@north-light/crouter 0.3.261 → 0.3.263

package/dist/core/__tests__/integration/broker-sdk-wiring.test.js

@@ -212,7 +212,7 @@ test('C3f — a logical request can reach a non-managed raw-registry fallback wh
                 family: 'custom',
                 credentialSource: 'user',
                 providerId: 'c3prov',
-                models: { strong: 'c3prov/c3model' },
+                models: { ultra: 'c3prov/c3model', strong: 'c3prov/c3model', medium: 'c3prov/c3model', light: 'c3prov/c3model' },
             },
         },
     })}\n`);

package/dist/core/__tests__/model-routes-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/model-routes-config.test.js

@@ -0,0 +1,142 @@
+import { after, afterEach, before, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { persistModelRoute, readConfig, readMergedLaunchConfig } from '../config.js';
+import { expandModelCandidates } from '../model-routes.js';
+import { resetScopeCache } from '../scope.js';
+let home;
+let work;
+let previousHome;
+function route(providerId = 'provider-x', family = 'family-x', credentialSource = 'source-x') {
+    return {
+        family,
+        credentialSource,
+        providerId,
+        models: {
+            ultra: `${providerId}/ultra`,
+            strong: `${providerId}/strong`,
+            medium: `${providerId}/medium`,
+            light: `${providerId}/light`,
+        },
+    };
+}
+function writeConfig(root, config) {
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'config.json'), JSON.stringify(config));
+}
+before(() => {
+    previousHome = process.env.HOME;
+});
+beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-model-routes-home-'));
+    work = mkdtempSync(join(tmpdir(), 'crtr-model-routes-work-'));
+    process.env.HOME = home;
+    resetScopeCache();
+});
+afterEach(() => {
+    resetScopeCache();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(work, { recursive: true, force: true });
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = previousHome;
+    resetScopeCache();
+});
+test('complete routes preserve arbitrary names and credential-source ordering', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            personal: route('shared-provider', 'family/one', 'personal source'),
+            funded: route('shared-provider', 'family/one', 'funded source'),
+        },
+        modelRouting: {
+            credentialSourceOrder: ['funded source', 'personal source'],
+            familyOrder: ['family/one'],
+            strengthFallback: ['strong'],
+        },
+    });
+    const config = readMergedLaunchConfig(work, null);
+    assert.deepEqual(config.modelRoutes?.personal?.models, route('shared-provider', 'family/one', 'personal source').models);
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'family/one', strength: 'strong', spec: 'family/one/strong' }, work, null).map((candidate) => candidate.routeId), ['funded', 'personal'], 'same provider/model refs remain distinct candidates when routes differ');
+});
+test('a sparse upper-scope route patch overlays a complete lower route', () => {
+    writeConfig(join(home, '.crouter'), { modelRoutes: { shared: route() } });
+    writeConfig(join(work, '.crouter'), { modelRoutes: { shared: { models: { medium: 'provider-x/project-medium' } } } });
+    const config = readMergedLaunchConfig(work, null);
+    assert.equal(config.modelRoutes?.shared?.models.medium, 'provider-x/project-medium');
+    assert.equal(config.modelRoutes?.shared?.models.ultra, 'provider-x/ultra');
+});
+test('legacy sparse routes remain readable with no invented cells', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            legacy: { family: 'legacy', credentialSource: 'old', providerId: 'legacy-provider', models: { medium: 'legacy-provider/medium' } },
+        },
+    });
+    const config = readMergedLaunchConfig(work, null);
+    assert.equal(config.modelRoutes, undefined);
+    assert.deepEqual(config.legacyModelRoutes?.legacy?.models, { medium: 'legacy-provider/medium' });
+    assert.deepEqual(readConfig('user').legacyModelRoutes?.legacy?.models, { medium: 'legacy-provider/medium' });
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'legacy', strength: 'medium', spec: 'legacy/medium' }, work, null).map((candidate) => candidate.modelId), ['medium']);
+});
+test('route records retain __proto__ ids when read and persisted', () => {
+    const root = join(home, '.crouter');
+    writeConfig(root, JSON.parse(JSON.stringify({ modelRoutes: { ['__proto__']: route() } })));
+    assert.deepEqual(readMergedLaunchConfig(work, null).modelRoutes?.['__proto__'], route());
+    persistModelRoute(root, '__proto__', route('persisted-provider'));
+    const raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes['__proto__'], route('persisted-provider'));
+});
+test('route candidate identity distinguishes delimiter-containing route and provider ids', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            a: route('b:c', 'family', 'first'),
+            'a:b': route('c', 'family', 'second'),
+        },
+        modelRouting: {
+            credentialSourceOrder: ['first', 'second'],
+            familyOrder: ['family'],
+            strengthFallback: ['strong'],
+        },
+    });
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'family', strength: 'strong', spec: 'family/strong' }, work, null).map((candidate) => candidate.routeId), ['a', 'a:b']);
+});
+test('route writes reject missing cells and provider-prefix mismatches with actionable diagnostics', () => {
+    const root = join(home, '.crouter');
+    const incomplete = { ...route(), models: { strong: 'provider-x/strong' } };
+    assert.throws(() => persistModelRoute(root, 'needs-all-rungs', incomplete), /model route "needs-all-rungs" is incomplete; missing strengths: ultra, medium, light/);
+    assert.throws(() => persistModelRoute(root, 'wrong-provider', { ...route(), models: { ...route().models, light: 'other/light' } }), /model route "wrong-provider" models.light provider prefix must equal providerId/);
+});
+test('invalid route entries do not block valid routes, and no valid routes falls back to local ladders', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            valid: route('valid-provider', 'valid family', 'valid source'),
+            invalid: { family: 'bad', credentialSource: 'bad', providerId: 'one', models: { ultra: 'two/u', strong: 'two/s', medium: 'two/m', light: 'two/l' } },
+        },
+    });
+    assert.deepEqual(Object.keys(readMergedLaunchConfig(work, null).modelRoutes ?? {}), ['valid']);
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            invalid: { family: 'bad', credentialSource: 'bad', providerId: 'one', models: { ultra: 'two/u', strong: 'two/s', medium: 'two/m', light: 'two/l' } },
+        },
+    });
+    assert.equal(readMergedLaunchConfig(work, null).modelRoutes, undefined);
+    assert.equal(expandModelCandidates({ kind: 'logical', family: 'anthropic', strength: 'strong', spec: 'anthropic/strong' }, work, null)[0]?.routeId, 'anthropic');
+});
+test('persistModelRoute touches only its raw route and deletes by restoring inheritance', () => {
+    const root = join(home, '.crouter');
+    const other = route('other-provider');
+    writeConfig(root, { modelRoutes: { other }, max_panes_per_window: 7 });
+    persistModelRoute(root, 'edited', route('edited-provider'));
+    let raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes.other, other);
+    assert.deepEqual(raw.modelRoutes.edited, route('edited-provider'));
+    assert.equal(raw.modelLadders, undefined);
+    assert.equal(raw.max_panes_per_window, 7);
+    persistModelRoute(root, 'edited', undefined);
+    raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes, { other });
+});

package/dist/core/__tests__/on-read-nested-store.test.js

@@ -69,6 +69,11 @@ function makeWorkTree() {
         '  - {on: workspace-open, at: content}\n' +
         '  - {on: read, match: "./**", at: content}\n---\n' +
         `${NESTED_BODY}\n`);
+    // A bootless neighbour in the same discovered store: it wins no delivery of
+    // its own, so only a listing can ever disclose it.
+    writeFileSync(join(nestedStore, 'constraint.md'), '---\nkind: knowledge\n' +
+        'when-and-why-to-read: When changing pkg internals, this knowledge should be read because it names the constraint.\n---\n' +
+        'NESTED NEIGHBOUR BODY\n');
     return work;
 }
 test('a nested store front door surfaces on a read beneath its owning dir, not outside it', () => {
@@ -79,6 +84,9 @@ test('a nested store front door surfaces on a read beneath its owning dir, not o
     writeFileSync(inside, 'export const x = 1;\n');
     const rendered = renderOnReadDocs(node, inside, freshTranscriptTarget());
     assert.ok(rendered.includes(NESTED_BODY), `read beneath pkg surfaces the nested front door; got: ${rendered}`);
+    // A content delivery is a read: the discovered store's own listing comes
+    // with it, answered from the corpus the read walk discovered.
+    assert.match(rendered, /\[\[work\/pkg\/constraint\]\]: When changing pkg internals/, `the delivered front door discloses its directory's bootless member; got: ${rendered}`);
     const outside = join(work, 'docs', 'notes.ts');
     mkdirSync(join(work, 'docs'), { recursive: true });
     writeFileSync(outside, 'export const y = 2;\n');

package/dist/core/__tests__/profile-project-memory-delivery.test.js

@@ -25,11 +25,18 @@ import { spawnNode } from '../runtime/nodes.js';
 import { memoryDir } from '../runtime/memory.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
 import { renderKnowledgeBlock } from '../substrate/render-node.js';
+import { renderKnowledgeForSubject, renderPreferencesForSubject } from '../substrate/render.js';
+import { assembleNodeSubject } from '../substrate/subject.js';
 import { renderWorkspaceOpenDocs } from '../substrate/on-read-node.js';
+import { renderWorkspaceOpenDocsForSubject } from '../substrate/on-read.js';
 import { documentExposedAtOrAbove, emptyContextExposureState, exposedAtOrAbove, exposureTarget, loadContextExposureState, saveContextExposureState, } from '../substrate/injected-store.js';
 import { readLeaf } from '../../commands/memory/read.js';
 import { listLeaf } from '../../commands/memory/list.js';
 import { findLeaf } from '../../commands/memory/find.js';
+import { assembleEventAccounting, docRow, effectivePlan, } from '../../commands/sys/context/resolve.js';
+import { planDelivery } from '../substrate/plan.js';
+import { PlanSet } from '../../commands/sys/context/admin/model.js';
+import { buildRows } from '../../commands/sys/context/admin/docs-panel.js';
 function freshTranscriptTarget() {
     return exposureTarget(emptyContextExposureState(), 'transcript');
 }
@@ -48,6 +55,14 @@ const B = {
     dupFar: 'BODY-T9-DUP-FROM-FAR',
     kindSplit: 'BODY-T9-KIND-SPLIT',
     documentGateWins: 'BODY-T9-DOCUMENT-GATE-WINS',
+    codeCraftIndex: 'BODY-T9-CODE-CRAFT-INDEX',
+    companionSource: 'BODY-T9-COMPANION-SOURCE',
+    companionA: 'BODY-T9-COMPANION-A',
+    companionB: 'BODY-T9-COMPANION-B',
+    prefRouter: 'BODY-T9-PREF-ROUTER',
+    crossPartition: 'BODY-T9-CROSS-PARTITION',
+    outsideGuide: 'BODY-T9-OUTSIDE-GUIDE',
+    pnameNeighbour: 'BODY-T9-NEIGHBOUR-IN-PNAMEDIR',
 };
 let home;
 let canvasHome;
@@ -58,6 +73,7 @@ let prevProfile;
 let prevNode;
 let prevCwd;
 let cwdProject;
+let outsideProject;
 let ppreviewDocPath;
 /** A doc delivered automatically at the top rung by both automatic channels —
  *  every cap observed below is the relationship's, never the author's. */
@@ -157,6 +173,60 @@ before(() => {
         B.kindSplit,
         '',
     ].join('\n'));
+    writeDoc(user, 'dev/code-craft/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When planning code work, this knowledge should be read because it routes the applicable craft guidance"',
+        'surfaces:',
+        '  - {on: boot, gate: {kind: {in: [design, spec, plan, developer]}}, at: content}',
+        '---',
+        '',
+        B.codeCraftIndex,
+        '',
+    ].join('\n'));
+    for (let i = 1; i <= 10; i++) {
+        writeDoc(user, `dev/code-craft/member-${i}`, bootlessDoc(`When code-craft member ${i} applies`, `BODY-T9-CODE-CRAFT-MEMBER-${i}`));
+    }
+    // The ANCESTOR half of a content delivery's listings: a bootless sibling of
+    // the `dev/code-craft` directory, disclosed because `dev/` is the enclosing
+    // directory of the doc whose body delivered.
+    writeDoc(user, 'dev/sibling', bootlessDoc('When the dev sibling applies', 'BODY-T9-DEV-SIBLING'));
+    writeDoc(user, 't9-companion-source', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When companion delivery starts, this knowledge should be read because it proves content reads cascade"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.companionSource,
+        '',
+    ].join('\n'));
+    // A companion that FRONTS a directory: its content delivery discloses its own
+    // members exactly as the source doc's did, one level deeper in the fixpoint.
+    writeDoc(user, 't9-companion-a/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the source is read, this knowledge should be read because it proves the first companion route"',
+        'surfaces:',
+        '  - {on: memory-read, match: t9-companion-source, at: content}',
+        '---',
+        '',
+        B.companionA,
+        '',
+    ].join('\n'));
+    writeDoc(user, 't9-companion-a/member-1', bootlessDoc('When the companion member applies', 'BODY-T9-COMPANION-A-MEMBER-1'));
+    writeDoc(user, 't9-companion-b', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the first companion is read, this knowledge should be read because it proves the route reaches a fixpoint"',
+        'surfaces:',
+        '  - {on: memory-read, match: t9-companion-a, at: content}',
+        '---',
+        '',
+        B.companionB,
+        '',
+    ].join('\n'));
     writeDoc(user, 't9-document-gate-wins', [
         '---',
         'kind: knowledge',
@@ -169,6 +239,78 @@ before(() => {
         B.documentGateWins,
         '',
     ].join('\n'));
+    // Cross-partition single emission: a preference body routes a KNOWLEDGE doc
+    // that carries boot content of its own. Both partitions render against one
+    // exposure state, so that body must be delivered exactly once.
+    writeDoc(user, 't9-pref-router', [
+        '---',
+        'kind: preference',
+        'when-and-why-to-read: "When the preference partition renders, this preference should be read because it routes a knowledge companion"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.prefRouter,
+        '',
+    ].join('\n'));
+    writeDoc(user, 't9-cross-partition', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the preference routes here, this knowledge should be read because it proves one body crosses both partitions once"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '  - {on: memory-read, match: t9-pref-router, at: content}',
+        '---',
+        '',
+        B.crossPartition,
+        '',
+    ].join('\n'));
+    // Cap safety: a name-tree directory merges across stores, so this user doc
+    // sits in the SAME canonical directory as the name-capped project's docs. Its
+    // content delivery discloses that directory — and must not raise a capped
+    // neighbour above the bare name its relationship allows.
+    writeDoc(user, 'pname/user-guide', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the merged directory renders, this knowledge should be read because it discloses that directory"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.pnameNeighbour,
+        '',
+    ].join('\n'));
+    // A project OUTSIDE the profile manifest: its store mounts only for a target
+    // whose cwd sits inside it, so a workspace-open render of it proves the
+    // listings answer from the opened workspace rather than the ambient one.
+    const poutside = store('poutside', 'poutside');
+    outsideProject = join(home, 'poutside');
+    writeDoc(poutside, 't9-ws-guide/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When that workspace opens, this knowledge should be read because it fronts its guide directory"',
+        'surfaces:',
+        '  - {on: workspace-open, at: content}',
+        '---',
+        '',
+        B.outsideGuide,
+        '',
+    ].join('\n'));
+    writeDoc(poutside, 't9-ws-guide/member-1', bootlessDoc('When the outside guide member applies', 'BODY-T9-OUTSIDE-MEMBER-1'));
+    // Workspace-open plans project stores only, but a content delivery's
+    // read-equivalent attachments answer from the whole opened target.
+    writeDoc(user, 'poutside/listing-member', bootlessDoc('When the workspace listing member applies', 'BODY-T9-WORKSPACE-LISTING-MEMBER'));
+    writeDoc(user, 't9-workspace-companion', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the workspace guide is read, this companion proves full-view accounting"',
+        'surfaces:',
+        '  - {on: memory-read, match: poutside/t9-ws-guide, at: content}',
+        '---',
+        '',
+        'BODY-T9-WORKSPACE-COMPANION',
+        '',
+    ].join('\n'));
     // Hidden-count pair: a top-level dir always renders, so a dir holding only a
     // bootless doc shows as `<dir>/` + `[+1 more]` — unless its project is `none`.
     writeDoc(pnone, join('t9-none-hidden', 'probe'), bootlessDoc('When counted', 'HIDDEN-NONE'));
@@ -219,7 +361,10 @@ test('boot delivery caps every profile project at its relationship, including th
     // does, and the relationship still decides the ceiling.
     assert.ok(!boot.includes(B.ppreview), `the cwd project is capped at preview — its body must not render; got:\n${boot}`);
     assert.match(boot, /t9-ppreview-doc {2}# read when: When the cwd project delivers\./, `the cwd project's doc discloses at preview; got:\n${boot}`);
-    // `name` discloses the bare identifier and nothing else.
+    // `name` discloses the bare identifier and nothing else — including when a
+    // content delivery in the same merged directory (the user-store neighbour)
+    // discloses that directory's listing.
+    assert.ok(boot.includes(B.pnameNeighbour), `the merged directory's uncapped document delivers; got:\n${boot}`);
     assert.ok(!boot.includes(B.pname), 'a name-capped project must not render a body');
     assert.match(boot, /[├└]─ t9-pname-doc$/m, `the name-capped doc discloses as a bare name; got:\n${boot}`);
     assert.ok(!boot.includes('When the name project delivers'), 'a name-capped doc discloses no preview line');
@@ -242,6 +387,88 @@ test('surface-entry gates select the rung by node kind while the document gate r
     const developer = renderKnowledgeBlock(newNode('developer'), freshTranscriptTarget());
     assert.ok(!developer.includes('t9-document-gate-wins'), `a failing document gate excludes every entry; got:\n${developer}`);
     assert.ok(!developer.includes(B.documentGateWins), 'a failing document gate excludes its content');
+    assert.ok(developer.includes(B.codeCraftIndex), 'the directory document delivers its boot content');
+    for (let i = 1; i <= 10; i++) {
+        assert.match(developer, new RegExp(`member-${i} {2}# read when: When code-craft member ${i} applies`), `content delivery exposes code-craft member ${i} at preview; got:\n${developer}`);
+    }
+    // The ancestor listing, not just the doc's own directory.
+    assert.match(developer, /sibling {2}# read when: When the dev sibling applies\./, `content delivery exposes the enclosing directory's members too; got:\n${developer}`);
+});
+test('context docs accounting reports content attachment raises from the renderer', () => {
+    const node = newNode('developer');
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const target = { cwd: cwdProject, profileId, nodeId: node };
+    const direct = planDelivery(subject, target, 'boot');
+    const rendered = assembleEventAccounting({ subject, target, nodeMissing: false }, 'boot', {});
+    const rows = effectivePlan(direct, rendered.accounting.deliveries).docs.map((record) => docRow(record, true, subject));
+    for (let i = 1; i <= 10; i++) {
+        const row = rows.find((candidate) => candidate.name === `dev/code-craft/member-${i}`);
+        assert.equal(row?.final_rung, 'preview', `member ${i} is raised to the listing preview rung`);
+        assert.equal(row?.delivery_cause, 'directory listing attached to content delivery');
+    }
+    const companion = rows.find((row) => row.name === 't9-companion-a');
+    assert.equal(companion?.final_rung, 'content', 'a memory-read companion reaches its rendered rung');
+    assert.equal(companion?.delivery_cause, 'memory-read companion of content delivery');
+    const plans = new PlanSet({
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        hasManager: true,
+        profileId,
+        cwd: cwdProject,
+        nodeId: node,
+        depth: 0,
+        event: 'boot',
+        file: '',
+        docName: '',
+        command: '',
+    });
+    plans.plan('boot');
+    const viewerMember = buildRows(plans, 'boot').find((row) => row.name === 'dev/code-craft/member-1');
+    const viewerRecord = viewerMember?.records.get('boot');
+    assert.equal(viewerRecord?.finalRung, 'preview', 'the admin row reads the renderer-raised rung');
+    assert.equal(viewerRecord?.deliveryCause, 'directory listing attached to content delivery');
+    plans.dispose();
+});
+test('context docs accounting adds full-view workspace content attachments', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const target = { cwd: outsideProject, profileId, nodeId: node };
+    const direct = planDelivery(subject, target, 'workspace-open');
+    const rendered = assembleEventAccounting({ subject, target, nodeMissing: false }, 'workspace-open', {});
+    const rows = effectivePlan(direct, rendered.accounting.deliveries).docs.map((record) => docRow(record, true, subject));
+    const listing = rows.find((row) => row.name === 'poutside/listing-member');
+    assert.equal(listing?.final_rung, 'preview');
+    assert.equal(listing?.delivery_cause, 'directory listing attached to content delivery');
+    const companion = rows.find((row) => row.name === 't9-workspace-companion');
+    assert.equal(companion?.final_rung, 'content');
+    assert.equal(companion?.delivery_cause, 'memory-read companion of content delivery');
+});
+test('boot content triggers memory-read companions to a deduplicated fixpoint', () => {
+    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+    for (const body of [B.companionSource, B.companionA, B.companionB]) {
+        assert.equal(boot.split(body).length - 1, 1, `content companion ${body} delivers once; got:\n${boot}`);
+    }
+    // A companion is read-equivalent in its own right: the directory it fronts
+    // discloses its members exactly as the doc that routed to it did.
+    assert.match(boot, /member-1 {2}# read when: When the companion member applies\./, `a content companion exposes its own directory's members; got:\n${boot}`);
+});
+test('one body delivered across both boot partitions renders exactly once', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const state = emptyContextExposureState();
+    // The live boot order: the knowledge block and the preference splice share
+    // ONE exposure state, so a knowledge body already delivered as a preference's
+    // companion must not render again as knowledge prose.
+    const preferences = renderPreferencesForSubject(subject, exposureTarget(state, 'system')).block;
+    const knowledge = renderKnowledgeForSubject(subject, node, exposureTarget(state, 'transcript'));
+    assert.ok(preferences.includes(B.prefRouter), `the routing preference delivers its body; got:\n${preferences}`);
+    assert.ok(preferences.includes(B.crossPartition), `its companion delivers with it; got:\n${preferences}`);
+    const occurrences = (preferences.split(B.crossPartition).length - 1) + (knowledge.split(B.crossPartition).length - 1);
+    assert.equal(occurrences, 1, `the companion body renders once across both partitions; got:\n${preferences}\n---\n${knowledge}`);
 });
 test('a node-local doc floors to name only without boot entries', () => {
     const node = newNode('explore');
@@ -312,6 +539,17 @@ test('workspace-open clamps each project store the same way boot does', () => {
     assert.ok(!opened.includes('t9-pnone-doc'), 'the none-capped project delivers nothing at workspace-open');
     assert.ok(!opened.includes(B.sharedFromPnone), 'nor its side of a name collision');
 });
+test('workspace-open answers its listings from the workspace it opened, not the ambient one', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    // The process cwd is `ppreview`; this workspace is outside the profile
+    // manifest, so ONLY the opened target's corpus knows its store at all.
+    const opened = renderWorkspaceOpenDocsForSubject(subject, join(home, 'poutside'), profileId, freshTranscriptTarget());
+    assert.ok(opened.includes(B.outsideGuide), `the opened workspace's guide delivers its body; got:\n${opened}`);
+    assert.match(opened, /<memory-listing dir="poutside\/t9-ws-guide">/, `its directory listing renders from that workspace's corpus; got:\n${opened}`);
+    assert.match(opened, /\[\[poutside\/t9-ws-guide\/member-1\]\]: When the outside guide member applies\./, `the listing carries that directory's own members; got:\n${opened}`);
+});
 test('memory list and find record synthetic pages without crediting matched documents', async () => {
     const node = newNode();
     process.env['CRTR_NODE_ID'] = node;
@@ -350,6 +588,31 @@ test('memory list and find record synthetic pages without crediting matched docu
         delete process.env['CRTR_NODE_ID'];
     }
 });
+test('an explicit read after boot content adds no duplicate directory attachments', async () => {
+    const node = newNode('developer');
+    process.env['CRTR_NODE_ID'] = node;
+    try {
+        const state = loadContextExposureState(node);
+        renderKnowledgeBlock(node, exposureTarget(state, 'transcript'));
+        saveContextExposureState(node, state);
+        const result = (await readLeaf.run({
+            name: 'dev/code-craft',
+            kind: undefined,
+            frontmatter: false,
+            scope: undefined,
+            dir: undefined,
+        }));
+        assert.equal(result.content.trim(), B.codeCraftIndex, 'the repeated read returns its body without a new attachment block');
+        assert.equal(result.listing.length, 10, 'the deliberate directory read still returns its immediate members');
+        const afterRead = loadContextExposureState(node);
+        for (let i = 1; i <= 10; i++) {
+            assert.ok(documentExposedAtOrAbove(afterRead, join(home, '.crouter', 'memory', 'dev', 'code-craft', `member-${i}.md`), `BODY-T9-CODE-CRAFT-MEMBER-${i}`, 'preview'), `boot content registered member ${i} at preview before the explicit read`);
+        }
+    }
+    finally {
+        delete process.env['CRTR_NODE_ID'];
+    }
+});
 test('an explicit `crtr memory read` returns and records the full body a cap withheld', async () => {
     const node = newNode();
     process.env['CRTR_NODE_ID'] = node;

package/dist/core/__tests__/seam/broker-provider-retry.test.js

@@ -399,8 +399,8 @@ test('reload_auth restores a newly authenticated personal route before the next
     mkdirSync(userConfigDir, { recursive: true });
     writeFileSync(userConfigPath, JSON.stringify({
         modelRoutes: {
-            personal: { family: 'anthropic', credentialSource: 'user', providerId: personal.provider, models: { medium: personalSpec } },
-            funded: { family: 'anthropic', credentialSource: 'northlight', providerId: funded.provider, models: { medium: `${funded.provider}/${funded.id}:medium` } },
+            personal: { family: 'anthropic', credentialSource: 'user', providerId: personal.provider, models: { ultra: personalSpec, strong: personalSpec, medium: personalSpec, light: personalSpec } },
+            funded: { family: 'anthropic', credentialSource: 'northlight', providerId: funded.provider, models: { ultra: `${funded.provider}/${funded.id}:medium`, strong: `${funded.provider}/${funded.id}:medium`, medium: `${funded.provider}/${funded.id}:medium`, light: `${funded.provider}/${funded.id}:medium` } },
         },
         modelRouting: { credentialSourceOrder: ['user', 'northlight'], familyOrder: ['anthropic'], strengthFallback: ['medium'] },
     }));

package/dist/core/canvas/render-source.d.ts

@@ -137,7 +137,7 @@ export declare function dashboardRowsFromSource(source: CanvasSource, rootId: st
  *  the node ids from one `listFocuses()` query so `viewed` remains visible without
  *  coupling the canvas source to local viewer state. Remote sources ignore that
  *  set. Local disk telemetry/fault/streaming are likewise suppressed remotely. */
-export declare function dashboardRowsAllFromSource(source: CanvasSource, localFocusedNodeIds?: ReadonlySet<string>): Promise<DashboardRow[]>;
+export declare function dashboardRowsAllFromSource(source: CanvasSource, localFocusedNodeIds?: ReadonlySet<string>, liveOnly?: boolean): Promise<DashboardRow[]>;
 export declare function enrichRowsFromSource(source: CanvasSource, rows: DashboardRow[], asks?: Record<string, number>): Promise<void>;
 /** goal (initial-prompt.md) and session parts are local disk reads — suppressed
  *  to undefined for a remote source. */

package/dist/core/canvas/render-source.js

@@ -443,10 +443,11 @@ export async function dashboardRowsFromSource(source, rootId) {
  *  the node ids from one `listFocuses()` query so `viewed` remains visible without
  *  coupling the canvas source to local viewer state. Remote sources ignore that
  *  set. Local disk telemetry/fault/streaming are likewise suppressed remotely. */
-export async function dashboardRowsAllFromSource(source, localFocusedNodeIds = new Set()) {
+export async function dashboardRowsAllFromSource(source, localFocusedNodeIds = new Set(), liveOnly = false) {
     const remote = source instanceof RemoteCanvasSource;
     const focusedNodeIds = remote ? new Set() : localFocusedNodeIds;
-    return (await source.listNodes()).map((row) => dashboardRowFromNodeRow(row, focusedNodeIds, remote));
+    const rows = await source.listNodes(liveOnly ? { status: ['active', 'idle'] } : undefined);
+    return rows.map((row) => dashboardRowFromNodeRow(row, focusedNodeIds, remote));
 }
 // Lazy enrichment (source-driven) — fold expensive per-node reads into rows on
 // demand. Ask counts are supplied by the caller (`asks` — a pre-fetched

package/dist/core/config.d.ts

@@ -2,12 +2,12 @@ import type { PageComponentRegistration, Scope, ScopeConfig, ScopeState, HumanAc
 import { type BindingId } from './keybindings/catalog.js';
 export declare function configPath(scope: Scope): string | null;
 export declare function statePath(scope: Scope): string | null;
-export declare function readConfig(scope: Scope): ScopeConfig;
+export declare function readConfig(scope: Scope): ResolvedScopeConfig;
 /** Read the config that lives at an EXACT scope-root dir, rather than the
  *  resolved nearest root for a scope. Lets a caller iterate each visible
  *  project root's own config when several are in scope (nested `.crouter` dirs
  *  or a profile-widened stack), instead of collapsing them onto the nearest. */
-export declare function readConfigAtRoot(root: string): ScopeConfig;
+export declare function readConfigAtRoot(root: string): ResolvedScopeConfig;
 export declare function readState(scope: Scope): ScopeState;
 type RawConfig = Record<string, unknown>;
 export declare function updateRawConfigAtomically(scope: Scope, mutate: (latest: RawConfig) => RawConfig): RawConfig;
@@ -26,6 +26,14 @@ export declare function ensureScopeInitialized(scope: Scope, root: string): void
 /** Normalize the user-owned list of attach actions allowed to bridge through an
  * occupied tmux root binding. Unknown and non-attach ids have no effect. */
 export declare function normalizeTmuxPassthrough(raw: unknown): BindingId[];
+type LegacyModelRouteConfig = Omit<ModelRouteConfig, 'models'> & {
+    models: Partial<Record<ModelStrength, string>>;
+};
+/** Read configuration exposes legacy sparse routes separately during the
+ * one-release cutover; launch code only treats `modelRoutes` as complete. */
+export type ResolvedScopeConfig = ScopeConfig & {
+    legacyModelRoutes?: Record<string, LegacyModelRouteConfig>;
+};
 /** One malformed `bin` declaration. The read path retains these as doctor
  *  findings rather than letting malformed config break a node launch. */
 export interface BinDeclarationIssue {
@@ -103,7 +111,11 @@ export declare function readRawScopeConfig(scope: Scope): Partial<ScopeConfig> |
 export interface MergedLaunchConfig {
     kinds: Record<string, KindConfig>;
     modelLadders: ModelLaddersConfig;
+    /** Complete declared routes. Every route here has all four strengths. */
     modelRoutes?: Record<string, ModelRouteConfig>;
+    /** Read-only compatibility view for sparse routes written before complete
+     * routes were required. New route persistence never produces this shape. */
+    legacyModelRoutes?: Record<string, LegacyModelRouteConfig>;
     modelRouting?: ModelRoutingConfig;
     /** The merged `spawnEnv.allow` set (project stack > profile > user >
      *  builtin, additive) — read by `buildOperationalEnvBase`
@@ -185,6 +197,11 @@ export declare function persistModelLadders(root: string, patch: {
     anthropic?: Partial<Record<ModelStrength, string>>;
     openai?: Partial<Record<ModelStrength, string>>;
 }): void;
+/** Persist one complete route at one exact config root. The route is the only
+ * raw route entry touched; unrelated routes and local ladder defaults remain
+ * absent. Pass `undefined` to remove this scope's entry, which resumes lower
+ * scope inheritance rather than introducing a tombstone. */
+export declare function persistModelRoute(root: string, routeId: string, route: ModelRouteConfig | undefined): void;
 /** Mutate one exact config root. Setup uses this for profile and explicit
  * project targets that cannot be represented by the user/project Scope enum. */
 export declare function updateConfigAtRoot(root: string, mutate: (cfg: ScopeConfig) => void): ScopeConfig;