forge_server/

surface.rs

//! The surface a view uses: named read verbs by subject, returning values
//! that carry no view type, and one dispatch verb for what a view acts
//! with.
//!
//! [`ViewSurface::dispatch`] is a verb rather than an accessor, so a second
//! view is handed the commands it needs and not the whole core, and changes
//! arrive on [`ViewSurface::subscribe_client`].

pub mod accounts;
pub mod agents;
pub mod biometric;
pub mod board;
pub mod composer;
pub mod connectors;
pub mod dictate;
pub mod extensions;
pub mod inspector;
pub mod plugins;
pub mod reviews;
pub mod roster;
pub mod session;
pub mod usage;
pub mod vault;
pub mod voice;
pub mod workers;

use std::path::{Path, PathBuf};
use std::sync::Arc;

use forge_primitives::SessionSlot;
use forge_workspace::{Command, DispatchError, Workspace};

pub use agents::{AgentRow, Agents, PendingKind};
pub use dictate::DictateView;
pub use extensions::{ExtensionsView, LspServerCheck};
pub use forge_primitives::document::DocumentRead;
// A view compares the values the surface hands it, so it needs their names
// too - re-exported here rather than reached for in the crates below, which
// a view does not name.
pub use forge_primitives::ConversationHistory;
pub use forge_workspace::env::cli_version::CliVersionInfo;
pub use forge_workspace::protocol::PendingAsk;
pub use forge_workspace::{DictateFailure, DictateModelState, DictateOutcome, LoadingState};
pub use roster::Roster;
pub use session::{SessionState, machine_turn};
pub use workers::{WorkerRef, Workers};

/// A view's read handle on the core.
pub struct ViewSurface {
    workspace: Arc<Workspace>,
    /// The pool's last scan and when it was taken, so a reader asking twice
    /// inside the window does not walk it twice. A `Mutex` rather than a
    /// second cache type: one report, one window.
    usage_cache:
        std::sync::Mutex<Option<(std::time::Instant, forge_primitives::token_usage::UsageReport)>>,
    /// Whether a pricing refresh is already out. The fetch crosses the
    /// network, so the ask that finds one running is not a reason for a
    /// second.
    pricing_refill: std::sync::atomic::AtomicBool,
    /// The one scan a cold cache runs: a second reader waits here rather than
    /// walking the pool beside the first.
    usage_scan: tokio::sync::Mutex<()>,
    /// How many scans were started, so a test can prove two misses ran one.
    #[cfg(any(test, feature = "testing"))]
    usage_scans: std::sync::atomic::AtomicU64,
    /// Holds every miss at one point, so the race the guard covers is a
    /// barrier rather than a large pool that might finish first.
    #[cfg(any(test, feature = "testing"))]
    usage_gate: std::sync::Mutex<Option<Arc<tokio::sync::Barrier>>>,
}

/// The update the core emits, re-exported: it is the workspace-to-view
/// protocol already, so a view subscribes to it rather than to a second
/// vocabulary this crate would have to keep in step.
pub use forge_workspace::SeatUpdate;
pub use forge_workspace::SessionUpdate;

/// The wire shape a turn that finished arrives as. A view marking a
/// completion reads the `Result` through this rather than deciding for
/// itself which results count.
pub fn is_success_result(is_error: bool, subtype: &str) -> bool {
    !is_error && subtype == "success"
}

/// A `[server]` size key in KB as bytes: `0` means no bound (`tool_record_cap_kb`
/// serves the records whole, `first_frame_cap_kb` the page the turn count asks
/// for), and a value too large for this machine is clamped rather than
/// truncated to zero.
fn cap_bytes(kb: u64) -> usize {
    if kb == 0 {
        usize::MAX
    } else {
        usize::try_from(kb.saturating_mul(1024)).unwrap_or(usize::MAX)
    }
}

impl ViewSurface {
    pub fn new(workspace: Arc<Workspace>) -> Self {
        Self {
            workspace,
            usage_cache: std::sync::Mutex::new(None),
            pricing_refill: std::sync::atomic::AtomicBool::new(false),
            usage_scan: tokio::sync::Mutex::new(()),
            #[cfg(any(test, feature = "testing"))]
            usage_scans: std::sync::atomic::AtomicU64::new(0),
            #[cfg(any(test, feature = "testing"))]
            usage_gate: std::sync::Mutex::new(None),
        }
    }

    /// The terminal a client asked to view, with this connection counted as
    /// a viewer. **An attach naming a terminal the seat no longer has is
    /// refused**; an attach naming none opens the seat's terminal, which is
    /// the person's door on a seat no agent has touched.
    pub fn terminal_attach_or_open(
        &self,
        seat: &SessionSlot,
        id: Option<u16>,
    ) -> Result<Arc<forge_workspace::terminal::TerminalEntry>, String> {
        let entry = match id {
            Some(id) => self.workspace.terminal_by_id(seat, id)?,
            // **The person's door on an untouched seat.** An attach that
            // names no terminal opens the seat's, creating it on first use.
            None => self.workspace.open_terminal(seat)?,
        };
        entry.attached.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
        Ok(entry)
    }

    /// The person's own take: always explicit, and landing even during a
    /// parked hand-off, whose surface opens as a viewer's.
    pub fn take_terminal_control(
        &self,
        seat: &SessionSlot,
        id: u16,
        viewer: u64,
    ) -> Result<(), String> {
        self.workspace.take_terminal_control(seat, id, viewer)
    }

    /// The person's close door: end the terminal's process group.
    pub fn terminal_close(&self, seat: &SessionSlot, id: u16) -> Result<(), String> {
        self.workspace.terminal_by_id(seat, id)?;
        self.workspace.close_terminal(seat);
        Ok(())
    }

    /// The attached surface changed size.
    pub fn terminal_resize(
        &self,
        seat: &SessionSlot,
        id: u16,
        cols: u16,
        rows: u16,
    ) -> Result<(), String> {
        let entry = self.workspace.terminal_by_id(seat, id)?;
        entry.terminal.resize(cols, rows).map_err(|error| error.to_string())
    }

    /// The person's own keystrokes, written to the PTY. They are not logged
    /// or forwarded, but the shell may echo them onto the screen the terminal
    /// tools read once the hand-off resolves.
    pub fn terminal_write(&self, seat: &SessionSlot, id: u16, bytes: &[u8]) -> Result<(), String> {
        let entry = self.workspace.terminal_by_id(seat, id)?;
        entry.terminal.write_bytes(bytes).map_err(|error| error.to_string())
    }

    /// Whether a hand-off parked on the seat's terminal owns its input.
    pub fn terminal_held(&self, seat: &SessionSlot) -> bool {
        self.workspace.terminal_held(seat)
    }

    /// The seat's terminal as the record draws it, when it has one.
    pub fn terminal(
        &self,
        seat: &SessionSlot,
    ) -> Option<forge_primitives::terminal::TerminalSummary> {
        let held = self.workspace.terminal_held(seat);
        self.workspace.terminal_if_any(seat).map(|entry| entry.summary(seat, held))
    }

    /// How many pool scans this surface started. Test-only: the single-flight
    /// guard's whole claim is that two concurrent misses start one.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_usage_scans(&self) -> u64 {
        self.usage_scans.load(std::sync::atomic::Ordering::Acquire)
    }

    /// Hold every usage miss here until the test lets it go. Test-only, and
    /// `None` outside the tests that seed one.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_usage_gate(&self, gate: Arc<tokio::sync::Barrier>) {
        *self.usage_gate.lock().unwrap_or_else(std::sync::PoisonError::into_inner) = Some(gate);
    }

    #[cfg(any(test, feature = "testing"))]
    async fn pass_test_usage_gate(&self) {
        let gate =
            self.usage_gate.lock().unwrap_or_else(std::sync::PoisonError::into_inner).clone();
        if let Some(gate) = gate {
            gate.wait().await;
        }
    }

    /// The byte cap one frame's `tool_use_result` may reach in a served
    /// page (#2374): `[server] tool_record_cap_kb`, with `0` meaning whole.
    pub fn tool_record_cap_bytes(&self) -> usize {
        cap_bytes(self.workspace.server_config().tool_record_cap_kb)
    }

    /// The conversation bytes a session's first snapshot may carry:
    /// `[server] first_frame_cap_kb`, with `0` meaning the turn count alone
    /// decides the page.
    pub fn first_frame_cap_bytes(&self) -> usize {
        cap_bytes(self.workspace.server_config().first_frame_cap_kb)
    }

    /// The conversation bytes a `more` page may carry:
    /// `[server] more_page_cap_kb`, with `0` meaning the turn count alone
    /// decides the page.
    pub fn more_page_cap_bytes(&self) -> usize {
        cap_bytes(self.workspace.server_config().more_page_cap_kb)
    }

    /// Dispatch one command to the core, which is how a view acts rather
    /// than only reads.
    ///
    /// A verb rather than an accessor, on purpose: a second view is handed
    /// the writes it needs and not the whole core, so nothing here grows a
    /// way to reach the workspace itself.
    pub fn dispatch(&self, command: Command) -> Result<(), DispatchError> {
        // A view's entry rather than the core's: the press is routed through
        // the view's own door, and no frame marks who sent it since v27.
        self.workspace.dispatch_from_view(command)
    }

    /// The last fatal error, or `None` when nothing has failed fatally.
    ///
    /// App-level rather than the seat's: it names a startup that could not
    /// happen. It is held because the update carries no state of its own,
    /// so a view that attached afterwards has no other way to learn of it.
    pub fn fatal_error(&self) -> Option<forge_primitives::error::AppError> {
        self.workspace.last_fatal_error()
    }

    /// The statuspage's last answer, or `None`.
    ///
    /// App-level: the answer is the same for every viewer, so the core
    /// probes it once and every view reads this rather than fetching its
    /// own. `None` covers both a healthy statuspage and one that could not
    /// be reached, which is the fetch's own contract.
    pub fn service_status(&self) -> Option<forge_primitives::cloud::service_status::ServiceIssue> {
        self.workspace.service_status()
    }

    /// What the seat at `slot` is holding, with a draft leading and the rest
    /// oldest first, so a view that attached after a prompt landed still
    /// draws what it offers. Empty when the seat is holding nothing.
    pub fn pending_asks(&self, slot: &SessionSlot) -> Vec<PendingAsk> {
        self.workspace.pending_asks(slot)
    }

    /// The core's own update stream for a consumer that reads it WITHOUT
    /// answering.
    ///
    /// **The caller this exists for is a process-wide fold.** It folds into
    /// state of its own and never replies, so the answering role would park
    /// a permission, question or Slack draft waiting on an answer nobody
    /// sends.
    ///
    /// A view with a dock to answer from takes [`Self::subscribe_client`].
    pub fn subscribe_mirror(&self) -> tokio::sync::mpsc::UnboundedReceiver<SeatUpdate> {
        self.workspace.subscribe_mirror()
    }

    /// The core's stream for a connecting client, registered with the
    /// role that client declared.
    ///
    /// **A stream carries what follows its own subscribe and nothing
    /// before it**, whatever the role: a client that attaches late reads what
    /// it missed from the subject's snapshot.
    ///
    /// The role decides one thing: whether the core may park a prompt on this
    /// connection's reply. `answering` is the client's own statement that it
    /// can show and answer a prompt.
    pub fn subscribe_client(
        &self,
        answering: bool,
    ) -> tokio::sync::mpsc::UnboundedReceiver<SeatUpdate> {
        if answering {
            self.workspace.subscribe_answerer()
        } else {
            self.workspace.subscribe_mirror()
        }
    }

    /// The projects, their sessions, and the per-project lists the home
    /// page renders.
    pub fn roster(&self) -> Roster {
        Roster::collect(Arc::clone(&self.workspace))
    }

    /// One session's operational state. `cwd_raw` is the caller's own
    /// cwd for the session, which a git worker's worktree overrides.
    pub fn session(&self, slot: &SessionSlot, cwd_raw: &Path) -> SessionState {
        SessionState::collect(&self.workspace, slot, cwd_raw)
    }

    /// The number `slot`'s next frame will be minted under: the read a
    /// client makes when it attaches. It belongs to the epoch its occupant
    /// names - a seat whose occupant changed starts over at 1 - so the two
    /// are read together.
    pub fn seat_next_seq(&self, slot: &SessionSlot) -> u64 {
        self.workspace.seat_next_seq(slot)
    }

    /// The frames `slot`'s stream emitted under the numbers in `from..=to`,
    /// oldest first: the answer to a client's range ask while the seat's own
    /// window holds them.
    pub fn seat_frames_between(&self, slot: &SessionSlot, from: u64, to: u64) -> Vec<SeatUpdate> {
        self.workspace.seat_frames_between(slot, from, to)
    }

    /// The oldest number `slot`'s window still holds, `None` for a seat that
    /// has emitted nothing: what tells a range answered from memory from one
    /// that has to be read off the transcript.
    pub fn seat_oldest_kept_seq(&self, slot: &SessionSlot) -> Option<u64> {
        self.workspace.seat_oldest_kept_seq(slot)
    }

    /// How many of the numbers in `from..=to` on `slot`'s stream no window
    /// holds: the frames that close an epoch are numbered but kept out of the
    /// ring, so a reader measuring whether a copy covers a stretch leaves them
    /// out of what it must account for.
    pub fn seat_unringed_between(&self, slot: &SessionSlot, from: u64, to: u64) -> u64 {
        self.workspace.seat_unringed_between(slot, from, to)
    }

    /// Whether `slot`'s latest epoch-opening seal carried rows, which no ring
    /// holds.
    pub fn seat_epoch_opened_with_rows(&self, slot: &SessionSlot) -> bool {
        self.workspace.seat_epoch_opened_with_rows(slot)
    }

    /// The live workers, per project.
    pub fn workers(&self) -> Workers {
        Workers::collect(Arc::clone(&self.workspace))
    }

    /// The installed and npm-published `claude` CLI versions. The same
    /// answer for every viewer, so the core holds it and a change arrives
    /// as `SessionUpdate::CliVersionChanged`; `None` until the boot probe
    /// lands.
    pub fn cli_version(&self) -> Option<CliVersionInfo> {
        self.workspace.cli_version()
    }

    /// Register this connection as an attached client for as long as it
    /// lives, so a document hand-off can tell a viewer exists to open on.
    /// The transport's per-connection guard calls these two.
    pub fn client_attached(&self) {
        self.workspace.note_client_attached();
    }

    /// The counterpart of [`Self::client_attached`].
    pub fn client_detached(&self) {
        self.workspace.note_client_detached();
    }

    /// The live `[server]` snapshot, read by the socket's origin gate on
    /// every upgrade so a reload's new allowances apply to the next
    /// connection without a restart.
    pub fn server_config(&self) -> forge_primitives::ServerConfig {
        self.workspace.server_config()
    }

    /// The `[client]` settings a connection greets with. Read when the
    /// connection opens, so an edit applies to the next connection.
    pub fn client_config(&self) -> forge_primitives::ClientConfig {
        self.workspace.client_config()
    }

    /// Apply a batched settings save. The refusal is answered by the
    /// connection that asked, on the settings refusal frame.
    pub fn save_settings(
        &self,
        fingerprint: &str,
        edits: &[forge_primitives::settings::SettingsEditRequest],
    ) -> Result<(), forge_workspace::SettingsSaveError> {
        self.workspace.save_settings(fingerprint, edits)
    }

    /// One document, read out of the seat's own tree for a viewer's route.
    ///
    /// `path` resolves against the session's working directory and
    /// `reviewable` is what the hand-off flagged; both go to the read in
    /// `forge_agent::env::documents`, whose refusals are the sentences a
    /// route draws and a refused hand-off returns. The seat's project's
    /// `document_roots` go with them, so a document the hand-off accepted
    /// opens here too. The read is blocking (a file off disk), so a
    /// caller offloads it rather than running it in a handler.
    pub fn read_document(
        &self,
        seat: &SessionSlot,
        path: &str,
        reviewable: bool,
    ) -> Result<DocumentRead, String> {
        let Some(cwd) = self.roster().cwd_for(seat) else {
            return Err(format!("forge holds no session for {}", seat.display()));
        };
        forge_workspace::env::documents::read(
            &cwd,
            &self.roster().document_roots_for(seat),
            path,
            reviewable,
            self.workspace.document_max_bytes(),
        )
        .map_err(|refusal| refusal.to_string())
    }

    /// The byte ceiling every whole-file read takes, which the record's
    /// whole-file anchor fallback shares with the review page's expansion.
    pub fn document_max_bytes(&self) -> u64 {
        self.workspace.document_max_bytes()
    }

    /// One file's whole content at a revision, for a review page's
    /// between-hunk expansion.
    ///
    /// `sha` names the revision - a commit's own tree for a commit scope -
    /// and `None` reads the seat's branch tip, which is the new side of the
    /// all-changes diff. The read is bounded by the same ceiling a document
    /// read is, and a file cut at that ceiling answers the lines it carried,
    /// flagged, rather than refusing: the gaps those lines reach are still
    /// worth drawing.
    ///
    /// **`None` is the branch tip read NOW, and it is stated rather than
    /// pinned for want of anything to pin it to.** The record's diff was
    /// scanned from this same seat, but it carries no revision for its
    /// branch layer - its commit chain names only the commits ahead of the
    /// default - so a branch that moves between the record's read and the
    /// reader's ask can draw newer lines against frozen hunks. The window is
    /// the record's age, the page draws its own controls only for lines the
    /// read reaches, and the alternative (carrying the scanned revision on
    /// the record, and a wire field with it) buys a race nobody has hit for
    /// a field every reader would pay.
    pub async fn file_content(
        &self,
        seat: &SessionSlot,
        path: &str,
        sha: Option<&str>,
    ) -> Result<forge_workspace::env::git_diff::file::FileLines, String> {
        let Some(cwd) = self.roster().cwd_for(seat) else {
            return Err(format!("forge holds no session for {}", seat.display()));
        };
        forge_workspace::env::git_diff::file::read_file_lines(
            &cwd,
            sha.unwrap_or("HEAD"),
            path,
            self.workspace.document_max_bytes(),
        )
        .await
        .map_err(|refusal| refusal.to_string())
    }

    /// The conversation the session at `slot` holds, read from its own
    /// transcript on disk: the same read a resume performs, for a view
    /// that arrived after the session was already running or one opening a
    /// seat that is asleep (the id is the live occupant's when there is one,
    /// and the store's own row otherwise - `transcript_place` resolves it).
    ///
    /// Subscribe first, then call this. The read is the baseline the stream
    /// is applied on top of, so a message may be in both: a view resolves
    /// that by dropping the stream's copy when the read already carries its
    /// id, and reading first instead would lose whatever arrived in between,
    /// which no later read brings back.
    ///
    /// The one class the two halves cannot reconcile by id is the prompts
    /// the workspace injects. A cron, a Gotify delivery, a Slack bundle or a
    /// peer comm reaches the stream as text alone (`CronPromptAppended`,
    /// `GotifyNotificationAppended`, `SlackMessageAppended`) and reaches this
    /// read as the envelope-wrapped row the CLI persisted, with no id shared
    /// between them, so a view holding both has to match on the envelope's
    /// source and body instead.
    ///
    /// This reads a whole transcript off disk on the calling thread, with no
    /// size cap: a real session costs milliseconds, and the largest
    /// transcript on this machine 2.5 s in a release build. A caller must
    /// offload it rather than run it in a handler, the way this project's
    /// other async work does with a spawned task on its own channel.
    ///
    /// `cwd_raw` is the session's own cwd, which a git worker's worktree
    /// overrides. An empty `cwd_raw` resolves to the slot's recorded path,
    /// because the read's no-directory arm walks every `projects/` directory
    /// for the first file named after the session: that pays the walk per
    /// call and takes whichever copy of the same session it meets first. A
    /// slot with no live session, or one whose cwd no record places, reads as
    /// an empty conversation, and records which of the two it was, so a view
    /// drawing nothing can say which of them it met rather than only that it
    /// has nothing to draw.
    ///
    /// **This is the surface's read for a view that does not hold its own,
    /// and the transport reads it only for a seat it holds nothing for.**
    /// A live seat's conversation is the one the session task seeds, so no
    /// request walks a file for it; a sleeping one has no task to ask and
    /// this read is what answers it (`transport::wire::seed_from_transcript`).
    /// A view keeps its own copy in session state. The verb's other
    /// callers are the surface's own tests and the measurement harness, which
    /// is what a surface test is for rather than a sign it is unused.
    pub fn conversation(&self, slot: &SessionSlot, cwd_raw: &Path) -> ConversationHistory {
        let Some((session_id, cwd)) = self.transcript_place(slot, cwd_raw) else {
            return ConversationHistory::default();
        };
        // **A dispatch row's expansion is drawn from these frames.** The
        // page carries the sub-agent's own rows so the chat can render the
        // timeline under the call; the row list skips them client-side
        // (#1763).
        let read = forge_workspace::session_history(self.workspace.config_dir(), &session_id, &cwd);
        ConversationHistory {
            messages: crate::transcript::notices_as_blocks(read.messages),
            compaction_count: read.compaction_count,
            session_id: Some(session_id),
        }
    }

    /// The schedules the fired prompts in `uuids` came from, keyed by the
    /// prompt's own id: the read half of the pairing the delivery frame
    /// carries once.
    pub fn cron_names(
        &self,
        slot: &SessionSlot,
        uuids: &[&str],
    ) -> std::collections::BTreeMap<String, forge_primitives::cron::CronName> {
        self.workspace.cron_names(slot, uuids)
    }

    /// The rows of `slot`'s transcript that sit strictly before `below`, for a
    /// paging read that has walked below the held window's floor.
    ///
    /// **A bounded row read.** `below` is the row the page above stopped at -
    /// the id it carries and, once a read has seen it, the byte it starts at -
    /// and `None` reads the file's own newest rows, which is what a walk asks
    /// for on a window that holds no row to name. `None` when the transcript
    /// cannot answer: no session for the slot, no file, or an anchor the file
    /// does not carry.
    pub fn transcript_rows(
        &self,
        slot: &SessionSlot,
        cwd_raw: &Path,
        below: Option<&forge_primitives::TranscriptAnchor>,
        rows: usize,
    ) -> Option<forge_primitives::TranscriptSpan> {
        let (session_id, cwd) = self.transcript_place(slot, cwd_raw)?;
        forge_workspace::transcript_rows(
            self.workspace.config_dir(),
            &session_id,
            &cwd,
            below,
            rows,
        )
    }

    /// The session id and the working directory a transcript read for `slot`
    /// needs, each unmet case recorded as it was met.
    ///
    /// **The id is the live occupant's when there is one, and the store's own
    /// row otherwise.** A sleeping seat still has a session - the one a wake
    /// resumes - and its transcript is what a view opening on it reads, so a
    /// read that resolved only pooled sessions drew a sleeping seat empty.
    fn transcript_place(&self, slot: &SessionSlot, cwd_raw: &Path) -> Option<(String, String)> {
        let Some(session_id) = self.workspace.transcript_session_id_for(slot) else {
            tracing::debug!(
                event_name = "conversation_no_session",
                org = slot.org(),
                project = slot.project(),
                label = slot.label(),
                "no session is recorded for this slot - nothing live and no stored id - \
                 so nothing here can find its transcript; drawing the conversation empty",
            );
            return None;
        };
        let cwd_raw = if cwd_raw.as_os_str().is_empty() {
            let Some(recorded) = self.workspace.cwd_for_session(slot) else {
                tracing::debug!(
                    event_name = "conversation_cwd_unplaced",
                    org = slot.org(),
                    project = slot.project(),
                    label = slot.label(),
                    session_id = %session_id,
                    "no record places this session's working directory, so its transcript \
                     cannot be looked up; drawing the conversation empty",
                );
                return None;
            };
            PathBuf::from(recorded)
        } else {
            cwd_raw.to_path_buf()
        };
        let cwd = self.workspace.git_scan_cwd_for_session(slot, &cwd_raw);
        Some((session_id, cwd.to_string_lossy().into_owned()))
    }
}

#[cfg(test)]
mod tests {
    use std::path::Path;
    use std::sync::Arc;

    use forge_primitives::SessionSlot;
    use forge_workspace::Workspace;

    use super::ViewSurface;
    use crate::test_support::logged;

    /// The claude versions are facts about the world rather than about a
    /// viewer, so a view reads the core's answer instead of probing for
    /// itself: nothing probed yet reads as nothing.
    #[tokio::test]
    async fn the_surface_reads_the_claude_version_the_core_holds() {
        let (workspace, _dir) = crate::surface::testing::workspace();
        let surface = ViewSurface::new(Arc::clone(&workspace));

        assert!(surface.cli_version().is_none(), "nothing probed yet reads as nothing");

        workspace.seed_test_cli_version(Some("2.1.156"), Some("2.1.201"));
        let held = surface.cli_version().expect("the core's snapshot reaches the view");

        assert_eq!(
            held.installed.as_deref(),
            Some("2.1.156"),
            "the verb carries the installed version the core holds",
        );
        assert_eq!(held.latest.as_deref(), Some("2.1.201"), "and the published one beside it");
    }

    /// The mirror is the call site, not the fanout. Both verbs sit on one
    /// `UpdateFanout`, whose own test pins its two halves; what this pins
    /// is which half each one calls.
    ///
    /// **The role decides whether the core may park a prompt on a reply.**
    /// A view that draws a dock while declaring itself an observer draws
    /// prompts that are already dead - the workspace resolves a permission,
    /// question or Slack draft `Cancelled` when no subscriber can answer -
    /// and nothing in a build or a test would say so. This is the one place
    /// in the tree that tells the two apart.
    #[tokio::test]
    async fn a_surface_client_subscribes_with_the_role_it_declared() {
        let (workspace, _dir) = crate::surface::testing::workspace();
        let surface = ViewSurface::new(Arc::clone(&workspace));

        let _answering = surface.subscribe_client(true);
        let _mirror = surface.subscribe_client(false);
        let _fold = surface.subscribe_mirror();

        assert_eq!(
            workspace.test_answering_count(),
            1,
            "only the client that declared it answers counts as an answerer",
        );
        assert_eq!(workspace.test_subscriber_count(), 3, "each verb registers a stream of its own");
    }

    const SESSION_A: &str = "5b1c2d3e-4f50-4a61-b728-9c0d1e2f3a45";
    const SESSION_B: &str = "6c2d3e4f-5061-4b72-8839-ad1e2f3a4b56";

    /// Write `turns` user rows as the transcript of `session_id`, under the
    /// project key `cwd` resolves to: where the CLI would have left them.
    fn seed_transcript(projects: &Path, session_id: &str, turns: usize) {
        use std::fmt::Write as _;
        let mut body = String::new();
        for i in 0..turns {
            let _ = writeln!(
                body,
                "{{\"type\":\"user\",\"message\":{{\"role\":\"user\",\"content\":\"turn {i}\"}}}}"
            );
        }
        std::fs::write(projects.join(format!("{session_id}.jsonl")), body).expect("write");
    }

    /// A worker's transcript is written under its worktree's project key,
    /// not the project root's, so the verb has to resolve the cwd the way
    /// the session verb beside it does: a caller handing it the project
    /// root still reads the worker's own conversation rather than an
    /// empty one.
    #[test]
    fn conversation_resolves_a_workers_worktree() {
        let dir = tempfile::tempdir().expect("tempdir");
        let (workspace, _updates) = Workspace::testing_stub_with_config_dir(dir.path().to_owned());
        let project_root = dir.path().join("project");
        std::fs::create_dir_all(&project_root).expect("project dir");
        workspace.seed_test_project("forge", &project_root.to_string_lossy());

        let worker = SessionSlot::worker("TestOrg", "forge", "probe-a");
        let worktree = project_root.join(".claude/worktrees/probe-a");
        std::fs::create_dir_all(&worktree).expect("worktree");
        workspace.seed_test_running_session_id(&worker, SESSION_A);
        let project = ViewSurface::new(Arc::clone(&workspace))
            .roster()
            .project_named("forge")
            .expect("seeded project")
            .key
            .clone();
        workspace.insert_live_worker(
            &project,
            forge_workspace::WorkerEntry {
                label: "probe-a".to_owned(),
                charter: "charter".to_owned(),
                slot: worker.clone(),
                session_id: None,
                status: forge_primitives::WorkerLiveness::Running,
                spawned_at: std::time::SystemTime::UNIX_EPOCH,
                spawned_by: SessionSlot::lead("TestOrg", "forge"),
                needs_tag: false,
                is_git_repo_at_spawn: true,
                cwd: None,
                diagnostic: None,
                kick: None,
            },
        );

        let worktree_str = worktree.to_string_lossy().into_owned();
        let projects = dir.path().join("projects").join(
            forge_workspace::userdata::catalog::scan::project_key_for_directory(Some(
                &worktree_str,
            )),
        );
        std::fs::create_dir_all(&projects).expect("projects dir");
        seed_transcript(&projects, SESSION_A, 2);

        let read = ViewSurface::new(Arc::clone(&workspace)).conversation(&worker, &project_root);

        assert_eq!(read.messages.len(), 2, "the worker reads its worktree transcript");
    }

    /// An empty `cwd_raw` is a state a project picker produces, and the read
    /// must not carry it on. The slot's own record places the read instead,
    /// so a caller that holds no path still gets the session's conversation.
    /// The fixture writes a real `forge.toml`: the project has to be one the
    /// workspace loaded, not one only the test overlay knows.
    #[test]
    fn conversation_places_an_empty_cwd_from_the_session_record() {
        let (workspace, _dir) = crate::surface::testing::workspace();
        let lead = SessionSlot::lead("TestOrg", "forge");
        workspace.seed_test_running_session_id(&lead, SESSION_A);

        // The fixture's one project lives at `/tmp`; the transcript lands
        // under its key inside the fixture's own config dir.
        let projects = workspace.config_dir().join("projects").join(
            forge_workspace::userdata::catalog::scan::project_key_for_directory(Some("/tmp")),
        );
        std::fs::create_dir_all(&projects).expect("projects dir");
        seed_transcript(&projects, SESSION_A, 2);

        let read = ViewSurface::new(Arc::clone(&workspace)).conversation(&lead, Path::new(""));

        assert_eq!(read.messages.len(), 2, "the record places the read the caller could not");
    }

    /// **A dispatch row's expansion is drawn from these frames.** The read
    /// folds a sidecar in under its dispatch, and the page must carry the
    /// sub-agent's own rows so the chat can render the call's timeline; the
    /// client's row list is what skips them, not this read (#1763).
    #[test]
    fn conversation_carries_subagent_frames() {
        let (workspace, _dir) = crate::surface::testing::workspace();
        let lead = SessionSlot::lead("TestOrg", "forge");
        workspace.seed_test_running_session_id(&lead, SESSION_A);
        let projects = workspace.config_dir().join("projects").join(
            forge_workspace::userdata::catalog::scan::project_key_for_directory(Some("/tmp")),
        );
        std::fs::create_dir_all(&projects).expect("projects dir");
        std::fs::write(
            projects.join(format!("{SESSION_A}.jsonl")),
            "{\"type\":\"assistant\",\"message\":{\"id\":\"msg_1\",\"type\":\"message\",\"role\":\"assistant\",\"model\":\"claude-sonnet-5\",\"content\":[{\"type\":\"tool_use\",\"id\":\"toolu_a\",\"name\":\"Agent\",\"input\":{\"prompt\":\"x\"}}]},\"uuid\":\"a1\"}\n\
             {\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":[{\"type\":\"tool_result\",\"tool_use_id\":\"toolu_a\",\"content\":\"done\"}]},\"uuid\":\"u1\"}\n",
        )
        .expect("write");
        let sidecars = projects.join(SESSION_A).join("subagents");
        std::fs::create_dir_all(&sidecars).expect("subagents dir");
        std::fs::write(
            sidecars.join("agent-abc.meta.json"),
            "{\"agentType\":\"Explore\",\"toolUseId\":\"toolu_a\"}",
        )
        .expect("meta");
        std::fs::write(
            sidecars.join("agent-abc.jsonl"),
            "{\"type\":\"assistant\",\"message\":{\"id\":\"msg_2\",\"type\":\"message\",\"role\":\"assistant\",\"model\":\"claude-sonnet-5\",\"content\":[{\"type\":\"text\",\"text\":\"child\"}]},\"uuid\":\"c1\"}\n",
        )
        .expect("sidecar");

        let read = ViewSurface::new(Arc::clone(&workspace)).conversation(&lead, Path::new(""));

        assert_eq!(
            read.messages.len(),
            3,
            "the transcript's two rows plus the sidecar frame the row expansion draws",
        );
        assert!(
            read.messages.iter().any(|message| matches!(
                message,
                forge_primitives::Message::Assistant {
                    parent_tool_use_id: Some(parent),
                    ..
                } if parent == "toolu_a"
            )),
            "the sub-agent frame is carried and names the dispatch it ran under",
        );
    }

    /// **A sub-agent's refused result survives the read with its error mark.**
    /// The sidecar fold itself is #1763's; this pins the half a resumed page
    /// needs: the denial comes through as an errored `tool_result` whose
    /// content still carries the refusal's words, under the expansion that
    /// owns it. No measured capture keeps a `permission_denied` row for a
    /// sub-agent's call, so the sidecar row is the only thing a reload can
    /// draw it from.
    #[test]
    fn conversation_carries_a_subagents_denied_result() {
        let (workspace, _dir) = crate::surface::testing::workspace();
        let lead = SessionSlot::lead("TestOrg", "forge");
        workspace.seed_test_running_session_id(&lead, SESSION_A);
        let projects = workspace.config_dir().join("projects").join(
            forge_workspace::userdata::catalog::scan::project_key_for_directory(Some("/tmp")),
        );
        std::fs::create_dir_all(&projects).expect("projects dir");
        std::fs::write(
            projects.join(format!("{SESSION_A}.jsonl")),
            "{\"type\":\"assistant\",\"message\":{\"id\":\"msg_1\",\"type\":\"message\",\"role\":\"assistant\",\"model\":\"claude-sonnet-5\",\"content\":[{\"type\":\"tool_use\",\"id\":\"toolu_a\",\"name\":\"Agent\",\"input\":{\"prompt\":\"x\"}}]},\"uuid\":\"a1\"}\n\
             {\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":[{\"type\":\"tool_result\",\"tool_use_id\":\"toolu_a\",\"content\":\"done\"}]},\"uuid\":\"u1\"}\n",
        )
        .expect("write");
        let sidecars = projects.join(SESSION_A).join("subagents");
        std::fs::create_dir_all(&sidecars).expect("subagents dir");
        std::fs::write(
            sidecars.join("agent-abc.meta.json"),
            "{\"agentType\":\"general-purpose\",\"toolUseId\":\"toolu_a\"}",
        )
        .expect("meta");
        std::fs::write(
            sidecars.join("agent-abc.jsonl"),
            "{\"type\":\"assistant\",\"agentId\":\"agent-abc\",\"message\":{\"id\":\"msg_2\",\"type\":\"message\",\"role\":\"assistant\",\"model\":\"claude-sonnet-5\",\"content\":[{\"type\":\"tool_use\",\"id\":\"call_refused\",\"name\":\"Bash\",\"input\":{\"command\":\"rm -rf /tmp/x\"}}]},\"uuid\":\"c1\"}\n\
             {\"type\":\"user\",\"agentId\":\"agent-abc\",\"message\":{\"role\":\"user\",\"content\":[{\"type\":\"tool_result\",\"content\":\"Permission to use Bash with command rm -rf /tmp/x has been denied.\",\"is_error\":true,\"tool_use_id\":\"call_refused\"}]},\"uuid\":\"c2\"}\n",
        )
        .expect("sidecar");

        let read = ViewSurface::new(Arc::clone(&workspace)).conversation(&lead, Path::new(""));

        let denied = read
            .messages
            .iter()
            .find_map(|message| match message {
                forge_primitives::Message::User { parent_tool_use_id, message, .. }
                    if parent_tool_use_id.as_deref() == Some("toolu_a") =>
                {
                    message.content.iter().find_map(|block| match block {
                        forge_primitives::ContentBlock::ToolResult {
                            tool_use_id,
                            is_error,
                            content,
                            ..
                        } if tool_use_id == "call_refused" && *is_error => Some(content.clone()),
                        _ => None,
                    })
                }
                _ => None,
            })
            .expect("the sidecar's refused result, under the dispatch it ran under");
        assert!(
            format!("{denied:?}").contains("has been denied"),
            "and it carries the refusal's own words: {denied:?}",
        );
    }

    /// A slot whose cwd no record places reads as empty, and not as whatever
    /// a walk of every project happened to find: given no directory, the scan
    /// answers with the first `<session_id>.jsonl` on disk, which here is
    /// another project directory's copy of the same session.
    #[test]
    fn conversation_does_not_scan_every_project_for_an_empty_cwd() {
        let dir = tempfile::tempdir().expect("tempdir");
        let (workspace, _updates) = Workspace::testing_stub_with_config_dir(dir.path().to_owned());
        let stranger = dir.path().join("projects").join("some-other-project");
        std::fs::create_dir_all(&stranger).expect("projects dir");
        seed_transcript(&stranger, SESSION_A, 2);

        let unplaced = SessionSlot::lead("TestOrg", "not-a-project");
        workspace.seed_test_running_session_id(&unplaced, SESSION_A);

        let read = ViewSurface::new(Arc::clone(&workspace)).conversation(&unplaced, Path::new(""));

        assert!(read.messages.is_empty(), "no recorded cwd reads as empty, not as a stranger's");
    }

    /// The verb reads the slot's own transcript, and a slot with no session
    /// reads as empty: a view arriving before a session exists must render an
    /// empty conversation, not another session's.
    #[test]
    fn conversation_reads_the_slot_and_not_a_neighbour() {
        let dir = tempfile::tempdir().expect("tempdir");
        let (workspace, _updates) = Workspace::testing_stub_with_config_dir(dir.path().to_owned());
        let cwd = dir.path().join("project");
        std::fs::create_dir_all(&cwd).expect("project dir");
        let cwd_str = cwd.to_string_lossy().into_owned();
        let projects = dir.path().join("projects").join(
            forge_workspace::userdata::catalog::scan::project_key_for_directory(Some(&cwd_str)),
        );
        std::fs::create_dir_all(&projects).expect("projects dir");
        seed_transcript(&projects, SESSION_A, 2);
        seed_transcript(&projects, SESSION_B, 3);

        // One project, three seats: the neighbours differ by label rather
        // than by project, so a read that resolves the wrong seat is the
        // one this catches.
        let a = SessionSlot::lead("TestOrg", "forge");
        let b = SessionSlot::worker("TestOrg", "forge", "probe-a");
        let idle = SessionSlot::worker("TestOrg", "forge", "asleep");
        workspace.seed_test_running_session_id(&a, SESSION_A);
        workspace.seed_test_running_session_id(&b, SESSION_B);

        let surface = ViewSurface::new(Arc::clone(&workspace));
        let read_a = surface.conversation(&a, &cwd);
        let read_b = surface.conversation(&b, &cwd);

        assert_eq!(read_a.messages.len(), 2, "each slot reads its own transcript");
        assert_eq!(read_b.messages.len(), 3, "and the neighbour reads its own, not this one");
        let none = surface.conversation(&idle, &cwd);
        assert!(none.messages.is_empty(), "a slot with no session reads as empty");
    }

    /// A view drawing an empty conversation with nothing recorded gives a
    /// reader no way to tell a session with no transcript from a read that
    /// never happened, so each of the two silent paths says which it was,
    /// and names the slot it was silent for.
    #[test]
    fn an_empty_conversation_records_which_kind_of_empty_it_was() {
        let dir = tempfile::tempdir().expect("tempdir");
        let (workspace, _updates) = Workspace::testing_stub_with_config_dir(dir.path().to_owned());
        let surface = ViewSurface::new(Arc::clone(&workspace));

        // Whether one record carries `event_name`, at debug, naming all three
        // parts of `slot`: the org, project and label a reader acts on.
        let names = |events: &[(tracing::Level, String)], event_name: &str, slot: &SessionSlot| {
            events.iter().any(|(level, fields)| {
                *level == tracing::Level::DEBUG
                    && fields.contains(event_name)
                    && fields.contains(&format!(r#"org="{}""#, slot.org()))
                    && fields.contains(&format!(r#"project="{}""#, slot.project()))
                    && fields.contains(&format!(r#"label="{}""#, slot.label()))
            })
        };

        let idle = SessionSlot::lead("TestOrg", "forge");
        let no_session = logged(|| {
            let read = surface.conversation(&idle, Path::new("/tmp"));
            assert!(read.messages.is_empty(), "a slot with no session still reads as empty");
        });
        assert!(
            names(&no_session, "conversation_no_session", &idle),
            "the slot with no session at all is named, and so is what was missing: \
             {no_session:?}",
        );

        let unplaced = SessionSlot::lead("TestOrg", "not-a-project");
        workspace.seed_test_running_session_id(&unplaced, SESSION_A);
        let no_cwd = logged(|| {
            let read = surface.conversation(&unplaced, Path::new(""));
            assert!(read.messages.is_empty(), "an unplaced cwd still reads as empty");
        });
        let read_as_the_other =
            no_cwd.iter().any(|(_, fields)| fields.contains("conversation_no_session"));
        assert!(
            names(&no_cwd, "conversation_cwd_unplaced", &unplaced)
                && no_cwd.iter().any(|(_, fields)| fields.contains(SESSION_A))
                && !read_as_the_other,
            "a cwd no record places is named as its own reason and not as the other one, \
             for the session it could not place: {no_cwd:?}",
        );
    }

    /// The viewer's route hands the seat's project's document roots to the
    /// read, so a document the hand-off accepted opens here too - and a
    /// path outside the tree and every root keeps the refusal. Dropping
    /// the roots from the read call fails this on the first read.
    #[test]
    fn the_viewer_route_reads_a_document_under_the_seats_document_roots() {
        let tree = tempfile::tempdir().expect("tempdir");
        let documents = tempfile::tempdir().expect("tempdir");
        std::fs::write(documents.path().join("plan.md"), b"# plan\n").expect("the document");
        let elsewhere = tempfile::tempdir().expect("tempdir");
        std::fs::write(elsewhere.path().join("x.md"), b"x").expect("the outside document");
        let (workspace, _dir) =
            crate::surface::testing::workspace_with_document_roots(tree.path(), documents.path());
        let surface = ViewSurface::new(Arc::clone(&workspace));
        let seat = SessionSlot::lead("TestOrg", "forge");

        let plan = documents.path().join("plan.md");
        let document = surface
            .read_document(&seat, &plan.to_string_lossy(), false)
            .expect("the document opens");
        assert_eq!(document.bytes, b"# plan\n");
        assert_eq!(document.path, plan.canonicalize().expect("canonical"), "resolved");

        let outside = elsewhere.path().join("x.md");
        let refusal = surface
            .read_document(&seat, &outside.to_string_lossy(), false)
            .expect_err("outside the tree and every root");
        assert!(
            refusal.contains("resolves outside the session's tree"),
            "the refusal sentence, unchanged: {refusal}"
        );
    }
}

#[cfg(test)]
pub(crate) mod testing {
    use std::sync::Arc;

    use forge_workspace::Workspace;

    const CONFIG: &str = "\
[[orgs]]
name = \"TestOrg\"
accounts = [\"Granite\", \"OpenRouter-TM\"]

[[orgs.projects]]
name = \"forge\"
path = \"/tmp\"

[[accounts]]
display_name = \"Granite\"
token = \"t\"
models = [\"claude-sonnet-5\"]
provider = \"anthropic\"

[[accounts]]
display_name = \"OpenRouter-TM\"
token = \"t\"
models = [\"deepseek-v4.1-flash\"]
provider = \"openrouter\"
base_url = \"https://openrouter.ai/api\"

[dictate]
enabled = true
models_dir = \"/tmp/forge-dictate-models\"
";

    /// A workspace over a tempdir config with two accounts and one
    /// project, with its store open, plus the tempdir that must outlive
    /// it.
    pub(crate) fn workspace() -> (Arc<Workspace>, tempfile::TempDir) {
        let dir = tempfile::tempdir().expect("tempdir");
        let forge = dir.path().join("forge");
        std::fs::create_dir_all(&forge).expect("forge/");
        std::fs::write(forge.join("forge.toml"), CONFIG).expect("write forge.toml");
        let workspace = Workspace::new_for_test(dir.path().to_owned()).expect("workspace");
        workspace.install_db_for_test(
            forge_workspace::store::Db::open(&dir.path().join("db.redb")).expect("open db"),
        );
        (Arc::new(workspace), dir)
    }

    /// A workspace whose one project is rooted at `root` and declares
    /// `document_roots`, its store open. Both come from `forge.toml`, so
    /// the seat's cwd and its document roots resolve the way production's
    /// do.
    pub(crate) fn workspace_with_document_roots(
        root: &std::path::Path,
        documents: &std::path::Path,
    ) -> (Arc<Workspace>, tempfile::TempDir) {
        let dir = tempfile::tempdir().expect("tempdir");
        let forge = dir.path().join("forge");
        std::fs::create_dir_all(&forge).expect("forge/");
        let config = format!(
            "\
[[orgs]]
name = \"TestOrg\"
accounts = [\"Granite\"]

[[orgs.projects]]
name = \"forge\"
path = \"{}\"
document_roots = [\"{}\"]

[[accounts]]
display_name = \"Granite\"
token = \"t\"
models = [\"claude-sonnet-5\"]
provider = \"anthropic\"
",
            root.display(),
            documents.display(),
        );
        std::fs::write(forge.join("forge.toml"), config).expect("write forge.toml");
        let workspace = Workspace::new_for_test(dir.path().to_owned()).expect("workspace");
        workspace.install_db_for_test(
            forge_workspace::store::Db::open(&dir.path().join("db.redb")).expect("open db"),
        );
        (Arc::new(workspace), dir)
    }

    /// The fixture with the pricing refill driven by `fetcher`: the cache
    /// starts empty, so a scan answers unpriced and kicks the fetch, and
    /// the test owns what the fetch answers and when.
    pub(crate) fn workspace_with_pricing_fetcher(
        fetcher: forge_workspace::PricingFetcher,
    ) -> (Arc<Workspace>, tempfile::TempDir) {
        let dir = tempfile::tempdir().expect("tempdir");
        let forge = dir.path().join("forge");
        std::fs::create_dir_all(&forge).expect("forge/");
        std::fs::write(forge.join("forge.toml"), CONFIG).expect("write forge.toml");
        let workspace =
            Workspace::new_for_test_with_pricing_fetcher(dir.path().to_owned(), fetcher)
                .expect("workspace");
        (Arc::new(workspace), dir)
    }

    /// The same fixture with a pricing snapshot already cached: the row is
    /// written into the store before the workspace opens it, the way the
    /// boot load expects to find it, so a scan prices from it with nothing
    /// left to fetch.
    pub(crate) fn workspace_with_pricing(json: &str) -> (Arc<Workspace>, tempfile::TempDir) {
        let dir = tempfile::tempdir().expect("tempdir");
        let forge = dir.path().join("forge");
        std::fs::create_dir_all(&forge).expect("forge/");
        std::fs::write(forge.join("forge.toml"), CONFIG).expect("write forge.toml");
        let app_support = dir.path().join("app-support");
        std::fs::create_dir_all(&app_support).expect("app-support/");
        {
            let db_path = forge_workspace::store::path_for(&app_support, dir.path());
            std::fs::create_dir_all(db_path.parent().expect("stores/")).expect("stores/");
            let db = forge_workspace::store::Db::open(&db_path).expect("open db");
            forge_workspace::store::pricing::store(
                &db,
                &forge_workspace::store::pricing::CachedPricing {
                    fetched_at: std::time::SystemTime::now(),
                    json: json.to_owned(),
                },
            )
            .expect("seed the pricing cache");
        }
        let workspace = Workspace::new_for_test(dir.path().to_owned()).expect("workspace");
        (Arc::new(workspace), dir)
    }

    /// A workspace whose durable Gotify and Slack subscriptions were
    /// written before it opened its store, so the boot load puts them in
    /// memory and the reads see real rows.
    pub(crate) fn workspace_with_connector_subs() -> (Arc<Workspace>, tempfile::TempDir) {
        let dir = tempfile::tempdir().expect("tempdir");
        let forge = dir.path().join("forge");
        std::fs::create_dir_all(&forge).expect("forge/");
        std::fs::write(forge.join("forge.toml"), CONFIG).expect("write forge.toml");
        let app_support = dir.path().join("app-support");
        std::fs::create_dir_all(&app_support).expect("app-support/");
        {
            // `new_for_test` opens this exact path and loads both sets at
            // construction, so the rows have to be there first.
            let db_path = forge_workspace::store::path_for(&app_support, dir.path());
            std::fs::create_dir_all(db_path.parent().expect("stores/")).expect("stores/");
            let db = forge_workspace::store::Db::open(&db_path).expect("open db");
            forge_workspace::store::gotify::insert(&db, &gotify_sub("forge"))
                .expect("insert gotify sub");
            forge_workspace::store::slack::insert(&db, &slack_sub("forge"))
                .expect("insert slack sub");
        }
        let workspace = Workspace::new_for_test(dir.path().to_owned()).expect("workspace");
        (Arc::new(workspace), dir)
    }

    pub(crate) fn gotify_sub(project: &str) -> forge_primitives::GotifySubscription {
        forge_primitives::GotifySubscription {
            id: uuid::Uuid::new_v4(),
            project: project.to_owned(),
            team_role: None,
            applications: vec!["forge".to_owned()],
            min_priority: None,
            created_at: std::time::SystemTime::UNIX_EPOCH,
        }
    }

    pub(crate) fn slack_sub(project: &str) -> forge_primitives::slack::SlackSubscription {
        forge_primitives::slack::SlackSubscription {
            id: uuid::Uuid::new_v4(),
            workspace: "acme".to_owned(),
            project: project.to_owned(),
            team_role: None,
            target: forge_primitives::slack::SlackSubscriptionTarget::DirectMessages,
            created_at: std::time::SystemTime::UNIX_EPOCH,
        }
    }

    /// **The config's KB crosses as bytes, and `0` as whole** (#2374): the
    /// primitives test pins the field's parse, and this one pins the mapping
    /// the served-page cap is read through - dropping the `* 1024` would omit
    /// every record over 64 bytes with the suite green.
    #[test]
    fn the_record_cap_crosses_kilobytes_and_zero_means_whole() {
        assert_eq!(super::cap_bytes(64), 65_536, "64 KB is 65536 bytes");
        assert_eq!(super::cap_bytes(0), usize::MAX, "0 serves the record whole");
    }
}