From d3c99a7dec87c2ee2b1d039d632596b4b5b10358 Mon Sep 17 00:00:00 2001
From: Lexus2016 <lexus@cdzv.com>
Date: Wed, 7 Oct 2026 18:22:49 +0200
Subject: [PATCH 1/2] fix(engine): apply the configured engine at boot, wait
 for it before the first send, sync the mobile chips

Three ways the UI and the chat disagree about the engine. #103 and #105 proposed two of
them and were withdrawn because they did not cure the reported 402; verifying them in a
browser found the cause they both missed.

- checkVersion() called loadTerminalCapability() before it stored the default engine, and
  that helper lives in the last script block. A reply landing before the parser reached
  it threw a ReferenceError into checkVersion's own catch{}, skipping the configured
  engine, the chat defaults and loadBots(). Measured on a clean main with
  defaultEngine=subscription and a late xterm.js: curEngine stayed "api". The call is
  now optional; its other callers load the capability lazily.
- send() read curEngine on its 'api' placeholder before /api/version had landed. It now
  awaits engineDefaultReady(), bounded by VERSION_WAIT_MS so a dead /api/version cannot
  freeze the composer. First chat frame: engine "api" after 8 ms -> "subscription" after
  2722 ms.
- syncMobSheetFromDesktop() had no engine branch, so cur stayed '' and the toggle removed
  the shipped `on` from both engine chips.

test/render/engine-default.test.mjs: 10 tests, each watched failing for the right reason
first. CLAUDE.md test counts corrected (101 = 20 + 81; the 89/19/70 were already stale).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                           |   4 +-
 public/index.html                   |  27 ++++-
 test/render/engine-default.test.mjs | 164 ++++++++++++++++++++++++++++
 3 files changed, 191 insertions(+), 4 deletions(-)
 create mode 100644 test/render/engine-default.test.mjs

diff --git a/CLAUDE.md b/CLAUDE.md
index ac22cd18..3239c901 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,7 +31,7 @@ npm run release <patch|minor|major|x.y.z>  # bump, commit, tag, push → GitHub
 npm run release:mac                         # on the Mac with the cert: build, notarize, verify, upload, bump the cask
 ```
 
-No linting and no build step configured. `npm test` chains 89 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 70 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 101 test files under `test/`: 20 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 81 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow), and `engine-default.test.mjs` pins three ways the UI and the chat disagreed about the engine: the mobile sheet's engine chips (the API chip ships `on`, so a sync that skips the group blanks both), `send()` waiting — bounded by `VERSION_WAIT_MS`, never indefinitely — for `/api/version` to supply the configured default before it reads `curEngine`, and `checkVersion()` applying that default even when the last script block (home of `loadTerminalCapability`) has not been parsed yet. The third is the cause of the other two looking like they did nothing: that call threw a `ReferenceError` into `checkVersion`'s own `catch {}` and skipped the configured engine, the chat defaults and `loadBots()`. Keep literal `<script>` tags out of comments in `index.html` — `script-scope.test.mjs` counts them as block boundaries. `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
@@ -1183,7 +1183,7 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
 
 ## How to Verify Changes
 
-`npm test` runs 89 test files under `test/` (19 `test/render/*.test.mjs` + 70 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
+`npm test` runs 101 test files under `test/` (20 `test/render/*.test.mjs` + 81 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
 
 ```bash
 # 1. Start server
diff --git a/public/index.html b/public/index.html
index 98fd5800..fd742c34 100644
--- a/public/index.html
+++ b/public/index.html
@@ -4520,6 +4520,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // Global default engine for NEW chats (server-backed via /api/default-engine).
 // _curSessionRunEngine = the open chat's explicit run_engine (null = inherit default).
 let _globalDefaultEngine = 'api', _curSessionRunEngine = null;
+// curEngine above is a placeholder until checkVersion() has fetched the configured default.
+// Boot replaces this with checkVersion()'s promise; send() waits on it (engineDefaultReady),
+// so the first message of a page load cannot go out on the placeholder.
+let _versionCheckDone = Promise.resolve();
+const VERSION_WAIT_MS = 3000;   // upper bound on that wait — a dead /api/version must not freeze the composer
 // Server truth for the currently-open session, snapshotted by loadSess() — an
 // 'interrupt' row still undelivered only means "lost" if the task has actually
 // ended; while it's running, the same row is still sitting in the server's queue.
@@ -11910,7 +11915,20 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // ─── Send / Stop ─────────────────────────────────────────────────────────
 function sendChat(text) { inEl.value = text; send(); }
 
+// Resolves once the configured default engine is known (checkVersion() has run
+// resolveEngineForView()), or after VERSION_WAIT_MS if it never answers. The server stores the
+// engine of every turn it receives, so a message sent on the 'api' placeholder runs — and
+// bills — on the wrong engine. Never throws: the worst case is the pre-fix behaviour.
+async function engineDefaultReady() {
+  let timer;
+  try {
+    await Promise.race([_versionCheckDone, new Promise(r => { timer = setTimeout(r, VERSION_WAIT_MS); })]);
+  } catch {}
+  clearTimeout(timer);
+}
+
 async function send() {
+  await engineDefaultReady();   // a settled promise costs one microtask once the page has been open a moment
   if (!ws || ws.readyState !== 1) { toast(t('toast.no_connection'), true); return; }
 
   const txt = inEl.value.trim();
@@ -12270,7 +12288,11 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     if (local.claudeCli && local.claudeCli.available === false) {
       showNotification({ level: 'error', title: t('claudecli.unavailable.title'), detail: t('claudecli.unavailable.detail'), timestamp: Date.now() });
     }
-    loadTerminalCapability();
+    // loadTerminalCapability() lives in the LAST script block. A reply that lands before the
+    // parser reaches it would throw ReferenceError into the catch below and skip everything
+    // after this line — the configured engine included — so it is optional here. Its other
+    // callers (`if (_terminalAvailable === null) await …`) load it lazily.
+    if (typeof loadTerminalCapability === 'function') loadTerminalCapability();
     loadBots();
     // Store the global default and resolve the current view's engine. An open
     // chat's explicit run_engine wins; a chat without one inherits this default.
@@ -16948,6 +16970,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     if (group === 'mode') cur = curMode;
     else if (group === 'agent') cur = curAgent;
     else if (group === 'model') cur = curModel;
+    else if (group === 'engine') cur = curEngine;   // without it cur stays '' and the toggle below strips the shipped `on` from both engine chips
     chip.classList.toggle('on', v === cur);
   });
   // Sync turns
@@ -17661,7 +17684,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 _projectsReady = loadProjectsList();
 loadRemoteHosts();
 connect();
-checkVersion();
+_versionCheckDone = checkVersion();
 // ─── Image chip hover preview ───
 {
   const _prev = $i('imgChipPreview');
diff --git a/test/render/engine-default.test.mjs b/test/render/engine-default.test.mjs
new file mode 100644
index 00000000..62c53bf4
--- /dev/null
+++ b/test/render/engine-default.test.mjs
@@ -0,0 +1,164 @@
+// Three engine-selection defects that all end in "the UI says one engine, the chat runs
+// on another". #105 and #103 were proposed as PRs and withdrawn by their author because
+// they did not cure the reported 402 — and 3. below is why: neither touched the cause.
+//
+// 1. The mobile settings sheet blanked the engine chips. The API chip ships with
+//    `class="mob-chip on"`, and syncMobSheetFromDesktop() compared every chip against a
+//    `cur` that stayed '' for the engine group — so opening the sheet REMOVED the highlight
+//    from both chips and the user saw no engine selected.
+//
+// 2. send() read `curEngine` before /api/version had landed. `curEngine` starts as the
+//    placeholder 'api' and only becomes the configured default in resolveEngineForView(),
+//    so the first message of a fresh page load could go out on the wrong engine. The server
+//    persists the engine of every turn (server.js: UPDATE sessions SET run_engine), so the
+//    damage is that one turn, not the chat's lifetime — which is also why the wait must be
+//    BOUNDED: a /api/version that never answers may not freeze the composer.
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { loadFn } from './_load.mjs';
+
+const HTML = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '../../public/index.html'), 'utf8');
+const tick = () => new Promise(r => setImmediate(r));
+
+// ── 1. mobile sheet chips ───────────────────────────────────────────────────────────
+
+function mobChips() {
+  const mk = (mob, v) => ({ dataset: { mob, v }, on: undefined, classList: { toggle(_c, on) { this.owner.on = on; } } });
+  const chips = [mk('mode', 'auto'), mk('mode', 'plan'), mk('engine', 'api'), mk('engine', 'subscription')];
+  chips.forEach(c => { c.classList.owner = c; });
+  globalThis.document = { querySelectorAll: () => chips };
+  globalThis.$i = () => null;            // no turns inputs -> the turns branch is skipped
+  return Object.fromEntries(chips.map(c => [`${c.dataset.mob}:${c.dataset.v}`, c]));
+}
+
+test('opening the mobile sheet highlights the Subscription chip when that is the engine', () => {
+  const c = mobChips();
+  Object.assign(globalThis, { curMode: 'auto', curAgent: 'single', curModel: 'sonnet', curEngine: 'subscription' });
+  loadFn('syncMobSheetFromDesktop')();
+  assert.strictEqual(c['engine:subscription'].on, true, 'Subscription chip must be on');
+  assert.strictEqual(c['engine:api'].on, false, 'API chip must be off');
+});
+
+test('opening the mobile sheet highlights the API chip when that is the engine', () => {
+  const c = mobChips();
+  Object.assign(globalThis, { curMode: 'auto', curAgent: 'single', curModel: 'sonnet', curEngine: 'api' });
+  loadFn('syncMobSheetFromDesktop')();
+  assert.strictEqual(c['engine:api'].on, true, 'API chip must be on');
+  assert.strictEqual(c['engine:subscription'].on, false, 'Subscription chip must be off');
+});
+
+test('the engine branch leaves the other chip groups alone', () => {
+  const c = mobChips();
+  Object.assign(globalThis, { curMode: 'plan', curAgent: 'single', curModel: 'sonnet', curEngine: 'api' });
+  loadFn('syncMobSheetFromDesktop')();
+  assert.strictEqual(c['mode:plan'].on, true);
+  assert.strictEqual(c['mode:auto'].on, false);
+});
+
+// ── 2. the first message waits for the engine default ───────────────────────────────
+
+test('engineDefaultReady() holds until the version check has settled', async () => {
+  globalThis.VERSION_WAIT_MS = 5000;     // far beyond the test: only the check may release it
+  let release;
+  globalThis._versionCheckDone = new Promise(r => { release = r; });
+  let done = false;
+  const p = loadFn('engineDefaultReady')().then(() => { done = true; });
+  await tick();
+  assert.strictEqual(done, false, 'must not resolve while the version check is pending');
+  release();
+  await p;
+  assert.strictEqual(done, true);
+});
+
+test('engineDefaultReady() gives up after VERSION_WAIT_MS when /api/version never answers', async () => {
+  globalThis.VERSION_WAIT_MS = 40;
+  globalThis._versionCheckDone = new Promise(() => {});   // never settles
+  const t0 = Date.now();
+  await loadFn('engineDefaultReady')();
+  const waited = Date.now() - t0;
+  assert.ok(waited >= 25, `must wait for the bound before giving up, waited ${waited}ms`);
+  assert.ok(waited < 1000, `must not wait much past the bound, waited ${waited}ms`);
+});
+
+test('engineDefaultReady() never throws, even if the version check rejects', async () => {
+  globalThis.VERSION_WAIT_MS = 5000;
+  globalThis._versionCheckDone = Promise.reject(new Error('boom'));
+  await loadFn('engineDefaultReady')();    // would reject here if the error escaped
+});
+
+test('send() waits for engineDefaultReady() before it touches the socket', async () => {
+  const toasts = [];
+  let release;
+  Object.assign(globalThis, {
+    ws: null,                              // after the wait, send() bails out with a toast
+    t: k => k,
+    toast: (...a) => toasts.push(a),
+    engineDefaultReady: () => new Promise(r => { release = r; }),
+  });
+  const p = loadFn('send')();
+  await tick();
+  assert.strictEqual(toasts.length, 0, 'send() acted before the engine default was known');
+  release();
+  await p;
+  assert.strictEqual(toasts.length, 1, 'send() must continue once the default is known');
+});
+
+// ── 3. the default must actually be APPLIED, not merely awaited ─────────────────────
+// Found while verifying 2. in a real browser: with /vendor/xterm.js slow, the page kept
+// curEngine='api' although the server's configured default was 'subscription' — on a clean
+// `main` too. checkVersion() called loadTerminalCapability() BEFORE it stored the default,
+// and that helper lives in the LAST <script> block. A reply that lands before the parser
+// reaches that block throws ReferenceError, which checkVersion's own `catch {}` swallows —
+// so the default, the editor label, the chat defaults and loadBots() were all silently
+// skipped. Waiting for a promise that settled without doing its job (2.) cures nothing.
+
+function versionEnv(calls) {
+  globalThis._globalDefaultEngine = 'api';
+  Object.assign(globalThis, {
+    fetch: () => Promise.resolve({ json: () => ({ version: '7.18.4', tmuxAvailable: true, defaultEngine: 'subscription',
+                                                  claudeCli: { available: true }, editor: { label: 'VS Code' } }) }),
+    applyTmuxCapability: () => {},
+    showNotification: () => {},
+    t: k => k,
+    loadBots: () => calls.push('loadBots'),
+    _syncEditorLabels: () => {},
+    resolveEngineForView: () => calls.push('resolveEngineForView'),
+    loadChatDefaults: () => { calls.push('loadChatDefaults'); return Promise.resolve(); },
+    applyChatDefaults: () => {},
+    curProjectId: null, currentSessionId: null,
+    $i: () => null,                          // no #versionBadge -> stops before the GitHub lookup
+  });
+}
+
+test('checkVersion() applies the configured engine even when the terminal block is not parsed yet', async () => {
+  const calls = [];
+  versionEnv(calls);
+  delete globalThis.loadTerminalCapability;  // the late block has not run: calling it is a ReferenceError
+  await loadFn('checkVersion')();
+  assert.strictEqual(globalThis._globalDefaultEngine, 'subscription', 'the configured default was never stored');
+  assert.ok(calls.includes('resolveEngineForView'), 'curEngine was never re-resolved from it');
+  assert.ok(calls.includes('loadBots') && calls.includes('loadChatDefaults'),
+    `the rest of checkVersion() was skipped: ${calls.join(', ') || '(nothing ran)'}`);
+});
+
+test('checkVersion() still preloads the terminal capability once that block exists', async () => {
+  const calls = [];
+  versionEnv(calls);
+  globalThis.loadTerminalCapability = () => calls.push('loadTerminalCapability');
+  await loadFn('checkVersion')();
+  assert.strictEqual(calls.filter(c => c === 'loadTerminalCapability').length, 1);
+  assert.strictEqual(globalThis._globalDefaultEngine, 'subscription');
+  delete globalThis.loadTerminalCapability;
+});
+
+// The behaviour above is only real if the page feeds the promise. Column-0 anchors match
+// the statement itself and never a comment that merely describes it.
+// (assert.ok on a boolean, not assert.match: a failing match prints the whole 1 MB page.)
+test('boot hands the real checkVersion() promise to send()', () => {
+  assert.ok(/^let _versionCheckDone = Promise\.resolve\(\);/m.test(HTML), 'declaration with a harmless default');
+  assert.ok(/^_versionCheckDone = checkVersion\(\);/m.test(HTML), 'boot assigns the real promise');
+  assert.ok(!/^checkVersion\(\);/m.test(HTML), 'a bare call would fetch /api/version twice and feed nothing');
+});

From c5f0924a0f971c4e8c01d5460d05829e7f8c277b Mon Sep 17 00:00:00 2001
From: Lexus2016 <lexus@cdzv.com>
Date: Wed, 7 Oct 2026 18:54:04 +0200
Subject: [PATCH 2/2] fix(engine): an explicit engine pick survives the wait,
 and the wait ignores the GitHub lookup

The first commit made send() wait for /api/version. An independent review (codex, agy)
found two defects in that wait, both reproduced before this change:

- A click on an engine chip made before /api/version answered was overwritten by
  resolveEngineForView() and the message then left on the overwritten engine: the user
  chose Subscription, the turn ran on API. _engineUserPicked (set by setOpt/setMobOpt,
  cleared by resolveEngineForView) now exempts the pick from both the wait and
  checkVersion()'s resolve.
- _versionCheckDone was the promise of the whole checkVersion(), which ends by awaiting
  api.github.com. With packets to GitHub dropped, every send() paid the full
  VERSION_WAIT_MS. The lookup moved to _checkLatestRelease(), not awaited.

Also from the review: the default engine is stored right after applyTmuxCapability(),
ahead of the notification, terminal and loadBots() calls that can throw.

Measured in a browser: user picks Subscription while /api/version takes 2.5 s -> frame on
"subscription" after 7 ms; GitHub unreachable -> first send after 6 ms.
test/render/engine-default.test.mjs: 18 tests, the new ones watched failing first.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                           |   2 +-
 public/index.html                   |  69 +++++++++-------
 test/render/engine-default.test.mjs | 117 ++++++++++++++++++++++++++++
 3 files changed, 160 insertions(+), 28 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 3239c901..c950cd97 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,7 +31,7 @@ npm run release <patch|minor|major|x.y.z>  # bump, commit, tag, push → GitHub
 npm run release:mac                         # on the Mac with the cert: build, notarize, verify, upload, bump the cask
 ```
 
-No linting and no build step configured. `npm test` chains 101 test files under `test/`: 20 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 81 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow), and `engine-default.test.mjs` pins three ways the UI and the chat disagreed about the engine: the mobile sheet's engine chips (the API chip ships `on`, so a sync that skips the group blanks both), `send()` waiting — bounded by `VERSION_WAIT_MS`, never indefinitely — for `/api/version` to supply the configured default before it reads `curEngine`, and `checkVersion()` applying that default even when the last script block (home of `loadTerminalCapability`) has not been parsed yet. The third is the cause of the other two looking like they did nothing: that call threw a `ReferenceError` into `checkVersion`'s own `catch {}` and skipped the configured engine, the chat defaults and `loadBots()`. Keep literal `<script>` tags out of comments in `index.html` — `script-scope.test.mjs` counts them as block boundaries. `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 101 test files under `test/`: 20 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 81 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow), and `engine-default.test.mjs` pins three ways the UI and the chat disagreed about the engine: the mobile sheet's engine chips (the API chip ships `on`, so a sync that skips the group blanks both), `send()` waiting for `/api/version` to supply the configured default before it reads `curEngine`, and `checkVersion()` applying that default even when the last script block (home of `loadTerminalCapability`) has not been parsed yet. The third is the cause of the other two looking like they did nothing: that call threw a `ReferenceError` into `checkVersion`'s own `catch {}` and skipped the configured engine, the chat defaults and `loadBots()`. Three rules on the wait, each found by an independent review of the first version: it is bounded by `VERSION_WAIT_MS`, never indefinite; it never applies to a user who already clicked an engine chip (`_engineUserPicked` — set by `setOpt`/`setMobOpt`, cleared by `resolveEngineForView()`), whose pick neither the wait nor `checkVersion()`'s resolve may overwrite; and it waits on the LOCAL version reply only — the GitHub release lookup is `_checkLatestRelease`, deliberately not awaited, or a firewall that drops packets to GitHub would add the full bound to every send. Keep literal `<script>` tags out of comments in `index.html` — `script-scope.test.mjs` counts them as block boundaries. `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
diff --git a/public/index.html b/public/index.html
index fd742c34..153a00c5 100644
--- a/public/index.html
+++ b/public/index.html
@@ -4525,6 +4525,10 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // so the first message of a page load cannot go out on the placeholder.
 let _versionCheckDone = Promise.resolve();
 const VERSION_WAIT_MS = 3000;   // upper bound on that wait — a dead /api/version must not freeze the composer
+// True once the user has clicked an engine chip. Their pick is not a placeholder: neither the wait
+// above nor checkVersion()'s resolve may override it. resolveEngineForView() clears it — a view
+// that is re-resolved (chat switch, new tab) derives its engine from the defaults again.
+let _engineUserPicked = false;
 // Server truth for the currently-open session, snapshotted by loadSess() — an
 // 'interrupt' row still undelivered only means "lost" if the task has actually
 // ended; while it's running, the same row is still sitting in the server's queue.
@@ -11343,7 +11347,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   if (group === 'mode') curMode = v;
   else if (group === 'agent') curAgent = v;
   else if (group === 'model') curModel = v;
-  else if (group === 'engine') { curEngine = v; syncDefaultStar(); }
+  else if (group === 'engine') { curEngine = v; _engineUserPicked = true; syncDefaultStar(); }
   updInd();
   // Sync mobile UI
   if (typeof updateMobSubtitle === 'function') updateMobSubtitle();
@@ -11366,6 +11370,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // both checkVersion (default loaded) and loadSess (session loaded); whichever
 // runs last produces the correct result.
 function resolveEngineForView() {
+  _engineUserPicked = false;
   const want = _curSessionRunEngine || _globalDefaultEngine;
   curEngine = (want === 'subscription' && _tmuxAvailable) ? 'subscription' : 'api';
   syncBtn('engine', curEngine);
@@ -11920,6 +11925,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
 // engine of every turn it receives, so a message sent on the 'api' placeholder runs — and
 // bills — on the wrong engine. Never throws: the worst case is the pre-fix behaviour.
 async function engineDefaultReady() {
+  if (_engineUserPicked) return;   // the user chose; there is no placeholder to wait out
   let timer;
   try {
     await Promise.race([_versionCheckDone, new Promise(r => { timer = setTimeout(r, VERSION_WAIT_MS); })]);
@@ -12282,6 +12288,12 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   try {
     const local = await fetch('/api/version').then(r => r.json());
     applyTmuxCapability(local.tmuxAvailable !== false);
+    // The engine comes first, ahead of every call below that can throw: it decides which engine
+    // — and so which bill — the next message runs on. An open chat's explicit run_engine wins;
+    // a chat without one inherits this default. An engine the user already clicked stays theirs
+    // (only the default star follows the new default).
+    _globalDefaultEngine = local.defaultEngine === 'subscription' ? 'subscription' : 'api';
+    if (_engineUserPicked) syncDefaultStar(); else resolveEngineForView();
     // Surface a missing local `claude` binary up front — every chat send would
     // otherwise fail mid-turn with no warning beforehand. `error` level never
     // auto-dismisses (NOTIF_DURATIONS), matching how broken this actually is.
@@ -12290,17 +12302,13 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     }
     // loadTerminalCapability() lives in the LAST script block. A reply that lands before the
     // parser reaches it would throw ReferenceError into the catch below and skip everything
-    // after this line — the configured engine included — so it is optional here. Its other
+    // after this line (bots, editor label, chat defaults), so it is optional here. Its other
     // callers (`if (_terminalAvailable === null) await …`) load it lazily.
     if (typeof loadTerminalCapability === 'function') loadTerminalCapability();
     loadBots();
-    // Store the global default and resolve the current view's engine. An open
-    // chat's explicit run_engine wins; a chat without one inherits this default.
-    _globalDefaultEngine = local.defaultEngine === 'subscription' ? 'subscription' : 'api';
     // Issue #63 — label the "Open in …" buttons with the editor actually configured.
     if (local.editor && local.editor.label) _editorLabel = local.editor.label;
     _syncEditorLabels();
-    resolveEngineForView();
     // Issue #58: resolve the dials for whatever project the session restored to.
     // Only a brand-new tab is seeded — a restored chat keeps what it was saved with.
     loadChatDefaults(curProjectId).then(() => { if (!currentSessionId) applyChatDefaults(); });
@@ -12309,29 +12317,36 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
     const cur = local.version || '?';
     el.textContent = `v${cur}`;
     el.title = t('ver.current');
-    try {
-      const gh = await fetch('https://api.github.com/repos/Lexus2016/claude-code-studio/releases/latest',
-        { headers: { Accept: 'application/vnd.github.v3+json' } }).then(r => r.json());
-      const latest = (gh.tag_name || '').replace(/^v/, '');
-      if (latest && latest !== cur) {
-        el.textContent = `v${cur} → v${latest} ↑`;
-        el.className = 'update';
-        if (window.electronAPI && window.electronAPI.update) {
-          // Desktop: the top update banner owns the update flow (electron-updater).
-          // Don't point users at the npx command or the GitHub release page here.
-          el.title = `v${latest}`;
-          el.onclick = null;
-        } else {
-          el.title = t('ver.update').replace('{tag}', gh.tag_name);
-          el.onclick = () => window.open(gh.html_url, '_blank');
-        }
-      } else if (latest) {
-        el.title = `v${cur}${t('ver.latest')}`;
-      }
-    } catch { /* GitHub API unavailable, keep local version only */ }
+    // Not awaited: the promise this function returns is what send() waits on (_versionCheckDone),
+    // and behind a firewall that drops packets to GitHub this lookup never settles.
+    _checkLatestRelease(el, cur);
   } catch { /* API not ready */ }
 }
 
+// The update badge's "newer release exists" lookup. Cosmetic and best-effort: never rejects.
+async function _checkLatestRelease(el, cur) {
+  try {
+    const gh = await fetch('https://api.github.com/repos/Lexus2016/claude-code-studio/releases/latest',
+      { headers: { Accept: 'application/vnd.github.v3+json' } }).then(r => r.json());
+    const latest = (gh.tag_name || '').replace(/^v/, '');
+    if (latest && latest !== cur) {
+      el.textContent = `v${cur} → v${latest} ↑`;
+      el.className = 'update';
+      if (window.electronAPI && window.electronAPI.update) {
+        // Desktop: the top update banner owns the update flow (electron-updater).
+        // Don't point users at the npx command or the GitHub release page here.
+        el.title = `v${latest}`;
+        el.onclick = null;
+      } else {
+        el.title = t('ver.update').replace('{tag}', gh.tag_name);
+        el.onclick = () => window.open(gh.html_url, '_blank');
+      }
+    } else if (latest) {
+      el.title = `v${cur}${t('ver.latest')}`;
+    }
+  } catch { /* GitHub API unavailable, keep local version only */ }
+}
+
 // ─── Session History ──────────────────────────────────────────────────────
 let histSelectMode = false;
 const histSelected = new Set();
@@ -16955,7 +16970,7 @@ <h2 id="dlgModalTitle" data-i18n="dlg.title">Delegate to Agent</h2>
   if (group === 'mode') curMode = v;
   else if (group === 'agent') curAgent = v;
   else if (group === 'model') curModel = v;
-  else if (group === 'engine') curEngine = v;
+  else if (group === 'engine') { curEngine = v; _engineUserPicked = true; }
   syncBtn(group, v);
   if (group === 'engine') syncDefaultStar();
   updateMobSubtitle();
diff --git a/test/render/engine-default.test.mjs b/test/render/engine-default.test.mjs
index 62c53bf4..6aefc7f5 100644
--- a/test/render/engine-default.test.mjs
+++ b/test/render/engine-default.test.mjs
@@ -62,6 +62,7 @@ test('the engine branch leaves the other chip groups alone', () => {
 
 test('engineDefaultReady() holds until the version check has settled', async () => {
   globalThis.VERSION_WAIT_MS = 5000;     // far beyond the test: only the check may release it
+  globalThis._engineUserPicked = false;  // the page always declares it; here nobody has clicked
   let release;
   globalThis._versionCheckDone = new Promise(r => { release = r; });
   let done = false;
@@ -75,6 +76,7 @@ test('engineDefaultReady() holds until the version check has settled', async ()
 
 test('engineDefaultReady() gives up after VERSION_WAIT_MS when /api/version never answers', async () => {
   globalThis.VERSION_WAIT_MS = 40;
+  globalThis._engineUserPicked = false;
   globalThis._versionCheckDone = new Promise(() => {});   // never settles
   const t0 = Date.now();
   await loadFn('engineDefaultReady')();
@@ -85,6 +87,7 @@ test('engineDefaultReady() gives up after VERSION_WAIT_MS when /api/version neve
 
 test('engineDefaultReady() never throws, even if the version check rejects', async () => {
   globalThis.VERSION_WAIT_MS = 5000;
+  globalThis._engineUserPicked = false;
   globalThis._versionCheckDone = Promise.reject(new Error('boom'));
   await loadFn('engineDefaultReady')();    // would reject here if the error escaped
 });
@@ -117,7 +120,9 @@ test('send() waits for engineDefaultReady() before it touches the socket', async
 
 function versionEnv(calls) {
   globalThis._globalDefaultEngine = 'api';
+  globalThis._engineUserPicked = false;
   Object.assign(globalThis, {
+    syncDefaultStar: () => calls.push('syncDefaultStar'),
     fetch: () => Promise.resolve({ json: () => ({ version: '7.18.4', tmuxAvailable: true, defaultEngine: 'subscription',
                                                   claudeCli: { available: true }, editor: { label: 'VS Code' } }) }),
     applyTmuxCapability: () => {},
@@ -154,6 +159,118 @@ test('checkVersion() still preloads the terminal capability once that block exis
   delete globalThis.loadTerminalCapability;
 });
 
+// ── 4. what an independent review (codex + agy) found in the first version of 2. ────
+// a) A click on an engine chip made BEFORE /api/version answered was overwritten by
+//    resolveEngineForView() — and, because send() now waited for that, the message left on
+//    the overwritten engine: the user chose Subscription, the turn ran on API.
+// b) _versionCheckDone was the promise of the WHOLE checkVersion(), which ends by awaiting
+//    api.github.com for the update badge. Behind a firewall that drops packets, every send()
+//    paid the full VERSION_WAIT_MS.
+// c) The default was stored only after calls that can throw (notification, loadBots).
+
+const chip = v => ({ dataset: { v }, classList: { add() {}, remove() {} },
+                     closest: () => ({ querySelectorAll: () => [] }) });
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+test('clicking an engine chip is remembered as the user\'s own choice (desktop and mobile)', () => {
+  Object.assign(globalThis, { curEngine: 'api', syncDefaultStar() {}, updInd() {}, syncBtn() {}, saveUIState() {},
+                              updateMobSubtitle() {}, _engineUserPicked: false });
+  loadFn('setOpt')(chip('subscription'), 'engine');
+  assert.strictEqual(globalThis._engineUserPicked, true, 'toolbar chip');
+  globalThis._engineUserPicked = false;
+  loadFn('setMobOpt')(chip('subscription'), 'engine');
+  assert.strictEqual(globalThis._engineUserPicked, true, 'mobile chip');
+});
+
+test('picking a model or mode is NOT an engine choice', () => {
+  Object.assign(globalThis, { curModel: 'sonnet', syncDefaultStar() {}, updInd() {}, _engineUserPicked: false });
+  loadFn('setOpt')(chip('opus'), 'model');
+  assert.strictEqual(globalThis._engineUserPicked, false);
+});
+
+test('resolveEngineForView() hands the engine back to the defaults', () => {
+  Object.assign(globalThis, { _engineUserPicked: true, _curSessionRunEngine: null, _globalDefaultEngine: 'api',
+                              _tmuxAvailable: true, syncBtn() {}, syncDefaultStar() {} });
+  loadFn('resolveEngineForView')();
+  assert.strictEqual(globalThis._engineUserPicked, false, 'a re-resolved view is derived state again');
+});
+
+test('engineDefaultReady() does not hold a user who already chose an engine', async () => {
+  globalThis.VERSION_WAIT_MS = 5000;
+  globalThis._versionCheckDone = new Promise(() => {});   // /api/version has not answered
+  globalThis._engineUserPicked = true;
+  const r = await Promise.race([loadFn('engineDefaultReady')().then(() => 'ready'), sleep(200).then(() => 'HELD')]);
+  assert.strictEqual(r, 'ready');
+});
+
+test('checkVersion() stores the default but leaves an explicit choice alone', async () => {
+  const calls = [];
+  versionEnv(calls);
+  globalThis._engineUserPicked = true;                    // the user already clicked API
+  await loadFn('checkVersion')();                         // server default is 'subscription'
+  assert.strictEqual(globalThis._globalDefaultEngine, 'subscription', 'the default is still recorded for new chats');
+  assert.ok(!calls.includes('resolveEngineForView'), 'the explicit choice was overwritten');
+  assert.ok(calls.includes('syncDefaultStar'), 'the default star must follow the new default');
+});
+
+test('checkVersion() stores the default even if a later step throws', async () => {
+  const calls = [];
+  versionEnv(calls);
+  globalThis.loadBots = () => { throw new Error('boom'); };
+  delete globalThis.loadTerminalCapability;
+  await loadFn('checkVersion')();
+  assert.strictEqual(globalThis._globalDefaultEngine, 'subscription');
+  assert.ok(calls.includes('resolveEngineForView'));
+});
+
+test('checkVersion() settles without waiting for the GitHub release lookup', async () => {
+  const calls = [];
+  versionEnv(calls);
+  const local = { version: '7.18.4', tmuxAvailable: true, defaultEngine: 'subscription', claudeCli: { available: true } };
+  globalThis.fetch = url => String(url).includes('api.github.com')
+    ? new Promise(() => {})                               // a firewall that drops the packets
+    : Promise.resolve({ json: () => local });
+  globalThis.$i = () => ({});                             // a #versionBadge exists -> reaches the lookup
+  globalThis.window = {};
+  globalThis._checkLatestRelease = loadFn('_checkLatestRelease');
+  const r = await Promise.race([loadFn('checkVersion')().then(() => 'settled'), sleep(300).then(() => 'HUNG on GitHub')]);
+  assert.strictEqual(r, 'settled');
+});
+
+test('an engine picked while /api/version is pending is the engine the message leaves on', async () => {
+  // The reviewer's scenario end to end, on the real functions: pick Subscription, then the
+  // server's default turns out to be API, then send.
+  const frames = [];
+  const box = () => ({ dataset: {}, style: {}, appendChild() {}, querySelector() { return { before() {} }; } });
+  let reply;
+  Object.assign(globalThis, {
+    document: { querySelectorAll: () => [], createElement: box },
+    localStorage: { removeItem() {} }, t: k => k, toast() {},
+    inEl: { value: 'Use the engine I selected', style: {} },
+    ws: { readyState: 1, send: s => frames.push(JSON.parse(s)) },
+    _attachments: [], _clearAttachments() { globalThis._attachments = []; }, _closeAtPopup() {},
+    curProjectId: 'p', currentSessionId: null, activeTabId: 'A', openTabs: [{ id: 'A', generating: true }],
+    projects: [{ id: 'p' }], curEngine: 'api', _globalDefaultEngine: 'api', _curSessionRunEngine: null,
+    _tmuxAvailable: true, _engineUserPicked: false,
+    curAgent: 'single', curModel: 'sonnet', curMode: 'auto', curEffort: '', curWorkdir: '/p',
+    activeSkills: new Set(), activeMcp: new Set(), replyTo: null, clearReply() {}, addMsg: box,
+    setUserMsgText() {}, getTS: () => ({}), interruptSendMode: 'queue', autoSkillsMode: false,
+    $i: id => (id === 'versionBadge' ? null : { value: '50' }),
+    syncBtn() {}, syncDefaultStar() {}, updInd() {}, loadBots() {}, _syncEditorLabels() {},
+    loadChatDefaults: () => Promise.resolve(), applyChatDefaults() {}, _editorLabel: 'VS Code',
+    applyTmuxCapability: loadFn('applyTmuxCapability'), resolveEngineForView: loadFn('resolveEngineForView'),
+    VERSION_WAIT_MS: 3000, engineDefaultReady: loadFn('engineDefaultReady'),
+    fetch: () => new Promise(r => { reply = () => r({ json: () => ({ defaultEngine: 'api', tmuxAvailable: true }) }); }),
+  });
+  globalThis._versionCheckDone = loadFn('checkVersion')();          // still waiting for the server
+  loadFn('setOpt')(chip('subscription'), 'engine');                 // the user clicks Subscription
+  const pending = loadFn('send')();
+  reply();
+  await pending;
+  assert.strictEqual(frames[0]?.engine, 'subscription', 'the message left on the engine the user chose');
+  assert.strictEqual(globalThis.curEngine, 'subscription', 'and the toolbar still shows it');
+});
+
 // The behaviour above is only real if the page feeds the promise. Column-0 anchors match
 // the statement itself and never a comment that merely describes it.
 // (assert.ok on a boolean, not assert.match: a failing match prints the whole 1 MB page.)