@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/__tests__/seam/broker-provider-retry.test.js

@@ -1,686 +0,0 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-provider-retry.test.ts
-//
-// Broker-level regression coverage for turn-time provider rotation, context
-// overflow settlement, model-choice durability, and the model-less launch
-// re-drive. The fake engine emits pi's actual lifecycle events over
-// session.subscribe, so this exercises runBroker's live handlers rather than
-// its helpers in isolation.
-import { test, before, after, afterEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHeadlessHarness, readLines } from '../helpers/harness.js';
-import { createAttachKit } from '../helpers/broker-clients.js';
-import { openDb } from '../../canvas/db.js';
-import { defaultModelLaddersConfig } from '../../../types.js';
-import { admitEpisode, readEpisode as readProviderRetryEpisode, readFault, recordPendingEpisode } from '../../canvas/recovery.js';
-import { buildPiArgv, normalizeModel } from '../../runtime/launch.js';
-import { writeRawConfig } from '../../config.js';
-import { encodeFrame } from '../../runtime/broker-protocol.js';
-import { CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY, generatedContextText, parseCard } from '../../../shared/generated-context.js';
-import { RUNTIME_RESTART_CONTINUATION } from '../../runtime/kickoff.js';
-import { writeSubscriptionPool } from '../../subscription-state.js';
-const MODEL_LADDERS = defaultModelLaddersConfig();
-function resolvedModel(spec) {
-    const normalized = normalizeModel(spec, MODEL_LADDERS);
-    const modelSpec = normalized.replace(/:(?:off|minimal|low|medium|high|xhigh|max)$/, '');
-    const slash = modelSpec.indexOf('/');
-    assert.notEqual(slash, -1, `${spec} must normalize to a qualified provider/model spec`);
-    const provider = modelSpec.slice(0, slash);
-    const id = modelSpec.slice(slash + 1);
-    return { spec: normalized, model: { provider, id } };
-}
-const OPENAI_STRONG = resolvedModel('openai/strong');
-let h;
-const kit = createAttachKit(() => h);
-const { attachUntil } = kit;
-function episodeSessionId(episode) {
-    assert.ok(episode.sessionId !== null, 'a provider retry episode is bound to a session');
-    return episode.sessionId;
-}
-function admitProviderRetryEpisode(nodeId, episode, fault) {
-    return admitEpisode(nodeId, { sessionId: episodeSessionId(episode), faultId: fault.faultId, retry: fault.retry });
-}
-function setActiveFaultAnchor(nodeId, anchorEntryId) {
-    const result = openDb().prepare('UPDATE node_faults SET anchor_entry_id = ? WHERE node_id = ? AND active = 1').run(anchorEntryId, nodeId);
-    assert.equal(result.changes, 1, 'the fixture changes exactly one active fault');
-}
-function restoreAdmittedProviderRetryEpisode(nodeId, episode, fault) {
-    const stored = recordPendingEpisode(nodeId, {
-        sessionId: episodeSessionId(episode),
-        input: {
-            link: fault.link,
-            op: fault.op,
-            kind: fault.kind,
-            retry: fault.retry,
-            message: fault.message,
-            since: fault.since,
-            operation_id: fault.operation_id,
-            ...(fault.anchorEntryId === undefined ? {} : { anchorEntryId: fault.anchorEntryId }),
-            ...(fault.providerError === undefined ? {} : { providerError: fault.providerError }),
-        },
-    });
-    assert.ok(stored !== null, 'the bound session accepts a pending recovery episode');
-    assert.equal(admitProviderRetryEpisode(nodeId, episode, stored), true, 'the pending recovery episode becomes admitted');
-}
-async function seedPool(provider, cooling) {
-    await writeSubscriptionPool(provider, [{
-            label: 'test-account', refresh: 'refresh', access: 'access', expires: Date.now() + 60_000,
-            rateLimitedUntil: cooling ? Date.now() + 60_000 : 0, lastAttemptAt: 0, lastRateLimitedAt: 0,
-        }]);
-}
-function modelRoute(spec) {
-    return { ultra: spec, strong: spec, medium: spec, light: spec };
-}
-function seedCapacityFallbackRoutes() {
-    writeRawConfig('user', {
-        kinds: { 'test/capacity-fallback': { whenToUse: 'Capacity fallback regression.', model: 'anthropic/medium' } },
-        modelRoutes: {
-            primary: { family: 'anthropic', credentialSource: 'user', providerId: 'fake-primary', models: modelRoute('fake-primary/primary') },
-            fallback: { family: 'anthropic', credentialSource: 'northlight', providerId: 'fake-small', models: modelRoute('fake-small/small') },
-            largerFallback: { family: 'anthropic', credentialSource: 'third', providerId: 'fake-large', models: modelRoute('fake-large/large') },
-        },
-        modelRouting: { credentialSourceOrder: ['user', 'northlight', 'third'], familyOrder: ['anthropic'], strengthFallback: ['medium'] },
-    });
-}
-function seedCapacityFixture(id, largeContextWindow = 999) {
-    const dir = join(h.home, 'nodes', id);
-    writeFileSync(join(dir, 'fake-pi.context-tokens'), '1000');
-    writeFileSync(join(dir, 'fake-pi.model-capacities.json'), JSON.stringify({
-        'fake-primary/primary': 2000,
-        'fake-small/small': 999,
-        'fake-large/large': largeContextWindow,
-    }));
-}
-// The node's recorded model (fake-pi.model.json, written by the fake's
-// recordModel) — `null` for a model-less boot. A disk read, so it survives the
-// broker exiting after its kickoff turn idle-releases.
-function model(id) {
-    return JSON.parse(readFileSync(join(h.home, 'nodes', id, 'fake-pi.model.json'), 'utf8'));
-}
-// The fake engine records each settled overflow episode's outcome in
-// fake-pi.overflow.json, OVERWRITING it per episode. Two episodes on one broker
-// must therefore gate on the parsed `outcome`, never on file existence.
-function overflowOutcome(id) {
-    try {
-        const raw = readFileSync(join(h.home, 'nodes', id, 'fake-pi.overflow.json'), 'utf8');
-        return JSON.parse(raw).outcome ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-// Every fired lifecycle event is appended to fake-pi.events.jsonl. A broker
-// re-drive is a fresh session.prompt → emitTurn, which fires one 'agent_start';
-// counting them is the observable proof of how many times the turn was re-driven.
-function agentStartCount(id) {
-    return readLines(join(h.home, 'nodes', id, 'fake-pi.events.jsonl'))
-        .filter((line) => JSON.parse(line).event === 'agent_start').length;
-}
-async function crashAndRespawn(id, boots) {
-    const pid = h.node(id)?.pi_pid;
-    assert.ok(pid != null, 'the broker has a live pid before its physical death');
-    process.kill(pid, 'SIGKILL');
-    await h.awaitFleetExit(id);
-    await h.tick();
-    const deferred = h.node(id);
-    assert.ok(deferred.respawn_not_before != null, 'the daemon records respawn backoff after the broker exit');
-    await h.tick(Date.parse(deferred.respawn_not_before) + 1);
-    await h.awaitBoot(id, { minCount: boots + 1 });
-    await h.waitFor(() => existsSync(h.brokerSock(id)), { label: 'replacement broker listener bound' });
-}
-before(async () => {
-    h = await createHeadlessHarness({ sessionPrefix: 'crtr-provider-retry' });
-});
-after(async () => {
-    if (h !== undefined)
-        await h.dispose();
-});
-afterEach(() => {
-    kit.closeAll();
-});
-test('a normalized 503 survives into a durable provider fault and re-drives the turn', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('structured provider failure parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'structured provider failure', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(child) >= 1, { label: 'initial structured-failure fixture turn started' });
-    const kickoffObserver = await attachUntil(child, 'observer', 'structured-503-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'structured 503 kickoff settled');
-    kickoffObserver.close();
-    const baselineStarts = agentStartCount(child);
-    h.fakeCmd(child, {
-        cmd: 'stop',
-        reason: 'error',
-        errorMessage: 'Request failed',
-        providerFailure: { status: 503 },
-    });
-    const fault = await h.waitFor(() => {
-        const current = readFault(child);
-        return current?.kind === 'overloaded' && current.retry.disposition === 'auto' ? current : undefined;
-    }, { label: 'structured 503 published as an automatic provider fault' });
-    assert.equal(fault.providerError?.provider, OPENAI_STRONG.model.provider);
-    assert.equal(fault.providerError?.model, OPENAI_STRONG.model.id);
-    assert.equal(fault.providerError?.status, 503);
-    await h.waitFor(() => agentStartCount(child) >= baselineStarts + 1, {
-        label: 'structured 503 automatic recovery turn started',
-    });
-    await h.waitFor(() => readFault(child) === null, { label: 'successful recovery clears the structured provider fault' });
-});
-test('a managed-cooling terminal authors a rate-limit auto fault whose deadline drives exactly one broker re-drive', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('cooling terminal parent');
-    // The terminal fault path is pool-independent — the stophook classifies purely
-    // off the errorMessage text + the cooling diagnostic, so pool state is inert.
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'cooling terminal', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(child) >= 1, { label: 'initial cooling fixture turn started' });
-    const kickoffObserver = await attachUntil(child, 'observer', 'cooling-terminal-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'cooling terminal kickoff settled');
-    kickoffObserver.close();
-    const baselineStarts = agentStartCount(child);
-    // A terminal managed-cooling error at agent_end: its explanatory prose avoids
-    // rate-limit words entirely; the typed diagnostic alone must classify the
-    // fault as rate-limit/auto and carry its exact deadline.
-    const deadline = Date.now() + 2000;
-    h.fakeCmd(child, {
-        cmd: 'stop',
-        reason: 'error',
-        errorMessage: 'Managed provider pools are temporarily unavailable; switch to a direct API key. (tried anthropic, openai-codex)',
-        deadline,
-    });
-    // (1) the REAL stophook authored the pi→provider fault, stamping nextAt from
-    //     the cooling diagnostic — this is the whole point of the runtime fix.
-    const fault = await h.waitFor(() => {
-        const f = readFault(child);
-        return f !== null && f.link === 'pi→provider' ? f : undefined;
-    }, { label: 'cooling fault authored by stophook' });
-    assert.equal(fault.kind, 'rate-limit', 'the typed cooling terminal classifies as rate-limit without prose matching');
-    assert.equal(fault.retry.disposition, 'auto', 'a rate-limit fault is auto-retryable');
-    assert.equal(fault.retry.by, 'daemon', 'the broker/daemon owns the re-drive');
-    assert.equal(fault.retry.nextAt, new Date(deadline).toISOString(), 'the earliest cooling deadline becomes retry.nextAt');
-    // (2) the broker's own fault-retry timer fires exactly ONE re-drive at the
-    //     deadline. A completed re-drive turn clears the pi→provider fault at
-    //     turn_end, so no second timer is ever armed.
-    await h.waitFor(() => agentStartCount(child) >= baselineStarts + 1, {
-        label: 'broker re-drove the turn at the deadline',
-        timeoutMs: 10_000,
-    });
-    // A persistent fault would re-arm immediately (nextAt is now in the past), so a
-    // spurious second re-drive would land within a poll interval. Wait past that.
-    await new Promise((resolve) => setTimeout(resolve, 2500));
-    assert.equal(agentStartCount(child), baselineStarts + 1, 'the fault-retry timer re-drives the turn exactly once');
-});
-test('a crashed broker re-drives a pending episode and a no-progress admitted one, never a progressed or invalidated episode', { timeout: 90_000 }, async () => {
-    const parent = h.spawnRoot('durable provider episode parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const pendingNode = await h.spawnHeadlessChild(parent, 'pending provider episode', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(pendingNode) >= 1, { label: 'pending episode fixture started' });
-    const pendingKickoffObserver = await attachUntil(pendingNode, 'observer', 'pending-provider-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'pending provider episode kickoff settled');
-    pendingKickoffObserver.close();
-    const pendingStarts = agentStartCount(pendingNode);
-    h.fakeCmd(pendingNode, {
-        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 2_000,
-    });
-    const pending = await h.waitFor(() => readProviderRetryEpisode(pendingNode)?.state === 'pending' ? readProviderRetryEpisode(pendingNode) : null, { label: 'pending provider episode persisted before crash' });
-    assert.equal(pending.sessionId, h.node(pendingNode).pi_session_id, 'the pending episode is tied to its bound session');
-    await crashAndRespawn(pendingNode, h.bootCount(pendingNode));
-    await h.waitFor(() => agentStartCount(pendingNode) >= pendingStarts + 1, { label: 'replacement re-drove the pending episode' });
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    assert.equal(agentStartCount(pendingNode), pendingStarts + 1, 'a pending episode re-drives exactly once after broker death');
-    // An admitted episode is re-openable, guarded by a no-progress proof: the
-    // branch segment strictly after its anchor must carry no assistant content
-    // and no tool activity. Case A proves the no-progress half re-drives exactly
-    // once, one attempt higher, with the restart continuation suppressed. Case B
-    // proves an admitted episode whose dead attempt DID produce real work is
-    // never replayed — the ordinary continuation delivers instead, unchanged.
-    const admittedNode = await h.spawnHeadlessChild(parent, 'admitted provider episode (no progress)', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(admittedNode) >= 1, { label: 'admitted episode fixture started' });
-    const admittedKickoffObserver = await attachUntil(admittedNode, 'observer', 'admitted-provider-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'admitted provider episode kickoff settled');
-    admittedKickoffObserver.close();
-    const admittedStarts = agentStartCount(admittedNode);
-    h.fakeCmd(admittedNode, {
-        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
-    });
-    const admittedPending = await h.waitFor(() => readProviderRetryEpisode(admittedNode)?.state === 'pending' ? readProviderRetryEpisode(admittedNode) : null, { label: 'admitted episode pending record persisted' });
-    const admittedFault = readFault(admittedNode);
-    assert.ok(admittedFault !== null, 'the pending episode retains its retry fault before admission');
-    // The 60s-future deadline above keeps the ORIGINAL process's own in-process
-    // timer from firing before this synthetic admission runs. The episode's own
-    // fault gets its nextAt rewritten into the past, matching production: by the
-    // time a REAL replacement broker boots, the original deadline has typically
-    // already elapsed (see the design's "effectively zero delay" note), so this
-    // proves the re-drive without a real ~60s wait.
-    const admittedFaultForEpisode = { ...admittedFault, retry: { ...admittedFault.retry, nextAt: new Date(Date.now() - 1_000).toISOString() } };
-    assert.equal(admitProviderRetryEpisode(admittedNode, admittedPending, admittedFaultForEpisode), true, 'the dispatch boundary durably admits the matching episode');
-    assert.equal(readProviderRetryEpisode(admittedNode)?.state, 'admitted');
-    await crashAndRespawn(admittedNode, h.bootCount(admittedNode));
-    await h.waitFor(() => agentStartCount(admittedNode) >= admittedStarts + 1, { label: 'replacement re-drove the no-progress admitted episode' });
-    // A persistent re-arm would re-drive again immediately (nextAt is now in the
-    // past), so a spurious second re-drive would land within a poll interval.
-    await new Promise((resolve) => setTimeout(resolve, 2500));
-    assert.equal(agentStartCount(admittedNode), admittedStarts + 1, 'a no-progress admitted episode re-drives exactly once, never more');
-    const admittedBranch = JSON.parse(readFileSync(join(h.home, 'nodes', admittedNode, 'fake-pi.tree.json'), 'utf8')).activeBranch;
-    const admittedUserMessages = admittedBranch.filter((message) => message.role === 'user');
-    const newestAdmittedUserMessage = admittedUserMessages[admittedUserMessages.length - 1];
-    assert.ok(newestAdmittedUserMessage !== undefined, 'the re-drive delivers a user-role recovery message');
-    const expectedRecoveryBody = admittedFault.kind === 'connection' ? CONNECTION_FAULT_RECOVERY_BODY : PROVIDER_FAULT_RECOVERY_BODY;
-    const redriveCard = parseCard(newestAdmittedUserMessage);
-    assert.equal(redriveCard?.kind, 'recovery', 'the re-drive delivers the recovery card, not a duplicate failure entry');
-    assert.equal(redriveCard?.body, expectedRecoveryBody, 'the recovery card carries the body matching the fault kind');
-    // Every superseded attempt leaves the active branch, so this card is the only
-    // visible record of the sequence — it must name which attempt it is. The
-    // exact number depends on how far the ladder had already advanced, so assert
-    // that the facts are present and coherent rather than pinning a literal.
-    const redriveAttempt = Number(redriveCard?.facts['attempt']);
-    const redriveMax = Number(redriveCard?.facts['max']);
-    assert.ok(Number.isInteger(redriveAttempt) && redriveAttempt >= 1, 'the recovery card names which attempt it is');
-    assert.ok(Number.isInteger(redriveMax) && redriveMax >= redriveAttempt, 'the recovery card names the ladder length it counts against');
-    assert.ok(!admittedBranch.some((message) => generatedContextText(message) === RUNTIME_RESTART_CONTINUATION), 'a no-progress re-drive suppresses the restart continuation entirely');
-    // The fake engine's recovery-card prompt runs a genuine successful turn (no
-    // forced failure is queued for it), so the episode clears at settlement —
-    // Flow A's success ending, not another failure round. `nextFaultRetry`
-    // already advances `fault.retry.attempt` on every admission regardless of
-    // this design (unchanged, pre-existing ladder logic); this settle just
-    // proves the sequence can end cleanly through the reopened path too.
-    assert.equal(readProviderRetryEpisode(admittedNode), null, 'the successful re-drive clears the episode at settlement');
-    const progressNode = await h.spawnHeadlessChild(parent, 'admitted provider episode (progress)', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(progressNode) >= 1, { label: 'progress episode fixture started' });
-    const progressKickoffObserver = await attachUntil(progressNode, 'observer', 'progress-provider-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'progress episode kickoff settled');
-    progressKickoffObserver.close();
-    h.fakeCmd(progressNode, {
-        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
-    });
-    const progressPending = await h.waitFor(() => readProviderRetryEpisode(progressNode)?.state === 'pending' ? readProviderRetryEpisode(progressNode) : null, { label: 'progress episode pending record persisted' });
-    const progressFault = readFault(progressNode);
-    assert.ok(progressFault !== null, 'the pending episode retains its retry fault before admission');
-    assert.equal(admitProviderRetryEpisode(progressNode, progressPending, progressFault), true, 'the dispatch boundary durably admits the matching episode');
-    assert.equal(readProviderRetryEpisode(progressNode)?.state, 'admitted');
-    // A real successful turn past the anchor: proves the dead attempt's slot is
-    // no longer the branch tail, so recoverOnStartup's no-progress proof must
-    // find this assistant content and refuse to roll it back.
-    const progressController = await kit.attach(progressNode, 'controller', 'progress-provider-episode');
-    progressController.send({ type: 'prompt', text: `progress past anchor ${Date.now()}` });
-    await progressController.waitFrame((f) => f.type === 'agent_end', 'the progress turn settles');
-    progressController.close();
-    // The natural settle above clears the episode. Restore the same admitted SQL
-    // record so the crash below tests the no-progress proof against a genuine
-    // post-anchor assistant turn rather than an unreliable real-crash race.
-    await h.waitFor(() => readProviderRetryEpisode(progressNode) === null, { label: 'the settled turn cleared the episode' });
-    restoreAdmittedProviderRetryEpisode(progressNode, progressPending, progressFault);
-    assert.equal(readProviderRetryEpisode(progressNode)?.state, 'admitted', 'the SQL fixture restores the admitted episode for the crash below');
-    const progressStartsBeforeCrash = agentStartCount(progressNode);
-    await crashAndRespawn(progressNode, h.bootCount(progressNode));
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    assert.equal(agentStartCount(progressNode), progressStartsBeforeCrash, 'progress past the anchor is never replayed by replacement startup');
-    assert.equal(readProviderRetryEpisode(progressNode), null, 'the progress branch clears the episode rather than leaving it inert');
-    const invalidatedNode = await h.spawnHeadlessChild(parent, 'invalidated provider episode', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(invalidatedNode) >= 1, { label: 'invalidated episode fixture started' });
-    const invalidatedKickoffObserver = await attachUntil(invalidatedNode, 'observer', 'invalidated-provider-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'invalidated provider episode kickoff settled');
-    invalidatedKickoffObserver.close();
-    const invalidatedStarts = agentStartCount(invalidatedNode);
-    h.fakeCmd(invalidatedNode, {
-        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
-    });
-    await h.waitFor(() => readProviderRetryEpisode(invalidatedNode)?.state === 'pending' ? true : null, { label: 'invalidated episode pending record persisted' });
-    const controller = await kit.attach(invalidatedNode, 'controller', 'invalidated-provider-episode');
-    controller.send({ type: 'new_session' });
-    await controller.waitFrame((frame) => frame.type === 'ack' && frame.for === 'new_session', 'replacement session acknowledged');
-    assert.equal(readFault(invalidatedNode), null, 'replacement discards the old daemon-owned auto fault instead of inheriting its anchor');
-    await h.waitFor(() => readProviderRetryEpisode(invalidatedNode)?.state === 'invalidated' ? true : null, { label: 'rebind durably invalidated the old episode' });
-    controller.close();
-    await crashAndRespawn(invalidatedNode, h.bootCount(invalidatedNode));
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    assert.equal(agentStartCount(invalidatedNode), invalidatedStarts, 'an invalidated rebound-session episode is never replayed by replacement startup');
-    const cyclingNode = await h.spawnHeadlessChild(parent, 'fresh-cycle provider episode', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(cyclingNode) >= 1, { label: 'fresh-cycle episode fixture started' });
-    const cyclingKickoffObserver = await attachUntil(cyclingNode, 'observer', 'fresh-cycle-provider-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'fresh-cycle provider episode kickoff settled');
-    cyclingKickoffObserver.close();
-    h.fakeCmd(cyclingNode, {
-        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 2_000,
-    });
-    await h.waitFor(() => readProviderRetryEpisode(cyclingNode)?.state === 'pending' ? true : null, { label: 'fresh-cycle episode pending record persisted' });
-    const cyclingStarts = agentStartCount(cyclingNode);
-    const cyclingBoots = h.bootCount(cyclingNode);
-    const yieldResult = h.cli(cyclingNode, ['node', 'yield', 'begin a fresh cycle']);
-    assert.equal(yieldResult.code, 0, `node yield should succeed\n--stderr--\n${yieldResult.stderr}`);
-    const cyclingPid = h.node(cyclingNode)?.pi_pid;
-    assert.ok(cyclingPid != null, 'the refresh-pending broker remains live until its physical death');
-    process.kill(cyclingPid, 'SIGKILL');
-    await h.awaitFleetExit(cyclingNode);
-    await h.tick();
-    const cyclingBackoff = h.node(cyclingNode);
-    assert.ok(cyclingBackoff.respawn_not_before != null, 'the fresh-cycle relaunch receives daemon backoff');
-    await h.tick(Date.parse(cyclingBackoff.respawn_not_before) + 1);
-    await h.awaitBoot(cyclingNode, { minCount: cyclingBoots + 1 });
-    await h.waitFor(() => existsSync(h.brokerSock(cyclingNode)), { label: 'fresh-cycle replacement broker listener bound' });
-    await h.waitFor(() => readProviderRetryEpisode(cyclingNode) === null, { label: 'fresh-cycle kickoff settled successfully' });
-    assert.equal(readProviderRetryEpisode(cyclingNode), null, 'the settled fresh-cycle kickoff clears the old provider episode');
-    assert.equal(agentStartCount(cyclingNode), cyclingStarts + 1, 'the fresh-cycle kickoff starts exactly once');
-    // A retained episode would re-arm immediately once its deadline becomes due.
-    // Wait past that poll interval to prove the completed kickoff cannot replay.
-    await new Promise((resolve) => setTimeout(resolve, 2500));
-    assert.equal(agentStartCount(cyclingNode), cyclingStarts + 1, 'the cleared fresh-cycle episode never replays');
-});
-test('reload_auth re-drives a parked fatal provider-auth turn exactly once', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('auth reload parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'auth reload child', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(child) >= 1, { label: 'initial auth fixture turn started' });
-    const kickoffObserver = await attachUntil(child, 'observer', 'auth-reload-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'auth reload kickoff settled');
-    kickoffObserver.close();
-    const baselineStarts = agentStartCount(child);
-    h.fakeCmd(child, {
-        cmd: 'stop',
-        reason: 'error',
-        errorMessage: 'Provider authentication failed (invalid_grant) for anthropic/test-account',
-    });
-    const fault = await h.waitFor(() => {
-        const current = readFault(child);
-        return current?.kind === 'auth' ? current : undefined;
-    }, { label: 'fatal auth fault authored by stophook' });
-    assert.equal(fault.link, 'pi→provider');
-    assert.equal(fault.retry.disposition, 'fatal');
-    const observer = await kit.attach(child, 'observer', 'auth-reload-test');
-    observer.send({ type: 'reload_auth' });
-    observer.send({ type: 'reload_auth' });
-    await observer.waitFrame((frame) => frame.type === 'ack' && frame.for === 'reload_auth', 'reload_auth acknowledged');
-    await h.waitFor(() => agentStartCount(child) >= baselineStarts + 1, {
-        label: 'fresh auth re-drove the parked turn',
-    });
-    await new Promise((resolve) => setTimeout(resolve, 250));
-    assert.equal(readFault(child), null, 'the auth fault is cleared before the recovery prompt');
-    assert.equal(agentStartCount(child), baselineStarts + 1, 'overlapping auth reloads produce one recovery turn');
-    observer.close();
-});
-test('reload_auth leaves a parked auth fault with its original session when navigation is overtaken by replacement', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('auth replacement parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'auth replacement child', { model: OPENAI_STRONG.spec });
-    await h.waitFor(() => agentStartCount(child) >= 1, { label: 'initial replacement fixture turn started' });
-    const kickoffObserver = await attachUntil(child, 'observer', 'auth-replacement-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'auth replacement kickoff settled');
-    kickoffObserver.close();
-    h.fakeCmd(child, {
-        cmd: 'stop',
-        reason: 'error',
-        errorMessage: 'Provider authentication failed (invalid_grant) for anthropic/test-account',
-    });
-    const fault = await h.waitFor(() => {
-        const current = readFault(child);
-        return current?.kind === 'auth' ? current : undefined;
-    }, { label: 'replacement fixture auth fault authored by stophook' });
-    const baselineStarts = agentStartCount(child);
-    const nodeDir = join(h.home, 'nodes', child);
-    // Force the redrive's leaf/anchor comparison to diverge so it actually enters
-    // navigateTree (a matching leaf/anchor legitimately skips the rewind) — the
-    // fixture's fault otherwise anchors to the leaf already current.
-    setActiveFaultAnchor(child, 'auth-replacement-anchor-mismatch');
-    writeFileSync(join(nodeDir, 'fake-pi.navigate-hold'), '');
-    const controller = await kit.attach(child, 'controller', 'auth-replacement-test');
-    controller.send({ type: 'reload_auth' });
-    await h.waitFor(() => existsSync(join(nodeDir, 'fake-pi.navigate-started')) ? true : null, { label: 'auth redrive entered held navigation' });
-    controller.send({ type: 'new_session' });
-    await controller.waitFrame((frame) => frame.type === 'ack' && frame.for === 'new_session', 'replacement session acknowledged');
-    writeFileSync(join(nodeDir, 'fake-pi.navigate-release'), '');
-    await new Promise((resolve) => setTimeout(resolve, 250));
-    assert.equal(readFault(child)?.since, fault.since, 'the original auth fault remains for its original session');
-    assert.equal(agentStartCount(child), baselineStarts, 'the replacement session receives no stale recovery prompt');
-    controller.close();
-});
-// Both overflow outcomes on ONE broker, in order: Pi's compact-and-retry
-// recovers (nothing is committed, the child lives), and only then does a
-// definitive failure make the episode terminal.
-test('a recovered compact-and-retry commits nothing, while a definitive failure publishes one structured overflow fault and terminal notice', { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('overflow parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    const child = await h.spawnHeadlessChild(parent, 'overflow child', { model: OPENAI_STRONG.spec });
-    h.fakeCmd(child, { cmd: 'overflow', outcome: 'recover' });
-    await h.waitFor(() => overflowOutcome(child) === 'recover' ? true : null, { label: 'recovered overflow reached agent_settled' });
-    await h.tick();
-    assert.equal(readFault(child), null, 'raw overflow is never committed before Pi recovery settles');
-    assert.notEqual(h.status(child), 'dead', 'a recovered child remains live');
-    assert.doesNotMatch(h.inbox(parent).map((entry) => entry.label).join('\n'), /context window|will not recover/i, 'recovery publishes no fatal parent notice');
-    // A settled ordinary provider failure leaves an active daemon-owned retry
-    // marker in place while the next turn runs. The later terminal overflow must
-    // supersede that marker rather than lose to its priority in fault storage.
-    h.fakeCmd(child, {
-        cmd: 'stop',
-        reason: 'error',
-        errorMessage: 'Managed provider pools are temporarily unavailable.',
-        deadline: Date.now() + 60_000,
-    });
-    const autoFault = await h.waitFor(() => {
-        const f = readFault(child);
-        return f?.retry.disposition === 'auto' ? f : undefined;
-    }, { label: 'ordinary settled provider fault published' });
-    assert.equal(autoFault.kind, 'rate-limit', 'ordinary settled provider failures retain broker-owned retry behavior');
-    h.fakeCmd(child, { cmd: 'overflow', outcome: 'fail' });
-    await h.waitFor(() => overflowOutcome(child) === 'fail' ? true : null, { label: 'failed overflow reached agent_settled' });
-    const fault = await h.waitFor(() => {
-        const current = readFault(child);
-        return current?.kind === 'context-overflow' ? current : null;
-    }, { label: 'failed overflow publishes its definitive context-overflow fault' });
-    assert.equal(fault.kind, 'context-overflow');
-    assert.equal(fault.op, 'context overflow recovery');
-    assert.equal(fault.retry.disposition, 'fatal');
-    assert.match(fault.message, /failed after one compact-and-retry attempt/i);
-    await h.tick();
-    assert.equal(h.status(child), 'dead', 'the daemon applies one terminal child transition');
-    const notices = h.inbox(parent).filter((entry) => /exceeded its model context window/i.test(entry.label));
-    assert.equal(notices.length, 1, 'the parent receives exactly one structured overflow notice');
-});
-test('provider-retry and model-not-found fallback both terminate when every available target has a smaller known context window', { timeout: 30_000 }, async () => {
-    seedCapacityFallbackRoutes();
-    try {
-        const parent = h.spawnRoot('capacity fallback parent');
-        const providerRetry = await h.spawnHeadlessChild(parent, 'provider retry capacity fallback', { kind: 'test/capacity-fallback' });
-        await h.waitFor(() => agentStartCount(providerRetry) >= 1, { label: 'provider retry capacity fixture started' });
-        seedCapacityFixture(providerRetry, 2000);
-        h.fakeCmd(providerRetry, { cmd: 'auto_retry', errorMessage: 'rate limit exceeded' });
-        await h.waitFor(() => model(providerRetry)?.provider === 'fake-large' ? true : null, { label: 'provider retry skips the too-small target for the large enough target' });
-        assert.equal(model(providerRetry).provider, 'fake-large', 'a large enough fallback remains eligible after the smaller route is rejected');
-        const exhaustedProviderRetry = await h.spawnHeadlessChild(parent, 'exhausted provider retry capacity fallback', { kind: 'test/capacity-fallback' });
-        await h.waitFor(() => agentStartCount(exhaustedProviderRetry) >= 1, { label: 'exhausted provider retry capacity fixture started' });
-        seedCapacityFixture(exhaustedProviderRetry);
-        h.fakeCmd(exhaustedProviderRetry, { cmd: 'auto_retry', errorMessage: 'rate limit exceeded' });
-        const providerRetryFault = await h.waitFor(() => readFault(exhaustedProviderRetry)?.kind === 'context-overflow' ? readFault(exhaustedProviderRetry) : null, { label: 'provider retry rejects every too-small fallback target' });
-        assert.equal(providerRetryFault.retry.disposition, 'fatal', 'all known-too-small provider retry targets produce a fatal context-overflow fault');
-        assert.match(providerRetryFault.message, /1000 tokens/, 'the terminal fault identifies the current conversation size');
-        assert.equal(JSON.parse(readFileSync(join(h.home, 'nodes', exhaustedProviderRetry, 'fake-pi.auto-retry.json'), 'utf8')).aborted, true, 'the retry delay is cancelled after Pi creates its retry controller');
-        const modelNotFound = await h.spawnHeadlessChild(parent, 'model-not-found capacity fallback', { kind: 'test/capacity-fallback' });
-        await h.waitFor(() => agentStartCount(modelNotFound) >= 1, { label: 'model-not-found capacity fixture started' });
-        seedCapacityFixture(modelNotFound);
-        h.fakeCmd(modelNotFound, { cmd: 'stop', reason: 'error', errorMessage: 'Model not found' });
-        const modelNotFoundFault = await h.waitFor(() => readFault(modelNotFound)?.kind === 'context-overflow' ? readFault(modelNotFound) : null, { label: 'model-not-found rejects the too-small fallback target' });
-        assert.equal(modelNotFoundFault.retry.disposition, 'fatal', 'all known-too-small model-not-found targets produce a fatal context-overflow fault');
-        assert.match(modelNotFoundFault.message, /1000 tokens/, 'the terminal fault survives ordinary settlement staging');
-    }
-    finally {
-        writeRawConfig('user', {});
-    }
-});
-// Two real logical launches keep both user paths non-vacuous: the picker first
-// proves an explicit concrete choice pins and clears routing, while Alt+M runs
-// directly against still-present logical intent before Shift+Tab and replay.
-test("picker and Alt+M choices each clear logical routing, and Alt+M / Shift+Tab become the durable restart recipe", { timeout: 30_000 }, async () => {
-    const parent = h.spawnRoot('model durability parent');
-    await seedPool('anthropic', false);
-    await seedPool('openai-codex', false);
-    writeRawConfig('user', {
-        kinds: { 'test/logical-openai': { whenToUse: 'Logical OpenAI routing test.', model: 'openai/strong' } },
-    });
-    const pickerNode = await h.spawnHeadlessChild(parent, 'picker durability child', { kind: 'test/logical-openai' });
-    const pickerBefore = h.node(pickerNode);
-    assert.deepEqual(pickerBefore.launch?.modelIntent, { family: 'openai', strength: 'strong' }, 'picker fixture starts from a logical launch preference');
-    assert.equal(pickerBefore.launch?.env.CRTR_MODEL_INTENT, 'openai/strong');
-    const pickerCtrl = await kit.attach(pickerNode, 'controller', 'picker-durability-test');
-    pickerCtrl.send({ type: 'set_model', model: OPENAI_STRONG.spec }); // exactly what buildModelPicker sends — no `pinned`
-    await pickerCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'set_model', 'picker set_model acked');
-    let pickerState = h.node(pickerNode);
-    assert.equal(pickerState.launch?.modelProviderPinned, true, 'the omitted-pinned frame derives pinned from the real openai-codex registry namespace');
-    assert.equal(pickerState.launch?.modelIntent, undefined, 'the explicit concrete choice clears the logical launch intent');
-    assert.equal(pickerState.launch?.env.CRTR_MODEL_INTENT, undefined, 'a revive cannot restore the stale logical route intent');
-    // `cycle_ladder` carries no raw model/pin token. Running it after the picker
-    // proves that this internal change preserves the concrete provider pin.
-    pickerCtrl.send({ type: 'cycle_ladder', direction: 'forward' });
-    await pickerCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'post-picker Alt+M cycle_ladder acked');
-    pickerState = h.node(pickerNode);
-    assert.equal(pickerState.launch?.modelProviderPinned, true, 'an internal no-raw-token ladder change preserves the explicit picker pin');
-    pickerCtrl.close();
-    // A separate logical launch reaches Alt+M with BOTH intent representations
-    // still populated. This is the regression path: a user-selected ladder rung
-    // must clear them before a restart can resolve the stale route over it.
-    const ladderNode = await h.spawnHeadlessChild(parent, 'ladder durability child', { kind: 'test/logical-openai' });
-    const ladderBefore = h.node(ladderNode);
-    assert.deepEqual(ladderBefore.launch?.modelIntent, { family: 'openai', strength: 'strong' }, 'Alt+M starts with durable logical modelIntent present');
-    assert.equal(ladderBefore.launch?.env.CRTR_MODEL_INTENT, 'openai/strong', 'Alt+M starts with the launch environment intent present');
-    const ladderCtrl = await kit.attach(ladderNode, 'controller', 'ladder-durability-test');
-    ladderCtrl.send({ type: 'cycle_ladder', direction: 'forward' });
-    await ladderCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_ladder', 'logical-launch Alt+M cycle_ladder acked');
-    let after = h.node(ladderNode);
-    assert.equal(after.launch?.modelIntent, undefined, 'Alt+M clears the durable logical launch intent');
-    assert.equal(after.launch?.env.CRTR_MODEL_INTENT, undefined, 'Alt+M clears the logical intent from the restart environment');
-    assert.equal(after.launch?.modelProviderPinned, ladderBefore.launch?.modelProviderPinned, 'Alt+M preserves the existing pin state verbatim');
-    assert.equal(after.launch?.model, after.model_override, 'the selected model and thinking rung is the durable revive recipe');
-    const rung = after.launch?.model;
-    assert.ok(rung, 'Alt+M persisted a concrete model rung');
-    const thinkingFrameOffset = ladderCtrl.frames.length;
-    ladderCtrl.send({ type: 'cycle_thinking' });
-    const thinkingChanged = await h.waitFor(() => ladderCtrl.frames.slice(thinkingFrameOffset).find((f) => f.type === 'thinking_level_changed') ?? null, { label: 'Shift+Tab thinking change relayed' });
-    await ladderCtrl.waitFrame((f) => f.type === 'ack' && f.for === 'cycle_thinking', 'Shift+Tab cycle acked');
-    after = h.node(ladderNode);
-    const level = thinkingChanged.type === 'thinking_level_changed' ? thinkingChanged.level : 'off';
-    const bareRung = rung.replace(/:(?:off|minimal|low|medium|high|xhigh|max)$/, '');
-    const expected = `${bareRung}${level === 'off' ? '' : `:${level}`}`;
-    assert.equal(after.launch?.model, expected, 'Shift+Tab persists the new thinking level with the selected model');
-    assert.equal(after.model_override, expected, 'polymorphs preserve the same user-selected model and thinking level');
-    const replay = buildPiArgv(after, { resumeSessionPath: after.pi_session_file ?? undefined });
-    const modelArg = replay.argv.indexOf('--model');
-    assert.notEqual(modelArg, -1, 'a daemon revive replays a model argument');
-    assert.equal(replay.argv[modelArg + 1], expected, 'the replayed model argument carries both choices');
-    assert.equal(replay.env.CRTR_MODEL_INTENT, undefined, 'the stale logical intent is absent from the restarted broker environment');
-    ladderCtrl.close();
-    writeRawConfig('user', {});
-});
-test('reload_auth restores a newly authenticated personal route before the next idle prompt', { timeout: 30_000 }, async () => {
-    const personal = { provider: 'personal-anthropic', id: 'claude-personal' };
-    const funded = { provider: 'northlight-openai', id: 'gpt-funded' };
-    const personalSpec = `${personal.provider}/${personal.id}:xhigh`;
-    const unauthenticatedProvider = join(h.home, 'fake-pi.unauthenticated-provider');
-    writeRawConfig('user', {
-        // A fixture-private kind, never `general`: the child launches with the
-        // package root as cwd, so an ambient project-scope config above the repo
-        // (`~/.crouter/config.json`) overrides this user-scope `general` and the
-        // child boots on that machine's default strength instead of medium.
-        kinds: { 'test/logical-anthropic': { whenToUse: 'Logical Anthropic routing test.', model: 'anthropic/medium' } },
-        modelRoutes: {
-            personal: { family: 'anthropic', credentialSource: 'user', providerId: personal.provider, models: { ultra: personalSpec, strong: personalSpec, medium: personalSpec, light: personalSpec } },
-            funded: { family: 'anthropic', credentialSource: 'northlight', providerId: funded.provider, models: { ultra: `${funded.provider}/${funded.id}:medium`, strong: `${funded.provider}/${funded.id}:medium`, medium: `${funded.provider}/${funded.id}:medium`, light: `${funded.provider}/${funded.id}:medium` } },
-        },
-        modelRouting: { credentialSourceOrder: ['user', 'northlight'], familyOrder: ['anthropic'], strengthFallback: ['medium'] },
-    });
-    writeFileSync(unauthenticatedProvider, personal.provider);
-    try {
-        const parent = h.spawnRoot('auth route reconciliation parent');
-        const child = await h.spawnHeadlessChild(parent, 'auth route reconciliation child', { kind: 'test/logical-anthropic' });
-        assert.deepEqual(model(child), funded, 'the logical request starts on the funded route while personal auth is absent');
-        const controller = await kit.connectRaw(child, { read: true });
-        controller.send({ type: 'hello', role: 'controller', client_id: 'auth-route-reconciliation' });
-        await h.waitFor(() => controller.frames.some((frame) => frame.type === 'welcome') ? true : null, { label: 'route reconciliation controller welcomed' });
-        await h.waitFor(() => agentStartCount(child) >= 1, { label: 'route reconciliation kickoff started' });
-        const kickoffObserver = await attachUntil(child, 'observer', 'route-reconciliation-kickoff-settled', (a) => a.welcome.snapshot.state.isStreaming === false, 'route reconciliation kickoff settled');
-        kickoffObserver.close();
-        rmSync(unauthenticatedProvider, { force: true });
-        const frameStart = controller.frames.length;
-        controller.writeRaw(encodeFrame({ type: 'reload_auth' })
-            + encodeFrame({ type: 'prompt', text: 'continue after login' }));
-        await h.waitFor(() => {
-            const frames = controller.frames.slice(frameStart);
-            const changed = frames.some((frame) => frame.type === 'model_changed' && frame.spec === personalSpec);
-            const started = frames.some((frame) => frame.type === 'agent_start');
-            return changed && started ? true : null;
-        }, { label: 'personal route adopted before queued prompt starts' });
-        const frames = controller.frames.slice(frameStart);
-        const modelChangedIndex = frames.findIndex((frame) => frame.type === 'model_changed' && frame.spec === personalSpec);
-        const agentStartIndex = frames.findIndex((frame) => frame.type === 'agent_start');
-        assert.ok(modelChangedIndex >= 0 && modelChangedIndex < agentStartIndex, 'route reconciliation completes before the next idle prompt starts');
-        assert.deepEqual(model(child), personal, 'the live session adopts the newly authenticated personal route');
-        const persisted = await h.waitFor(() => {
-            const node = h.node(child);
-            return node?.launch?.model === personalSpec ? node : null;
-        }, { label: 'personal route persisted without clearing logical intent' });
-        assert.deepEqual(persisted.launch?.modelIntent, { family: 'anthropic', strength: 'medium' });
-        assert.equal(persisted.launch?.env.CRTR_MODEL_INTENT, 'anthropic/medium', 'algorithmic reconciliation preserves the durable logical intent');
-    }
-    finally {
-        rmSync(unauthenticatedProvider, { force: true });
-        writeRawConfig('user', {});
-    }
-});
-// MODEL-LESS LAUNCH RE-DRIVE — MUST REMAIN THE LAST TEST IN THIS FILE. Its
-// zero-auth seam, <CRTR_HOME>/fake-pi.no-auth, is HOME-GLOBAL: while it exists
-// the fake engine's modelRegistry reports a genuine zero-auth boot, so no other
-// boot may overlap it. Arming it before the spawn is race-free against the
-// broker's boot-time registry read, and deleting it mid-test is a live auth-on
-// flip that reload_auth's modelRegistry.refresh() re-reads (fake-engine.ts,
-// createAgentSessionServices).
-//
-// Locks two broker.ts launch-model fixes:
-//   0b unknown-stub detection — the SDK hands a model-less session an
-//      unknown-stub model (never `undefined`), so sessionHasNoModel() must defer
-//      the kickoff instead of prompting a keyless engine.
-//   0a self-healing model-less registry — the construction-time mask that
-//      suppresses the SDK's findInitialModel must reveal() the instant
-//      construction returns, or list_models stays broken forever for a
-//      model-less-booted node even after a /login. The auth-on list_models
-//      assertion below is the ONLY one that discriminates that bug: with the
-//      mask never revealed, getAvailable() returns [] forever.
-//
-// The request is LOGICAL (`anthropic/medium`), deliberately. A CONCRETE pin can
-// never reach a model-less boot: both `node new`'s assertLaunchModelRegistered
-// and resolveLaunchModel's own unregisteredConcreteModel gate treat a concrete
-// spec absent from the serving registry as a FATAL model-not-found, and under
-// the zero-auth sentinel every spec is absent. A logical request skips both
-// gates by design, so the zero-auth window produces the tier-3 model-less boot
-// this test exists to cover. After the flip its candidate tail includes the
-// fake registry's non-managed `fake/fake-model`, whose hasConfiguredAuth() the
-// sentinel controls — so the re-drive resolves without needing managed
-// subscription-pool occupancy (broker-sdk-wiring's scope).
-test('login re-drive → list_models self-heals (0a) and reload_auth resolves a model + fires the deferred kickoff', { timeout: 30_000 }, async () => {
-    const noAuthSentinel = join(h.home, 'fake-pi.no-auth');
-    writeRawConfig('user', {
-        kinds: { general: { whenToUse: 'General work.', model: 'anthropic/medium' } },
-    });
-    writeFileSync(noAuthSentinel, '1');
-    try {
-        const parent = h.spawnRoot('login re-drive parent');
-        const child = await h.spawnHeadlessChild(parent, 'login re-drive');
-        assert.equal(model(child), null, 'boots model-less under zero-auth');
-        assert.equal(agentStartCount(child), 0, 'kickoff deferred at boot');
-        const c = await attachUntil(child, 'controller', 'redrive-ctrl', (a) => a.welcome.role === 'controller', 'redrive controller admitted');
-        // A read-op reply is a correlated `data` frame the client swallows into
-        // request()'s by-id resolver (NEVER a generic 'frame'), so we MUST use
-        // client.request(), not send()+waitFrame.
-        // Baseline: under zero-auth the registry reports nothing available.
-        const lm0 = await c.client.request({ type: 'list_models' });
-        assert.ok(lm0.kind === 'list_models' && lm0.availableIds.length === 0, 'zero-auth: no models available');
-        // FLIP AUTH ON, then re-query while the broker is still alive (no turn has run
-        // yet). getAvailable() flows through the revealed construction proxy →
-        // NON-empty. With the mask never revealed it would still be [].
-        rmSync(noAuthSentinel, { force: true });
-        const lm1 = await c.client.request({ type: 'list_models' });
-        assert.ok(lm1.kind === 'list_models' && lm1.availableIds.length > 0, 'auth on: list_models reports an available model (0a self-heal — the construction mask revealed)');
-        // reload_auth re-drives the launch policy → resolves a model and fires the
-        // deferred kickoff. Disk reads, so they survive the broker idle-releasing
-        // once that kickoff turn ends.
-        c.send({ type: 'reload_auth' });
-        await h.waitFor(() => model(child) !== null, { label: 're-drive selected a model' });
-        await h.waitFor(() => agentStartCount(child) >= 1, { label: 'deferred kickoff fired after re-drive' });
-    }
-    finally {
-        rmSync(noAuthSentinel, { force: true });
-        writeRawConfig('user', {});
-    }
-});