fix(tmux): confirm delivery by draft transition, not by prompt glyph (#1257 )

send-message.sh located the REPL input box with grep -E '❯|^>|│ >'. That set is Claude Code's box. A pi seat renders a bare U+2500 rule with no glyph, so on every idle pi seat the capture succeeded, the grep matched nothing, status stayed "unconfirmed", and the tool exited 2 "may be UNDELIVERED" with the paste and the Enter both landed. The stderr tells the operator to retry, and that retry is the duplicate delivery reported against the same tool. Confirmation is now runtime-agnostic: our message tail sits on the input line (located by cursor row, no glyph) before Enter and has left it after. That transition is positive proof of submission. Absence still proves nothing, which is the guard the 2026-08 fix was reaching for and got backwards. Two positive checks keep it: - a prompt box that IS locatable and still carries our tail => draft, exit 2. This covers the cursor-row blind spot: a cooked pane whose foreground process never reads stdin echoes the paste through the kernel line discipline and moves the cursor off it on Enter, which by cursor row alone is indistinguishable from a real submit. - no draft ever observed on the input line => unconfirmed, non-zero. Tests, both red-first against the shipping blob d397907: test-send-message-glyph-agnostic.sh (new, 6 fixtures) 4/6 -> 6/6 test-send-message-verdict.sh (fixture 2 reshaped, 2b added) 3/4 -> 4/4 Fixture 2 of the verdict suite asserted exit 2 for a glyphless pane that submits and was labelled "false-positive FIXED". A pi seat is that fixture, so the suite was locking the bug in. It is reshaped deliberately, and the guard it was credited with moves to new fixture 2b (glyphless AND non-submitting, raw/no-echo) so the "never infer delivered from absence" property is tested positively rather than as a side effect. Measured on tmux 3.7b (sb-it-1-dt), 3.5a (fomo-lin), and dragon-lin. Co-authored-by: scooby <[email protected]>
2026-08-16 16:35:36 -05:00
20 changed files with 353 additions and 2555 deletions
@@ -1,110 +0,0 @@
 'use client';
 import type { ReactElement } from 'react';
 import { formatAge, type FreshnessLabel } from '@/lib/freshness/model';
 /**
 * Rendering rules for non-current freshness states (RI-5-001).
 *
 * - `unavailable` renders an explicit failure panel — never an empty
 *   healthy collection.
 * - `stale` may render last-known data, but only under a visible label
 *   carrying source identity, snapshot version, and age.
 * - `partial` renders the verified parts plus an explicit list of what is
 *   missing.
 */
 interface RetryableNoticeProps {
  readonly onRetry?: () => void;
  readonly retryLabel?: string;
 }
 function RetryButton({ onRetry, retryLabel }: RetryableNoticeProps): ReactElement | null {
  if (!onRetry) return null;
  return (
    <button
      type="button"
      onClick={onRetry}
      className="mt-2 rounded-lg border border-surface-border px-3 py-1.5 text-xs transition-colors hover:border-gray-500"
    >
      {retryLabel ?? 'Retry'}
    </button>
  );
 }
 export interface UnavailableDataNoticeProps extends RetryableNoticeProps {
  /** What is unavailable, e.g. "Tasks". */
  readonly title: string;
  /** Optional underlying failure detail (network message, invalidation reason). */
  readonly detail?: string | null;
 }
 /** Explicit `unavailable` state. Never renders as an empty healthy collection. */
 export function UnavailableDataNotice({
  title,
  detail,
  onRetry,
  retryLabel,
 }: UnavailableDataNoticeProps): ReactElement {
  return (
    <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
      <p className="font-medium text-text-primary">{title} are unavailable</p>
      <p className="mt-1 text-text-muted">
        This is not an empty result — the data could not be verified from the gateway.
        {detail ? ` ${detail}` : ''}
      </p>
      <RetryButton onRetry={onRetry} retryLabel={retryLabel} />
    </div>
  );
 }
 export interface StaleDataNoticeProps extends RetryableNoticeProps {
  /** Provenance of the last-known snapshot being displayed. */
  readonly label: FreshnessLabel;
 }
 /**
 * Situational-awareness banner for `stale` data: last-known data may render,
 * but visibly labeled with source identity, snapshot version, and age.
 */
 export function StaleDataNotice({
  label,
  onRetry,
  retryLabel,
 }: StaleDataNoticeProps): ReactElement {
  return (
    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
      <p className="font-medium text-warning">Showing last-known data — it may be out of date</p>
      <p className="mt-1 text-xs text-text-muted">
        Source {label.source} · snapshot v{label.version} · fetched{' '}
        {formatAge(label.fetchedAt, Date.now())}. Verdicts derived from this data are unknown and
        changes are disabled until it is revalidated.
      </p>
      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
    </div>
  );
 }
 export interface PartialDataNoticeProps extends RetryableNoticeProps {
  /** Display names of the sections whose collections are unavailable. */
  readonly missing: readonly string[];
 }
 /** `partial` surface banner: verified parts render, missing parts are explicit. */
 export function PartialDataNotice({
  missing,
  onRetry,
  retryLabel,
 }: PartialDataNoticeProps): ReactElement {
  return (
    <div role="status" className="rounded-lg border border-warning/40 px-4 py-3 text-sm">
      <p className="font-medium text-warning">Some data could not be loaded</p>
      <p className="mt-1 text-xs text-text-muted">
        {missing.join(', ')} {missing.length === 1 ? 'is' : 'are'} unavailable — sections below show
        an explicit unavailable state instead of an empty list. Derived verdicts remain unknown
        until every collection is revalidated.
      </p>
      <RetryButton onRetry={onRetry} retryLabel={retryLabel ?? 'Revalidate'} />
    </div>
  );
 }
@@ -1,324 +0,0 @@
 import { describe, expect, it } from 'vitest';
 import type { Task } from '@/lib/types';
 import {
  acceptSnapshot,
  assertMutable,
  canMutate,
  combineFreshness,
  computeDigest,
  computeFreshness,
  DEFAULT_FRESHNESS_POLICY,
  formatAge,
  type FreshSnapshot,
  invalidationReasonLabels,
  StaleMutationError,
  UNKNOWN_VERDICT,
  verdictValue,
 } from './model';
 import { validateProjectCollection, validateTaskCollection } from './validators';
 const NOW = 1_800_000_000_000;
 const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
 const taskPayload: Task[] = [
  {
    id: 'task-1',
    title: 'T1',
    description: null,
    status: 'not-started',
    priority: 'high',
    projectId: 'project-1',
    missionId: null,
    assignee: null,
    tags: null,
    dueDate: null,
    metadata: null,
    createdAt: '2026-08-01T00:00:00.000Z',
    updatedAt: '2026-08-01T00:00:00.000Z',
  },
 ];
 function acceptedTaskSnapshot(
  overrides: Partial<FreshSnapshot<typeof taskPayload>> = {},
 ): FreshSnapshot<typeof taskPayload> {
  const result = acceptSnapshot({
    value: taskPayload,
    validate: validateTaskCollection,
    previous: null,
    policy,
    source: 'gateway:/api/tasks',
    now: NOW,
  });
  if (result.outcome !== 'accepted') {
    throw new Error(`fixture setup failed: ${result.reason}`);
  }
  return { ...result.snapshot, ...overrides };
 }
 describe('computeFreshness', () => {
  it('treats a missing snapshot as unavailable, never as an empty healthy collection', () => {
    expect(computeFreshness({ snapshot: null, policy, now: NOW })).toBe('unavailable');
  });
  it('returns current for a fresh verified snapshot regardless of data emptiness', () => {
    const empty = acceptSnapshot({
      value: [],
      validate: validateTaskCollection,
      previous: null,
      policy,
      source: 'gateway:/api/tasks',
      now: NOW,
    });
    if (empty.outcome !== 'accepted') throw new Error('expected acceptance');
    expect(computeFreshness({ snapshot: empty.snapshot, policy, now: NOW })).toBe('current');
  });
  it('degrades to stale once the snapshot ages past staleAfterMs', () => {
    const snapshot = acceptedTaskSnapshot();
    expect(computeFreshness({ snapshot, policy, now: NOW + 60_001 })).toBe('stale');
    expect(computeFreshness({ snapshot, policy, now: NOW + 59_999 })).toBe('current');
  });
  it('degrades to stale when the latest revalidation failed', () => {
    const snapshot = acceptedTaskSnapshot();
    expect(computeFreshness({ snapshot, policy, now: NOW, degraded: true })).toBe('stale');
  });
 });
 describe('mutation guard', () => {
  it('permits mutations only on current data', () => {
    expect(canMutate('current')).toBe(true);
    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
      expect(canMutate(state)).toBe(false);
    }
  });
  it('refuses mutations on non-current data via assertMutable', () => {
    expect(() => assertMutable('current')).not.toThrow();
    for (const state of ['stale', 'partial', 'unknown', 'unavailable'] as const) {
      let thrown: unknown;
      try {
        assertMutable(state);
      } catch (caught) {
        thrown = caught;
      }
      expect(thrown).toBeInstanceOf(StaleMutationError);
      expect(thrown).toBeInstanceOf(Error);
      if (thrown instanceof StaleMutationError) {
        expect(thrown.name).toBe('StaleMutationError');
        expect(thrown.freshness).toBe(state);
        expect(thrown.message).toContain(state);
        expect(thrown.message).toContain('revalidat');
      }
    }
  });
 });
 describe('acceptSnapshot', () => {
  it('accepts a valid payload with provenance', () => {
    const result = acceptSnapshot({
      value: taskPayload,
      validate: validateTaskCollection,
      previous: null,
      policy,
      source: 'gateway:/api/tasks',
      now: NOW,
    });
    expect(result.outcome).toBe('accepted');
    if (result.outcome !== 'accepted') return;
    expect(result.snapshot.source).toBe('gateway:/api/tasks');
    expect(result.snapshot.version).toBe(1);
    expect(result.snapshot.fetchedAt).toBe(NOW);
    expect(result.snapshot.data).toEqual(taskPayload);
  });
  it('invalidates a schema-mismatched payload instead of rendering it', () => {
    const result = acceptSnapshot({
      value: { not: 'an array' },
      validate: validateTaskCollection,
      previous: acceptedTaskSnapshot(),
      policy,
      source: 'gateway:/api/tasks',
      now: NOW,
    });
    expect(result).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
    expect(invalidationReasonLabels['schema-mismatch']).toContain('schema');
  });
  it('invalidates cross-workspace payloads', () => {
    const userOne = acceptSnapshot({
      value: [
        {
          id: 'p1',
          name: 'P1',
          description: null,
          status: 'active',
          userId: 'user-1',
          metadata: null,
          createdAt: '2026-08-01T00:00:00.000Z',
          updatedAt: '2026-08-01T00:00:00.000Z',
        },
      ],
      validate: validateProjectCollection,
      previous: null,
      policy,
      source: 'gateway:/api/projects',
      now: NOW,
    });
    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
    const switched = acceptSnapshot({
      value: [
        {
          id: 'p9',
          name: 'P9',
          description: null,
          status: 'active',
          userId: 'user-2',
          metadata: null,
          createdAt: '2026-08-01T00:00:00.000Z',
          updatedAt: '2026-08-01T00:00:00.000Z',
        },
      ],
      validate: validateProjectCollection,
      previous: userOne.snapshot,
      policy,
      source: 'gateway:/api/projects',
      now: NOW,
    });
    expect(switched).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
  });
  it('keeps the previous workspace for collections with no intrinsic identity', () => {
    const userOne = acceptSnapshot({
      value: [
        {
          id: 'p1',
          name: 'P1',
          description: null,
          status: 'active',
          userId: 'user-1',
          metadata: null,
          createdAt: '2026-08-01T00:00:00.000Z',
          updatedAt: '2026-08-01T00:00:00.000Z',
        },
      ],
      validate: validateProjectCollection,
      previous: null,
      policy,
      source: 'gateway:/api/projects',
      now: NOW,
    });
    if (userOne.outcome !== 'accepted') throw new Error('expected acceptance');
    // Empty list after the user deleted every project: no identity to check,
    // so the verified scope is retained and the empty state stays healthy.
    const emptied = acceptSnapshot({
      value: [],
      validate: validateProjectCollection,
      previous: userOne.snapshot,
      policy,
      source: 'gateway:/api/projects',
      now: NOW,
    });
    expect(emptied.outcome).toBe('accepted');
    if (emptied.outcome === 'accepted') {
      expect(emptied.snapshot.data).toEqual([]);
      expect(emptied.snapshot.workspace).toBe('user-1');
    }
  });
  it('invalidates version regressions', () => {
    const previous = acceptedTaskSnapshot({ version: 7 });
    const regressed = acceptSnapshot({
      value: taskPayload,
      validate: validateTaskCollection,
      previous,
      policy,
      source: 'gateway:/api/tasks',
      now: NOW,
      incomingVersion: 3,
    });
    expect(regressed).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
    const newerSchema = acceptedTaskSnapshot({ schemaVersion: 4 });
    const downgradedClient = acceptSnapshot({
      value: taskPayload,
      validate: validateTaskCollection,
      previous: newerSchema,
      policy: { ...policy, schemaVersion: 2 },
      source: 'gateway:/api/tasks',
      now: NOW,
    });
    expect(downgradedClient).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
  });
  it('increments the version monotonically across accepted snapshots', () => {
    const first = acceptedTaskSnapshot();
    const second = acceptSnapshot({
      value: taskPayload,
      validate: validateTaskCollection,
      previous: first,
      policy,
      source: 'gateway:/api/tasks',
      now: NOW,
    });
    expect(second.outcome).toBe('accepted');
    if (second.outcome === 'accepted') {
      expect(second.snapshot.version).toBe(first.version + 1);
    }
  });
 });
 describe('combineFreshness', () => {
  it('gates the surface on the primary collection', () => {
    expect(combineFreshness('unavailable', ['current'])).toBe('unavailable');
    expect(combineFreshness('unknown', ['current'])).toBe('unknown');
    expect(combineFreshness('current', [])).toBe('current');
  });
  it('degrades to partial when a secondary is unavailable', () => {
    expect(combineFreshness('current', ['current', 'unavailable'])).toBe('partial');
  });
  it('degrades to unknown while a secondary is still loading', () => {
    expect(combineFreshness('current', ['unknown'])).toBe('unknown');
  });
  it('degrades to stale when any collection is stale', () => {
    expect(combineFreshness('current', ['stale'])).toBe('stale');
    expect(combineFreshness('stale', ['current'])).toBe('stale');
  });
  it('propagates partial secondaries', () => {
    expect(combineFreshness('current', ['partial'])).toBe('partial');
  });
 });
 describe('computeDigest', () => {
  it('is stable across key order and changes with data', () => {
    const a = computeDigest({ x: 1, y: [1, 2] });
    const b = computeDigest({ y: [1, 2], x: 1 });
    expect(a).toBe(b);
    expect(computeDigest({ x: 1, y: [1, 3] })).not.toBe(a);
  });
 });
 describe('verdictValue', () => {
  it('returns the value only for verified inputs', () => {
    expect(verdictValue(true, '5')).toBe('5');
    expect(verdictValue(false, '5')).toBe(UNKNOWN_VERDICT);
    expect(verdictValue(false, '5')).not.toBe('5');
  });
 });
 describe('formatAge', () => {
  it('labels age in human terms', () => {
    expect(formatAge(NOW, NOW)).toBe('just now');
    expect(formatAge(NOW, NOW + 15_000)).toBe('under a minute ago');
    expect(formatAge(NOW, NOW + 120_000)).toBe('2m ago');
    expect(formatAge(NOW, NOW + 3 * 3_600_000)).toBe('3h ago');
    expect(formatAge(NOW, NOW + 2 * 86_400_000)).toBe('2d ago');
  });
 });
@@ -1,261 +0,0 @@
 /**
 * Typed freshness model for gateway-fetched collections (RI-5-001).
 *
 * A failed or stale fetch must never be indistinguishable from an empty
 * healthy collection. Every fetched surface carries an explicit freshness
 * state, a verified snapshot identity (source, workspace, version, age), and
 * a mutation guard that refuses state-changing operations unless the data is
 * verified current.
 */
 /** Freshness states for fetched data. Never inferred from emptiness. */
 export type FreshnessState = 'current' | 'stale' | 'partial' | 'unknown' | 'unavailable';
 /**
 * Reasons a snapshot is invalidated. An invalidated snapshot is treated as
 * unavailable and is never rendered as current.
 */
 export type InvalidationReason =
  | 'cache-corruption'
  | 'cross-workspace'
  | 'schema-mismatch'
  | 'version-regression';
 /** Human-readable labels for invalidation reasons (UI + error messages). */
 export const invalidationReasonLabels: Record<InvalidationReason, string> = {
  'cache-corruption': 'cached snapshot failed integrity checks',
  'cross-workspace': 'data belongs to a different workspace',
  'schema-mismatch': 'response did not match the expected schema',
  'version-regression': 'snapshot version regressed below the accepted version',
 };
 /** A verified snapshot of fetched data with full provenance. */
 export interface FreshSnapshot<T> {
  readonly data: T;
  /** Source identity of the fetch, e.g. `gateway:/api/tasks`. */
  readonly source: string;
  /** Workspace scope the data belongs to. */
  readonly workspace: string;
  /** Monotonic snapshot sequence number for this surface. */
  readonly version: number;
  /** Schema version of the validator that accepted this snapshot. */
  readonly schemaVersion: number;
  /** Epoch ms at which the data was verified. */
  readonly fetchedAt: number;
  /** Integrity digest of `data`, used to detect cache corruption. */
  readonly digest: string;
 }
 /** Provenance label rendered next to last-known data. */
 export interface FreshnessLabel {
  readonly source: string;
  readonly version: number;
  readonly fetchedAt: number;
 }
 /** Policy governing freshness for a surface. */
 export interface FreshnessPolicy {
  /** Active workspace scope. Snapshots from other scopes are invalidated. */
  readonly workspace: string;
  /** Schema version of the current validator. */
  readonly schemaVersion: number;
  /** Age after which a verified snapshot degrades from current to stale. */
  readonly staleAfterMs: number;
 }
 export const DEFAULT_FRESHNESS_POLICY: FreshnessPolicy = {
  workspace: 'default',
  schemaVersion: 1,
  staleAfterMs: 60_000,
 };
 /** Payload returned by a successful schema validation. */
 export interface FreshPayload<T> {
  readonly data: T;
  /**
   * Workspace identity extracted from the payload itself when the collection
   * carries one (e.g. a uniform `userId` on projects). `null` when the
   * collection has no intrinsic workspace identity.
   */
  readonly workspace: string | null;
 }
 /** Error thrown when a mutation is attempted on non-current data. */
 export class StaleMutationError extends Error {
  readonly freshness: FreshnessState;
  constructor(freshness: FreshnessState) {
    super(`Refused mutation on ${freshness} data: revalidation is required before mutating.`);
    this.name = 'StaleMutationError';
    this.freshness = freshness;
  }
 }
 /** Stable JSON digest used for snapshot integrity checks. */
 export function computeDigest(value: unknown): string {
  // FNV-1a 32-bit over the stable JSON serialization. This is an integrity
  // check against corruption, not a cryptographic guarantee.
  let hash = 0x811c9dc5;
  for (const byte of stableStringify(value)) {
    hash ^= byte.charCodeAt(0);
    hash = Math.imul(hash, 0x01000193) >>> 0;
  }
  return hash.toString(16).padStart(8, '0');
 }
 function stableStringify(value: unknown): string {
  return serialize(value);
 }
 function serialize(value: unknown): string {
  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? 'null';
  if (Array.isArray(value)) return `[${value.map(serialize).join(',')}]`;
  const entries = Object.entries(value as Record<string, unknown>)
    .filter(([, item]) => item !== undefined)
    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
    .map(([key, item]) => `${JSON.stringify(key)}:${serialize(item)}`);
  return `{${entries.join(',')}}`;
 }
 export type AcceptSnapshotResult<T> =
  | { readonly outcome: 'accepted'; readonly snapshot: FreshSnapshot<T> }
  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
 export interface AcceptSnapshotOptions<T> {
  /** Raw fetched value (untrusted JSON). */
  readonly value: unknown;
  /** Schema validator; returns `null` when the value does not match. */
  readonly validate: (value: unknown) => FreshPayload<T> | null;
  /** Previously accepted snapshot for this surface, if any. */
  readonly previous: FreshSnapshot<T> | null;
  readonly policy: FreshnessPolicy;
  readonly source: string;
  /**
   * Version carried by the incoming payload when the transport exposes one.
   * Must not regress below the accepted snapshot's version.
   */
  readonly incomingVersion?: number;
  readonly now: number;
 }
 /**
 * Validate and accept a fetched value as a snapshot, or invalidate it.
 *
 * Invalidation rules (each treated as unavailable, never rendered current):
 * - schema mismatch: the payload fails validation
 * - cross-workspace: the payload's workspace differs from the verified one
 * - version regression: payload/schema version is below the accepted one
 */
 export function acceptSnapshot<T>(options: AcceptSnapshotOptions<T>): AcceptSnapshotResult<T> {
  const payload = options.validate(options.value);
  if (payload === null) {
    return { outcome: 'invalidated', reason: 'schema-mismatch' };
  }
  // Workspace identity: the payload's own scope wins; a collection with no
  // intrinsic identity (e.g. an empty list after every project was deleted)
  // keeps the previously verified scope rather than resetting to the policy
  // default, so a legitimately empty response is not mistaken for a scope
  // change.
  const workspace = payload.workspace ?? options.previous?.workspace ?? options.policy.workspace;
  if (options.previous !== null && options.previous.workspace !== workspace) {
    return { outcome: 'invalidated', reason: 'cross-workspace' };
  }
  if (options.previous !== null && options.policy.schemaVersion < options.previous.schemaVersion) {
    return { outcome: 'invalidated', reason: 'version-regression' };
  }
  if (
    options.incomingVersion !== undefined &&
    options.previous !== null &&
    options.incomingVersion < options.previous.version
  ) {
    return { outcome: 'invalidated', reason: 'version-regression' };
  }
  const snapshot: FreshSnapshot<T> = {
    data: payload.data,
    source: options.source,
    workspace,
    version: options.incomingVersion ?? (options.previous?.version ?? 0) + 1,
    schemaVersion: options.policy.schemaVersion,
    fetchedAt: options.now,
    digest: computeDigest(payload.data),
  };
  return { outcome: 'accepted', snapshot };
 }
 export interface ComputeFreshnessOptions {
  readonly snapshot: FreshSnapshot<unknown> | null;
  readonly policy: FreshnessPolicy;
  readonly now: number;
  /**
   * True when the snapshot cannot be trusted as current regardless of age:
   * the latest revalidation failed, or the snapshot was restored from cache
   * and has not been verified by a fetch in this session.
   */
  readonly degraded?: boolean;
 }
 /**
 * Compute the freshness state of a snapshot. A missing snapshot is
 * `unavailable` (never "empty and healthy"); a degraded or aged snapshot is
 * `stale` (situational awareness only).
 */
 export function computeFreshness(options: ComputeFreshnessOptions): FreshnessState {
  const { snapshot, policy, now, degraded = false } = options;
  if (snapshot === null) return 'unavailable';
  if (degraded) return 'stale';
  if (now - snapshot.fetchedAt > policy.staleAfterMs) return 'stale';
  return 'current';
 }
 /** Only verified-current data may back a state-changing action. */
 export function canMutate(state: FreshnessState): boolean {
  return state === 'current';
 }
 /** Defense in depth: reject the mutation call itself on non-current data. */
 export function assertMutable(state: FreshnessState): void {
  if (!canMutate(state)) {
    throw new StaleMutationError(state);
  }
 }
 /**
 * Combine freshness across a multi-collection surface (primary + secondaries).
 * The primary collection gates the surface: unknown while it loads,
 * unavailable when it fails. Missing secondaries degrade the surface to
 * `partial`; aged collections degrade it to `stale`.
 */
 export function combineFreshness(
  primary: FreshnessState,
  secondaries: readonly FreshnessState[],
 ): FreshnessState {
  if (primary === 'unavailable') return 'unavailable';
  if (primary === 'unknown') return 'unknown';
  if (secondaries.includes('unavailable')) return 'partial';
  if (secondaries.includes('unknown')) return 'unknown';
  if (secondaries.includes('stale') || primary === 'stale') return 'stale';
  if (secondaries.includes('partial')) return 'partial';
  return 'current';
 }
 /** Render-safe age label for snapshot provenance. */
 export function formatAge(fetchedAt: number, now: number): string {
  const ageMs = Math.max(0, now - fetchedAt);
  if (ageMs < 10_000) return 'just now';
  const minutes = Math.floor(ageMs / 60_000);
  if (minutes < 1) return 'under a minute ago';
  if (minutes < 60) return `${minutes}m ago`;
  const hours = Math.floor(minutes / 60);
  if (hours < 24) return `${hours}h ago`;
  const days = Math.floor(hours / 24);
  return `${days}d ago`;
 }
 /** Derived verdict placeholder for non-current inputs — never a green value. */
 export const UNKNOWN_VERDICT = '?';
 export function verdictValue(verified: boolean, value: string): string {
  return verified ? value : UNKNOWN_VERDICT;
 }
@@ -1,197 +0,0 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from './model';
 import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
 import { validateProjectCollection, validateTaskCollection } from './validators';
 import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
 import type { Project, Task } from '@/lib/types';
 const KEY = 'test:tasks';
 const NOW = 1_800_000_000_000;
 const policy = { ...DEFAULT_FRESHNESS_POLICY, staleAfterMs: 60_000 };
 function storedTaskSnapshot() {
  const result = acceptSnapshot({
    value: taskFixtures,
    validate: validateTaskCollection,
    previous: null,
    policy,
    source: 'gateway:/api/tasks',
    now: NOW,
  });
  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
  return result.snapshot;
 }
 function storedProjectSnapshot() {
  const result = acceptSnapshot({
    value: projectFixtures,
    validate: validateProjectCollection,
    previous: null,
    policy,
    source: 'gateway:/api/projects',
    now: NOW,
  });
  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
  return result.snapshot;
 }
 function readTasks() {
  return readSnapshotCache({
    key: KEY,
    workspace: policy.workspace,
    policy,
    validate: validateTaskCollection,
  });
 }
 /** Write an arbitrary value directly at the raw cache slot. */
 function writeRaw(key: string, value: unknown): void {
  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify(value));
 }
 /** Parse and re-write the stored entry (for tampering with internals). */
 function tamperStored<T>(key: string, mutate: (stored: T) => void): void {
  const parsed = JSON.parse(sessionStorage.getItem(`mosaic:freshness:v1:${key}`) ?? '{}') as T;
  mutate(parsed);
  writeRaw(key, parsed);
 }
 beforeEach(() => {
  sessionStorage.clear();
 });
 afterEach(() => {
  sessionStorage.clear();
 });
 describe('readSnapshotCache', () => {
  it('misses when nothing is stored', () => {
    expect(readTasks()).toEqual({ outcome: 'miss' });
  });
  it('hits for a well-formed entry and preserves provenance', () => {
    const snapshot = storedTaskSnapshot();
    writeSnapshotCache(KEY, snapshot);
    const result = readTasks();
    expect(result.outcome).toBe('hit');
    if (result.outcome === 'hit') {
      expect(result.snapshot.data).toEqual(taskFixtures);
      expect(result.snapshot.source).toBe('gateway:/api/tasks');
      expect(result.snapshot.version).toBe(snapshot.version);
      expect(result.snapshot.fetchedAt).toBe(snapshot.fetchedAt);
      expect(result.snapshot.workspace).toBe(snapshot.workspace);
    }
  });
  it('invalidates unparsable entries as cache corruption', () => {
    sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, '{not json');
    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
  });
  it('invalidates structurally wrong entries as cache corruption', () => {
    const malformed: unknown[] = [
      'nested but not a snapshot',
      { data: taskFixtures }, // missing provenance fields
      {
        data: taskFixtures,
        source: 1,
        workspace: 'w',
        version: 1,
        schemaVersion: 1,
        fetchedAt: 1,
        digest: 'x',
      },
      null,
      17,
    ];
    for (const entry of malformed) {
      writeRaw(KEY, entry);
      expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
    }
  });
  it('invalidates digest mismatches as cache corruption (tampered data)', () => {
    writeSnapshotCache(KEY, storedTaskSnapshot());
    tamperStored<{ data: Task[] }>(KEY, (stored) => {
      stored.data = [...stored.data, { ...stored.data[0]!, id: 'injected-task' }];
    });
    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cache-corruption' });
  });
  it('invalidates entries scoped to another workspace', () => {
    const snapshot = storedTaskSnapshot();
    writeSnapshotCache(KEY, { ...snapshot, workspace: 'someone-else' });
    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
  });
  it('invalidates entries written by a newer schema as a version regression', () => {
    const snapshot = storedTaskSnapshot();
    writeSnapshotCache(KEY, { ...snapshot, schemaVersion: policy.schemaVersion + 1 });
    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'version-regression' });
  });
  it('invalidates entries whose data no longer validates (schema mismatch)', () => {
    writeSnapshotCache(KEY, storedTaskSnapshot());
    tamperStored<{ data: unknown }>(KEY, (stored) => {
      stored.data = { malformed: true };
    });
    expect(readTasks()).toEqual({ outcome: 'invalidated', reason: 'schema-mismatch' });
  });
  it('never reports a corrupted raw entry as a hit (negative control)', () => {
    for (const raw of ['{oops', 'null', '"string"', '[]', '12']) {
      sessionStorage.setItem(`mosaic:freshness:v1:${KEY}`, raw);
      const result = readTasks();
      expect(result.outcome).not.toBe('hit');
      expect(result.outcome).toBe('invalidated');
    }
  });
  it('scopes project collections by their workspace identity', () => {
    const snapshot = storedProjectSnapshot();
    writeSnapshotCache('test:projects', snapshot);
    const sameScope = readSnapshotCache({
      key: 'test:projects',
      workspace: 'user-1',
      policy,
      validate: validateProjectCollection,
    });
    expect(sameScope.outcome).toBe('hit');
    const foreignScope = readSnapshotCache({
      key: 'test:projects',
      workspace: 'user-2',
      policy,
      validate: validateProjectCollection,
    });
    expect(foreignScope).toEqual({ outcome: 'invalidated', reason: 'cross-workspace' });
  });
 });
 describe('writeSnapshotCache round-trip', () => {
  it('round-trips an accepted project snapshot', () => {
    const snapshot = storedProjectSnapshot();
    writeSnapshotCache('test:projects', snapshot);
    const result = readSnapshotCache({
      key: 'test:projects',
      workspace: snapshot.workspace,
      policy,
      validate: validateProjectCollection,
    });
    expect(result.outcome).toBe('hit');
    if (result.outcome === 'hit') {
      expect(result.snapshot.data).toEqual(projectFixtures as Project[]);
    }
  });
 });
 describe('clearSnapshotCache', () => {
  it('drops the entry so the next read misses', () => {
    writeSnapshotCache(KEY, storedTaskSnapshot());
    expect(readTasks().outcome).toBe('hit');
    clearSnapshotCache(KEY);
    expect(readTasks()).toEqual({ outcome: 'miss' });
  });
 });
@@ -1,154 +0,0 @@
 import {
  computeDigest,
  type FreshPayload,
  type FreshSnapshot,
  type FreshnessPolicy,
  type InvalidationReason,
 } from './model';
 /**
 * Session-scoped last-known snapshot cache (RI-5-001).
 *
 * Restored snapshots are situational awareness only: they surface as `stale`
 * until a fetch re-verifies them. A cache entry that is corrupted, belongs to
 * another workspace, was written by a newer schema, or no longer validates is
 * invalidated (treated as unavailable, never rendered as current).
 */
 const CACHE_PREFIX = 'mosaic:freshness:v1';
 interface StoredSnapshot {
  data: unknown;
  source: string;
  workspace: string;
  version: number;
  schemaVersion: number;
  fetchedAt: number;
  digest: string;
 }
 export type SnapshotCacheRead<T> =
  | { readonly outcome: 'hit'; readonly snapshot: FreshSnapshot<T> }
  | { readonly outcome: 'miss' }
  | { readonly outcome: 'invalidated'; readonly reason: InvalidationReason };
 export interface ReadSnapshotCacheOptions<T> {
  readonly key: string;
  readonly workspace: string;
  readonly policy: FreshnessPolicy;
  readonly validate: (value: unknown) => FreshPayload<T> | null;
 }
 function cacheKey(key: string): string {
  return `${CACHE_PREFIX}:${key}`;
 }
 function isStoredSnapshot(value: unknown): value is StoredSnapshot {
  if (typeof value !== 'object' || value === null) return false;
  const candidate = value as Record<string, unknown>;
  return (
    typeof candidate['data'] === 'object' &&
    candidate['data'] !== null &&
    typeof candidate['source'] === 'string' &&
    typeof candidate['workspace'] === 'string' &&
    typeof candidate['version'] === 'number' &&
    typeof candidate['schemaVersion'] === 'number' &&
    typeof candidate['fetchedAt'] === 'number' &&
    typeof candidate['digest'] === 'string'
  );
 }
 function getStorage(): Storage | null {
  try {
    return globalThis.sessionStorage ?? null;
  } catch {
    return null;
  }
 }
 /**
 * Restore a cached snapshot under the active workspace scope. Every failure
 * mode maps to an explicit invalidation reason or a miss — never to data
 * that renders as current.
 */
 export function readSnapshotCache<T>(options: ReadSnapshotCacheOptions<T>): SnapshotCacheRead<T> {
  const storage = getStorage();
  if (storage === null) return { outcome: 'miss' };
  let raw: string | null;
  try {
    raw = storage.getItem(cacheKey(options.key));
  } catch {
    return { outcome: 'miss' };
  }
  if (raw === null) return { outcome: 'miss' };
  let parsed: unknown;
  try {
    parsed = JSON.parse(raw);
  } catch {
    return { outcome: 'invalidated', reason: 'cache-corruption' };
  }
  if (!isStoredSnapshot(parsed)) {
    return { outcome: 'invalidated', reason: 'cache-corruption' };
  }
  if (parsed.workspace !== options.workspace) {
    return { outcome: 'invalidated', reason: 'cross-workspace' };
  }
  if (parsed.schemaVersion > options.policy.schemaVersion) {
    // Written by a newer build than the running client: version regression.
    return { outcome: 'invalidated', reason: 'version-regression' };
  }
  const payload = options.validate(parsed.data);
  if (payload === null) {
    return { outcome: 'invalidated', reason: 'schema-mismatch' };
  }
  if (computeDigest(payload.data) !== parsed.digest) {
    return { outcome: 'invalidated', reason: 'cache-corruption' };
  }
  return {
    outcome: 'hit',
    snapshot: {
      data: payload.data,
      source: parsed.source,
      workspace: parsed.workspace,
      version: parsed.version,
      schemaVersion: parsed.schemaVersion,
      fetchedAt: parsed.fetchedAt,
      digest: parsed.digest,
    },
  };
 }
 /** Persist a verified snapshot. Failures are non-fatal (cache is best-effort). */
 export function writeSnapshotCache<T>(key: string, snapshot: FreshSnapshot<T>): void {
  const storage = getStorage();
  if (storage === null) return;
  const stored: StoredSnapshot = {
    data: snapshot.data,
    source: snapshot.source,
    workspace: snapshot.workspace,
    version: snapshot.version,
    schemaVersion: snapshot.schemaVersion,
    fetchedAt: snapshot.fetchedAt,
    digest: snapshot.digest,
  };
  try {
    storage.setItem(cacheKey(key), JSON.stringify(stored));
  } catch {
    // Quota or serialization failures simply skip caching.
  }
 }
 /** Drop a cached snapshot (used when a surface invalidates its cache entry). */
 export function clearSnapshotCache(key: string): void {
  const storage = getStorage();
  if (storage === null) return;
  try {
    storage.removeItem(cacheKey(key));
  } catch {
    // Ignorable: a wedged storage entry is detected as corruption on read.
  }
 }
@@ -1,372 +0,0 @@
 import { act } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Task } from '@/lib/types';
 import { acceptSnapshot, StaleMutationError, DEFAULT_FRESHNESS_POLICY } from './model';
 import type { FreshnessFailure } from './use-fresh-collection';
 import {
  describeFailure,
  useFreshCollection,
  type FreshCollection,
  type UseFreshCollectionOptions,
 } from './use-fresh-collection';
 import { validateProjectCollection, validateTaskCollection } from './validators';
 import { projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
 /**
 * Failure-matrix coverage for the freshness seam (RI-5-001): network failure,
 * auth failure, malformed response, cache corruption, stale age, schema
 * mismatch, cross-workspace, recovery, and stale-action rejection — with
 * negative controls proving no case yields current data or an enabled
 * mutation.
 */
 const NOW = 1_800_000_000_000;
 interface Deferred<T> {
  promise: Promise<T>;
  resolve: (value: T) => void;
  reject: (reason?: unknown) => void;
 }
 function createDeferred<T>(): Deferred<T> {
  let resolve!: (value: T) => void;
  let reject!: (reason?: unknown) => void;
  const promise = new Promise<T>((res, rej) => {
    resolve = res;
    reject = rej;
  });
  return { promise, resolve, reject };
 }
 let root: Root | null = null;
 let container: HTMLDivElement;
 let latest: FreshCollection<Task[]> | null = null;
 function Probe({
  options,
 }: {
  options: UseFreshCollectionOptions<Task[]>;
 }): React.ReactElement | null {
  latest = useFreshCollection<Task[]>(options);
  return null;
 }
 beforeAll(() => {
  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
    configurable: true,
    value: true,
  });
 });
 beforeEach(() => {
  sessionStorage.clear();
 });
 afterEach(async () => {
  await act(async () => {
    root?.unmount();
  });
  document.body.replaceChildren();
  root = null;
  latest = null;
  sessionStorage.clear();
  vi.restoreAllMocks();
 });
 async function renderCollection(
  options: UseFreshCollectionOptions<Task[]>,
 ): Promise<FreshCollection<Task[]>> {
  container = document.createElement('div');
  document.body.append(container);
  root = createRoot(container);
  await act(async () => {
    root?.render(<Probe options={options} />);
  });
  if (latest === null) throw new Error('hook did not run');
  return latest;
 }
 function taskOptions(
  overrides: Partial<UseFreshCollectionOptions<Task[]>> = {},
 ): UseFreshCollectionOptions<Task[]> {
  return {
    source: 'gateway:/api/tasks',
    fetcher: () => Promise.resolve(taskFixtures),
    validate: validateTaskCollection,
    cacheKey: 'tasks',
    clock: () => NOW,
    ...overrides,
  };
 }
 function authError(statusCode: number): Error & { statusCode: number } {
  return Object.assign(new Error(`Request failed with ${statusCode}`), { statusCode });
 }
 function seedCache(key: string): number {
  const result = acceptSnapshot({
    value: taskFixtures,
    validate: validateTaskCollection,
    previous: null,
    policy: DEFAULT_FRESHNESS_POLICY,
    source: 'gateway:/api/tasks',
    now: NOW,
  });
  if (result.outcome !== 'accepted') throw new Error('fixture setup failed');
  sessionStorage.setItem(`mosaic:freshness:v1:${key}`, JSON.stringify({ ...result.snapshot }));
  return result.snapshot.version;
 }
 describe('useFreshCollection failure matrix', () => {
  it('is unknown (not empty) while the first validation is in flight', async () => {
    const deferred = createDeferred<Task[]>();
    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
    expect(collection.freshness).toBe('unknown');
    expect(collection.validating).toBe(true);
    expect(collection.data).toBeNull();
    expect(collection.canMutate).toBe(false);
    await act(async () => {
      deferred.resolve(taskFixtures);
      await deferred.promise;
    });
  });
  it('becomes current with provenance after a verified fetch', async () => {
    const collection = await renderCollection(taskOptions());
    expect(collection.freshness).toBe('current');
    expect(collection.data).toEqual(taskFixtures);
    expect(collection.snapshot?.source).toBe('gateway:/api/tasks');
    expect(collection.snapshot?.version).toBe(1);
    expect(collection.failure).toBeNull();
    expect(collection.canMutate).toBe(true);
    // Verified snapshot is persisted for last-known restore.
    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeTruthy();
  });
  it('treats a network failure as unavailable — never an empty healthy collection', async () => {
    const collection = await renderCollection(
      taskOptions({ fetcher: () => Promise.reject(new Error('network down')) }),
    );
    expect(collection.freshness).toBe('unavailable');
    expect(collection.data).toBeNull();
    expect(collection.failure).toEqual({ kind: 'fetch', message: 'network down' });
    expect(collection.canMutate).toBe(false);
    expect(describeFailure(collection.failure)).toBe('network down');
  });
  it('treats an auth failure as unavailable and drops the last-known snapshot', async () => {
    let call = 0;
    const collection = await renderCollection(
      taskOptions({
        fetcher: () => {
          call += 1;
          return call === 1 ? Promise.resolve(taskFixtures) : Promise.reject(authError(401));
        },
      }),
    );
    expect(collection.freshness).toBe('current');
    await act(async () => {
      await collection.revalidate();
    });
    expect(latest?.freshness).toBe('unavailable');
    expect(latest?.data).toBeNull();
    expect(latest?.failure?.kind).toBe('fetch');
    // The previous user's data must not linger in the session cache.
    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
  });
  it('invalidates a malformed response as a schema mismatch', async () => {
    const collection = await renderCollection(
      taskOptions({ fetcher: () => Promise.resolve({ malformed: true }) }),
    );
    expect(collection.freshness).toBe('unavailable');
    expect(collection.data).toBeNull();
    expect(collection.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
    expect(collection.canMutate).toBe(false);
  });
  it('keeps the previous snapshot as labeled stale when a later payload mismatches', async () => {
    let call = 0;
    const collection = await renderCollection(
      taskOptions({
        fetcher: () => {
          call += 1;
          return call === 1 ? Promise.resolve(taskFixtures) : Promise.resolve('garbage');
        },
      }),
    );
    expect(collection.freshness).toBe('current');
    await act(async () => {
      await collection.revalidate();
    });
    expect(latest?.freshness).toBe('stale');
    expect(latest?.data).toEqual(taskFixtures);
    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'schema-mismatch' });
    expect(latest?.canMutate).toBe(false);
  });
  it('drops the snapshot when the workspace changes under it (cross-workspace)', async () => {
    let call = 0;
    const collection = await renderCollection(
      taskOptions({
        fetcher: () => {
          call += 1;
          return Promise.resolve(
            call === 1 ? projectFixtures : [{ ...projectFixtures[0], userId: 'user-2' }],
          );
        },
        validate: validateProjectCollection as unknown as (value: unknown) => {
          data: Task[];
          workspace: string | null;
        },
        source: 'gateway:/api/projects',
      }),
    );
    expect(collection.freshness).toBe('current');
    await act(async () => {
      await collection.revalidate();
    });
    expect(latest?.freshness).toBe('unavailable');
    expect(latest?.data).toBeNull();
    expect(latest?.failure).toEqual({ kind: 'invalidated', reason: 'cross-workspace' });
  });
  it('ages from current to stale and refuses mutations on stale data', async () => {
    let fakeNow = NOW;
    const collection = await renderCollection(
      taskOptions({
        clock: () => fakeNow,
        policy: { staleAfterMs: 40 },
        tickMs: 10,
      }),
    );
    expect(collection.freshness).toBe('current');
    // Age the snapshot past the policy and let the tick recompute.
    fakeNow = NOW + 60;
    await act(async () => {
      await new Promise((resolve) => setTimeout(resolve, 25));
    });
    expect(latest?.freshness).toBe('stale');
    expect(latest?.data).toEqual(taskFixtures);
    expect(latest?.canMutate).toBe(false);
    const operation = vi.fn(async () => 'result');
    await expect(latest?.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
    expect(operation).not.toHaveBeenCalled();
  });
  it('recovers to current after a successful revalidation', async () => {
    let call = 0;
    const collection = await renderCollection(
      taskOptions({
        fetcher: () => {
          call += 1;
          return call === 1
            ? Promise.reject(new Error('first attempt failed'))
            : Promise.resolve(taskFixtures);
        },
      }),
    );
    expect(collection.freshness).toBe('unavailable');
    await act(async () => {
      await collection.revalidate();
    });
    expect(latest?.freshness).toBe('current');
    expect(latest?.failure).toBeNull();
    const operation = vi.fn(async (data: Task[]) => data.length);
    await expect(latest?.mutate(operation)).resolves.toBe(taskFixtures.length);
    expect(operation).toHaveBeenCalledOnce();
  });
  it('restores a cached snapshot as unverified stale data, then verifies it', async () => {
    const seededVersion = seedCache('tasks');
    const deferred = createDeferred<Task[]>();
    const collection = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
    // Restored data is situational awareness only: labeled stale, never
    // current, and mutations are refused before verification.
    expect(collection.freshness).toBe('stale');
    expect(collection.data).toEqual(taskFixtures);
    expect(collection.canMutate).toBe(false);
    await expect(collection.mutate(vi.fn())).rejects.toBeInstanceOf(StaleMutationError);
    await act(async () => {
      deferred.resolve(taskFixtures);
      await deferred.promise;
    });
    expect(latest?.freshness).toBe('current');
    expect(latest?.snapshot?.version).toBe(seededVersion + 1);
  });
  it('never promotes corrupted cache data to current (cache corruption)', async () => {
    sessionStorage.setItem('mosaic:freshness:v1:tasks', '{"data":');
    const collection = await renderCollection(
      taskOptions({ fetcher: () => Promise.reject(new Error('still down')) }),
    );
    expect(collection.freshness).toBe('unavailable');
    expect(collection.data).toBeNull();
    expect(collection.canMutate).toBe(false);
    // The corrupted entry is dropped so it cannot come back.
    expect(sessionStorage.getItem('mosaic:freshness:v1:tasks')).toBeNull();
  });
  it('refuses mutations while unknown or unavailable — the call itself, not just the button', async () => {
    const deferred = createDeferred<Task[]>();
    const unknown = await renderCollection(taskOptions({ fetcher: () => deferred.promise }));
    const operation = vi.fn(async () => 'result');
    await expect(unknown.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
    expect(operation).not.toHaveBeenCalled();
    await act(async () => {
      deferred.reject(new Error('failed'));
      await deferred.promise.catch(() => undefined);
    });
    const unavailable = latest!;
    await expect(unavailable.mutate(operation)).rejects.toBeInstanceOf(StaleMutationError);
    expect(operation).not.toHaveBeenCalled();
    expect(unavailable.canMutate).toBe(false);
  });
  it('degrades to stale with last-known data when a revalidation fails after success', async () => {
    let call = 0;
    const collection = await renderCollection(
      taskOptions({
        fetcher: () => {
          call += 1;
          return call === 1
            ? Promise.resolve(taskFixtures)
            : Promise.reject(new Error('connection lost'));
        },
      }),
    );
    expect(collection.freshness).toBe('current');
    await act(async () => {
      await collection.revalidate();
    });
    expect(latest?.freshness).toBe('stale');
    expect(latest?.data).toEqual(taskFixtures);
    const failure: FreshnessFailure | null = latest?.failure ?? null;
    expect(failure).toEqual({ kind: 'fetch', message: 'connection lost' });
  });
 });
@@ -1,281 +0,0 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import {
  acceptSnapshot,
  assertMutable,
  computeFreshness,
  DEFAULT_FRESHNESS_POLICY,
  invalidationReasonLabels,
  type FreshPayload,
  type FreshSnapshot,
  type FreshnessPolicy,
  type FreshnessState,
  type InvalidationReason,
  StaleMutationError,
 } from './model';
 import { clearSnapshotCache, readSnapshotCache, writeSnapshotCache } from './snapshot-cache';
 /**
 * Freshness-aware collection fetch hook (RI-5-001).
 *
 * One hook owns one gateway collection end to end: fetch, schema validation,
 * snapshot acceptance with provenance, session-scoped last-known caching,
 * aging, and the mutation guard. Pages consume `freshness` and never infer
 * health from emptiness.
 */
 /** Why the latest validation did not produce a current snapshot. */
 export type FreshnessFailure =
  | { readonly kind: 'fetch'; readonly message: string }
  | { readonly kind: 'invalidated'; readonly reason: InvalidationReason };
 export interface UseFreshCollectionOptions<T> {
  /** Source identity for provenance labels, e.g. `gateway:/api/tasks`. */
  readonly source: string;
  /** Performs the unvalidated fetch. The hook owns abort and verification. */
  readonly fetcher: (signal: AbortSignal) => Promise<unknown>;
  /**
   * Runtime schema validator. Returning `null` invalidates the payload
   * (`schema-mismatch`) instead of letting malformed JSON flow into render.
   */
  readonly validate: (value: unknown) => FreshPayload<T> | null;
  /** Overrides of the default freshness policy. */
  readonly policy?: Partial<FreshnessPolicy>;
  /**
   * Session cache key for last-known snapshots. `null`/omitted disables
   * restore. Restored snapshots are unverified: they render only as
   * labeled `stale` data until a fetch re-verifies them.
   */
  readonly cacheKey?: string | null;
  /** Injectable clock for deterministic age transitions in tests. */
  readonly clock?: () => number;
  /** Aging tick interval override (default derived from `staleAfterMs`). */
  readonly tickMs?: number;
  /** When false, no fetch runs (surfaces stay `unavailable`/`unknown`). */
  readonly enabled?: boolean;
 }
 export interface FreshCollection<T> {
  /** Last verified (or restored-unverified) snapshot, or `null`. */
  readonly snapshot: FreshSnapshot<T> | null;
  /** Snapshot data or `null` — never a fabricated empty collection. */
  readonly data: T | null;
  readonly freshness: FreshnessState;
  /** True while a validation request is in flight. */
  readonly validating: boolean;
  /** Outcome of the latest failed validation, `null` when healthy. */
  readonly failure: FreshnessFailure | null;
  /** False unless freshness is `current`; drives disabled UI affordances. */
  readonly canMutate: boolean;
  /** Re-run the fetch and re-verify. Always allowed (it is a read). */
  readonly revalidate: () => Promise<void>;
  /**
   * Run a state-changing operation against verified-current data only.
   * Rejects with `StaleMutationError` on any other state — the guard fires
   * even if a disabled button was bypassed (defense in depth).
   */
  readonly mutate: <R>(operation: (data: T) => Promise<R>) => Promise<R>;
 }
 const defaultClock = (): number => Date.now();
 function resolveTickMs(policy: FreshnessPolicy, override?: number): number {
  if (override !== undefined && override > 0) return override;
  return Math.min(5_000, Math.max(250, Math.floor(policy.staleAfterMs / 4)));
 }
 function isAuthFailure(caught: unknown): boolean {
  return (
    typeof caught === 'object' &&
    caught !== null &&
    'statusCode' in caught &&
    ((caught as { statusCode?: unknown }).statusCode === 401 ||
      (caught as { statusCode?: unknown }).statusCode === 403)
  );
 }
 function fetchFailureMessage(caught: unknown): string {
  if (caught instanceof Error && caught.message.trim().length > 0) return caught.message;
  return 'The request failed.';
 }
 /** Human-readable summary of a failure for unavailable/stale notices. */
 export function describeFailure(failure: FreshnessFailure | null): string | null {
  if (failure === null) return null;
  if (failure.kind === 'fetch') return failure.message;
  return `The snapshot was invalidated: ${invalidationReasonLabels[failure.reason]}.`;
 }
 export function useFreshCollection<T>(options: UseFreshCollectionOptions<T>): FreshCollection<T> {
  const optionsRef = useRef(options);
  optionsRef.current = options;
  const policy = useMemo<FreshnessPolicy>(
    () => ({ ...DEFAULT_FRESHNESS_POLICY, ...options.policy }),
    [options.policy],
  );
  const policyRef = useRef(policy);
  policyRef.current = policy;
  const clockRef = useRef(options.clock ?? defaultClock);
  clockRef.current = options.clock ?? defaultClock;
  const [snapshot, setSnapshot] = useState<FreshSnapshot<T> | null>(null);
  const [failure, setFailure] = useState<FreshnessFailure | null>(null);
  const [unverified, setUnverified] = useState(false);
  const [validating, setValidating] = useState(options.enabled !== false);
  const [now, setNow] = useState(() => (options.clock ?? defaultClock)());
  const snapshotRef = useRef(snapshot);
  snapshotRef.current = snapshot;
  const failureRef = useRef(failure);
  failureRef.current = failure;
  const unverifiedRef = useRef(unverified);
  unverifiedRef.current = unverified;
  const runRef = useRef(0);
  const abortRef = useRef<AbortController | null>(null);
  const revalidate = useCallback(async (): Promise<void> => {
    const current = optionsRef.current;
    if (current.enabled === false) {
      setValidating(false);
      return;
    }
    const runId = ++runRef.current;
    abortRef.current?.abort();
    const controller = new AbortController();
    abortRef.current = controller;
    setValidating(true);
    let value: unknown;
    try {
      value = await current.fetcher(controller.signal);
    } catch (caught) {
      if (runRef.current !== runId || controller.signal.aborted) return;
      if (isAuthFailure(caught)) {
        // An unauthenticated viewer must not keep (or be served) the
        // previous user's last-known data.
        setSnapshot(null);
        setUnverified(false);
        if (current.cacheKey) clearSnapshotCache(current.cacheKey);
      }
      setFailure({ kind: 'fetch', message: fetchFailureMessage(caught) });
      setValidating(false);
      return;
    }
    if (runRef.current !== runId) return;
    const result = acceptSnapshot({
      value,
      validate: current.validate,
      previous: snapshotRef.current,
      policy: policyRef.current,
      source: current.source,
      now: clockRef.current(),
    });
    if (result.outcome === 'accepted') {
      setSnapshot(result.snapshot);
      setUnverified(false);
      setFailure(null);
      if (current.cacheKey) writeSnapshotCache(current.cacheKey, result.snapshot);
    } else {
      if (result.reason === 'cross-workspace') {
        // Data verified for a different workspace must not linger as
        // last-known situational awareness either.
        setSnapshot(null);
        setUnverified(false);
      }
      if (current.cacheKey) clearSnapshotCache(current.cacheKey);
      setFailure({ kind: 'invalidated', reason: result.reason });
    }
    setValidating(false);
  }, []);
  // Restore the last-known snapshot (unverified) and run the first fetch.
  useEffect(() => {
    if (optionsRef.current.enabled === false) {
      setValidating(false);
      return;
    }
    const cacheKey = optionsRef.current.cacheKey;
    if (cacheKey) {
      const restored = readSnapshotCache<T>({
        key: cacheKey,
        workspace: policyRef.current.workspace,
        policy: policyRef.current,
        validate: optionsRef.current.validate,
      });
      if (restored.outcome === 'hit') {
        setSnapshot(restored.snapshot);
        setUnverified(true);
      } else if (restored.outcome === 'invalidated') {
        // A corrupted/foreign/regressed entry is dropped immediately; it must
        // never surface as data. The fetch decides the visible state.
        clearSnapshotCache(cacheKey);
      }
    }
    void revalidate();
    return () => {
      abortRef.current?.abort();
    };
    // Mount-once by design: `revalidate` is stable and reads live options
    // through refs, so it never needs to re-run when options change.
    // Route-param pages remount this hook via an identity `key` instead.
  }, [revalidate]);
  // Aging tick: recomputes freshness as the snapshot ages past the policy.
  useEffect(() => {
    const interval = setInterval(
      () => {
        setNow(clockRef.current());
      },
      resolveTickMs(policyRef.current, optionsRef.current.tickMs),
    );
    return () => clearInterval(interval);
  }, []);
  const freshness = useMemo<FreshnessState>(() => {
    if (snapshot === null) return validating ? 'unknown' : 'unavailable';
    return computeFreshness({
      snapshot,
      policy,
      now,
      degraded: failure !== null || unverified,
    });
    // `now` from state covers age; refs inside computeFreshness are pure.
  }, [snapshot, validating, failure, unverified, now, policy]);
  const canMutate = freshness === 'current';
  const mutate = useCallback(async <R>(operation: (data: T) => Promise<R>): Promise<R> => {
    const currentSnapshot = snapshotRef.current;
    // No verified snapshot at all: with nothing verified there is nothing
    // current to mutate, regardless of the recorded failure.
    if (currentSnapshot === null) throw new StaleMutationError('unavailable');
    const state = computeFreshness({
      snapshot: currentSnapshot,
      policy: policyRef.current,
      now: clockRef.current(),
      degraded: failureRef.current !== null || unverifiedRef.current,
    });
    assertMutable(state);
    return operation(currentSnapshot.data);
  }, []);
  return {
    snapshot,
    data: snapshot === null ? null : snapshot.data,
    freshness,
    validating,
    failure,
    canMutate,
    revalidate,
    mutate,
  };
 }
@@ -1,103 +0,0 @@
 import { describe, expect, it } from 'vitest';
 import type { Mission, Project, Task } from '@/lib/types';
 import {
  validateMissionCollection,
  validateProjectCollection,
  validateProjectEntity,
  validateTaskCollection,
 } from './validators';
 import { missionFixtures, projectFixtures, taskFixtures } from '@/spa/pages/page-fixtures';
 describe('validateTaskCollection', () => {
  it('accepts a well-formed task collection', () => {
    expect(validateTaskCollection(taskFixtures)).toEqual({
      data: taskFixtures,
      workspace: null,
    });
  });
  it('accepts an empty collection (a healthy empty state is a valid payload)', () => {
    expect(validateTaskCollection([])).toEqual({ data: [], workspace: null });
  });
  it.each([
    ['not an array', { items: [] }],
    ['item is not an object', ['nope']],
    ['missing id', [{ ...(taskFixtures[0] as Task), id: undefined }]],
    ['missing title', [{ ...(taskFixtures[0] as Task), title: undefined }]],
    ['unknown status enum', [{ ...(taskFixtures[0] as Task), status: 'finished' }]],
    ['unknown priority enum', [{ ...(taskFixtures[0] as Task), priority: 'urgent' }]],
    ['tags of the wrong type', [{ ...(taskFixtures[0] as Task), tags: 'spa' }]],
    ['metadata of the wrong type', [{ ...(taskFixtures[0] as Task), metadata: 'notes' }]],
    ['createdAt of the wrong type', [{ ...(taskFixtures[0] as Task), createdAt: 1234 }]],
    ['null sneaks past a required string', [{ ...(taskFixtures[0] as Task), title: null }]],
  ])('rejects a malformed payload: %s', (_label, value) => {
    expect(validateTaskCollection(value)).toBeNull();
  });
 });
 describe('validateMissionCollection', () => {
  it('accepts a well-formed mission collection', () => {
    expect(validateMissionCollection(missionFixtures)).toEqual({
      data: missionFixtures,
      workspace: null,
    });
  });
  it.each([
    ['not an array', null],
    ['item missing name', [{ ...(missionFixtures[0] as Mission), name: 42 }]],
    ['unknown status enum', [{ ...(missionFixtures[0] as Mission), status: 'canceled' }]],
    ['projectId of the wrong type', [{ ...(missionFixtures[0] as Mission), projectId: 7 }]],
  ])('rejects a malformed payload: %s', (_label, value) => {
    expect(validateMissionCollection(value)).toBeNull();
  });
 });
 describe('validateProjectCollection', () => {
  it('accepts a uniform workspace-scoped collection and reports its workspace', () => {
    expect(validateProjectCollection(projectFixtures)).toEqual({
      data: projectFixtures,
      workspace: 'user-1',
    });
  });
  it('accepts an empty collection with no workspace identity', () => {
    expect(validateProjectCollection([])).toEqual({ data: [], workspace: null });
  });
  it.each([
    ['not an array', 42],
    ['item missing userId', [{ ...(projectFixtures[0] as Project), userId: undefined }]],
    ['unknown status enum', [{ ...(projectFixtures[0] as Project), status: 'live' }]],
    ['description of the wrong type', [{ ...(projectFixtures[0] as Project), description: 1 }]],
  ])('rejects a malformed payload: %s', (_label, value) => {
    expect(validateProjectCollection(value)).toBeNull();
  });
  it('rejects a collection mixing workspace identities (cross-workspace leak)', () => {
    const mixed = [
      projectFixtures[0] as Project,
      { ...(projectFixtures[1] as Project), userId: 'user-2' },
    ];
    expect(validateProjectCollection(mixed)).toBeNull();
  });
 });
 describe('validateProjectEntity', () => {
  it('accepts a well-formed project and reports its workspace', () => {
    expect(validateProjectEntity(projectFixtures[0])).toEqual({
      data: projectFixtures[0],
      workspace: 'user-1',
    });
  });
  it.each([
    ['not an object', 'project-1'],
    ['null', null],
    ['array', [projectFixtures[0]]],
    ['missing userId', [{ ...(projectFixtures[0] as Project), userId: null }]],
  ])('rejects a malformed entity: %s', (_label, value) => {
    expect(validateProjectEntity(value)).toBeNull();
  });
 });
@@ -1,135 +0,0 @@
 import type { Mission, Project, Task, MissionStatus, TaskPriority, TaskStatus } from '@/lib/types';
 import type { FreshPayload } from './model';
 /**
 * Runtime schema validators for gateway collections (RI-5-001).
 *
 * `api<T>()` returns untrusted JSON cast to `T`; these validators are the
 * seam where a malformed response becomes an explicit schema mismatch
 * instead of flowing into the render path as if it were healthy data.
 */
 const taskStatuses: readonly TaskStatus[] = [
  'not-started',
  'in-progress',
  'blocked',
  'done',
  'cancelled',
 ];
 const taskPriorities: readonly TaskPriority[] = ['critical', 'high', 'medium', 'low'];
 const missionStatuses: readonly MissionStatus[] = [
  'planning',
  'active',
  'paused',
  'completed',
  'failed',
 ];
 const projectStatuses: readonly Project['status'][] = ['active', 'paused', 'completed', 'archived'];
 function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 function isString(value: unknown): value is string {
  return typeof value === 'string';
 }
 function isNullableString(value: unknown): value is string | null {
  return value === null || typeof value === 'string';
 }
 function isOneOf<T extends string>(value: unknown, allowed: readonly T[]): value is T {
  return typeof value === 'string' && (allowed as readonly string[]).includes(value);
 }
 function isNullableRecord(value: unknown): value is Record<string, unknown> | null {
  return value === null || isRecord(value);
 }
 function isNullableStringArray(value: unknown): value is string[] | null {
  if (value === null) return true;
  if (!Array.isArray(value)) return false;
  return value.every((item) => typeof item === 'string');
 }
 function isIsoLike(value: unknown): value is string {
  return typeof value === 'string' && value.length > 0;
 }
 function isTask(value: unknown): value is Task {
  if (!isRecord(value)) return false;
  return (
    isString(value['id']) &&
    isString(value['title']) &&
    isOneOf(value['status'], taskStatuses) &&
    isOneOf(value['priority'], taskPriorities) &&
    isNullableString(value['projectId']) &&
    isNullableString(value['missionId']) &&
    isNullableString(value['assignee']) &&
    isNullableStringArray(value['tags']) &&
    isNullableRecord(value['metadata']) &&
    isNullableString(value['dueDate']) &&
    isIsoLike(value['createdAt']) &&
    isIsoLike(value['updatedAt'])
  );
 }
 /** Tasks carry no workspace identity; scope falls back to the policy. */
 export function validateTaskCollection(value: unknown): FreshPayload<Task[]> | null {
  if (!Array.isArray(value) || !value.every(isTask)) return null;
  return { data: value as Task[], workspace: null };
 }
 function isMission(value: unknown): value is Mission {
  if (!isRecord(value)) return false;
  return (
    isString(value['id']) &&
    isString(value['name']) &&
    isOneOf(value['status'], missionStatuses) &&
    isNullableString(value['projectId']) &&
    isNullableString(value['description']) &&
    isNullableRecord(value['metadata']) &&
    isIsoLike(value['createdAt']) &&
    isIsoLike(value['updatedAt'])
  );
 }
 /** Missions carry no workspace identity; scope falls back to the policy. */
 export function validateMissionCollection(value: unknown): FreshPayload<Mission[]> | null {
  if (!Array.isArray(value) || !value.every(isMission)) return null;
  return { data: value as Mission[], workspace: null };
 }
 function isProject(value: unknown): value is Project {
  if (!isRecord(value)) return false;
  return (
    isString(value['id']) &&
    isString(value['name']) &&
    isOneOf(value['status'], projectStatuses) &&
    isString(value['userId']) &&
    isNullableString(value['description']) &&
    isNullableRecord(value['metadata']) &&
    isIsoLike(value['createdAt']) &&
    isIsoLike(value['updatedAt'])
  );
 }
 /**
 * Projects are workspace-scoped: every item must carry the same `userId`.
 * A collection mixing identities (cross-workspace leak) is a schema
 * mismatch; the uniform `userId` becomes the snapshot workspace.
 */
 export function validateProjectCollection(value: unknown): FreshPayload<Project[]> | null {
  if (!Array.isArray(value) || !value.every(isProject)) return null;
  const projects = value as Project[];
  const workspaces = new Set(projects.map((project) => project.userId));
  if (workspaces.size > 1) return null;
  return { data: projects, workspace: projects.length > 0 ? projects[0]!.userId : null };
 }
 /** Single project entity (project detail primary collection). */
 export function validateProjectEntity(value: unknown): FreshPayload<Project> | null {
  if (!isProject(value)) return null;
  const project = value as Project;
  return { data: project, workspace: project.userId };
 }
@@ -35,7 +35,6 @@ afterEach(async () => {
  document.body.replaceChildren();
  root = null;
  apiMock.mockReset();
  sessionStorage.clear();
 });
 async function renderProjectDetailPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -65,49 +64,21 @@ function clickButtonByText(text: string): void {
  button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
-async function flushAct(): Promise<void> {
+describe('ProjectDetailPage', () => {
-  await act(async () => {
+  it('loads the project, tasks, missions, and optional PRD content for the active project', async () => {
    await Promise.resolve();
  });
 }
 interface Deferred<T> {
  promise: Promise<T>;
  resolve: (value: T) => void;
 }
 function createDeferred<T>(): Deferred<T> {
  let resolve!: (value: T) => void;
  const promise = new Promise<T>((res) => {
    resolve = res;
  });
  return { promise, resolve };
 }
 const projectOneTasks = taskFixtures.filter((task) => task.projectId === 'project-1');
 function mockHealthyLoad(): void {
    apiMock
      .mockResolvedValueOnce(projectFixtures[0])
      .mockResolvedValueOnce(missionFixtures)
-    .mockResolvedValueOnce(projectOneTasks);
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
 }
 describe('ProjectDetailPage', () => {
  it('loads the project, tasks, missions, and optional PRD content for the active project', async () => {
    mockHealthyLoad();
    await renderProjectDetailPage();
-    expect(apiMock.mock.calls.map((call) => call[0])).toEqual([
+    expect(apiMock.mock.calls).toEqual([
-      '/api/projects/project-1',
+      ['/api/projects/project-1'],
-      '/api/missions',
+      ['/api/missions'],
-      '/api/tasks?projectId=project-1',
+      ['/api/tasks?projectId=project-1'],
    ]);
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
    expect(container.textContent).toContain('Mosaic Stack');
    expect(container.textContent).toContain('Route /projects/:id');
    expect(container.textContent).toContain('Tasks');
@@ -130,7 +101,10 @@ describe('ProjectDetailPage', () => {
  });
  it('opens and closes the existing read-only task modal from the tasks tab', async () => {
-    mockHealthyLoad();
+    apiMock
      .mockResolvedValueOnce(projectFixtures[0])
      .mockResolvedValueOnce(missionFixtures)
      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
    await renderProjectDetailPage();
@@ -160,153 +134,35 @@ describe('ProjectDetailPage', () => {
    expect(container.querySelector('[role="dialog"]')).toBeNull();
  });
-  it('shows verified completion verdicts when the task collection is current', async () => {
+  it('renders the project with an empty missions tab when the missions request fails', async () => {
    mockHealthyLoad();
    await renderProjectDetailPage();
    const doneCard = [...container.querySelectorAll('div')].find(
      (candidate) => candidate.textContent === 'Done1',
    );
    expect(doneCard).toBeTruthy();
    const inProgressCard = [...container.querySelectorAll('div')].find(
      (candidate) => candidate.textContent === 'In Progress1',
    );
    expect(inProgressCard).toBeTruthy();
  });
  it('renders an explicit unavailable missions tab when the missions request fails (partial, not empty)', async () => {
    apiMock
      .mockResolvedValueOnce(projectFixtures[0])
      .mockRejectedValueOnce(new Error('Missions request failed'))
-      .mockResolvedValueOnce(projectOneTasks);
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
    await renderProjectDetailPage();
    // Secondary failure degrades the surface to partial; the project itself
    // still renders.
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'partial',
    );
    expect(container.textContent).toContain('Mosaic Stack');
-    const partial = container.querySelector('[role="status"]');
+    expect(container.querySelector('[role="alert"]')).toBeNull();
    expect(partial?.textContent).toContain('Missions');
    expect(partial?.textContent).toContain('unavailable');
    await act(async () => {
-      clickButtonByText('Missions (?)');
+      clickButtonByText('Missions (0)');
    });
-    const alert = container.querySelector('[role="alert"]');
+    expect(container.textContent).toContain('No missions for this project');
    expect(alert?.textContent).toContain('Missions request failed');
    // Negative control: a failed fetch must not look like an empty list.
    expect(container.textContent).not.toContain('No missions for this project');
  });
-  it('marks derived verdicts unknown when the tasks collection is unavailable', async () => {
+  it('renders a visible alert when the project request fails and lets the user navigate back', async () => {
    apiMock
      .mockResolvedValueOnce(projectFixtures[0])
      .mockResolvedValueOnce(missionFixtures)
      .mockRejectedValueOnce(new Error('Tasks request failed'));
    await renderProjectDetailPage();
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'partial',
    );
    // Completion verdicts become unknown ('?') — never green counts.
    for (const label of ['Done', 'In Progress', 'Blocked', 'Tasks']) {
      const unknownCard = [...container.querySelectorAll('div')].find(
        (candidate) => candidate.textContent === `${label}?`,
      );
      expect(unknownCard, `expected ${label} card to render ?`).toBeTruthy();
    }
    // Negative control: no green "Done 1" verdict anywhere.
    expect(
      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
    ).toBe(false);
    await act(async () => {
      clickButtonByText('Tasks (?)');
    });
    const alert = container.querySelector('[role="alert"]');
    expect(alert?.textContent).toContain('Tasks request failed');
    // Negative control: no healthy empty task list from a failed fetch.
    expect(container.textContent).not.toContain('No tasks found');
    expect(container.querySelector('table')).toBeNull();
  });
  it('recovers a partial surface to current after revalidation', async () => {
    apiMock
      .mockResolvedValueOnce(projectFixtures[0])
      .mockResolvedValueOnce(missionFixtures)
      .mockRejectedValueOnce(new Error('Tasks request failed'))
      .mockResolvedValueOnce(projectFixtures[0])
      .mockResolvedValueOnce(missionFixtures)
      .mockResolvedValueOnce(projectOneTasks);
    await renderProjectDetailPage();
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'partial',
    );
    await act(async () => {
      clickButtonByText('Revalidate');
    });
    await flushAct();
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
    expect(
      [...container.querySelectorAll('div')].some((candidate) => candidate.textContent === 'Done1'),
    ).toBe(true);
  });
  it("never shows one project's data on another project's route after navigation", async () => {
    mockHealthyLoad();
    const router = await renderProjectDetailPage();
    expect(container.textContent).toContain('Mosaic Stack');
    const deferred = createDeferred<(typeof projectFixtures)[number]>();
    apiMock
      .mockResolvedValueOnce(deferred.promise)
      .mockResolvedValueOnce([])
      .mockResolvedValueOnce([]);
    await act(async () => {
      await router.navigate('/projects/project-2');
    });
    // While project-2 loads, nothing from project-1 may render on its route.
    expect(container.textContent).toContain('Loading project...');
    expect(container.textContent).not.toContain('Mosaic Stack');
    expect(container.textContent).not.toContain('Route /projects/:id');
    await act(async () => {
      deferred.resolve(projectFixtures[1]!);
      await deferred.promise;
    });
    expect(container.textContent).toContain('Agent Runtime');
    expect(apiMock.mock.calls[3]?.[0]).toBe('/api/projects/project-2');
  });
  it('renders a visible unavailable state when the project request fails and lets the user navigate back', async () => {
    apiMock
      .mockRejectedValueOnce(new Error('Project request failed'))
      .mockResolvedValueOnce(missionFixtures)
-      .mockResolvedValueOnce(projectOneTasks);
+      .mockResolvedValueOnce(taskFixtures.filter((task) => task.projectId === 'project-1'));
    const router = await renderProjectDetailPage();
    const alert = container.querySelector('[role="alert"]');
    expect(alert).toBeTruthy();
    expect(alert?.textContent).toContain('Project request failed');
    expect(alert?.textContent).toContain('not an empty result');
    expect(container.textContent).not.toContain('Mosaic Stack');
    await act(async () => {
@@ -1,30 +1,14 @@
-import { useState, type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { useNavigate, useParams } from 'react-router-dom';
 import { MissionTimeline } from '@/components/projects/mission-timeline';
 import { PrdViewer } from '@/components/projects/prd-viewer';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
 import { TaskStatusSummary } from '@/components/tasks/task-status-summary';
 import {
  PartialDataNotice,
  StaleDataNotice,
  UnavailableDataNotice,
 } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Mission, Project, Task, TaskStatus } from '@/lib/types';
-import {
+import { getErrorMessage } from './page-errors';
  combineFreshness,
  UNKNOWN_VERDICT,
  verdictValue,
  type FreshSnapshot,
 } from '@/lib/freshness/model';
 import { describeFailure, useFreshCollection } from '@/lib/freshness/use-fresh-collection';
 import {
  validateMissionCollection,
  validateProjectEntity,
  validateTaskCollection,
 } from '@/lib/freshness/validators';
 type Tab = 'overview' | 'tasks' | 'missions' | 'prd';
@@ -67,75 +51,55 @@ function TabButton({ id, label, activeTab, onClick }: TabButtonProps): ReactElem
  );
 }
 /** Remounts per project id so no state from one project renders for another. */
 export function ProjectDetailPage(): ReactElement {
  const { id = '' } = useParams();
  return <ProjectDetail id={id} key={id} />;
 }
 function ProjectDetail({ id }: { id: string }): ReactElement {
  const navigate = useNavigate();
-  const enabled = id.length > 0;
+  const [project, setProject] = useState<Project | null>(null);
-
+  const [missions, setMissions] = useState<Mission[]>([]);
-  // Primary collection gates the surface; missions and tasks are secondaries
+  const [tasks, setTasks] = useState<Task[]>([]);
-  // whose failures degrade the surface to `partial` instead of rendering
+  const [loading, setLoading] = useState(true);
-  // empty healthy lists.
+  const [error, setError] = useState<string | null>(null);
  const project = useFreshCollection<Project>({
    source: `gateway:/api/projects/${id}`,
    fetcher: (signal) => api<unknown>(`/api/projects/${id}`, { signal }),
    validate: validateProjectEntity,
    // No last-known restore: the entity carries workspace identity that
    // cannot be scope-checked before display (see ProjectsPage note).
    enabled,
  });
  const missions = useFreshCollection<Mission[]>({
    source: 'gateway:/api/missions',
    fetcher: (signal) => api<unknown>('/api/missions', { signal }),
    validate: validateMissionCollection,
    cacheKey: enabled ? 'missions' : null,
    enabled,
  });
  const tasks = useFreshCollection<Task[]>({
    source: `gateway:/api/tasks?projectId=${id}`,
    fetcher: (signal) => api<unknown>(`/api/tasks?projectId=${id}`, { signal }),
    validate: validateTaskCollection,
    cacheKey: enabled ? `project-tasks:${id}` : null,
    enabled,
  });
  const [activeTab, setActiveTab] = useState<Tab>('overview');
  const [taskFilter, setTaskFilter] = useState<TaskStatus | 'all'>('all');
  const [selectedTask, setSelectedTask] = useState<Task | null>(null);
-  const surface = combineFreshness(project.freshness, [missions.freshness, tasks.freshness]);
+  useEffect(() => {
-  const tasksVerified = tasks.freshness === 'current';
+    if (!id) {
-  const projectMissions = missions.data?.filter((mission) => mission.projectId === id) ?? null;
+      setError('Project id is missing.');
-
+      setLoading(false);
-  const retryAll = (): void => {
+      return;
    void Promise.all([project.revalidate(), missions.revalidate(), tasks.revalidate()]);
  };
  if (!enabled) {
    return (
      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
        <header className="mb-6 border-b px-1 pb-3">
          <h1 className="text-2xl font-semibold">Project</h1>
        </header>
        <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
          Project id is missing.
        </div>
        <button
          type="button"
          onClick={() => navigate('/projects')}
          className="mt-4 w-fit text-sm underline"
        >
          Back to projects
        </button>
      </div>
    );
    }
-  if (project.freshness === 'unknown') {
+    let cancelled = false;
    setLoading(true);
    setError(null);
    void Promise.all([
      api<Project>('/api/projects/' + id),
      api<Mission[]>('/api/missions').catch(() => [] as Mission[]),
      api<Task[]>('/api/tasks?projectId=' + id).catch(() => [] as Task[]),
    ])
      .then(([loadedProject, allMissions, loadedTasks]) => {
        if (cancelled) return;
        setProject(loadedProject);
        setMissions(allMissions.filter((mission) => mission.projectId === id));
        setTasks(loadedTasks);
      })
      .catch((caught: unknown) => {
        if (cancelled) return;
        setError(getErrorMessage(caught, 'Failed to load project.'));
      })
      .finally(() => {
        if (cancelled) return;
        setLoading(false);
      });
    return () => {
      cancelled = true;
    };
  }, [id]);
  if (loading) {
    return (
      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
        <header className="mb-6 border-b px-1 pb-3">
@@ -146,17 +110,15 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
    );
  }
-  if (project.freshness === 'unavailable' || project.data === null) {
+  if (error || !project) {
    return (
      <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
        <header className="mb-6 border-b px-1 pb-3">
          <h1 className="text-2xl font-semibold">Project</h1>
        </header>
-        <UnavailableDataNotice
+        <div role="alert" className="rounded-lg border border-error/40 px-4 py-3 text-sm">
-          title="This project"
+          {error ?? 'Project not found.'}
-          detail={describeFailure(project.failure)}
+        </div>
          onRetry={retryAll}
        />
        <button
          type="button"
          onClick={() => navigate('/projects')}
@@ -168,48 +130,18 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
    );
  }
  const projectTasks = tasks.data ?? null;
  const filteredTasks =
-    projectTasks === null
+    taskFilter === 'all' ? tasks : tasks.filter((task) => task.status === taskFilter);
-      ? []
+  const prdContent = getPrdContent(project);
      : taskFilter === 'all'
        ? projectTasks
        : projectTasks.filter((task) => task.status === taskFilter);
  // Derived completion verdicts: unknown (never green) unless the task
  // collection is verified current.
  const doneCount = projectTasks?.filter((task) => task.status === 'done').length ?? 0;
  const inProgressCount = projectTasks?.filter((task) => task.status === 'in-progress').length ?? 0;
  const blockedCount = projectTasks?.filter((task) => task.status === 'blocked').length ?? 0;
  const prdContent = getPrdContent(project.data);
  const tabs: Array<{ id: Tab; label: string }> = [
    { id: 'overview', label: 'Overview' },
-    {
+    { id: 'tasks', label: `Tasks (${tasks.length})` },
-      id: 'tasks',
+    { id: 'missions', label: `Missions (${missions.length})` },
      label: `Tasks (${projectTasks === null ? UNKNOWN_VERDICT : projectTasks.length})`,
    },
    {
      id: 'missions',
      label: `Missions (${projectMissions === null ? UNKNOWN_VERDICT : projectMissions.length})`,
    },
    ...(prdContent ? [{ id: 'prd' as const, label: 'PRD' }] : []),
  ];
  const staleSnapshot: FreshSnapshot<unknown> | null =
    project.freshness === 'stale'
      ? project.snapshot
      : missions.freshness === 'stale'
        ? missions.snapshot
        : tasks.freshness === 'stale'
          ? tasks.snapshot
          : null;
  const missingSections: string[] = [];
  if (missions.freshness === 'unavailable') missingSections.push('Missions');
  if (tasks.freshness === 'unavailable') missingSections.push('Tasks');
  return (
-    <div data-freshness={surface} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
      <header className="mb-6 border-b px-1 pb-3">
        <nav className="mb-4 flex items-center gap-2 text-sm text-text-muted">
          <button
@@ -220,64 +152,49 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
            Projects
          </button>
          <span>/</span>
-          <span className="text-text-primary">{project.data.name}</span>
+          <span className="text-text-primary">{project.name}</span>
        </nav>
        <div className="flex items-start justify-between gap-4">
          <div>
            <div className="flex items-center gap-3">
-              <h1 className="text-2xl font-semibold text-text-primary">{project.data.name}</h1>
+              <h1 className="text-2xl font-semibold text-text-primary">{project.name}</h1>
              <span
                className={cn(
                  'rounded-full px-2 py-0.5 text-xs',
-                  projectStatusColors[project.data.status] ?? 'bg-gray-600/20 text-gray-400',
+                  projectStatusColors[project.status] ?? 'bg-gray-600/20 text-gray-400',
                )}
              >
-                {project.data.status}
+                {project.status}
              </span>
            </div>
-            {project.data.description ? (
+            {project.description ? (
-              <p className="mt-1 text-sm text-text-muted">{project.data.description}</p>
+              <p className="mt-1 text-sm text-text-muted">{project.description}</p>
            ) : null}
            <p className="mt-2 text-xs text-text-muted">
-              Created {new Date(project.data.createdAt).toLocaleDateString()} · Updated{' '}
+              Created {new Date(project.createdAt).toLocaleDateString()} · Updated{' '}
-              {new Date(project.data.updatedAt).toLocaleDateString()}
+              {new Date(project.updatedAt).toLocaleDateString()}
            </p>
          </div>
        </div>
      </header>
      {staleSnapshot !== null ? (
        <div className="mb-6">
          <StaleDataNotice label={staleSnapshot} onRetry={retryAll} />
        </div>
      ) : null}
      {missingSections.length > 0 ? (
        <div className="mb-6">
          <PartialDataNotice missing={missingSections} onRetry={retryAll} />
        </div>
      ) : null}
      <div className="mb-6 grid grid-cols-2 gap-3 sm:grid-cols-4">
-        <StatCard
+        <StatCard label="Tasks" value={String(tasks.length)} />
          label="Tasks"
          value={projectTasks === null ? UNKNOWN_VERDICT : String(projectTasks.length)}
        />
        <StatCard
          label="Done"
-          value={verdictValue(tasksVerified, String(doneCount))}
+          value={String(tasks.filter((task) => task.status === 'done').length)}
-          valueClass={tasksVerified ? 'text-success' : undefined}
+          valueClass="text-success"
        />
        <StatCard
          label="In Progress"
-          value={verdictValue(tasksVerified, String(inProgressCount))}
+          value={String(tasks.filter((task) => task.status === 'in-progress').length)}
-          valueClass={tasksVerified ? 'text-blue-400' : undefined}
+          valueClass="text-blue-400"
        />
        <StatCard
          label="Blocked"
-          value={verdictValue(tasksVerified, String(blockedCount))}
+          value={String(tasks.filter((task) => task.status === 'blocked').length)}
-          valueClass={tasksVerified && blockedCount > 0 ? 'text-error' : undefined}
+          valueClass={tasks.some((task) => task.status === 'blocked') ? 'text-error' : undefined}
        />
      </div>
@@ -294,43 +211,23 @@ function ProjectDetail({ id }: { id: string }): ReactElement {
      </div>
      {activeTab === 'overview' ? (
-        <OverviewTab project={project.data} missions={projectMissions} tasks={projectTasks} />
+        <OverviewTab project={project} missions={missions} tasks={tasks} />
      ) : null}
      {activeTab === 'tasks' ? (
        <div>
          {projectTasks === null ? (
            <UnavailableDataNotice
              title="Tasks"
              detail={describeFailure(tasks.failure)}
              onRetry={retryAll}
            />
          ) : (
            <>
          <div className="mb-4">
            <TaskStatusSummary
-                  tasks={projectTasks}
+              tasks={tasks}
              activeFilter={taskFilter}
              onFilterChange={setTaskFilter}
            />
          </div>
          <TaskListView tasks={filteredTasks} onTaskClick={setSelectedTask} />
            </>
          )}
        </div>
      ) : null}
-      {activeTab === 'missions' ? (
+      {activeTab === 'missions' ? <MissionTimeline missions={missions} /> : null}
        projectMissions === null ? (
          <UnavailableDataNotice
            title="Missions"
            detail={describeFailure(missions.failure)}
            onRetry={retryAll}
          />
        ) : (
          <MissionTimeline missions={projectMissions} />
        )
      ) : null}
      {activeTab === 'prd' && prdContent ? (
        <div className="rounded-lg border border-surface-border bg-surface-card p-6">
@@ -351,26 +248,18 @@ function OverviewTab({
  tasks,
 }: {
  project: Project;
-  missions: Mission[] | null;
+  missions: Mission[];
-  tasks: Task[] | null;
+  tasks: Task[];
 }): ReactElement {
-  const recentTasks =
+  const recentTasks = [...tasks]
-    tasks === null
+    .sort((left, right) => new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime())
      ? null
      : [...tasks]
          .sort(
            (left, right) =>
              new Date(right.updatedAt).getTime() - new Date(left.updatedAt).getTime(),
          )
    .slice(0, 5);
  return (
    <div className="grid gap-6 lg:grid-cols-2">
      <section>
        <h2 className="mb-3 text-sm font-semibold text-text-secondary">Recent Tasks</h2>
-        {recentTasks === null ? (
+        {recentTasks.length === 0 ? (
          <UnavailableDataNotice title="Tasks" />
        ) : recentTasks.length === 0 ? (
          <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
            <p className="text-sm text-text-muted">No tasks yet</p>
          </div>
@@ -398,9 +287,7 @@ function OverviewTab({
      <section>
        <h2 className="mb-3 text-sm font-semibold text-text-secondary">Missions</h2>
-        {missions === null ? (
+        {missions.length === 0 ? (
          <UnavailableDataNotice title="Missions" />
        ) : missions.length === 0 ? (
          <div className="rounded-lg border border-surface-border bg-surface-card p-4 text-center">
            <p className="text-sm text-text-muted">No missions yet</p>
          </div>
@@ -51,7 +51,6 @@ afterEach(async () => {
  document.body.replaceChildren();
  root = null;
  apiMock.mockReset();
  sessionStorage.clear();
 });
 async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRouter>> {
@@ -72,22 +71,6 @@ async function renderProjectsPage(): Promise<ReturnType<typeof createMemoryRoute
  return router;
 }
 function clickButtonByText(text: string): void {
  const button = [...container.querySelectorAll('button')].find((candidate) =>
    candidate.textContent?.includes(text),
  );
  if (!button) {
    throw new Error(`Button containing "${text}" not found`);
  }
  button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 async function flushAct(): Promise<void> {
  await act(async () => {
    await Promise.resolve();
  });
 }
 describe('ProjectsPage', () => {
  it('shows a visible loading state while the project request is in flight', async () => {
    const deferred = createDeferred<typeof projectFixtures>();
@@ -108,7 +91,7 @@ describe('ProjectsPage', () => {
    const router = await renderProjectsPage();
-    expect(apiMock.mock.calls[0]?.[0]).toBe('/api/projects');
+    expect(apiMock).toHaveBeenCalledWith('/api/projects');
    expect(container.textContent).toContain('Mosaic Stack');
    expect(container.textContent).toContain('Agent Runtime');
@@ -125,7 +108,7 @@ describe('ProjectsPage', () => {
    expect(container.textContent).toContain('Project detail target');
  });
-  it('renders the empty state only for a verified empty collection', async () => {
+  it('renders the empty state when the API returns no projects', async () => {
    apiMock.mockResolvedValueOnce([]);
    await renderProjectsPage();
@@ -134,12 +117,9 @@ describe('ProjectsPage', () => {
    expect(container.textContent).toContain(
      'Projects will appear here when created via the gateway API',
    );
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
  });
-  it('renders a failed fetch as an explicit unavailable state, never an empty collection', async () => {
+  it('renders a visible alert when the projects request fails', async () => {
    apiMock.mockRejectedValueOnce(new Error('Projects are unavailable'));
    await renderProjectsPage();
@@ -147,51 +127,5 @@ describe('ProjectsPage', () => {
    const alert = container.querySelector('[role="alert"]');
    expect(alert).toBeTruthy();
    expect(alert?.textContent).toContain('Projects are unavailable');
    expect(alert?.textContent).toContain('not an empty result');
    // Negative controls: no healthy empty state and no project cards render
    // from a failed fetch.
    expect(container.textContent).not.toContain('No projects yet');
    expect(container.textContent).not.toContain('Mosaic Stack');
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'unavailable',
    );
  });
  it('renders an auth failure as unavailable and recovers after retry', async () => {
    apiMock
      .mockRejectedValueOnce(Object.assign(new Error('Unauthorized'), { statusCode: 401 }))
      .mockResolvedValueOnce(projectFixtures);
    await renderProjectsPage();
    const alert = container.querySelector('[role="alert"]');
    expect(alert?.textContent).toContain('Unauthorized');
    expect(container.textContent).not.toContain('No projects yet');
    await act(async () => {
      clickButtonByText('Retry');
    });
    await flushAct();
    expect(container.querySelector('[role="alert"]')).toBeNull();
    expect(container.textContent).toContain('Mosaic Stack');
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
  });
  it('renders a schema-mismatched response as unavailable, never as data', async () => {
    apiMock.mockResolvedValueOnce({ results: projectFixtures });
    await renderProjectsPage();
    const alert = container.querySelector('[role="alert"]');
    expect(alert?.textContent).toContain('not an empty result');
    expect(container.textContent).not.toContain('Mosaic Stack');
    expect(container.textContent).not.toContain('No projects yet');
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'unavailable',
    );
  });
 });
@@ -1,51 +1,53 @@
-import { type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { ProjectCard } from '@/components/projects/project-card';
 import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import type { Project } from '@/lib/types';
-import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
+import { getErrorMessage } from './page-errors';
 import { validateProjectCollection } from '@/lib/freshness/validators';
 export function ProjectsPage(): ReactElement {
  const navigate = useNavigate();
-  const projects = useFreshCollection<Project[]>({
+  const [projects, setProjects] = useState<Project[]>([]);
-    source: 'gateway:/api/projects',
+  const [loading, setLoading] = useState(true);
-    fetcher: (signal) => api<unknown>('/api/projects', { signal }),
+  const [error, setError] = useState<string | null>(null);
-    validate: validateProjectCollection,
+
-    // Projects carry workspace identity (userId) that is only knowable from
+  useEffect(() => {
-    // the payload itself, so a restored entry cannot be scope-checked before
+    let cancelled = false;
-    // display. Conservative choice: no last-known restore for this surface;
+
-    // cross-workspace switching is still invalidated at verification time.
+    void api<Project[]>('/api/projects')
      .then((response) => {
        if (cancelled) return;
        setProjects(response);
      })
      .catch((caught: unknown) => {
        if (cancelled) return;
        setError(getErrorMessage(caught, 'Failed to load projects.'));
      })
      .finally(() => {
        if (cancelled) return;
        setLoading(false);
      });
-  const retry = (): void => {
+
-    void projects.revalidate();
+    return () => {
      cancelled = true;
    };
  }, []);
  return (
-    <div
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
      data-freshness={projects.freshness}
      className="flex min-h-screen flex-col px-4 py-6 sm:px-6"
    >
      <header className="mb-6 border-b px-1 pb-3">
        <h1 className="text-2xl font-semibold">Projects</h1>
      </header>
-      {projects.freshness === 'stale' && projects.snapshot ? (
+      {error ? (
-        <div className="mb-6">
+        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
-          <StaleDataNotice label={projects.snapshot} onRetry={retry} />
+          {error}
        </div>
      ) : null}
-      {projects.freshness === 'unknown' ? (
+      {loading ? (
        <p className="py-8 text-center text-sm text-text-muted">Loading projects...</p>
-      ) : projects.freshness === 'unavailable' ? (
+      ) : projects.length === 0 ? (
        <UnavailableDataNotice
          title="Projects"
          detail={describeFailure(projects.failure)}
          onRetry={retry}
        />
      ) : projects.data !== null && projects.data.length === 0 ? (
        <div className="py-12 text-center">
          <h2 className="text-lg font-medium text-text-secondary">No projects yet</h2>
          <p className="mt-1 text-sm text-text-muted">
@@ -54,7 +56,7 @@ export function ProjectsPage(): ReactElement {
        </div>
      ) : (
        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-          {(projects.data ?? []).map((project) => (
+          {projects.map((project) => (
            <ProjectCard
              key={project.id}
              project={project}
@@ -3,9 +3,6 @@ import { createRoot, type Root } from 'react-dom/client';
 import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
 import { taskFixtures } from './page-fixtures';
 import { acceptSnapshot, DEFAULT_FRESHNESS_POLICY } from '@/lib/freshness/model';
 import { writeSnapshotCache } from '@/lib/freshness/snapshot-cache';
 import { validateTaskCollection } from '@/lib/freshness/validators';
 const { apiMock } = vi.hoisted(() => ({
  apiMock: vi.fn(),
@@ -51,7 +48,6 @@ afterEach(async () => {
  document.body.replaceChildren();
  root = null;
  apiMock.mockReset();
  sessionStorage.clear();
 });
 async function renderTasksPage(): Promise<void> {
@@ -76,13 +72,6 @@ function clickButtonByText(text: string): void {
  button.dispatchEvent(new MouseEvent('click', { bubbles: true }));
 }
 /** Flush pending promise callbacks inside the act environment. */
 async function flushAct(): Promise<void> {
  await act(async () => {
    await Promise.resolve();
  });
 }
 describe('TasksPage', () => {
  it('shows a visible loading state before the tasks request settles', async () => {
    const deferred = createDeferred<typeof taskFixtures>();
@@ -143,7 +132,7 @@ describe('TasksPage', () => {
    expect(container.textContent).toContain('Wire list and kanban modal interactions');
  });
-  it('renders a failed fetch as an explicit unavailable state, never an empty healthy board', async () => {
+  it('renders a visible alert when the tasks request fails', async () => {
    apiMock.mockRejectedValueOnce(new Error('Tasks request failed'));
    await renderTasksPage();
@@ -151,80 +140,5 @@ describe('TasksPage', () => {
    const alert = container.querySelector('[role="alert"]');
    expect(alert).toBeTruthy();
    expect(alert?.textContent).toContain('Tasks request failed');
    expect(alert?.textContent).toContain('not an empty result');
    // Negative controls: no board, no healthy empty-state markers, and the
    // surface is marked unavailable rather than current.
    expect(container.textContent).not.toContain('Not Started');
    expect(container.textContent).not.toContain('No tasks');
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'unavailable',
    );
  });
  it('recovers to a current board after retrying a failed fetch', async () => {
    apiMock
      .mockRejectedValueOnce(new Error('Tasks request failed'))
      .mockResolvedValueOnce(taskFixtures);
    await renderTasksPage();
    expect(container.querySelector('[role="alert"]')).toBeTruthy();
    await act(async () => {
      clickButtonByText('Retry');
    });
    await flushAct();
    expect(container.querySelector('[role="alert"]')).toBeNull();
    expect(container.textContent).toContain('Not Started');
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
  });
  it('labels restored last-known data as stale with source, version, and age until verified', async () => {
    // Seed a last-known snapshot fetched five minutes ago; the page must
    // render it only under an explicit staleness label while the fetch is
    // still in flight.
    const restored = acceptSnapshot({
      value: taskFixtures,
      validate: validateTaskCollection,
      previous: null,
      policy: DEFAULT_FRESHNESS_POLICY,
      source: 'gateway:/api/tasks',
      now: Date.now() - 5 * 60_000,
    });
    if (restored.outcome !== 'accepted') throw new Error('fixture setup failed');
    writeSnapshotCache('tasks', restored.snapshot);
    const deferred = createDeferred<typeof taskFixtures>();
    apiMock.mockReturnValueOnce(deferred.promise);
    await renderTasksPage();
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'stale',
    );
    const banner = container.querySelector('[role="status"]');
    expect(banner?.textContent).toContain('last-known');
    expect(banner?.textContent).toContain('may be out of date');
    expect(banner?.textContent).toContain('gateway:/api/tasks');
    expect(banner?.textContent).toContain('snapshot v1');
    expect(banner?.textContent).toContain('5m ago');
    // Last-known data still renders as situational awareness under the label.
    expect(container.textContent).toContain('Route /tasks');
    expect(container.textContent).not.toContain('Loading tasks...');
    // Verification lands: the banner clears and the surface becomes current.
    await act(async () => {
      deferred.resolve(taskFixtures);
      await deferred.promise;
    });
    expect(container.querySelector('[role="status"]')).toBeNull();
    expect(container.querySelector('[data-freshness]')?.getAttribute('data-freshness')).toBe(
      'current',
    );
  });
 });
@@ -1,32 +1,45 @@
-import { useState, type ReactElement } from 'react';
+import { useEffect, useState, type ReactElement } from 'react';
 import { KanbanBoard } from '@/components/tasks/kanban-board';
 import { TaskDetailModal } from '@/components/tasks/task-detail-modal';
 import { TaskListView } from '@/components/tasks/task-list-view';
 import { StaleDataNotice, UnavailableDataNotice } from '@/components/freshness/freshness-notices';
 import { api } from '@/lib/api';
 import { cn } from '@/lib/cn';
 import type { Task } from '@/lib/types';
-import { useFreshCollection, describeFailure } from '@/lib/freshness/use-fresh-collection';
+import { getErrorMessage } from './page-errors';
 import { validateTaskCollection } from '@/lib/freshness/validators';
 type ViewMode = 'list' | 'kanban';
 export function TasksPage(): ReactElement {
-  const tasks = useFreshCollection<Task[]>({
+  const [tasks, setTasks] = useState<Task[]>([]);
    source: 'gateway:/api/tasks',
    fetcher: (signal) => api<unknown>('/api/tasks', { signal }),
    validate: validateTaskCollection,
    cacheKey: 'tasks',
  });
  const [view, setView] = useState<ViewMode>('kanban');
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState<string | null>(null);
  const [selectedTask, setSelectedTask] = useState<Task | null>(null);
-  const retry = (): void => {
+  useEffect(() => {
-    void tasks.revalidate();
+    let cancelled = false;
    void api<Task[]>('/api/tasks')
      .then((response) => {
        if (cancelled) return;
        setTasks(response);
      })
      .catch((caught: unknown) => {
        if (cancelled) return;
        setError(getErrorMessage(caught, 'Failed to load tasks.'));
      })
      .finally(() => {
        if (cancelled) return;
        setLoading(false);
      });
    return () => {
      cancelled = true;
    };
  }, []);
  return (
-    <div data-freshness={tasks.freshness} className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
+    <div className="flex min-h-screen flex-col px-4 py-6 sm:px-6">
      <header className="mb-6 flex items-center justify-between gap-4 border-b px-1 pb-3">
        <h1 className="text-2xl font-semibold">Tasks</h1>
        <div className="flex rounded-lg border border-surface-border">
@@ -57,24 +70,18 @@ export function TasksPage(): ReactElement {
        </div>
      </header>
-      {tasks.freshness === 'stale' && tasks.snapshot ? (
+      {error ? (
-        <div className="mb-6">
+        <div role="alert" className="mb-6 rounded-lg border border-error/40 px-4 py-3 text-sm">
-          <StaleDataNotice label={tasks.snapshot} onRetry={retry} />
+          {error}
        </div>
      ) : null}
-      {tasks.freshness === 'unknown' ? (
+      {loading ? (
        <p className="py-8 text-center text-sm text-text-muted">Loading tasks...</p>
      ) : tasks.freshness === 'unavailable' ? (
        <UnavailableDataNotice
          title="Tasks"
          detail={describeFailure(tasks.failure)}
          onRetry={retry}
        />
      ) : view === 'kanban' ? (
-        <KanbanBoard tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
+        <KanbanBoard tasks={tasks} onTaskClick={setSelectedTask} />
      ) : (
-        <TaskListView tasks={tasks.data ?? []} onTaskClick={setSelectedTask} />
+        <TaskListView tasks={tasks} onTaskClick={setSelectedTask} />
      )}
      {selectedTask ? (
@@ -39,20 +39,3 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
 # --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
 # Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
 # This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
 # It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
 # real system path, so on a host that installs those binaries the missing-binary
 # cases cannot be measured at all. The suite's own guard (line 103) says so and
 # fails rather than reporting a pass it cannot back. That guard is correct.
 # The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
 # dropped this exclusion, and the CI image provides `pi` in the system path, so
 # it has failed on every pipeline since. Measured 2026-08-16 across pipelines
 # 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
 # each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
 # Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
 # Because test:framework-shell is one && chain and this sat at position 44 of 48,
 # the four suites after it had not run at all since the merge.
 packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271
@@ -97,13 +97,34 @@ printf '%s' "$MSG" | "${tmux_cmd[@]}" load-buffer -b "$BUF" -
 #   would otherwise accumulate forever.
 sleep 0.5
-# 2) Submit, then POSITIVELY confirm submission; flush with another Enter if it is
+# 2) Submit, then POSITIVELY confirm submission by DRAFT TRANSITION, not by prompt
-#    still a draft. Success requires positive evidence — the queued banner, OR the
+#    glyph. The historical bug was treating ABSENCE of a draft as delivery; the
-#    REPL input box located AND clear of our message tail. The historical bug was
+#    2026-08 fix over-corrected to glyph inference (grep '❯|^>|│ >'), which locates
-#    treating ABSENCE of a draft as delivery: if the prompt glyph was never matched
+#    only Claude Code's box and false-NEGATIVES every glyphless REPL (pi renders a
-#    (wrong pane / prompt-glyph drift), an unsubmitted message read as "delivered"
+#    U+2500 rule, no glyph) — a delivered message reported "UNDELIVERED", driving a
-#    and worker->lead relays stalled silently. We now default to UNCONFIRMED and only
+#    retry that duplicates it. Runtime-agnostic evidence: our message tail sits on
-#    upgrade to delivered on positive evidence; anything we cannot confirm fails loud.
+#    the INPUT line (located by the cursor row, not a glyph) BEFORE Enter, and has
 #    LEFT it AFTER — that transition is positive proof of submission and needs no
 #    glyph. Absence alone still never means delivered: if we never saw our draft on
 #    the input line we stay UNCONFIRMED (wrong/dead pane), and a draft that never
 #    leaves the input line stays a DRAFT (exit 2), preserving both historical guards.
 _cursor_line() { # echo the pane's current input (cursor) line, glyph-free
  local cy line
  cy=$("${tmux_cmd[@]}" display-message -p -t "$EFFECTIVE_TARGET" -F '#{cursor_y}' 2>/dev/null) || return 1
  [ -n "$cy" ] || return 1
  "${tmux_cmd[@]}" capture-pane -t "$EFFECTIVE_TARGET" -p 2>/dev/null | sed -n "$((cy + 1))p"
 }
 _draft_on_input() { # true iff our message tail is sitting on the input line now
  [ -n "$snippet" ] || return 1
  printf '%s' "$(_cursor_line)" | grep -qF "$snippet"
 }
 # Baseline: after the paste, our draft must be on the input line. This is positive
 # proof we are on the right pane and the paste landed — the anchor the transition
 # check measures against.
 saw_draft=0
 _draft_on_input && saw_draft=1
 status="unconfirmed"
 for attempt in $(seq 1 $((RETRIES + 1))); do
  "${tmux_cmd[@]}" send-keys -t "$EFFECTIVE_TARGET" Enter
@@ -113,20 +134,26 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
  if printf '%s' "$pane" | grep -qF "$QUEUED_RE"; then
    status="queued"; break
  fi
-  # Locate the REPL input box (prompt glyph). If we cannot see it, we have NO
+  # POSITIVE draft evidence from a located prompt box, when one exists. This is the
-  # evidence of submission state — stay UNCONFIRMED and retry; never infer delivery.
+  # cursor-row check's blind spot: a pane in COOKED mode (a plain shell whose
  # foreground process never reads stdin) echoes our paste via the kernel line
  # discipline and moves the cursor off it on Enter, which is indistinguishable from
  # a real submit by cursor row alone. If a prompt box IS locatable and still carries
  # our tail, that is affirmative proof the message was not consumed. Absence of a
  # glyph is still never used for anything — that inference is the original E7 bug.
  promptline=$(printf '%s' "$pane" | grep -E '❯|^>|│ >' | tail -1)
-  if [ -z "$promptline" ]; then
+  if [ -n "$promptline" ] && [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
    status="unconfirmed"; continue
  fi
  # Input box located AND still carrying our tail => unsubmitted draft. Flush + retry.
  # (Submitted messages scroll up into history; a draft stays on the ❯ line.)
  if [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
    status="draft"; continue
  fi
-  # Input box located AND clear of our tail => positively submitted. This is the
+  if [ "$saw_draft" = 1 ]; then
-  # only path to success besides the queued banner.
+    if _draft_on_input; then
-  status="delivered"; break
+      status="draft"; continue      # still on the input line => not submitted; flush + retry
    fi
    status="delivered"; break        # left the input line => positively submitted
  fi
  # No confirmed baseline yet: try to (re)acquire it; never infer delivery from absence.
  if _draft_on_input; then saw_draft=1; status="draft"; continue; fi
  status="unconfirmed"; continue
 done
 [ "$VERBOSE" = 1 ] && { echo "--- pane tail ($TARGET) ---"; printf '%s\n' "$pane" | tail -4; echo "---"; }
@@ -0,0 +1,97 @@
 #!/usr/bin/env bash
 # Red-first regression test for E7 (#1017 task 2): the confirm-check must bind
 # "delivered" to WHETHER THE MESSAGE WAS SUBMITTED, not to which runtime's prompt
 # glyph is present. A pi seat renders a U+2500 rule input box with no ❯/^>/│ >
 # glyph; send-message.sh:118 locates the box only by glyph, so a genuinely
 # delivered message on a glyphless REPL falsely reports exit 2 "may be UNDELIVERED",
 # and the operator's rc=2-driven retry duplicates it.
 #
 # Parameterized on $SEND: RED against the shipping blob (B and D fail), GREEN
 # against a candidate patch. No pi; no fake HOME; hermetic throwaway socket.
 #
 # Submission counting is EXACT and terminal-echo-independent: the fixture message
 # is `echo <tok> >>SINK`; each real submission appends one line. wc -l SINK ==
 # number of times the REPL actually executed the send. This does not depend on how
 # many times the marker string is painted on screen.
 set -u
 SEND="${SEND:?set SEND=/path/to/send-message.sh}"
 SOCKET="glyphagnostic-$$"
 TMP="$(mktemp -d)"
 tmux() { command tmux -L "$SOCKET" "$@"; }
 cleanup() { command tmux -L "$SOCKET" kill-server 2>/dev/null; rm -rf "$TMP"; }
 trap cleanup EXIT
 pass=0; fail=0
 ok() { printf 'ok   %s\n' "$1"; pass=$((pass+1)); }
 no() { printf 'FAIL %s -- %s\n' "$1" "$2"; fail=$((fail+1)); }
 mk() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" "PS1='$2' exec bash --noprofile --norc -i"; sleep 0.5; }
 subs() { [ -f "$1" ] && wc -l <"$1" | tr -d ' ' || echo 0; }  # exact submission count
 echo "SEND=$SEND    tmux $(command tmux -V | awk '{print $2}')"
 # --- A (control): glyph box (❯) that submits => exit 0, exactly one submission.
 mk ctl '❯ '
 SINK="$TMP/sink.ctl"
 out=$("$SEND" -L "$SOCKET" -t ctl -m "echo x >>'$SINK'" 2>"$TMP/e.ctl"); rc=$?; sleep 0.4
 if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
  ok "control: ❯-box submits => exit 0, exactly one submission"
 else no "control: ❯-box submits => exit 0, one submission" "rc=$rc subs=$(subs "$SINK") err=[$(cat "$TMP/e.ctl")]"; fi
 # --- B (THE false-rc regression): glyphless U+2500 box that SUBMITS. Message lands
 #     (subs==1) yet shipping reports exit 2. Must be exit 0.
 mk sub $'──────── \n'
 SINK="$TMP/sink.sub"
 out=$("$SEND" -L "$SOCKET" -t sub -m "echo x >>'$SINK'" 2>"$TMP/e.sub"); rc=$?; sleep 0.4
 if [ "$rc" = 0 ] && [ "$(subs "$SINK")" = 1 ]; then
  ok "glyphless: U+2500 box that submits => exit 0 (delivered, not 'UNDELIVERED')"
 else no "glyphless: U+2500 box that submits => exit 0" \
        "rc=$rc subs=$(subs "$SINK")(delivered=$([ "$(subs "$SINK")" -ge 1 ] && echo yes||echo no)) err=[$(cat "$TMP/e.sub")]"; fi
 # --- D (duplicate arm): operator follows the rc=2 stderr and retries once. On the
 #     glyphless box, shipping => two submissions (the reported duplicate). The
 #     property: one logical send => exactly one submission. Same fix closes it.
 mk dup $'──────── \n'
 SINK="$TMP/sink.dup"
 tries=0
 for attempt in 1 2; do
  tries=$((tries+1))
  out=$("$SEND" -L "$SOCKET" -t dup -m "echo x >>'$SINK'" 2>/dev/null); rc=$?
  sleep 0.4
  [ "$rc" = 0 ] && break   # operator stops retrying only when told delivered
 done
 if [ "$(subs "$SINK")" = 1 ]; then
  ok "duplicate: one logical send (rc-driven retry) => exactly one submission (tries=$tries)"
 else no "duplicate: one logical send => exactly one submission" "submissions=$(subs "$SINK") tries=$tries"; fi
 # --- E (faithful hung managed TUI, NOT a cooked shell): raw/no-echo, paints nothing.
 #     A cooked `sleep infinity` echoes the paste via the kernel line discipline and
 #     false-passes a cursor-row fix that is correct on real seats (measured). So: raw.
 mk_rawstuck() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
  "bash --noprofile --norc -c 'stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity'"; sleep 0.5; }
 mk_rawstuck estuck
 SINK="$TMP/sink.estuck"
 out=$("$SEND" -L "$SOCKET" -t estuck -r 1 -m "this stuck draft was never submitted" 2>/dev/null); rc=$?
 sleep 0.3
 if [ "$rc" != 0 ] && [ "$(subs "$SINK")" = 0 ]; then
  ok "raw/no-echo stuck TUI (not submitted) => non-zero (no false delivered)"
 else no "raw stuck TUI must NOT report delivered" "rc=$rc subs=$(subs "$SINK")"; fi
 # --- F (busy/queued branch, your BUSY-not-runtime finding): glyphless pane rendering the
 #     queued banner, never consuming. QUEUED_RE :113 fires before the glyph grep => rc=0.
 mk_busy() { tmux new-session -d -s "$1" -x 120 -y 40 -c "$TMP" \
  "bash --noprofile --norc -c 'printf \"Press up to edit queued messages\n\"; exec sleep infinity'"; sleep 0.5; }
 mk_busy ebusy
 SINK="$TMP/sink.ebusy"
 out=$("$SEND" -L "$SOCKET" -t ebusy -m "echo x >>'$SINK'" 2>/dev/null); rc=$?; sleep 0.3
 if [ "$rc" = 0 ]; then
  ok "busy/queued-banner glyphless => exit 0 (queued is delivery; runtime owns custody)"
 else no "busy/queued-banner must report delivered" "rc=$rc"; fi
 # --- C (historical-bug guard): unresolvable target. No pane ever carried our draft
 #     => must fail, never infer delivered from absence of a glyph/snippet.
 if out=$("$SEND" -L "$SOCKET" -t "nonexistent-$$" -m "echo x >>'$TMP/sink.wrong'" 2>/dev/null); then
  no "wrong-pane: unresolvable target must NOT report success" "expected non-zero, got 0"
 else ok "wrong-pane: unresolvable target => non-zero (no false delivered)"; fi
 echo "---"; echo "pass=$pass fail=$fail"
 [ "$fail" = 0 ]
@@ -4,10 +4,13 @@
 #
 #   1. DELIVERED   — a REPL that renders a `❯ ` input box and submits on Enter
 #                    (text scrolls to history, box clears) => exit 0 "✓ delivered".
-#   2. UNCONFIRMED — a pane with NO locatable prompt glyph. This is the exact
+#   2. DELIVERED   — a pane with NO prompt glyph that DOES submit => exit 0. A pi
-#                    historical FALSE POSITIVE: pre-patch it printed "✓ delivered"
+#                    seat is this fixture (U+2500 rule, no glyph). Reshaped for
-#                    exit 0; post-patch it MUST fail loud (exit 2, stderr
+#                    #1257; see the note at the fixture for why the old exit-2
-#                    "could not confirm submission").
+#                    assertion was wrong.
 #   2b. UNCONFIRMED— a glyphless pane that never submits (raw/no-echo hung TUI)
 #                    => must fail loud. This carries the historical
 #                    false-positive guard that fixture 2 used to be credited with.
 #   3. DRAFT       — a `❯ `-prompt pane that never submits (message stays on the
 #                    input line) => exit 2, stderr "unsubmitted draft".
 set -uo pipefail
@@ -37,19 +40,44 @@ else
  no "delivered: ❯-prompt REPL that submits => exit 0 ✓ delivered" "rc=$rc out=[$out] err=[$(cat "$TMP/e1")]"
 fi
-# --- Fixture 2: NO prompt glyph (default bash PS1). THE regression: pre-patch this
+# --- Fixture 2: NO prompt glyph, and the pane DOES submit (interactive bash).
-#     was a silent false-positive "delivered"; post-patch it must be unconfirmed→exit 2.
+#     RESHAPED 2026-08-16 (#1257), deliberately. This fixture previously asserted
 #     exit 2 here and was labelled "false-positive FIXED". That assertion was wrong,
 #     and locking it in is what kept E7 alive: the pane submits, so "delivered" is
 #     the truth, and a pi seat — whose input box is a bare U+2500 rule with no glyph
 #     — IS this fixture. Reporting exit 2 for it told operators a delivered message
 #     may be undelivered, and the retry that advice invites is the duplicate.
 #
 #     The guard this fixture was reaching for is real and is NOT dropped: "never
 #     infer delivered from absence" is now enforced positively by fixture 2b below
 #     (glyphless AND not submitting => must fail) and by fixture 3 (locatable box
 #     still carrying our tail => draft). Absence alone decides nothing either way.
 tmux -L "$SOCKET" new-session -d -s noglyph -c "$TMP" \
  'PS1="sh-noglyph$ " exec bash --noprofile --norc -i'
 sleep 0.3
-if out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); then
+out=$("$SEND" -L "$SOCKET" -t "=noglyph" -m "verdict fixture two must fail loud" 2>"$TMP/e2"); rc=$?
-  no "unconfirmed: glyphless pane must NOT report success" "expected exit 2, got 0 (out=[$out])"
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -qF "✓ delivered"; then
  ok "delivered: glyphless pane that submits => exit 0 (runtime-agnostic, E7 FIXED)"
 else
  no "delivered: glyphless pane that submits => exit 0" "rc=$rc out=[$out] err=[$(cat "$TMP/e2")]"
 fi
 # --- Fixture 2b: NO prompt glyph AND never submits — a hung managed TUI holding the
 #     terminal in raw/no-echo, which is what a stuck agent seat actually is (measured
 #     on live pi: stty -echo -icanon). Nothing is echoed, nothing is consumed, so
 #     there is no positive evidence of submission and the tool MUST fail loud. This
 #     is the historical false-positive guard, kept as a positive test.
 tmux -L "$SOCKET" new-session -d -s rawstuck -c "$TMP" \
  'bash --noprofile --norc -c "stty -echo -icanon min 1 time 0 2>/dev/null; exec sleep infinity"'
 sleep 0.3
 if out=$("$SEND" -L "$SOCKET" -t "=rawstuck" -r 1 -m "verdict fixture two-b never submitted" 2>"$TMP/e2b"); then
  no "unconfirmed: glyphless hung TUI must NOT report success" "expected non-zero, got 0 (out=[$out])"
 else
  rc=$?
-  if [ "$rc" -eq 2 ] && grep -qF "could not confirm submission" "$TMP/e2"; then
+  if [ "$rc" -ne 0 ] && grep -qF "could not confirm submission" "$TMP/e2b"; then
-    ok "unconfirmed: glyphless pane => exit 2 + 'could not confirm submission' (false-positive FIXED)"
+    ok "unconfirmed: glyphless hung TUI (raw/no-echo) => non-zero + 'could not confirm submission'"
  else
-    no "unconfirmed: glyphless pane => exit 2 + stderr" "rc=$rc err=[$(cat "$TMP/e2")]"
+    no "unconfirmed: glyphless hung TUI => non-zero + stderr" "rc=$rc err=[$(cat "$TMP/e2b")]"
  fi
 fi
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",