@north-light/crouter 0.3.262 → 0.3.269

package/dist/core/__tests__/integration/broker-sdk-wiring.test.js

@@ -212,7 +212,7 @@ test('C3f — a logical request can reach a non-managed raw-registry fallback wh
                 family: 'custom',
                 credentialSource: 'user',
                 providerId: 'c3prov',
-                models: { strong: 'c3prov/c3model' },
+                models: { ultra: 'c3prov/c3model', strong: 'c3prov/c3model', medium: 'c3prov/c3model', light: 'c3prov/c3model' },
             },
         },
     })}\n`);

package/dist/core/__tests__/integration/revive.test.js

@@ -180,7 +180,8 @@ test('a resumed revive replays the persisted LaunchSpec (model, tools, extension
         pi_session_id: 'uuid-9',
         pi_session_file: sessionFile,
         launch: {
-            model: 'anthropic/sonnet',
+            model: 'anthropic/claude-opus-5:high',
+            modelExact: true,
             tools: ['bash', 'read'],
             extensions: ['/ext/a.js', '/ext/b.js'],
             systemPrompt: 'You are a developer orchestrator.',
@@ -196,7 +197,8 @@ test('a resumed revive replays the persisted LaunchSpec (model, tools, extension
     assert.equal(argv[ea - 1], '-e');
     // Model + tools + system prompt + resume target.
     const mi = argv.indexOf('--model');
-    assert.equal(argv[mi + 1], 'anthropic/sonnet');
+    assert.equal(argv[mi + 1], 'anthropic/claude-opus-5:high');
+    assert.ok(argv.includes('--crtr-model-exact'), 'revive preserves the exact-model contract');
     const ti = argv.indexOf('--tools');
     assert.equal(argv[ti + 1], 'bash,read');
     assert.ok(argv.includes('--append-system-prompt'), 'system prompt replayed');

package/dist/core/__tests__/model-pin-durability.test.js

@@ -20,7 +20,7 @@ import { join } from 'node:path';
 import { buildLaunchSpec, isProviderPinnedModelToken, normalizeModel } from '../runtime/launch.js';
 import { defaultModelLaddersConfig } from '../../types.js';
 import { persistDormantModel } from '../runtime/model-swap.js';
-import { promote } from '../runtime/promote.js';
+import { promote, reshapeNode } from '../runtime/promote.js';
 import { createNode, getNode } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 const ladders = defaultModelLaddersConfig();
@@ -86,6 +86,15 @@ test('only concrete provider/id tokens pin; logical family/tier refs remain pref
     assert.equal(isProviderPinnedModelToken('ultra'), false, 'a bare tier has no `/` and stays unpinned');
     assert.equal(isProviderPinnedModelToken('opus'), false, 'a bare family alias has no `/` and stays unpinned');
 });
+test('a new --model override resolves once and freezes portable and concrete requests', () => {
+    for (const requested of ['anthropic/opus', 'strong', 'anthropic/claude-fable-5:high']) {
+        const launch = buildSpec({ model: requested, modelOverride: true });
+        assert.equal(launch.model, normalizeModel(requested, ladders), `${requested} resolves through the configured ladder`);
+        assert.equal(launch.modelExact, true, `${requested} is exact after resolution`);
+        assert.equal(launch.modelIntent, undefined, `${requested} has no portable route intent`);
+        assert.equal(launch.env.CRTR_MODEL_INTENT, undefined, `${requested} cannot re-enable fallback on revive`);
+    }
+});
 // Direction 1: an EXPLICIT concrete pin must SURVIVE a config/lifecycle rebuild
 // even when the carried override has portablized back to a bare tier.
 test('an explicit concrete pin survives a config/lifecycle rebuild whose portablized override reads as a bare tier', () => {
@@ -103,6 +112,20 @@ test('an explicit concrete pin survives a config/lifecycle rebuild whose portabl
 // Direction 2: a deliberately TIER-run (unpinned) node must NOT be wrongly
 // re-pinned when a subsequent rebuild/persist normalizes its override to the
 // concrete cell it happens to share bytes with.
+test('reshape resolves and persists a new --model override as the exact revive recipe', () => {
+    createNode(node('override-node', {
+        model_override: 'strong',
+        launch: { extensions: [], env: { CRTR_MODEL_INTENT: 'anthropic/strong' }, model: normalizeModel('strong', ladders), modelIntent: { family: 'anthropic', strength: 'strong' } },
+    }));
+    reshapeNode('override-node', { model: 'anthropic/opus' });
+    const after = getNode('override-node');
+    const expected = normalizeModel('anthropic/opus', ladders);
+    assert.equal(after?.model_override, expected, 'the raw alias never becomes the durable override');
+    assert.equal(after?.launch?.model, expected, 'revive replays the resolved provider/model');
+    assert.equal(after?.launch?.modelExact, true, 'retries and revives reject substitutes');
+    assert.equal(after?.launch?.modelIntent, undefined);
+    assert.equal(after?.launch?.env.CRTR_MODEL_INTENT, undefined);
+});
 test('promotion preserves the exact-model contract required to revive a private human-work fork', () => {
     const exactModel = 'openai-codex/gpt-5.6-sol:max';
     createNode(node('exact-node', {
@@ -134,6 +157,7 @@ test('a deliberately tier-run node is not wrongly re-pinned when a rebuild or pe
     const after = getNode('tier-node');
     assert.equal(after?.launch?.model, ULTRA_CELL, 'the concrete spec is persisted as the launch model');
     assert.equal(after?.model_override, ULTRA_CELL, 'the concrete spec is persisted as the override');
+    assert.equal(after?.launch?.modelExact, true, 'an explicit model change remains exact on revive');
     assert.equal(after?.launch?.modelIntent, undefined, 'an explicit concrete choice clears the prior logical route intent');
     assert.equal(after?.launch?.env.CRTR_MODEL_INTENT, undefined, 'the revived broker does not inherit the prior logical route intent');
     assert.equal(after?.launch?.modelProviderPinned, false, 'an explicit bare-tier decision clears a prior pin — the raw-token decision wins over the concrete spec shape');

package/dist/core/__tests__/model-routes-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/model-routes-config.test.js

@@ -0,0 +1,142 @@
+import { after, afterEach, before, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { persistModelRoute, readConfig, readMergedLaunchConfig } from '../config.js';
+import { expandModelCandidates } from '../model-routes.js';
+import { resetScopeCache } from '../scope.js';
+let home;
+let work;
+let previousHome;
+function route(providerId = 'provider-x', family = 'family-x', credentialSource = 'source-x') {
+    return {
+        family,
+        credentialSource,
+        providerId,
+        models: {
+            ultra: `${providerId}/ultra`,
+            strong: `${providerId}/strong`,
+            medium: `${providerId}/medium`,
+            light: `${providerId}/light`,
+        },
+    };
+}
+function writeConfig(root, config) {
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'config.json'), JSON.stringify(config));
+}
+before(() => {
+    previousHome = process.env.HOME;
+});
+beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-model-routes-home-'));
+    work = mkdtempSync(join(tmpdir(), 'crtr-model-routes-work-'));
+    process.env.HOME = home;
+    resetScopeCache();
+});
+afterEach(() => {
+    resetScopeCache();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(work, { recursive: true, force: true });
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = previousHome;
+    resetScopeCache();
+});
+test('complete routes preserve arbitrary names and credential-source ordering', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            personal: route('shared-provider', 'family/one', 'personal source'),
+            funded: route('shared-provider', 'family/one', 'funded source'),
+        },
+        modelRouting: {
+            credentialSourceOrder: ['funded source', 'personal source'],
+            familyOrder: ['family/one'],
+            strengthFallback: ['strong'],
+        },
+    });
+    const config = readMergedLaunchConfig(work, null);
+    assert.deepEqual(config.modelRoutes?.personal?.models, route('shared-provider', 'family/one', 'personal source').models);
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'family/one', strength: 'strong', spec: 'family/one/strong' }, work, null).map((candidate) => candidate.routeId), ['funded', 'personal'], 'same provider/model refs remain distinct candidates when routes differ');
+});
+test('a sparse upper-scope route patch overlays a complete lower route', () => {
+    writeConfig(join(home, '.crouter'), { modelRoutes: { shared: route() } });
+    writeConfig(join(work, '.crouter'), { modelRoutes: { shared: { models: { medium: 'provider-x/project-medium' } } } });
+    const config = readMergedLaunchConfig(work, null);
+    assert.equal(config.modelRoutes?.shared?.models.medium, 'provider-x/project-medium');
+    assert.equal(config.modelRoutes?.shared?.models.ultra, 'provider-x/ultra');
+});
+test('legacy sparse routes remain readable with no invented cells', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            legacy: { family: 'legacy', credentialSource: 'old', providerId: 'legacy-provider', models: { medium: 'legacy-provider/medium' } },
+        },
+    });
+    const config = readMergedLaunchConfig(work, null);
+    assert.equal(config.modelRoutes, undefined);
+    assert.deepEqual(config.legacyModelRoutes?.legacy?.models, { medium: 'legacy-provider/medium' });
+    assert.deepEqual(readConfig('user').legacyModelRoutes?.legacy?.models, { medium: 'legacy-provider/medium' });
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'legacy', strength: 'medium', spec: 'legacy/medium' }, work, null).map((candidate) => candidate.modelId), ['medium']);
+});
+test('route records retain __proto__ ids when read and persisted', () => {
+    const root = join(home, '.crouter');
+    writeConfig(root, JSON.parse(JSON.stringify({ modelRoutes: { ['__proto__']: route() } })));
+    assert.deepEqual(readMergedLaunchConfig(work, null).modelRoutes?.['__proto__'], route());
+    persistModelRoute(root, '__proto__', route('persisted-provider'));
+    const raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes['__proto__'], route('persisted-provider'));
+});
+test('route candidate identity distinguishes delimiter-containing route and provider ids', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            a: route('b:c', 'family', 'first'),
+            'a:b': route('c', 'family', 'second'),
+        },
+        modelRouting: {
+            credentialSourceOrder: ['first', 'second'],
+            familyOrder: ['family'],
+            strengthFallback: ['strong'],
+        },
+    });
+    assert.deepEqual(expandModelCandidates({ kind: 'logical', family: 'family', strength: 'strong', spec: 'family/strong' }, work, null).map((candidate) => candidate.routeId), ['a', 'a:b']);
+});
+test('route writes reject missing cells and provider-prefix mismatches with actionable diagnostics', () => {
+    const root = join(home, '.crouter');
+    const incomplete = { ...route(), models: { strong: 'provider-x/strong' } };
+    assert.throws(() => persistModelRoute(root, 'needs-all-rungs', incomplete), /model route "needs-all-rungs" is incomplete; missing strengths: ultra, medium, light/);
+    assert.throws(() => persistModelRoute(root, 'wrong-provider', { ...route(), models: { ...route().models, light: 'other/light' } }), /model route "wrong-provider" models.light provider prefix must equal providerId/);
+});
+test('invalid route entries do not block valid routes, and no valid routes falls back to local ladders', () => {
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            valid: route('valid-provider', 'valid family', 'valid source'),
+            invalid: { family: 'bad', credentialSource: 'bad', providerId: 'one', models: { ultra: 'two/u', strong: 'two/s', medium: 'two/m', light: 'two/l' } },
+        },
+    });
+    assert.deepEqual(Object.keys(readMergedLaunchConfig(work, null).modelRoutes ?? {}), ['valid']);
+    writeConfig(join(home, '.crouter'), {
+        modelRoutes: {
+            invalid: { family: 'bad', credentialSource: 'bad', providerId: 'one', models: { ultra: 'two/u', strong: 'two/s', medium: 'two/m', light: 'two/l' } },
+        },
+    });
+    assert.equal(readMergedLaunchConfig(work, null).modelRoutes, undefined);
+    assert.equal(expandModelCandidates({ kind: 'logical', family: 'anthropic', strength: 'strong', spec: 'anthropic/strong' }, work, null)[0]?.routeId, 'anthropic');
+});
+test('persistModelRoute touches only its raw route and deletes by restoring inheritance', () => {
+    const root = join(home, '.crouter');
+    const other = route('other-provider');
+    writeConfig(root, { modelRoutes: { other }, max_panes_per_window: 7 });
+    persistModelRoute(root, 'edited', route('edited-provider'));
+    let raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes.other, other);
+    assert.deepEqual(raw.modelRoutes.edited, route('edited-provider'));
+    assert.equal(raw.modelLadders, undefined);
+    assert.equal(raw.max_panes_per_window, 7);
+    persistModelRoute(root, 'edited', undefined);
+    raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    assert.deepEqual(raw.modelRoutes, { other });
+});

package/dist/core/__tests__/on-read-nested-store.test.js

@@ -69,6 +69,11 @@ function makeWorkTree() {
         '  - {on: workspace-open, at: content}\n' +
         '  - {on: read, match: "./**", at: content}\n---\n' +
         `${NESTED_BODY}\n`);
+    // A bootless neighbour in the same discovered store: it wins no delivery of
+    // its own, so only a listing can ever disclose it.
+    writeFileSync(join(nestedStore, 'constraint.md'), '---\nkind: knowledge\n' +
+        'when-and-why-to-read: When changing pkg internals, this knowledge should be read because it names the constraint.\n---\n' +
+        'NESTED NEIGHBOUR BODY\n');
     return work;
 }
 test('a nested store front door surfaces on a read beneath its owning dir, not outside it', () => {
@@ -79,6 +84,9 @@ test('a nested store front door surfaces on a read beneath its owning dir, not o
     writeFileSync(inside, 'export const x = 1;\n');
     const rendered = renderOnReadDocs(node, inside, freshTranscriptTarget());
     assert.ok(rendered.includes(NESTED_BODY), `read beneath pkg surfaces the nested front door; got: ${rendered}`);
+    // A content delivery is a read: the discovered store's own listing comes
+    // with it, answered from the corpus the read walk discovered.
+    assert.match(rendered, /\[\[work\/pkg\/constraint\]\]: When changing pkg internals/, `the delivered front door discloses its directory's bootless member; got: ${rendered}`);
     const outside = join(work, 'docs', 'notes.ts');
     mkdirSync(join(work, 'docs'), { recursive: true });
     writeFileSync(outside, 'export const y = 2;\n');

package/dist/core/__tests__/profile-project-memory-delivery.test.js

@@ -25,11 +25,18 @@ import { spawnNode } from '../runtime/nodes.js';
 import { memoryDir } from '../runtime/memory.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
 import { renderKnowledgeBlock } from '../substrate/render-node.js';
+import { renderKnowledgeForSubject, renderPreferencesForSubject } from '../substrate/render.js';
+import { assembleNodeSubject } from '../substrate/subject.js';
 import { renderWorkspaceOpenDocs } from '../substrate/on-read-node.js';
+import { renderWorkspaceOpenDocsForSubject } from '../substrate/on-read.js';
 import { documentExposedAtOrAbove, emptyContextExposureState, exposedAtOrAbove, exposureTarget, loadContextExposureState, saveContextExposureState, } from '../substrate/injected-store.js';
 import { readLeaf } from '../../commands/memory/read.js';
 import { listLeaf } from '../../commands/memory/list.js';
 import { findLeaf } from '../../commands/memory/find.js';
+import { assembleEventAccounting, docRow, effectivePlan, } from '../../commands/sys/context/resolve.js';
+import { planDelivery } from '../substrate/plan.js';
+import { PlanSet } from '../../commands/sys/context/admin/model.js';
+import { buildRows } from '../../commands/sys/context/admin/docs-panel.js';
 function freshTranscriptTarget() {
     return exposureTarget(emptyContextExposureState(), 'transcript');
 }
@@ -48,6 +55,14 @@ const B = {
     dupFar: 'BODY-T9-DUP-FROM-FAR',
     kindSplit: 'BODY-T9-KIND-SPLIT',
     documentGateWins: 'BODY-T9-DOCUMENT-GATE-WINS',
+    codeCraftIndex: 'BODY-T9-CODE-CRAFT-INDEX',
+    companionSource: 'BODY-T9-COMPANION-SOURCE',
+    companionA: 'BODY-T9-COMPANION-A',
+    companionB: 'BODY-T9-COMPANION-B',
+    prefRouter: 'BODY-T9-PREF-ROUTER',
+    crossPartition: 'BODY-T9-CROSS-PARTITION',
+    outsideGuide: 'BODY-T9-OUTSIDE-GUIDE',
+    pnameNeighbour: 'BODY-T9-NEIGHBOUR-IN-PNAMEDIR',
 };
 let home;
 let canvasHome;
@@ -58,6 +73,7 @@ let prevProfile;
 let prevNode;
 let prevCwd;
 let cwdProject;
+let outsideProject;
 let ppreviewDocPath;
 /** A doc delivered automatically at the top rung by both automatic channels —
  *  every cap observed below is the relationship's, never the author's. */
@@ -157,6 +173,60 @@ before(() => {
         B.kindSplit,
         '',
     ].join('\n'));
+    writeDoc(user, 'dev/code-craft/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When planning code work, this knowledge should be read because it routes the applicable craft guidance"',
+        'surfaces:',
+        '  - {on: boot, gate: {kind: {in: [design, spec, plan, developer]}}, at: content}',
+        '---',
+        '',
+        B.codeCraftIndex,
+        '',
+    ].join('\n'));
+    for (let i = 1; i <= 10; i++) {
+        writeDoc(user, `dev/code-craft/member-${i}`, bootlessDoc(`When code-craft member ${i} applies`, `BODY-T9-CODE-CRAFT-MEMBER-${i}`));
+    }
+    // The ANCESTOR half of a content delivery's listings: a bootless sibling of
+    // the `dev/code-craft` directory, disclosed because `dev/` is the enclosing
+    // directory of the doc whose body delivered.
+    writeDoc(user, 'dev/sibling', bootlessDoc('When the dev sibling applies', 'BODY-T9-DEV-SIBLING'));
+    writeDoc(user, 't9-companion-source', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When companion delivery starts, this knowledge should be read because it proves content reads cascade"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.companionSource,
+        '',
+    ].join('\n'));
+    // A companion that FRONTS a directory: its content delivery discloses its own
+    // members exactly as the source doc's did, one level deeper in the fixpoint.
+    writeDoc(user, 't9-companion-a/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the source is read, this knowledge should be read because it proves the first companion route"',
+        'surfaces:',
+        '  - {on: memory-read, match: t9-companion-source, at: content}',
+        '---',
+        '',
+        B.companionA,
+        '',
+    ].join('\n'));
+    writeDoc(user, 't9-companion-a/member-1', bootlessDoc('When the companion member applies', 'BODY-T9-COMPANION-A-MEMBER-1'));
+    writeDoc(user, 't9-companion-b', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the first companion is read, this knowledge should be read because it proves the route reaches a fixpoint"',
+        'surfaces:',
+        '  - {on: memory-read, match: t9-companion-a, at: content}',
+        '---',
+        '',
+        B.companionB,
+        '',
+    ].join('\n'));
     writeDoc(user, 't9-document-gate-wins', [
         '---',
         'kind: knowledge',
@@ -169,6 +239,78 @@ before(() => {
         B.documentGateWins,
         '',
     ].join('\n'));
+    // Cross-partition single emission: a preference body routes a KNOWLEDGE doc
+    // that carries boot content of its own. Both partitions render against one
+    // exposure state, so that body must be delivered exactly once.
+    writeDoc(user, 't9-pref-router', [
+        '---',
+        'kind: preference',
+        'when-and-why-to-read: "When the preference partition renders, this preference should be read because it routes a knowledge companion"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.prefRouter,
+        '',
+    ].join('\n'));
+    writeDoc(user, 't9-cross-partition', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the preference routes here, this knowledge should be read because it proves one body crosses both partitions once"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '  - {on: memory-read, match: t9-pref-router, at: content}',
+        '---',
+        '',
+        B.crossPartition,
+        '',
+    ].join('\n'));
+    // Cap safety: a name-tree directory merges across stores, so this user doc
+    // sits in the SAME canonical directory as the name-capped project's docs. Its
+    // content delivery discloses that directory — and must not raise a capped
+    // neighbour above the bare name its relationship allows.
+    writeDoc(user, 'pname/user-guide', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the merged directory renders, this knowledge should be read because it discloses that directory"',
+        'surfaces:',
+        '  - {on: boot, at: content}',
+        '---',
+        '',
+        B.pnameNeighbour,
+        '',
+    ].join('\n'));
+    // A project OUTSIDE the profile manifest: its store mounts only for a target
+    // whose cwd sits inside it, so a workspace-open render of it proves the
+    // listings answer from the opened workspace rather than the ambient one.
+    const poutside = store('poutside', 'poutside');
+    outsideProject = join(home, 'poutside');
+    writeDoc(poutside, 't9-ws-guide/INDEX', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When that workspace opens, this knowledge should be read because it fronts its guide directory"',
+        'surfaces:',
+        '  - {on: workspace-open, at: content}',
+        '---',
+        '',
+        B.outsideGuide,
+        '',
+    ].join('\n'));
+    writeDoc(poutside, 't9-ws-guide/member-1', bootlessDoc('When the outside guide member applies', 'BODY-T9-OUTSIDE-MEMBER-1'));
+    // Workspace-open plans project stores only, but a content delivery's
+    // read-equivalent attachments answer from the whole opened target.
+    writeDoc(user, 'poutside/listing-member', bootlessDoc('When the workspace listing member applies', 'BODY-T9-WORKSPACE-LISTING-MEMBER'));
+    writeDoc(user, 't9-workspace-companion', [
+        '---',
+        'kind: knowledge',
+        'when-and-why-to-read: "When the workspace guide is read, this companion proves full-view accounting"',
+        'surfaces:',
+        '  - {on: memory-read, match: poutside/t9-ws-guide, at: content}',
+        '---',
+        '',
+        'BODY-T9-WORKSPACE-COMPANION',
+        '',
+    ].join('\n'));
     // Hidden-count pair: a top-level dir always renders, so a dir holding only a
     // bootless doc shows as `<dir>/` + `[+1 more]` — unless its project is `none`.
     writeDoc(pnone, join('t9-none-hidden', 'probe'), bootlessDoc('When counted', 'HIDDEN-NONE'));
@@ -219,7 +361,10 @@ test('boot delivery caps every profile project at its relationship, including th
     // does, and the relationship still decides the ceiling.
     assert.ok(!boot.includes(B.ppreview), `the cwd project is capped at preview — its body must not render; got:\n${boot}`);
     assert.match(boot, /t9-ppreview-doc {2}# read when: When the cwd project delivers\./, `the cwd project's doc discloses at preview; got:\n${boot}`);
-    // `name` discloses the bare identifier and nothing else.
+    // `name` discloses the bare identifier and nothing else — including when a
+    // content delivery in the same merged directory (the user-store neighbour)
+    // discloses that directory's listing.
+    assert.ok(boot.includes(B.pnameNeighbour), `the merged directory's uncapped document delivers; got:\n${boot}`);
     assert.ok(!boot.includes(B.pname), 'a name-capped project must not render a body');
     assert.match(boot, /[├└]─ t9-pname-doc$/m, `the name-capped doc discloses as a bare name; got:\n${boot}`);
     assert.ok(!boot.includes('When the name project delivers'), 'a name-capped doc discloses no preview line');
@@ -242,6 +387,88 @@ test('surface-entry gates select the rung by node kind while the document gate r
     const developer = renderKnowledgeBlock(newNode('developer'), freshTranscriptTarget());
     assert.ok(!developer.includes('t9-document-gate-wins'), `a failing document gate excludes every entry; got:\n${developer}`);
     assert.ok(!developer.includes(B.documentGateWins), 'a failing document gate excludes its content');
+    assert.ok(developer.includes(B.codeCraftIndex), 'the directory document delivers its boot content');
+    for (let i = 1; i <= 10; i++) {
+        assert.match(developer, new RegExp(`member-${i} {2}# read when: When code-craft member ${i} applies`), `content delivery exposes code-craft member ${i} at preview; got:\n${developer}`);
+    }
+    // The ancestor listing, not just the doc's own directory.
+    assert.match(developer, /sibling {2}# read when: When the dev sibling applies\./, `content delivery exposes the enclosing directory's members too; got:\n${developer}`);
+});
+test('context docs accounting reports content attachment raises from the renderer', () => {
+    const node = newNode('developer');
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const target = { cwd: cwdProject, profileId, nodeId: node };
+    const direct = planDelivery(subject, target, 'boot');
+    const rendered = assembleEventAccounting({ subject, target, nodeMissing: false }, 'boot', {});
+    const rows = effectivePlan(direct, rendered.accounting.deliveries).docs.map((record) => docRow(record, true, subject));
+    for (let i = 1; i <= 10; i++) {
+        const row = rows.find((candidate) => candidate.name === `dev/code-craft/member-${i}`);
+        assert.equal(row?.final_rung, 'preview', `member ${i} is raised to the listing preview rung`);
+        assert.equal(row?.delivery_cause, 'directory listing attached to content delivery');
+    }
+    const companion = rows.find((row) => row.name === 't9-companion-a');
+    assert.equal(companion?.final_rung, 'content', 'a memory-read companion reaches its rendered rung');
+    assert.equal(companion?.delivery_cause, 'memory-read companion of content delivery');
+    const plans = new PlanSet({
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        hasManager: true,
+        profileId,
+        cwd: cwdProject,
+        nodeId: node,
+        depth: 0,
+        event: 'boot',
+        file: '',
+        docName: '',
+        command: '',
+    });
+    plans.plan('boot');
+    const viewerMember = buildRows(plans, 'boot').find((row) => row.name === 'dev/code-craft/member-1');
+    const viewerRecord = viewerMember?.records.get('boot');
+    assert.equal(viewerRecord?.finalRung, 'preview', 'the admin row reads the renderer-raised rung');
+    assert.equal(viewerRecord?.deliveryCause, 'directory listing attached to content delivery');
+    plans.dispose();
+});
+test('context docs accounting adds full-view workspace content attachments', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const target = { cwd: outsideProject, profileId, nodeId: node };
+    const direct = planDelivery(subject, target, 'workspace-open');
+    const rendered = assembleEventAccounting({ subject, target, nodeMissing: false }, 'workspace-open', {});
+    const rows = effectivePlan(direct, rendered.accounting.deliveries).docs.map((record) => docRow(record, true, subject));
+    const listing = rows.find((row) => row.name === 'poutside/listing-member');
+    assert.equal(listing?.final_rung, 'preview');
+    assert.equal(listing?.delivery_cause, 'directory listing attached to content delivery');
+    const companion = rows.find((row) => row.name === 't9-workspace-companion');
+    assert.equal(companion?.final_rung, 'content');
+    assert.equal(companion?.delivery_cause, 'memory-read companion of content delivery');
+});
+test('boot content triggers memory-read companions to a deduplicated fixpoint', () => {
+    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+    for (const body of [B.companionSource, B.companionA, B.companionB]) {
+        assert.equal(boot.split(body).length - 1, 1, `content companion ${body} delivers once; got:\n${boot}`);
+    }
+    // A companion is read-equivalent in its own right: the directory it fronts
+    // discloses its members exactly as the doc that routed to it did.
+    assert.match(boot, /member-1 {2}# read when: When the companion member applies\./, `a content companion exposes its own directory's members; got:\n${boot}`);
+});
+test('one body delivered across both boot partitions renders exactly once', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    const state = emptyContextExposureState();
+    // The live boot order: the knowledge block and the preference splice share
+    // ONE exposure state, so a knowledge body already delivered as a preference's
+    // companion must not render again as knowledge prose.
+    const preferences = renderPreferencesForSubject(subject, exposureTarget(state, 'system')).block;
+    const knowledge = renderKnowledgeForSubject(subject, node, exposureTarget(state, 'transcript'));
+    assert.ok(preferences.includes(B.prefRouter), `the routing preference delivers its body; got:\n${preferences}`);
+    assert.ok(preferences.includes(B.crossPartition), `its companion delivers with it; got:\n${preferences}`);
+    const occurrences = (preferences.split(B.crossPartition).length - 1) + (knowledge.split(B.crossPartition).length - 1);
+    assert.equal(occurrences, 1, `the companion body renders once across both partitions; got:\n${preferences}\n---\n${knowledge}`);
 });
 test('a node-local doc floors to name only without boot entries', () => {
     const node = newNode('explore');
@@ -312,6 +539,17 @@ test('workspace-open clamps each project store the same way boot does', () => {
     assert.ok(!opened.includes('t9-pnone-doc'), 'the none-capped project delivers nothing at workspace-open');
     assert.ok(!opened.includes(B.sharedFromPnone), 'nor its side of a name collision');
 });
+test('workspace-open answers its listings from the workspace it opened, not the ambient one', () => {
+    const node = newNode();
+    const subject = assembleNodeSubject(node);
+    assert.ok(subject !== null, 'the fixture node assembles a subject');
+    // The process cwd is `ppreview`; this workspace is outside the profile
+    // manifest, so ONLY the opened target's corpus knows its store at all.
+    const opened = renderWorkspaceOpenDocsForSubject(subject, join(home, 'poutside'), profileId, freshTranscriptTarget());
+    assert.ok(opened.includes(B.outsideGuide), `the opened workspace's guide delivers its body; got:\n${opened}`);
+    assert.match(opened, /<memory-listing dir="poutside\/t9-ws-guide">/, `its directory listing renders from that workspace's corpus; got:\n${opened}`);
+    assert.match(opened, /\[\[poutside\/t9-ws-guide\/member-1\]\]: When the outside guide member applies\./, `the listing carries that directory's own members; got:\n${opened}`);
+});
 test('memory list and find record synthetic pages without crediting matched documents', async () => {
     const node = newNode();
     process.env['CRTR_NODE_ID'] = node;
@@ -350,6 +588,31 @@ test('memory list and find record synthetic pages without crediting matched docu
         delete process.env['CRTR_NODE_ID'];
     }
 });
+test('an explicit read after boot content adds no duplicate directory attachments', async () => {
+    const node = newNode('developer');
+    process.env['CRTR_NODE_ID'] = node;
+    try {
+        const state = loadContextExposureState(node);
+        renderKnowledgeBlock(node, exposureTarget(state, 'transcript'));
+        saveContextExposureState(node, state);
+        const result = (await readLeaf.run({
+            name: 'dev/code-craft',
+            kind: undefined,
+            frontmatter: false,
+            scope: undefined,
+            dir: undefined,
+        }));
+        assert.equal(result.content.trim(), B.codeCraftIndex, 'the repeated read returns its body without a new attachment block');
+        assert.equal(result.listing.length, 10, 'the deliberate directory read still returns its immediate members');
+        const afterRead = loadContextExposureState(node);
+        for (let i = 1; i <= 10; i++) {
+            assert.ok(documentExposedAtOrAbove(afterRead, join(home, '.crouter', 'memory', 'dev', 'code-craft', `member-${i}.md`), `BODY-T9-CODE-CRAFT-MEMBER-${i}`, 'preview'), `boot content registered member ${i} at preview before the explicit read`);
+        }
+    }
+    finally {
+        delete process.env['CRTR_NODE_ID'];
+    }
+});
 test('an explicit `crtr memory read` returns and records the full body a cap withheld', async () => {
     const node = newNode();
     process.env['CRTR_NODE_ID'] = node;

package/dist/core/__tests__/relaunch-root.test.js

@@ -18,6 +18,7 @@ import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { apiSocketPath } from '../canvas/paths.js';
 import { brokerCapReached, resetFleetForTests } from '../runtime/fleet.js';
+import { buildPiArgv } from '../runtime/launch.js';
 import { relaunchRoot } from '../runtime/reset.js';
 import { bindTestFleet } from './helpers/fleet.js';
 let home;
@@ -106,6 +107,22 @@ test('relaunchRoot parks the old root done and mints a fresh active root, reapin
     assert.equal(getNode('child')?.status, 'canceled', 'descendant child canceled');
     assert.equal(getNode('grand')?.status, 'canceled', 'descendant grandchild canceled');
 });
+test('relaunchRoot preserves an explicit model override as an exact replay recipe', async () => {
+    const exactModel = 'anthropic/claude-opus-5:high';
+    createNode(node('root', {
+        parent: null,
+        lifecycle: 'resident',
+        model_override: exactModel,
+        launch: { extensions: [], env: {}, model: exactModel, modelExact: true },
+    }));
+    const { deps } = makeDeps(4242);
+    const result = await relaunchRoot('root', deps);
+    assert.ok(result);
+    const replacement = getNode(result.newNodeId);
+    assert.equal(replacement?.launch?.model, exactModel);
+    assert.equal(replacement?.launch?.modelExact, true, 'the replacement cannot route away from the override');
+    assert.ok(buildPiArgv(replacement, {}).argv.includes('--crtr-model-exact'), 'broker replay preserves the exact-model contract');
+});
 test('relaunchRoot on a boot failure leaves the old root + descendants fully intact', async () => {
     // The mint-and-boot-FIRST ordering: a launch failure (pid=null) must occur
     // BEFORE the old root is parked or its descendants reaped.