@retaw106/mmc-oc 0.0.0-stage → 1.2.2

package/src/config/latch-permanence-guard.test.ts

@@ -0,0 +1,218 @@
+import { describe, expect, test } from "bun:test";
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPOSITORY_ROOT = join(dirname(fileURLToPath(import.meta.url)), "../../../..");
+const SOURCE_ROOTS = ["packages/plugin/src", "packages/pi-plugin/src"] as const;
+
+type Classification = "VERDICT" | "DIAGNOSTIC" | "PUBLICATION";
+
+type KnownSlot = {
+    classification: Classification;
+    reason: string;
+};
+
+/**
+ * Every module-level mutable slot whose name says it can retain a capability,
+ * absence, or failure verdict. A new matching slot must be classified here so
+ * a negative cache cannot quietly become permanent.
+ */
+const KNOWN_SLOTS: Record<string, KnownSlot> = {
+    "packages/plugin/src/features/magic-context/compaction-marker.ts:cachedSchemaCompatible": {
+        classification: "VERDICT",
+        reason: "DEFECT: a transient PRAGMA/read failure is cached as incompatible until the writable DB is closed.",
+    },
+    "packages/plugin/src/features/magic-context/memory/embedding-local.ts:nativeRuntimeMissing": {
+        classification: "VERDICT",
+        reason: "Correct: a missing or unloadable native binding needs an install repair, which this process cannot observe.",
+    },
+    "packages/plugin/src/features/magic-context/memory/embedding-local.ts:localEmbeddingProcessFailure":
+        {
+            classification: "DIAGNOSTIC",
+            reason: "Most-recent local runtime diagnostic: successful initialization and test reset both clear it; the separate runtime-mode slot owns the process verdict.",
+        },
+    "packages/plugin/src/features/magic-context/memory/embedding-synapse.ts:sharedClientPromise": {
+        classification: "VERDICT",
+        reason: "DEFECT: a rejected connection promise remains shared after the daemon recovers.",
+    },
+    "packages/plugin/src/features/magic-context/memory/embedding-synapse.ts:permanentFailure": {
+        classification: "VERDICT",
+        reason: "DEFECT: a daemon catalog or response classification can be repaired in-process, but the provider then returns null without another probe.",
+    },
+    "packages/plugin/src/features/magic-context/memory/embedding-openai.ts:failureTimes": {
+        classification: "VERDICT",
+        reason: "Correct: circuit state expires and a half-open probe re-evaluates the endpoint.",
+    },
+    "packages/pi-plugin/src/index.ts:databaseExitHookRegistered": {
+        classification: "PUBLICATION",
+        reason: "Correct: records that the one process-exit handler closing the shared database is installed, so /reload doesn't register a second one; it holds no failure or absence verdict.",
+    },
+    "packages/plugin/src/features/magic-context/memory/project-identity.ts:homeProjectPermission": {
+        classification: "VERDICT",
+        reason: "Boot config publishes the home-project permission; the setter replaces it on another host initialization, while explicit resolution arguments override it.",
+    },
+    "packages/plugin/src/features/magic-context/memory/project-identity.ts:directoryFallbackCache":
+        {
+            classification: "VERDICT",
+            reason: "Saved: each read checks for a newly-created .git directory and deletes the fallback before resolving again.",
+        },
+    "packages/plugin/src/features/magic-context/memory/project-identity.ts:transientFailureCooldown":
+        {
+            classification: "VERDICT",
+            reason: "Saved: getActiveCooldown deletes an expired entry and forces a new git probe after five minutes.",
+        },
+    "packages/plugin/src/features/magic-context/message-index.ts:MESSAGE_HISTORY_ORPHAN_UNAVAILABLE_REPROBE_MS":
+        {
+            classification: "VERDICT",
+            reason: "Saved: source_unavailable persists a future timestamp, then the normal cooldown arithmetic re-probes after one day.",
+        },
+    "packages/plugin/src/features/magic-context/storage-meta-session.ts:sessionMetaSelectColumnsCache":
+        {
+            classification: "VERDICT",
+            reason: "Correct by scope: session_meta migration completes before the first projection is built for this database handle.",
+        },
+    "packages/plugin/src/features/magic-context/memory/storage-memory.ts:memoryImportanceColumnCache":
+        {
+            classification: "VERDICT",
+            reason: "Correct by scope: memory schema migration completes before this database handle serves memory reads.",
+        },
+    "packages/plugin/src/features/magic-context/memory/storage-memory.ts:memoryScopeColumnCache": {
+        classification: "VERDICT",
+        reason: "Correct by scope: memory schema migration completes before this database handle serves memory reads.",
+    },
+    "packages/plugin/src/features/magic-context/memory/storage-memory.ts:memoryShareableColumnCache":
+        {
+            classification: "VERDICT",
+            reason: "Correct by scope: memory schema migration completes before this database handle serves memory reads.",
+        },
+    "packages/plugin/src/features/magic-context/memory/storage-memory.ts:memoryClassifiedAtColumnCache":
+        {
+            classification: "VERDICT",
+            reason: "Correct by scope: memory schema migration completes before this database handle serves memory reads.",
+        },
+    "packages/plugin/src/hooks/magic-context/ctx-reduce-availability.ts:ctxReduceRegisteredGlobally":
+        {
+            classification: "VERDICT",
+            reason: "Correct by scope: tool registration is resolved once at plugin boot and cannot change while that instance runs.",
+        },
+    "packages/plugin/src/hooks/magic-context/ctx-reduce-availability.ts:availabilityBySession": {
+        classification: "VERDICT",
+        reason: "Correct by contract: the first persisted user message freezes that session's tool surface.",
+    },
+    "packages/plugin/src/hooks/magic-context/ctx-reduce-availability.ts:permissionDeniedBySession":
+        {
+            classification: "DIAGNOSTIC",
+            reason: "Repeatedly assigned on each cache-busting permission read; later reads replace an earlier denial.",
+        },
+    "packages/plugin/src/hooks/magic-context/read-session-formatting.ts:tokenizerLoadAttempted": {
+        classification: "VERDICT",
+        reason: "DEFECT: a failed tokenizer load permanently selects heuristic token counts even if the package becomes available.",
+    },
+    "packages/plugin/src/plugin/conflict-warning-hook.ts:cachedDesktopStateByDir": {
+        classification: "VERDICT",
+        reason: "Correct by scope: its deciding startup-warning paths run once per plugin boot, so a later Desktop state-file write is not observed by design.",
+    },
+    "packages/plugin/src/plugin/embedding-routing.ts:synapseProbeCache": {
+        classification: "VERDICT",
+        reason: "Saved: the promise has a 60-second TTL, including rejections, and discovery is retried after expiry.",
+    },
+    "packages/plugin/src/shared/opencode-db-path.ts:lastReadFailure": {
+        classification: "DIAGNOSTIC",
+        reason: "Most-recent OpenCode DB read diagnostic: a successful open clears it, and path discovery re-probes after disappearance.",
+    },
+    "packages/plugin/src/shared/models-dev-cache.ts:authRewarmDone": {
+        classification: "VERDICT",
+        reason: "Saved: refreshModelLimitsAfterAuthOnce resets the latch when its warm fails.",
+    },
+    "packages/pi-plugin/src/pi-session-api.ts:cachedModulePromise": {
+        classification: "VERDICT",
+        reason: "Saved: promise.catch clears the same rejected promise, allowing the next resolver call to retry.",
+    },
+    "packages/plugin/src/features/magic-context/fail-closed-block.ts:lastHookInitFailure": {
+        classification: "DIAGNOSTIC",
+        reason: "Most-recent boot diagnostic: recordHookInitFailure overwrites it and clearHookInitFailure resets it.",
+    },
+    "packages/plugin/src/hooks/magic-context/read-session-formatting.ts:tokenizerLoadPromise": {
+        classification: "PUBLICATION",
+        reason: "In-flight handle only: finally clears it after the load settles, so it cannot retain a failure verdict.",
+    },
+    "packages/plugin/src/shared/exit-abort-registry.ts:listenerRegistered": {
+        classification: "PUBLICATION",
+        reason: "One-time process exit-listener installation, not a capability or failure verdict.",
+    },
+    "packages/plugin/src/shared/storage-permissions.ts:enforcePrivateStoragePermissions": {
+        classification: "VERDICT",
+        reason: "Repeatedly assigned configuration: the public setter can update it during the process.",
+    },
+    "packages/plugin/src/features/magic-context/storage-db.ts:lastSchemaFenceRejection": {
+        classification: "DIAGNOSTIC",
+        reason: "Most-recent diagnostic: every open attempt clears or overwrites it.",
+    },
+    "packages/plugin/src/features/magic-context/storage-db.ts:lastMigrationOnOpenRefusal": {
+        classification: "DIAGNOSTIC",
+        reason: "Most-recent diagnostic: every open attempt clears or overwrites it.",
+    },
+    "packages/plugin/src/shared/models-dev-cache.ts:apiCache": {
+        classification: "PUBLICATION",
+        reason: "Publishes last-known-good model metadata, not a failure verdict; refresh writes a later successful value.",
+    },
+};
+
+function sourceFiles(directory: string): string[] {
+    const files: string[] = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        const path = join(directory, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...sourceFiles(path));
+        } else if (entry.isFile() && path.endsWith(".ts") && !path.endsWith(".test.ts")) {
+            files.push(path);
+        }
+    }
+    return files;
+}
+
+function declaredOneShotSlots(source: string): string[] {
+    // `let` is deliberate: this targets mutable module state, not constant lookup
+    // tables or prepared-statement handles. The initializer restriction excludes
+    // ordinary counters and per-call scratch values.
+    const declarations =
+        /^(?:export\s+)?let\s+([A-Za-z_$][\w$]*)\b[^\n]*(?:=\s*(?:null|false|true)|Promise<)/gm;
+    const verdictName =
+        /(?:attempted|availability|compatible|cooldown|disabled|failed|failure|latch|missing|permission|promise|registered|unavailable)/i;
+    const moduleSlots = [...source.matchAll(declarations)].map((match) => match[1]);
+    // A provider-local permanent failure has the same operational effect as a
+    // module slot: every later provider call short-circuits without re-probing.
+    const providerLatches = [
+        ...source.matchAll(/^\s*private\s+(permanentFailure)\s*=\s*false;/gm),
+    ].map((match) => match[1]);
+    return [...moduleSlots, ...providerLatches].filter(
+        (name): name is string => name !== undefined && verdictName.test(name),
+    );
+}
+
+describe("latch permanence classification guard", () => {
+    test("classifies every production one-shot verdict-shaped slot", () => {
+        const inlineTestBlocks: string[] = [];
+        const discovered = new Set<string>();
+        for (const root of SOURCE_ROOTS) {
+            for (const file of sourceFiles(join(REPOSITORY_ROOT, root))) {
+                const source = readFileSync(file, "utf8");
+                if (/from\s+["']bun:test["']/.test(source)) {
+                    inlineTestBlocks.push(relative(REPOSITORY_ROOT, file));
+                }
+                for (const slot of declaredOneShotSlots(source)) {
+                    discovered.add(`${relative(REPOSITORY_ROOT, file)}:${slot}`);
+                }
+            }
+        }
+
+        expect(inlineTestBlocks).toEqual([]);
+        const unclassified = [...discovered].filter((slot) => !(slot in KNOWN_SLOTS)).sort();
+        expect(
+            unclassified,
+            `Classify each new one-shot verdict-shaped slot in KNOWN_SLOTS: ${unclassified.join(", ")}`,
+        ).toEqual([]);
+        expect(Object.keys(KNOWN_SLOTS).length).toBeGreaterThan(0);
+    });
+});

package/src/config/live-run-config.test.ts

@@ -0,0 +1,139 @@
+import { expect, test } from "bun:test";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { resolveHistorianModel } from "../shared/model-resolution";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
+import { loadPluginConfigDetailed } from "./index";
+import { historianRunConfig } from "./live-run-config";
+import { LiveConfigReader } from "./live-snapshot";
+
+for (const host of ["OC1", "OC2", "Pi"] as const) {
+    test(`${host} historian samples the next generation while an existing run keeps its model and fallback`, () => {
+        const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-historian-"));
+        const previous = { home: process.env.HOME, config: process.env.XDG_CONFIG_HOME };
+        process.env.HOME = root;
+        process.env.XDG_CONFIG_HOME = join(root, "config");
+        const directory = join(root, "project");
+        const file = join(root, "config", "opencode", "mmc.jsonc");
+        mkdirSync(join(root, "config", "opencode"), { recursive: true });
+        mkdirSync(join(directory, ".mmc"), { recursive: true });
+        try {
+            const block = host === "Pi" ? "pi" : "opencode";
+            const write = (
+                model: string,
+                fallback: string,
+                autoPromote: boolean,
+                minClusters: number,
+                maxTokens: number,
+            ) =>
+                writeFileSync(
+                    file,
+                    JSON.stringify({
+                        historian: { maxTokens, [block]: { model, fallback_models: [fallback] } },
+                        memory: { auto_promote: autoPromote },
+                        commit_cluster_trigger: { enabled: true, min_clusters: minClusters },
+                    }),
+                );
+            write("anthropic/old-model", "anthropic/old-fallback", true, 3, 4096);
+            const load = () => loadPluginConfigDetailed(directory, false).config;
+            const boot = load();
+            const reader = new LiveConfigReader(directory, boot, load, () => {});
+            reader.poll();
+            const runOne = historianRunConfig(boot, reader.current().effective);
+            write(
+                "anthropic/new-model-with-longer-name",
+                "anthropic/new-fallback-with-longer-name",
+                false,
+                5,
+                8192,
+            );
+            const runTwo = historianRunConfig(boot, reader.poll().effective);
+            const harness = host === "Pi" ? "pi" : "opencode";
+            expect(resolveHistorianModel(runOne, harness).primary?.model).toBe(
+                "anthropic/old-model",
+            );
+            expect(resolveHistorianModel(runOne, harness).fallbacks[0]?.model).toBe(
+                "anthropic/old-fallback",
+            );
+            expect(resolveHistorianModel(runTwo, harness).primary?.model).toBe(
+                "anthropic/new-model-with-longer-name",
+            );
+            expect(resolveHistorianModel(runTwo, harness).fallbacks[0]?.model).toBe(
+                "anthropic/new-fallback-with-longer-name",
+            );
+            expect(runOne.memory.auto_promote).toBe(true);
+            expect(runTwo.memory.auto_promote).toBe(false);
+            expect(runOne.commit_cluster_trigger.min_clusters).toBe(3);
+            expect(runTwo.commit_cluster_trigger.min_clusters).toBe(5);
+            expect(runOne.historian?.maxTokens).toBe(4096);
+            expect(runTwo.historian?.maxTokens).toBe(8192);
+            expect(reader.current().generation).toBe(2);
+        } finally {
+            if (previous.home === undefined) delete process.env.HOME;
+            else process.env.HOME = previous.home;
+            if (previous.config === undefined) delete process.env.XDG_CONFIG_HOME;
+            else process.env.XDG_CONFIG_HOME = previous.config;
+            rmSync(root, { recursive: true, force: true });
+        }
+    });
+}
+
+test("malformed project config retains last good values and deduplicates the warning; project overrides remain tier-safe", () => {
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-tiers-"));
+    const previous = { home: process.env.HOME, config: process.env.XDG_CONFIG_HOME };
+    process.env.HOME = root;
+    process.env.XDG_CONFIG_HOME = join(root, "config");
+    const directory = join(root, "project");
+    const userFile = join(root, "config", "opencode", "mmc.jsonc");
+    const projectFile = join(directory, ".mmc", "mmc.jsonc");
+    mkdirSync(join(root, "config", "opencode"), { recursive: true });
+    mkdirSync(join(directory, ".mmc"), { recursive: true });
+    const warnings: string[] = [];
+    try {
+        writeFileSync(
+            userFile,
+            JSON.stringify({
+                historian: { opencode: { model: "user/historian" } },
+            }),
+        );
+        writeFileSync(
+            projectFile,
+            JSON.stringify({
+                historian: { opencode: { model: "project/historian" } },
+            }),
+        );
+        const load = () => loadPluginConfigDetailed(directory, false).config;
+        const reader = new LiveConfigReader(directory, load(), load, (message) =>
+            warnings.push(message),
+        );
+        const first = reader.poll();
+        expect(resolveHistorianModel(first.effective, "opencode").primary?.model).toBe(
+            "user/historian",
+        );
+        writeFileSync(projectFile, "{ broken:");
+        expect(reader.poll()).toBe(first);
+        expect(reader.poll()).toBe(first);
+        expect(warnings.filter((message) => message.includes("config reload failed"))).toHaveLength(
+            1,
+        );
+        writeFileSync(
+            projectFile,
+            JSON.stringify({
+                historian: { opencode: { model: "project/new-historian" } },
+            }),
+        );
+        const second = reader.poll();
+        expect(second.generation).toBe(2);
+        expect(resolveHistorianModel(second.effective, "opencode").primary?.model).toBe(
+            "user/historian",
+        );
+    } finally {
+        if (previous.home === undefined) delete process.env.HOME;
+        else process.env.HOME = previous.home;
+        if (previous.config === undefined) delete process.env.XDG_CONFIG_HOME;
+        else process.env.XDG_CONFIG_HOME = previous.config;
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/src/config/live-run-config.ts

@@ -0,0 +1,79 @@
+import { log } from "../shared/logger";
+import { loadPluginConfigDetailed, type MagicContextPluginConfig } from "./index";
+import { LiveConfigReader } from "./live-snapshot";
+import { LIVE_RELOAD_CONFIG_PATHS, type MagicContextConfig } from "./schema/magic-context";
+
+/** Copy only schema-marked live paths from fresh config; other settings retain boot values. */
+export function sampleLiveConfig<T extends MagicContextConfig>(boot: T, fresh: T): T {
+    const result = { ...boot } as Record<string, unknown>;
+    for (const path of LIVE_RELOAD_CONFIG_PATHS) {
+        const parts = path.split(".");
+        let value: unknown = fresh;
+        for (const part of parts) value = (value as Record<string, unknown> | undefined)?.[part];
+        let target = result;
+        for (const part of parts.slice(0, -1)) {
+            const child = target[part];
+            const copy =
+                child && typeof child === "object" && !Array.isArray(child)
+                    ? { ...(child as Record<string, unknown>) }
+                    : {};
+            target[part] = copy;
+            target = copy;
+        }
+        const leaf = parts.at(-1);
+        if (leaf !== undefined) target[leaf] = value;
+    }
+    return result as T;
+}
+
+export function changedLiveKeys(previous: MagicContextConfig, next: MagicContextConfig): string[] {
+    const at = (config: MagicContextConfig, path: string): unknown =>
+        path
+            .split(".")
+            .reduce<unknown>(
+                (node, part) => (node as Record<string, unknown> | undefined)?.[part],
+                config,
+            );
+    return LIVE_RELOAD_CONFIG_PATHS.filter(
+        (path) => JSON.stringify(at(previous, path)) !== JSON.stringify(at(next, path)),
+    );
+}
+
+export const historianRunConfig = sampleLiveConfig;
+
+const pluginReaders = new Map<string, LiveConfigReader<MagicContextPluginConfig>>();
+
+/** Shared by all OpenCode entry points for one project in this process. */
+export function pluginConfigReader(directory: string, boot: MagicContextPluginConfig) {
+    let reader = pluginReaders.get(directory);
+    if (!reader) {
+        reader = new LiveConfigReader(
+            directory,
+            boot,
+            () => {
+                const loaded = loadPluginConfigDetailed(directory, false);
+                if (
+                    loaded.loadOutcome === "project-file-parse-error" ||
+                    loaded.loadOutcome === "project-file-io-error" ||
+                    loaded.loadOutcome === "schema-recovery"
+                ) {
+                    throw new Error(
+                        `invalid configuration: ${loaded.config.configWarnings?.join("; ") ?? loaded.loadOutcome}`,
+                    );
+                }
+                return loaded.config;
+            },
+            // Into our own log file: console output lands in the host's stdout/stderr
+            // (for `opencode serve`, the terminal or service log the user reads).
+            (message) => log(`[config] ${message}`),
+            changedLiveKeys,
+        );
+        reader.poll();
+        pluginReaders.set(directory, reader);
+    }
+    return reader;
+}
+
+export function currentPluginConfigReader(directory: string) {
+    return pluginReaders.get(directory);
+}

package/src/config/live-schema-drift.test.ts

@@ -0,0 +1,67 @@
+import { expect, test } from "bun:test";
+
+import { buildSchema } from "../../scripts/build-schema";
+import { sampleLiveConfig } from "./live-run-config";
+import { LIVE_RELOAD_CONFIG_PATHS, type MagicContextConfig } from "./schema/magic-context";
+
+type SchemaNode = { properties?: Record<string, SchemaNode>; "x-mc-live-reload"?: boolean };
+
+function leaves(node: SchemaNode, prefix = ""): Array<{ path: string; marked: boolean }> {
+    return Object.entries(node.properties ?? {}).flatMap(([key, child]) => {
+        const path = prefix ? `${prefix}.${key}` : key;
+        return child.properties
+            ? leaves(child, path)
+            : [{ path, marked: child["x-mc-live-reload"] === true }];
+    });
+}
+
+function assign(target: Record<string, unknown>, path: string, value: unknown): void {
+    const keys = path.split(".");
+    let node = target;
+    for (const key of keys.slice(0, -1)) {
+        node[key] ??= {};
+        node = node[key] as Record<string, unknown>;
+    }
+    node[keys.at(-1)!] = value;
+}
+
+function lookup(target: Record<string, unknown>, path: string): unknown {
+    return path
+        .split(".")
+        .reduce<unknown>(
+            (node, key) => (node as Record<string, unknown> | undefined)?.[key],
+            target,
+        );
+}
+
+test("schema live marks equal the keys sampled by producer consumers and published JSON schema", async () => {
+    const generated = buildSchema() as SchemaNode;
+    const published = (await Bun.file(
+        new URL("../../../../assets/magic-context.schema.json", import.meta.url),
+    ).json()) as SchemaNode;
+    const generatedLive = leaves(generated)
+        .filter((row) => row.marked)
+        .map((row) => row.path)
+        .sort();
+    const publishedLive = leaves(published)
+        .filter((row) => row.marked)
+        .map((row) => row.path)
+        .sort();
+    const boot = {} as Record<string, unknown>;
+    const fresh = {} as Record<string, unknown>;
+    for (const row of leaves(generated)) assign(fresh, row.path, `changed:${row.path}`);
+    const sampled = sampleLiveConfig(
+        boot as MagicContextConfig,
+        fresh as MagicContextConfig,
+    ) as Record<string, unknown>;
+    const consumed = leaves(generated)
+        .filter((row) => lookup(sampled, row.path) === `changed:${row.path}`)
+        .map((row) => row.path)
+        .sort();
+    expect(generatedLive).toEqual([...LIVE_RELOAD_CONFIG_PATHS].sort());
+    expect(publishedLive).toEqual(generatedLive);
+    expect(consumed).toEqual(generatedLive);
+    expect(generatedLive).not.toContain("language");
+    expect(generatedLive).not.toContain("historian.top_p");
+    expect(generatedLive).not.toContain("protected_tokens");
+});

package/src/config/live-snapshot.test.ts

@@ -0,0 +1,86 @@
+import { expect, test } from "bun:test";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { parseJsonc } from "../shared/jsonc-parser";
+import { createTestTempDirFromPath } from "../shared/test-temp-dir";
+import { LiveConfigReader } from "./live-snapshot";
+
+test("one snapshot per run survives a malformed tier and adopts both tiers atomically", () => {
+    const oldConfigHome = process.env.XDG_CONFIG_HOME;
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-config-"));
+    const project = join(root, "project");
+    const projectFile = join(project, ".mmc", "mmc.jsonc");
+    const userFile = join(root, "config", "opencode", "mmc.jsonc");
+    mkdirSync(join(project, ".mmc"), { recursive: true });
+    mkdirSync(join(root, "config", "opencode"), { recursive: true });
+    process.env.XDG_CONFIG_HOME = join(root, "config");
+    try {
+        const logs: string[] = [];
+        writeFileSync(userFile, '{"historian":{"model":"user"}}');
+        writeFileSync(projectFile, '{"historian":{"model":"project"}}');
+        const load = () => {
+            const user = parseJsonc<{ historian: { model: string } }>(
+                readFileSync(userFile, "utf8"),
+            );
+            const projectConfig = parseJsonc<{ historian: { model: string } }>(
+                readFileSync(projectFile, "utf8"),
+            );
+            return { model: projectConfig.historian.model ?? user.historian.model };
+        };
+        const reader = new LiveConfigReader(project, load(), load, (line) => logs.push(line));
+        const first = reader.poll();
+        expect(first.generation).toBe(1);
+        writeFileSync(projectFile, '{"historian":');
+        expect(reader.poll()).toBe(first);
+        expect(reader.lastFailure()?.path).toBe(projectFile);
+        reader.poll();
+        expect(logs.filter((line) => line.includes("reload failed"))).toHaveLength(1);
+        writeFileSync(projectFile, '{"historian":{"model":"second-model"}}');
+        const second = reader.poll();
+        expect(second.generation).toBe(2);
+        expect(second.effective.model).toBe("second-model");
+        expect(first.effective.model).toBe("project");
+        expect(reader.lastFailure()).toBeUndefined();
+        expect(logs.filter((line) => line.includes("config reloaded"))).toEqual([
+            "config reloaded gen=2 keys=[model]",
+        ]);
+    } finally {
+        if (oldConfigHome === undefined) delete process.env.XDG_CONFIG_HOME;
+        else process.env.XDG_CONFIG_HOME = oldConfigHome;
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+
+test("a write crossing the tier load boundary is not published as a mixed snapshot", () => {
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-live-crossing-"));
+    const previous = process.env.XDG_CONFIG_HOME;
+    process.env.XDG_CONFIG_HOME = join(root, "config");
+    const project = join(root, "project");
+    const file = join(project, ".mmc", "mmc.jsonc");
+    mkdirSync(join(project, ".mmc"), { recursive: true });
+    try {
+        writeFileSync(file, '{"model":"old"}');
+        let crossWrite = false;
+        const load = () => {
+            if (crossWrite) {
+                crossWrite = false;
+                writeFileSync(file, '{"model":"newest-longer"}');
+            }
+            return { model: JSON.parse(readFileSync(file, "utf8")).model as string };
+        };
+        const reader = new LiveConfigReader(project, load(), load, () => {});
+        reader.poll();
+        writeFileSync(file, '{"model":"intermediate"}');
+        crossWrite = true;
+        expect(reader.poll().effective.model).toBe("old");
+        expect(reader.current().generation).toBe(1);
+        expect(reader.poll().effective.model).toBe("newest-longer");
+        expect(reader.current().generation).toBe(2);
+    } finally {
+        if (previous === undefined) delete process.env.XDG_CONFIG_HOME;
+        else process.env.XDG_CONFIG_HOME = previous;
+        rmSync(root, { recursive: true, force: true });
+    }
+});