(settledIndex >= 0, 'abort releases the held original turn through agent_settled');
+    assert.ok(whipStartIndex > settledIndex, 'the original held turn settles before the whip turn starts');
+    assert.ok(whipMessageIndex > settledIndex, 'the whip message starts only after the original turn settles');
 });