fix(engine): apply the configured engine at boot, wait for it before the first send, sync the mobile chips

CLAUDE.md

@@ -31,7 +31,7 @@ npm run release <patch|minor|major|x.y.z>  # bump, commit, tag, push → GitHub
 npm run release:mac                         # on the Mac with the cert: build, notarize, verify, upload, bump the cask
 ```
 
-No linting and no build step configured. `npm test` chains 89 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 70 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 101 test files under `test/`: 20 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 81 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the interactive TUI's first-run screens (`claude-firstrun.test.js` reads the theme picker, trust question and Bypass Permissions warning CAPTURED from CLI 2.1.288 in `test/fixtures/claude-tui/`, pins the config seed, and drives `runInteractiveSingle` against a fake `claude` drawing the trust screen to prove nothing is pasted into it), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow), and `engine-default.test.mjs` pins three ways the UI and the chat disagreed about the engine: the mobile sheet's engine chips (the API chip ships `on`, so a sync that skips the group blanks both), `send()` waiting for `/api/version` to supply the configured default before it reads `curEngine`, and `checkVersion()` applying that default even when the last script block (home of `loadTerminalCapability`) has not been parsed yet. The third is the cause of the other two looking like they did nothing: that call threw a `ReferenceError` into `checkVersion`'s own `catch {}` and skipped the configured engine, the chat defaults and `loadBots()`. Three rules on the wait, each found by an independent review of the first version: it is bounded by `VERSION_WAIT_MS`, never indefinite; it never applies to a user who already clicked an engine chip (`_engineUserPicked` — set by `setOpt`/`setMobOpt`, cleared by `resolveEngineForView()`), whose pick neither the wait nor `checkVersion()`'s resolve may overwrite; and it waits on the LOCAL version reply only — the GitHub release lookup is `_checkLatestRelease`, deliberately not awaited, or a firewall that drops packets to GitHub would add the full bound to every send. Keep literal `<script>` tags out of comments in `index.html` — `script-scope.test.mjs` counts them as block boundaries. `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
@@ -1183,7 +1183,7 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
 
 ## How to Verify Changes
 
-`npm test` runs 89 test files under `test/` (19 `test/render/*.test.mjs` + 70 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
+`npm test` runs 101 test files under `test/` (20 `test/render/*.test.mjs` + 81 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
 
 ```bash
 # 1. Start server