@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/__tests__/seam/broker-attach-multiclient.test.js

@@ -1,262 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-attach-multiclient.test.ts
-//
-// COMPILED SEAM (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in seam/ (CI), not the fast local loop.
-//
-// The MULTI-CLIENT half of the `crtr surface attach` acceptance gate: everything
-// whose contract is "more than one viewer is attached at once". One shared broker
-// serves all four journeys.
-//
-// 3-PART HEADER (headless):
-//  (1) CONTRACT — every client that hellos as `controller` is welcomed writable,
-//      simultaneously and independently; each writable client may submit, every
-//      connected client (both writers plus a read-only observer) receives the
-//      merged stream of both submissions and the `model_changed` broadcast, and a
-//      client that hellos as `observer` is rejected with error{read_only} when it
-//      tries to drive. ONE blocking dialog fans to EVERY writable client, is
-//      handed to a writable client attaching MID-dialog via
-//      `welcome.pending_dialog`, is settled by the FIRST response with ITS value,
-//      dismisses every peer by id, and ignores a late peer answer. An in-place
-//      session mutation (`navigate_tree`) re-welcomes every viewer onto the
-//      rewound transcript. A late joiner's welcome is COMPLETE: retained display
-//      levels ride in `welcome.snapshot.display` and no display edge follows it.
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — role admission, dialog fan-out,
-//      re-welcome fan-out and catch-up shape are broker-process and view.sock
-//      contracts, exercised over a pure Unix socket using the production
-//      ViewSocketClient with a real broker process and no tmux pane or window.
-//  (3) HOW THE HEADLESS DRIVE ASSERTS THE CONTRACT — the real socket responses
-//      provide the welcome roles, per-writer relay frames, the read-only
-//      rejection, the fanned dialog frames plus the value and latency recorded in
-//      fake-pi.dialog.jsonl, the second welcome after navigate_tree, and the
-//      welcome payload of a late joiner.
-//
-// One shared broker is booted in before() and reused across every test. There is
-// no writer slot to hand off, so each test simply attaches at the role it wants;
-// afterEach closes the prior sockets, which is also what leaves the broker
-// VIEWERLESS for the display catch-up test.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { isPidAlive } from '../../canvas/pid.js';
-import { createAttachKit, delay, tok, frameHas } from '../helpers/broker-clients.js';
-let h;
-let id; // ONE shared broker, reused across every test (1 real boot)
-const kit = createAttachKit(() => h);
-const { attach, attachUntil } = kit;
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkmulti' });
-    const root = h.spawnRoot('broker-attach-multiclient suite root');
-    id = await h.spawnHeadlessChild(root, 'headless worker — multi-client gates');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-const brokerPid = () => h.node(id).pi_pid;
-// Attach a writable client. Every `hello` claiming `controller` is admitted
-// writable — attaching a peer never demotes an already-attached one.
-const writer = async (cid) => {
-    const a = await attach(id, 'controller', cid);
-    assert.equal(a.welcome.role, 'controller', `${cid}: admitted writable, not demoted by an existing peer`);
-    return a;
-};
-const observer = async (cid) => {
-    const a = await attach(id, 'observer', cid);
-    assert.equal(a.welcome.role, 'observer', `${cid}: an observer hello stays read-only`);
-    return a;
-};
-// The broker handles one client's frames in order, so an `ack` for a get_commands
-// sent AFTER some other frame proves that earlier frame was already processed.
-// Used to make "a late peer answer changed nothing" a deterministic assertion
-// instead of a sleep.
-const barrier = async (c, label) => {
-    c.send({ type: 'get_commands' });
-    await c.waitFrame((f) => f.type === 'ack' && f.for === 'get_commands', label);
-};
-const isRequest = (f) => f.type === 'extension_ui_request';
-const dismissFor = (reqId) => (f) => f.type === 'extension_ui_dismiss' && f.id === reqId;
-const welcomes = (frames) => frames.filter((f) => f.type === 'welcome');
-// G4 — multi-writer admission + read-only gating + broadcast fan-out. Guards: two
-// simultaneous `controller` hellos are BOTH welcomed writable, each one's own
-// submission reaches the engine, every connected client sees BOTH turns, an
-// explicit observer that tries to drive is rejected with error{read_only}, and a
-// model switch — for which pi emits no AgentSessionEvent at all — reaches EVERY
-// viewer as a `model_changed` frame rather than only acking the requester
-// (observed 2026-06-11: the status bar kept showing the old model).
-// Failure mode: a singleton writer slot demoting the second client, a writer
-// whose prompt is silently dropped, fan-out that misses a viewer, a read-only
-// client that can drive the engine, or a model switch only its requester hears.
-test('G4 — two simultaneous clients are both welcomed controller, each submits, all clients see both turns and the model switch; an observer drive → error{read_only}', async () => {
-    const [w1, w2] = await Promise.all([
-        attach(id, 'controller', 'g4-writer-1'),
-        attach(id, 'controller', 'g4-writer-2'),
-    ]);
-    assert.equal(w1.welcome.role, 'controller', 'first client is welcomed writable');
-    assert.equal(w2.welcome.role, 'controller', 'second SIMULTANEOUS client is ALSO welcomed writable (no singleton slot)');
-    const obs = await attach(id, 'observer', 'g4-observer');
-    assert.equal(obs.welcome.role, 'observer', 'an explicit observer hello stays read-only');
-    // A read-only client may not drive the engine — the role is per-client and
-    // fixed by its own hello, so this rejection is independent of who else is
-    // attached.
-    obs.send({ type: 'prompt', text: 'a read-only client must not drive' });
-    const err = await obs.waitFrame((f) => f.type === 'error', 'G4 observer prompt rejected');
-    assert.equal(err.code, 'read_only', 'G4: observer prompt → error{read_only}');
-    // Each writer submits its OWN token. Submissions are sequenced (a prompt sent
-    // mid-stream routes as a steer and produces no second turn), so each turn is
-    // driven to its terminal agent_end before the next writer submits.
-    const tokenA = tok('G4-WRITER-1');
-    w1.send({ type: 'prompt', text: tokenA });
-    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 1 saw its own turn');
-    const tokenB = tok('G4-WRITER-2');
-    w2.send({ type: 'prompt', text: tokenB });
-    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 2 saw its own turn');
-    // The merged stream: EVERY connected client — both writers and the read-only
-    // observer — receives BOTH writers' turns.
-    await w2.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 writer 2 ALSO received writer 1 turn');
-    await w1.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 writer 1 ALSO received writer 2 turn');
-    await obs.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenA), 'G4 observer received writer 1 turn');
-    await obs.waitFrame((f) => f.type === 'agent_end' && frameHas(f, tokenB), 'G4 observer received writer 2 turn');
-    // A model switch has no AgentSessionEvent to ride: the broker mirrors
-    // snapshot.state.model to every client itself. Pre-fix only the requester's
-    // bare ack existed, so both model_changed waits time out.
-    w1.send({ type: 'set_model', model: 'anthropic/fake-fable' });
-    const ack = await w1.waitFrame((f) => f.type === 'ack' && f.for === 'set_model', 'G4 set_model ack');
-    assert.ok(ack.type === 'ack' && ack.ok, 'G4: set_model acked ok to the requester');
-    const cm = await w1.waitFrame((f) => f.type === 'model_changed', 'G4 requester receives model_changed');
-    assert.ok(cm.type === 'model_changed' && cm.model?.id === 'fake-fable', 'G4: the requester sees the new model id');
-    const om = await obs.waitFrame((f) => f.type === 'model_changed', 'G4 observer receives model_changed');
-    assert.ok(om.type === 'model_changed' && om.model?.id === 'fake-fable', 'G4: a read-only observer ALSO hears the switch');
-});
-// G5 — dialog fan-out, mid-dialog handoff, and first-response settlement.
-// Guards: ONE blocking dialog reaches EVERY writable client (never a single
-// owner), a writable client attaching MID-dialog is handed it via
-// welcome.pending_dialog and becomes a full peer in the race to answer, the first
-// answer unblocks the engine with ITS value (not the default), every fanned
-// client gets the correlated extension_ui_dismiss, and a peer answering
-// afterwards is a no-op. An observer is never fanned an answerable dialog.
-// Failure modes: a dialog only one viewer can see (the others sit blind), a
-// late-joining writable viewer blind to an in-flight dialog, peers left holding
-// an overlay nothing can answer, or a late peer answer re-settling a dead dialog.
-test('G5 — one dialog fans out to every writable client and to a mid-dialog joiner, the first response settles it, all are dismissed, and a late peer response is a no-op', async () => {
-    const base = h.dialogResults(id).length;
-    const a = await writer('g5-A');
-    const b = await writer('g5-B');
-    const obs = await observer('g5-obs'); // must never be fanned an answerable dialog
-    h.fakeCmd(id, { cmd: 'dialog', timeout: 30_000 }); // generous: a writable client answers first
-    const reqA = await a.waitFrame(isRequest, 'G5 dialog fanned out to writable A');
-    const reqB = await b.waitFrame(isRequest, 'G5 dialog fanned out to writable B');
-    const reqId = reqA.id;
-    assert.equal(reqB.id, reqId, 'G5: both writable clients were fanned the SAME dialog id, not two dialogs');
-    assert.equal(reqA.method, 'confirm', 'G5: the fanned dialog is the confirm() the engine raised');
-    // A writable client attaching MID-dialog is handed the pending dialog in its
-    // welcome (retry covers the beat between the raise and this attach); an
-    // observer attaching mid-dialog is not.
-    assert.equal(obs.welcome.pending_dialog, null, 'G5: an observer welcome never carries a pending dialog');
-    const late = await attachUntil(id, 'controller', 'g5-late', (x) => x.welcome.role === 'controller' && x.welcome.pending_dialog != null, 'G5 writable client attaches mid-dialog and is handed the pending dialog');
-    assert.equal(late.welcome.pending_dialog.id, reqId, 'G5: welcome.pending_dialog is the SAME dialog the peers hold');
-    assert.equal(late.welcome.pending_dialog.method, 'confirm', 'G5: the pending dialog is the confirm()');
-    // The mid-dialog joiner answers FIRST — the engine must proceed with its true,
-    // not the false default.
-    late.send({ type: 'extension_ui_response', id: reqId, confirmed: true });
-    await late.waitFrame(dismissFor(reqId), 'G5 answerer receives the correlated dismiss');
-    await a.waitFrame(dismissFor(reqId), 'G5 peer A receives the correlated dismiss for the dialog it never answered');
-    await b.waitFrame(dismissFor(reqId), 'G5 peer B receives the correlated dismiss for the dialog it never answered');
-    const results = await h.waitFor(() => (h.dialogResults(id).length > base ? h.dialogResults(id) : null), { label: 'G5 dialog settled by the first response', timeoutMs: 15_000 });
-    assert.equal(results[base].resolved, true, 'G5: the engine proceeded with the first answer (true), not the default (false)');
-    // The observer was attached the whole time: it saw the broadcast dismiss but was
-    // never handed the answerable request.
-    await obs.waitFrame(dismissFor(reqId), 'G5 observer sees the broadcast dismiss (ordering barrier)');
-    assert.equal(obs.frames.filter(isRequest).length, 0, 'G5: an observer is never fanned an answerable dialog');
-    // B answers the already-settled dialog. The broker deleted the entry on the first
-    // response, so this finds nothing and is a silent no-op: no second engine
-    // resolution, and the recorded answer stays the first answerer's.
-    b.send({ type: 'extension_ui_response', id: reqId, confirmed: false });
-    await barrier(b, 'G5 broker processed B late response (ordered ack)');
-    const settled = h.dialogResults(id);
-    assert.equal(settled.length, base + 1, 'G5: the late peer response resolved nothing — no second dialog entry');
-    assert.equal(settled[base].resolved, true, "G5: the late peer response did not overwrite the first answerer's value");
-    assert.equal(isPidAlive(brokerPid()), true, 'G5: the late no-op response did not fault the broker');
-});
-// G9 — re-welcome after an IN-PLACE session mutation (real bug, observed
-// 2026-06-11 in `crtr surface attach`: double-Esc/`/tree` opened the session-tree
-// picker, but SELECTING an entry visibly did nothing). session.navigateTree()
-// rewinds in place — same session file, new leaf, NO relayed AgentSessionEvent —
-// so unlike the session-REPLACING ops (new_session/switch_session/fork →
-// runReplacement → reWelcomeAll) the handler used to only ack, leaving every
-// attached client rendering the abandoned branch and dropping the navigated-to
-// user message's editorText. Failure mode: no second welcome arrives at all, or
-// the re-welcome serves a stale snapshot.
-test('G9 — navigate_tree re-welcomes every viewer onto the rewound transcript and acks the editor text', async () => {
-    const c = await writer('nav-ctrl');
-    // Accrue one observable turn so the rewind has something to drop.
-    const token = tok('NAV-TURN');
-    c.send({ type: 'prompt', text: token });
-    await c.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G9 turn relayed before navigate');
-    // The observer attaches AFTER the turn so its first welcome deterministically
-    // holds the token (the pre-navigate baseline).
-    const o = await attachUntil(id, 'observer', 'nav-obs', (a) => frameHas(a.welcome, token), 'G9 observer welcome holds the pre-navigate turn');
-    c.send({ type: 'navigate_tree', targetId: 'entry-x' });
-    // The ack carries the navigated-to user message's text in detail (the viewer
-    // restores it to the editor). Pre-fix: ack had no detail.
-    const ack = await c.waitFrame((f) => f.type === 'ack' && f.for === 'navigate_tree', 'G9 navigate_tree ack');
-    assert.ok(ack.type === 'ack' && ack.ok, 'G9: navigate_tree acked ok');
-    assert.equal(ack.type === 'ack' ? ack.detail : undefined, 'rewound-to:entry-x', 'G9: ack.detail carries the rewound-to editor text');
-    // BOTH viewers get re-welcomed onto the rewound history. Pre-fix: no second
-    // welcome ever arrives (navigate_tree only acked).
-    await h.waitFor(() => (welcomes(c.frames).length >= 2 ? true : null), { label: 'G9 controller re-welcomed' });
-    await h.waitFor(() => (welcomes(o.frames).length >= 2 ? true : null), { label: 'G9 observer re-welcomed' });
-    // The re-welcome serves the REWOUND transcript: the fake's navigateTree popped
-    // the last accrued turn, so the token present in the observer's first welcome
-    // must be gone from its second.
-    const [first, second] = welcomes(o.frames);
-    assert.ok(frameHas(first, token), 'G9: pre-navigate welcome holds the turn');
-    assert.ok(!frameHas(second, token), 'G9: re-welcome serves the rewound transcript (turn dropped)');
-    assert.equal(second.snapshot.messages.length, first.snapshot.messages.length - 2, 'G9: re-welcome history is exactly one turn shorter (a turn = user + assistant = 2 tree messages)');
-});
-// G10 — catch-up is ONE atomic frame. `ctx.ui.setStatus/setWidget/setTitle` are
-// LEVELS with no pi getter, so the broker is their only holder; it ships that
-// held state as `welcome.snapshot.display` and sends NO display edge after the
-// welcome, so a late joiner renders complete chrome on its FIRST paint. Painting
-// here happens with ZERO viewers attached (afterEach closed the previous test's
-// clients), so only retention can carry it. Pre-2026-07-24 `sendWelcome`
-// re-emitted N synthetic display frames after the snapshot: catch-up was
-// non-atomic and the viewer had to clear-and-rebuild, painting blank chrome in
-// the gap. Both halves of that cut fail this test.
-test('G10 — retained extension display state rides IN welcome.snapshot.display, and no display edge follows the welcome', async () => {
-    const DISPLAY_METHODS = new Set(['setStatus', 'setWidget', 'setTitle']);
-    const isDisplayFrame = (f) => f.type === 'extension_ui_request' && f.method !== undefined && DISPLAY_METHODS.has(f.method);
-    h.fakeCmd(id, { cmd: 'display', text: 'crtr-brief', reason: 'painted while detached' });
-    const a = await attachUntil(id, 'observer', 'g10-late-joiner', (at) => at.welcome.snapshot.display?.statuses['crtr-brief'] !== undefined, 'G10 welcome.snapshot.display carries the retained status');
-    const display = a.welcome.snapshot.display;
-    assert.equal(display.statuses['crtr-brief'], 'painted while detached', 'G10: setStatus level survived in the snapshot');
-    assert.deepEqual(display.widgets['crtr-brief'], { lines: ['painted while detached'], placement: 'aboveEditor' }, 'G10: setWidget level survived in the snapshot, placement included');
-    assert.equal(display.title, 'painted while detached', 'G10: setTitle level survived in the snapshot');
-    // Atomicity: the welcome is COMPLETE. Give the broker a generous beat to emit a
-    // replay it must not emit, then assert nothing display-shaped arrived at all.
-    await delay(500);
-    assert.deepEqual(a.frames.filter((f) => isDisplayFrame(f)).map((f) => f.method), [], 'G10: catch-up is the welcome alone — no synthetic display edges replayed after it');
-    // A LIVE paint still arrives as an edge frame: the snapshot replaces the replay,
-    // not the ongoing relay.
-    h.fakeCmd(id, { cmd: 'display', text: 'crtr-live', reason: 'painted while attached' });
-    const live = (await a.waitFrame((f) => f.type === 'extension_ui_request' && f.statusKey === 'crtr-live', 'G10 a live setStatus still relays as an extension_ui_request edge'));
-    assert.equal(live.method, 'setStatus');
-    assert.equal(live.statusText, 'painted while attached');
-});
-// snapshot_tail — a viewer that asks for the last N messages gets exactly them,
-// each with the stable id it needs to page the omitted history back in. The
-// broker serves a tail only when the session yields those ids; it never invents
-// one, so a tail can never strand its recipient on history it cannot reach.
-test('snapshot_tail serves the last N messages with the stable ids that page the rest back', async () => {
-    const token = tok('snapshot-tail');
-    h.fakeCmd(id, { cmd: 'stream', text: token });
-    const full = await attachUntil(id, 'observer', 'snapshot-tail-full', (a) => JSON.stringify(a.welcome.snapshot.messages).includes(token), 'full snapshot after a tail-less attach');
-    const fullIds = full.welcome.snapshot.messageIds;
-    assert.ok(fullIds !== undefined && fullIds.length > 1, 'the session yields a stable id per message');
-    assert.equal(fullIds.length, full.welcome.snapshot.messages.length, 'every message in the welcome carries an id');
-    const tailed = await attach(id, 'observer', 'snapshot-tail-request', { snapshotTail: 1 });
-    assert.deepEqual(tailed.welcome.snapshot.messageIds, fullIds.slice(-1), 'the tail carries the ids of the messages it kept');
-    assert.deepEqual(tailed.welcome.snapshot.messages, full.welcome.snapshot.messages.slice(-1), 'the tail is the last message alone, not the whole history');
-});

package/dist/core/__tests__/seam/broker-attach-stream.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/seam/broker-attach-stream.test.js

@@ -1,176 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-attach-stream.test.ts
-//
-// COMPILED SEAM (real-boot-bound): tmux-free, but it boots a REAL broker process
-// (~5s pi-SDK load), so it lives in seam/ (CI), not the fast local loop.
-//
-// T8 — the `crtr surface attach` acceptance gate, gates G1/G1b/G2 (controller drive,
-// relay/coalescing, detach survival) plus the deliver ack's truthfulness (G3).
-// Split out of broker-lifecycle.test.ts; the gates are the original acceptance
-// gate, unchanged.
-//
-// 3-PART HEADER (headless-retarget):
-//  (1) BUG IT LOCKS — the broker's client fan-out: a controller `prompt` must run
-//      the engine and the streamed AgentSessionEvents must relay VERBATIM and IN
-//      ORDER to every viewer (G1); message_update coalescing must flush BEFORE any
-//      other event so a stale update can never land after message_end, and the
-//      last coalesced update must not be dropped (G1b, the F2 typing-lag fix);
-//      detach (bye+close) must drop ONE listener, never the engine (G2).
-//      Regression = a viewer that sees nothing / sees stale text / kills the engine
-//      on detach.
-//  (2) WHY BROKER/SOCKET-LEVEL, NOT PANE/WINDOW — the relay is a pure unix-socket
-//      path: ViewSocketClient ⇄ broker view.sock ⇄ in-process fake engine's
-//      subscribe channel. No tmux pane, window, or pi session read is involved, so
-//      the lock holds headlessly (createHeadlessHarness, no tmux). It needs a REAL
-//      broker PROCESS (not just model state) because it proves the cross-process
-//      frame codec + fan-out + coalescer, which is why this file keeps ONE real
-//      boot shared across all three gates.
-//  (3) HOW THE HEADLESS DRIVE STILL FAILS ON REGRESSION — each gate attaches the
-//      PRODUCTION ViewSocketClient over the real socket and asserts on the frames
-//      the real broker relays (order, types, snapshot, pid stability). A broken
-//      relay/coalescer/detach path fails the frame assertions exactly as it would
-//      under tmux; nothing here depended on a pane.
-//
-// The engine is hosted IN-PROCESS by the broker, so engine pid == broker pid ==
-// node.pi_pid == boot.pid; "engine pid unchanged" == broker pid unchanged + no new
-// boot. ONE shared broker is booted in before() and reused across all three gates
-// (each just attaches fresh clients) — 1 real boot total, not 3. Each gate attaches
-// a fresh writable client; afterEach closes prior sockets before the next gate begins,
-// and each client's role remains fixed for its socket.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { createHeadlessHarness } from '../helpers/harness.js';
-import { isPidAlive } from '../../canvas/pid.js';
-import { createAttachKit, brokerLogText, delay, tok, frameHas } from '../helpers/broker-clients.js';
-import { REJECT_PROMPT_CALL } from '../fixtures/fake-engine.js';
-let h;
-let id; // ONE shared broker, reused across G1/G1b/G2 (1 real boot, not 3)
-const kit = createAttachKit(() => h);
-const { attach, attachUntil } = kit;
-// Attach a writable client for the gate; its role remains fixed for this socket.
-const ctrl = (cid) => attachUntil(id, 'controller', cid, (a) => a.welcome.role === 'controller', `${cid} admitted controller`);
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-brkstrm' });
-    const root = h.spawnRoot('broker-attach-stream suite root');
-    id = await h.spawnHeadlessChild(root, 'headless worker — attach-stream gates');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-const brokerPid = () => h.node(id).pi_pid;
-// G1 — controller drive + live relay. Guards: a controller's `prompt` runs the
-// engine AND the streaming AgentSessionEvents are fanned out to the client
-// VERBATIM. Failure mode: a broken relay/fan-out (viewer sees nothing).
-test('G1 — controller prompt runs the engine and the streamed AgentSessionEvents relay to the client', async () => {
-    const c = await attachUntil(id, 'controller', 'g1-ctrl', (a) => a.welcome.role === 'controller' && a.welcome.snapshot.state.isStreaming === false, 'G1 controller admitted while the engine is idle');
-    assert.equal(c.welcome.role, 'controller', 'first controller is admitted as controller');
-    const token = tok('G1-PROMPT');
-    c.send({ type: 'prompt', text: token });
-    // The full streaming turn relays: agent_end carrying the token proves the turn
-    // ran AND its terminal frame reached the client; the intermediate types prove
-    // the stream (not just a final blob) was fanned out.
-    await c.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G1 agent_end carrying the prompt token');
-    for (const t of ['message_start', 'message_update', 'tool_execution_start', 'tool_execution_update', 'tool_execution_end', 'message_end', 'turn_end', 'agent_start', 'turn_start']) {
-        assert.ok(c.frames.some((f) => f.type === t), `G1: client received a relayed ${t} frame`);
-    }
-    assert.ok(c.frames.some((f) => f.type === 'message_start' && frameHas(f, token)), 'G1: a relayed message carries the prompt token');
-});
-// G1b — message_update coalescing preserves ordering (regression for the F2
-// attach typing-lag fix, 2026-06-09). The broker holds the latest message_update
-// on a ~75ms timer; any OTHER event must flush it FIRST, so a viewer can never
-// observe message_update AFTER its message_end (which would resurrect stale
-// streaming text over the final message), and the LAST coalesced update must not
-// be silently dropped at end-of-turn. Failure modes: a flush ordered after the
-// non-update event, or a pending update discarded when message_end wins the race.
-test('G1b — coalesced message_update never arrives after message_end; updates still relayed', async () => {
-    const c = await ctrl('g1b-ctrl');
-    const token = tok('G1B');
-    // 12 updates at the fake engine's setImmediate pace — far faster than the 75ms
-    // coalesce window, so coalescing genuinely engages (fewer relayed than emitted).
-    h.fakeCmd(id, { cmd: 'stream', text: token, updates: 12 });
-    await c.waitFrame((f) => f.type === 'agent_end' && frameHas(f, token), 'G1b turn relayed');
-    const types = c.frames.map((f) => f.type);
-    const lastUpdate = types.lastIndexOf('message_update');
-    const msgEnd = types.indexOf('message_end');
-    assert.ok(lastUpdate >= 0, 'G1b: at least one message_update relayed (coalescing must not starve updates)');
-    assert.ok(msgEnd >= 0, 'G1b: message_end relayed');
-    const updates = c.frames.filter((frame) => frame.type === 'message_update');
-    assert.ok(updates.length < 12, `G1b: ${updates.length} relayed updates proves the 12-update burst was coalesced`);
-    for (const update of updates) {
-        assert.equal(update.message.role, 'assistant', 'G1b: crouter relays the in-process cumulative message_update contract');
-        assert.ok('partial' in update.assistantMessageEvent, 'G1b: crouter does not route pi JSON/RPC delta-only events through view.sock');
-    }
-    assert.ok(lastUpdate < msgEnd, `G1b: a message_update arrived AFTER message_end (update@${lastUpdate} vs end@${msgEnd}) — the coalescer flushed out of order`);
-    // tool/turn/agent frames must also never precede a stale held update.
-    for (const t of ['tool_execution_start', 'turn_end', 'agent_end']) {
-        const i = types.indexOf(t);
-        assert.ok(i < 0 || lastUpdate < i, `G1b: message_update relayed after ${t}`);
-    }
-});
-// G2 — detach leaves the engine running. Guards: `bye`/close drops ONE listener,
-// never the engine. Failure mode: a detach that disposes the broker/engine.
-test('G2 — detach (bye+close) leaves the broker alive + the engine still emitting; engine pid unchanged', async () => {
-    const pid = brokerPid();
-    const boots = h.bootCount(id);
-    const c = await ctrl('g2-ctrl');
-    const p = tok('G2-PROMPT');
-    c.send({ type: 'prompt', text: p });
-    await c.waitFrame((f) => f.type === 'agent_end' && frameHas(f, p), 'G2 turn relayed before detach');
-    c.send({ type: 'bye' });
-    c.close();
-    await delay(300); // let the broker process the 'close'
-    assert.equal(isPidAlive(pid), true, 'G2: broker still alive after detach');
-    assert.equal(brokerPid(), pid, 'G2: engine (== broker) pid UNCHANGED across detach');
-    assert.equal(h.bootCount(id), boots, 'G2: no reboot — no second engine spawned');
-    // Still emitting: drive a turn with no client, then a fresh observer's snapshot
-    // carries it (the engine kept running and processing after the detach).
-    const after = tok('G2-AFTER-DETACH');
-    h.fakeCmd(id, { cmd: 'stream', text: after });
-    const o = await attachUntil(id, 'observer', 'g2-obs', (a) => JSON.stringify(a.welcome.snapshot.messages).includes(after), 'G2 post-detach message in snapshot');
-    assert.ok(o.welcome.snapshot.messages.length > 0, 'G2: the engine produced a message after the detach');
-    assert.equal(isPidAlive(pid), true, 'G2: broker still alive after the post-detach turn');
-});
-// G3 — the interactive `deliver` ack reports the ENGINE CALL's real outcome, not
-// the fact that a call was routed. A `session.prompt()` that REJECTS outright —
-// the shape a broker whose model resolved but whose provider has no installed
-// credential produces ("No API key found for anthropic") — used to still ack
-// ok:true, so crtrd returned `delivered:true, delivered_via:engine` for a message
-// the engine had refused and the one-shot client closed before the error frame
-// arrived: the message vanished with no trace. The ack now races acceptance (the
-// engine's own agent_start) against rejection and records
-// `broker.prompt.deliver_failed` in the node's job/log.jsonl. Shares this file's
-// one broker: the contract is two frames on an attached controller.
-test('G3 — a deliver whose prompt rejects acks ok:false and records deliver_failed; a succeeding deliver acks ok:true via prompt', async () => {
-    // Both delivers must route as `prompt` (idle), never `steer` — the steer route
-    // legitimately acks at routing time — so attach only once the engine is idle.
-    const c = await attachUntil(id, 'controller', 'g3-ctrl', (a) => a.welcome.role === 'controller' && a.welcome.snapshot.state.isStreaming === false, 'G3 controller admitted while the engine is idle');
-    // FAILURE: the engine refuses the call itself. Before the fix this acked
-    // ok:true and the rejection left no trace in the node's log.
-    c.send({ type: 'deliver', id: 'd-fail', text: `do a thing ${REJECT_PROMPT_CALL}` });
-    const failAck = await c.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-fail', 'G3 rejected deliver ack');
-    assert.equal(failAck.type === 'ack' && failAck.ok, false, 'G3: a rejected prompt must not ack delivered:true');
-    assert.match((failAck.type === 'ack' ? failAck.detail : undefined) ?? '', /No API key found/, 'G3: the ack detail carries the engine rejection');
-    await h.waitFor(() => (brokerLogText(h, id).includes('broker.prompt.deliver_failed') ? true : null), { label: 'G3 broker.prompt.deliver_failed recorded in job/log.jsonl' });
-    // POSITIVE CONTROL: an ordinary deliver still acks ok:true from acceptance
-    // (the engine's agent_start), detail naming the prompt route.
-    c.send({ type: 'deliver', id: 'd-ok', text: 'an ordinary interactive message' });
-    const okAck = await c.waitFrame((f) => f.type === 'ack' && f.for === 'deliver' && f.id === 'd-ok', 'G3 accepted deliver ack');
-    assert.equal(okAck.type === 'ack' && okAck.ok, true, 'G3: an accepted prompt acks delivered:true');
-    assert.equal(okAck.type === 'ack' ? okAck.detail : undefined, 'prompt');
-});
-// A message_end is only a broker/viewer relay. It must not depend on a daemon
-// read: a daemon outage after boot leaves tool results and the run settlement intact.
-test('G4 — a daemon read failure after boot does not interrupt a tool result or its settlement', async () => {
-    const c = await ctrl('g4-ctrl');
-    const pid = brokerPid();
-    await h.stopApiServer();
-    const token = tok('G4-TOOL-RESULT');
-    h.fakeCmd(id, { cmd: 'stream', text: token, updates: 0 });
-    await c.waitFrame((f) => f.type === 'tool_execution_end', 'G4 tool result relayed after the daemon server exits');
-    await c.waitFrame((f) => f.type === 'agent_settled', 'G4 run settles after the daemon server exits');
-    await delay(200);
-    assert.equal(isPidAlive(pid), true, 'G4: broker remains alive after relaying and settling the tool result');
-});

package/dist/core/__tests__/seam/broker-cap-freeze.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/__tests__/seam/broker-cap-freeze.test.js

@@ -1,155 +0,0 @@
-// Run with: npm run build && node --test dist/core/__tests__/seam/broker-cap-freeze.test.js
-//
-// The cap as the host actually meets it: real broker processes, the real
-// ledger, and the real supervision tick. With CRTR_MAX_LIVE_BROKERS=2 a third
-// birth gets no engine at all — the row exists, carries the durable wait mark,
-// and holds no pid — and it survives repeated saturated ticks rather than being
-// written off as a boot failure. When a live node finishes and gives its slot
-// back, the next tick spends that slot on the waiting row and retires the mark.
-//
-// This is the whole point of P3, and none of it is observable without real
-// processes: the freeze is decided at the launch seam and the thaw is decided
-// by the daemon pass, so it belongs in the compiled seam tier.
-import { after, before, test } from 'node:test';
-import assert from 'node:assert/strict';
-import { createNode } from '../../canvas/canvas.js';
-import { closeDb } from '../../canvas/db.js';
-import { resetSession } from '../../canvas/sessions.js';
-import { isPidAlive } from '../../canvas/pid.js';
-import { enqueueNodeMail } from '../../feed/messages.js';
-import { closeNode } from '../../runtime/close.js';
-import { headlessBrokerHost } from '../../runtime/host.js';
-import { transition } from '../../runtime/lifecycle.js';
-import { reviveNode } from '../../runtime/revive.js';
-import { spawnChild } from '../../runtime/spawn.js';
-import { createHarness } from '../helpers/harness.js';
-let h;
-let root;
-before(async () => {
-    // Read per launch by brokerThresholdsForDaemon(), so setting it before the
-    // harness boots covers every launch this file drives.
-    process.env['CRTR_MAX_LIVE_BROKERS'] = '2';
-    h = await createHarness({ headless: true, sessionPrefix: 'crtr-broker-cap' });
-    root = h.spawnRoot('broker cap suite root');
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-    delete process.env['CRTR_MAX_LIVE_BROKERS'];
-});
-test('node new reports a frozen delegated birth without claiming its broker started', { timeout: 120_000 }, async () => {
-    const created = [];
-    try {
-        for (const prompt of ['first API child', 'second API child']) {
-            const result = h.cli(root, ['--json', 'node', 'new', '--kind', 'general', prompt]);
-            assert.equal(result.code, 0, `node new should succeed\n${result.stderr}`);
-            const nodeId = result.json.node_id;
-            created.push(nodeId);
-            await h.awaitBoot(nodeId);
-        }
-        const frozen = h.cli(root, ['--json', 'node', 'new', '--kind', 'general', 'frozen API child']);
-        assert.equal(frozen.code, 0, `node new should record the frozen birth\n${frozen.stderr}`);
-        const output = frozen.json;
-        created.push(output.node_id);
-        assert.ok(output.frozen_at !== undefined, 'JSON reports the durable frozen birth detail');
-        assert.match(output.follow_up, /Child row exists, but no broker started because capacity is full/);
-        const prose = h.cli(root, ['node', 'new', '--kind', 'general', 'another frozen API child']);
-        assert.equal(prose.code, 0, `node new should report capacity in prose\n${prose.stderr}`);
-        assert.match(prose.stdout, /Child row exists, but no broker started because capacity is full/);
-        const proseNode = prose.stdout.match(/\(([^)]+)\)/)?.[1];
-        assert.ok(proseNode !== undefined, 'prose names the created frozen row');
-        created.push(proseNode);
-    }
-    finally {
-        for (const nodeId of created)
-            h.cli(root, ['node', 'lifecycle', 'close', '--node', nodeId]);
-    }
-});
-test('a birth at the cap freezes instead of booting, survives saturated ticks, and thaws when a slot frees', { timeout: 120_000 }, async () => {
-    const first = await h.spawnHeadlessChild(root, 'first live child');
-    const second = await h.spawnHeadlessChild(root, 'second live child');
-    assert.equal(h.fleet.size(), 2, 'precondition: both slots are held by real brokers');
-    // The third birth meets a full ledger. spawnChild returns rather than
-    // crashing the row: a node that only has to wait is not a failed launch.
-    const born = await spawnChild({
-        kind: 'general',
-        cwd: h.node(first).cwd,
-        prompt: 'third child, born at the cap',
-        parent: root,
-    });
-    closeDb();
-    const third = born.node.node_id;
-    assert.equal(born.frozen, true, 'the birth reports that it got no engine');
-    const frozenRow = h.node(third);
-    assert.ok(frozenRow.frozen_at != null, 'the row carries the durable wait mark');
-    assert.equal(frozenRow.pi_pid ?? null, null, 'no pid was ever recorded — status surfaces read frozen, not stale-active');
-    assert.equal(h.fleet.has(third), false, 'no broker process exists for the frozen row');
-    assert.equal(h.bootCount(third), 0, 'nothing booted');
-    // Six saturated ticks: the cap is not a failure, so nothing is charged
-    // against the row and nothing terminalizes it.
-    for (let i = 0; i < 6; i++)
-        await h.tick();
-    closeDb();
-    const survived = h.node(third);
-    assert.equal(survived.status, 'active', 'six saturated ticks leave the row alive and still owed an engine');
-    assert.equal(survived.respawn_failures ?? 0, 0, 'waiting for a slot is not a respawn failure');
-    assert.equal(survived.frozen_at, frozenRow.frozen_at, 'the original wait timestamp survives — the thaw order reads it');
-    assert.equal(h.fleet.size(), 2, 'the two live brokers were never disturbed');
-    // Finish one node: its broker exits and gives the slot back.
-    const firstPid = h.node(first).pi_pid;
-    closeNode(first, { rootEvent: 'finish' });
-    closeDb();
-    await h.awaitFleetExit(first);
-    assert.equal(h.fleet.size(), 1, 'the finished node released its slot');
-    // The next tick spends the freed slot on the waiting row.
-    await h.tick();
-    closeDb();
-    await h.awaitBoot(third);
-    closeDb();
-    const thawed = h.node(third);
-    assert.equal(thawed.frozen_at ?? null, null, 'the launch retired the wait mark');
-    assert.ok(thawed.pi_pid != null && isPidAlive(thawed.pi_pid), 'the thawed node holds a live broker');
-    assert.equal(h.fleet.has(third), true, 'the freed slot is now the thawed node\u2019s');
-    assert.equal(h.fleet.has(second), true, 'the untouched live node kept its slot throughout');
-    assert.notEqual(thawed.pi_pid, firstPid, 'the thaw is a real new broker, not the finished node\u2019s pid lingering');
-    transition(second, 'park');
-    headlessBrokerHost.teardown(second);
-    await h.awaitFleetExit(second);
-    const filler = await h.spawnHeadlessChild(root, 'terminal thaw filler');
-    assert.equal(h.fleet.size(), 2, 'the parked target is non-live while the cap remains full');
-    enqueueNodeMail(second, { senderNodeId: root, kind: 'message', label: 'durable wake', urgency: 'normal', wake: 1 });
-    assert.equal((await reviveNode(second, { resume: true, capacity: 'freeze' })).outcome, 'frozen');
-    closeDb();
-    const frozenTerminal = h.node(second);
-    assert.equal(frozenTerminal.status, 'done', 'freezing preserves the terminal status');
-    assert.equal(frozenTerminal.intent, 'parked', 'freezing preserves the terminal intent');
-    assert.ok(frozenTerminal.frozen_at != null, 'the durable wake remains in the bounded terminal tick population');
-    headlessBrokerHost.teardown(filler);
-    await h.awaitFleetExit(filler);
-    await h.tick();
-    await h.awaitBoot(second, { minCount: 2 });
-    closeDb();
-    assert.equal(h.node(second).frozen_at ?? null, null, 'a freed slot thaws the frozen terminal wake');
-    assert.equal(h.fleet.has(second), true, 'the terminal wake receives the freed slot');
-    createNode({
-        node_id: 'resident-drain',
-        name: 'resident drain',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'resident',
-        status: 'done',
-        intent: 'parked',
-        cwd: h.node(third).cwd,
-        host_kind: 'broker',
-        parent: root,
-        created: new Date().toISOString(),
-    });
-    resetSession('resident-drain', { sessionId: 'resident-drain-session', transcriptPath: null });
-    assert.equal((await reviveNode('resident-drain', { resume: true, capacity: 'freeze' })).outcome, 'frozen');
-    await h.tick();
-    closeDb();
-    const drained = h.node('resident-drain');
-    assert.equal(drained.status, 'idle', 'an eligible resident drains to Dormant');
-    assert.equal(drained.frozen_at ?? null, null, 'draining retires the frozen mark');
-    assert.equal(h.fleet.size(), 2, 'the drain does not spend a live-broker slot');
-});

package/dist/core/__tests__/seam/broker-crash-teardown.test.d.ts

@@ -1 +0,0 @@
-export {};