test(model-preflight): cover detect-mismatch + fix newline-trim bug

* New ModelPreflightTests suite (19 tests) covering both `check(_:)`
  and the v2.8 `detectMismatch(_:)` paths. Pins the dogfooding
  scenario (anthropic-prefixed model + nous active provider after
  Credential Pools OAuth swap), the case-insensitive prefix match,
  empty-prefix / empty-bare-model edge cases, and multi-slash model
  ids (OpenRouter style).

* Bug fix surfaced by the tests: `ModelPreflight` was using
  `trimmingCharacters(in: .whitespaces)` which doesn't strip
  newlines. A stray `\n` in a hand-edited config.yaml would either
  miss the missing-fields classifier OR false-positive the mismatch
  banner (showing "anthropic" vs "anthropic\n"). Switched both
  trims to `.whitespacesAndNewlines`.

perf(observability): instrument Tier C load paths + fetchSessionPreviews

No behavior change — adds ScarfMon coverage so future captures show
how often Memory/Skills/Cron/Curator/SessionPreviews load paths fire
and what they cost on remote (each is multiple sequential SFTP RTTs
that pre-fix were invisible). New events:

* `mac.fetchSessionPreviews` / `.rows` / `.transportError`
* `memory.load` / `.bytes`
* `cron.load` / `.jobs`
* `skills.load` / `.count`
* `curator.load` / `.bytes`

All 321 ScarfCore tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scarf/Packages/ScarfCore/Sources/ScarfCore/Services/HermesDataService.swift

@@ -637,6 +637,14 @@ public actor HermesDataService {
     }
 
     public func fetchSessionPreviews(limit: Int = QueryDefaults.sessionPreviewLimit) async -> [String: String] {
+        // Already bounded by `substr(content, 1, previewContentLength)`
+        // — wire payload caps at ~limit × 100 bytes. v2.8 added
+        // ScarfMon instrumentation + transport-error logging for
+        // parity with `fetchRecentToolCallsOutcome`; if this query
+        // ever does start timing out on a slow remote we'll see it
+        // in captures rather than swallowing the error and returning
+        // an empty preview map.
+        await ScarfMon.measureAsync(.sessionLoad, "mac.fetchSessionPreviews") {
             let sql = """
                 SELECT m.session_id, substr(m.content, 1, \(QueryDefaults.previewContentLength))
                 FROM messages m
@@ -655,9 +663,16 @@ public actor HermesDataService {
                 for row in rows {
                     previews[row.string(at: 0)] = row.string(at: 1)
                 }
+                ScarfMon.event(.sessionLoad, "mac.fetchSessionPreviews.rows", count: previews.count)
                 return previews
-        } catch {
+            } catch let BackendError.transport(reason) {
+                ScarfMon.event(.sessionLoad, "mac.fetchSessionPreviews.transportError", count: 1)
+                Self.logger.warning("fetchSessionPreviews transport error: \(reason, privacy: .public)")
                 return [:]
+            } catch {
+                Self.logger.warning("fetchSessionPreviews failed: \(error.localizedDescription, privacy: .public)")
+                return [:]
+            }
         }
     }
 

scarf/Packages/ScarfCore/Sources/ScarfCore/Services/ModelPreflight.swift

@@ -50,7 +50,7 @@ public enum ModelPreflight: Sendable {
     }
 
     private static func isUnset(_ value: String) -> Bool {
-        let trimmed = value.trimmingCharacters(in: .whitespaces).lowercased()
+        let trimmed = value.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
         return trimmed.isEmpty || trimmed == "unknown"
     }
 
@@ -79,8 +79,8 @@ public enum ModelPreflight: Sendable {
     /// Uses case-insensitive comparison — Hermes accepts both
     /// `Anthropic/...` and `anthropic/...` casings in the wild.
     public static func detectMismatch(_ config: HermesConfig) -> Mismatch? {
-        let modelDefault = config.model.trimmingCharacters(in: .whitespaces)
+        let modelDefault = config.model.trimmingCharacters(in: .whitespacesAndNewlines)
-        let activeProvider = config.provider.trimmingCharacters(in: .whitespaces)
+        let activeProvider = config.provider.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !isUnset(modelDefault), !isUnset(activeProvider) else { return nil }
         guard let slash = modelDefault.firstIndex(of: "/") else { return nil }
         let prefix = String(modelDefault[..<slash])

scarf/Packages/ScarfCore/Sources/ScarfCore/ViewModels/CuratorViewModel.swift

@@ -37,7 +37,12 @@ public final class CuratorViewModel {
         isLoading = true
         defer { isLoading = false }
         let context = self.context
-        let parsed = await Task.detached(priority: .userInitiated) { () -> (HermesCuratorStatus, String?) in
+        // v2.8 — instrumented. Curator load fires `hermes curator
+        // status` (CLI subprocess) plus 1-2 file reads; on remote
+        // each is a separate SSH RTT. Visibility lets future captures
+        // show how often the report file is missing or oversized.
+        let parsed = await ScarfMon.measureAsync(.diskIO, "curator.load") {
+            await Task.detached(priority: .userInitiated) { () -> (HermesCuratorStatus, String?) in
                 let textResult = Self.runCuratorStatus(context: context)
                 let stateData = context.readData(context.paths.curatorStateFile)
                 let parsed = HermesCuratorStatusParser.parse(text: textResult, stateFileJSON: stateData)
@@ -53,6 +58,13 @@ public final class CuratorViewModel {
                 }
                 return (parsed, report)
             }.value
+        }
+        ScarfMon.event(
+            .diskIO,
+            "curator.load.bytes",
+            count: 0,
+            bytes: parsed.1?.utf8.count ?? 0
+        )
         self.status = parsed.0
         self.lastReportMarkdown = parsed.1
     }

scarf/Packages/ScarfCore/Sources/ScarfCore/ViewModels/SkillsViewModel.swift

@@ -82,7 +82,11 @@ public final class SkillsViewModel {
         let ctx = context
         let xport = transport
         let pins = pinnedNames
-        let cats: [HermesSkillCategory] = await Task.detached {
+        // v2.8 — instrumented so future captures show how many SSH
+        // RTTs the SkillsScanner walk costs on remote (it stats
+        // every ~/.hermes/skills/* directory + reads SKILL.md per).
+        let cats: [HermesSkillCategory] = await ScarfMon.measureAsync(.diskIO, "skills.load") {
+            await Task.detached {
                 let disabled = Self.readDisabledSkillNames(context: ctx)
                 let pinned = pins ?? Self.readPinnedSkillNames(context: ctx)
                 return SkillsScanner.scan(
@@ -92,6 +96,9 @@ public final class SkillsViewModel {
                     pinnedNames: pinned
                 )
             }.value
+        }
+        let totalSkills = cats.reduce(0) { $0 + $1.skills.count }
+        ScarfMon.event(.diskIO, "skills.load.count", count: totalSkills)
         categories = cats
         isLoading = false
     }

scarf/Packages/ScarfCore/Tests/ScarfCoreTests/ModelPreflightTests.swift

@@ -0,0 +1,182 @@
+import Testing
+import Foundation
+@testable import ScarfCore
+
+/// Pure tests for `ModelPreflight` — both the `check(_:)` configured-vs-
+/// missing classifier and the v2.8 `detectMismatch(_:)` provider/prefix
+/// reconciliation. The mismatch path is what surfaces the orange
+/// "Model/provider mismatch in config.yaml" banner in ChatView when the
+/// user switches OAuth providers via Credential Pools and `model.default`
+/// is left carrying the old provider's prefix.
+@Suite struct ModelPreflightTests {
+
+    // MARK: - check(_:) — missing-field classifier
+
+    @Test func bothModelAndProviderEmptyReportsMissingBoth() {
+        var cfg = HermesConfig.empty
+        cfg.model = ""
+        cfg.provider = ""
+        #expect(ModelPreflight.check(cfg) == .missingBoth)
+    }
+
+    @Test func bothModelAndProviderUnknownReportsMissingBoth() {
+        // `HermesConfig.empty` defaults model/provider to the literal
+        // "unknown" — the classifier must treat that the same as "".
+        let cfg = HermesConfig.empty
+        #expect(ModelPreflight.check(cfg) == .missingBoth)
+    }
+
+    @Test func providerSetButModelEmptyReportsMissingModel() {
+        var cfg = HermesConfig.empty
+        cfg.model = ""
+        cfg.provider = "anthropic"
+        #expect(ModelPreflight.check(cfg) == .missingModel)
+    }
+
+    @Test func modelSetButProviderEmptyReportsMissingProvider() {
+        var cfg = HermesConfig.empty
+        cfg.model = "claude-sonnet-4.6"
+        cfg.provider = ""
+        #expect(ModelPreflight.check(cfg) == .missingProvider)
+    }
+
+    @Test func bothSetReportsConfigured() {
+        var cfg = HermesConfig.empty
+        cfg.model = "claude-sonnet-4.6"
+        cfg.provider = "anthropic"
+        #expect(ModelPreflight.check(cfg) == .configured)
+    }
+
+    @Test func whitespaceTreatedAsUnsetForBothFields() {
+        var cfg = HermesConfig.empty
+        cfg.model = "  "
+        cfg.provider = "\n"
+        #expect(ModelPreflight.check(cfg) == .missingBoth)
+    }
+
+    @Test func resultIsConfiguredOnlyForConfiguredCase() {
+        #expect(ModelPreflight.Result.configured.isConfigured)
+        #expect(!ModelPreflight.Result.missingBoth.isConfigured)
+        #expect(!ModelPreflight.Result.missingModel.isConfigured)
+        #expect(!ModelPreflight.Result.missingProvider.isConfigured)
+    }
+
+    // MARK: - detectMismatch(_:)
+
+    @Test func detectMismatchReturnsNilWhenNoPrefixOnModelDefault() {
+        var cfg = HermesConfig.empty
+        cfg.model = "claude-sonnet-4.6"
+        cfg.provider = "anthropic"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchReturnsNilWhenPrefixMatchesProvider() {
+        var cfg = HermesConfig.empty
+        cfg.model = "anthropic/claude-sonnet-4.6"
+        cfg.provider = "anthropic"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchReturnsNilWhenModelDefaultIsUnset() {
+        var cfg = HermesConfig.empty
+        cfg.model = ""
+        cfg.provider = "nous"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchReturnsNilWhenProviderIsUnset() {
+        var cfg = HermesConfig.empty
+        cfg.model = "anthropic/claude-sonnet-4.6"
+        cfg.provider = ""
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchReturnsNilWhenBothUnknown() {
+        // The literal "unknown" sentinel from the YAML parser fallback
+        // counts as unset on both sides — no mismatch to report.
+        let cfg = HermesConfig.empty // model + provider both "unknown"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchSurfacesPrefixVsActiveProvider() {
+        // The dogfooding scenario: Anthropic-prefixed model still sitting
+        // in config.yaml after the user OAuth'd into Nous via Credential
+        // Pools. Hermes can't reconcile and chats die with -32603 at
+        // first prompt. The banner offers a one-click fix in either
+        // direction; this test pins the data the banner reads.
+        var cfg = HermesConfig.empty
+        cfg.model = "anthropic/claude-sonnet-4.6"
+        cfg.provider = "nous"
+        let mismatch = ModelPreflight.detectMismatch(cfg)
+        #expect(mismatch != nil)
+        #expect(mismatch?.prefixProvider == "anthropic")
+        #expect(mismatch?.activeProvider == "nous")
+        #expect(mismatch?.modelDefault == "anthropic/claude-sonnet-4.6")
+        #expect(mismatch?.bareModel == "claude-sonnet-4.6")
+    }
+
+    @Test func detectMismatchIsCaseInsensitiveOnPrefixMatch() {
+        // Hermes accepts both `Anthropic/...` and `anthropic/...` casings
+        // in the wild — case-only differences must NOT surface as a
+        // mismatch (would be a false-positive banner).
+        var cfg = HermesConfig.empty
+        cfg.model = "Anthropic/claude-sonnet-4.6"
+        cfg.provider = "anthropic"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchHandlesNonAnthropicProviders() {
+        // The mismatch banner needs to work for any provider pair —
+        // not just the dogfooding case. Pin the openai+nous shape.
+        var cfg = HermesConfig.empty
+        cfg.model = "openai/gpt-5"
+        cfg.provider = "nous"
+        let mismatch = ModelPreflight.detectMismatch(cfg)
+        #expect(mismatch?.prefixProvider == "openai")
+        #expect(mismatch?.activeProvider == "nous")
+        #expect(mismatch?.bareModel == "gpt-5")
+    }
+
+    @Test func detectMismatchReturnsNilForEmptyBareModel() {
+        // A pathological "anthropic/" with no model name after the
+        // slash isn't a valid mismatch — caller has no bare model to
+        // write back. The classifier should refuse to surface it
+        // rather than emit a useless fix button.
+        var cfg = HermesConfig.empty
+        cfg.model = "anthropic/"
+        cfg.provider = "nous"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchReturnsNilForEmptyPrefix() {
+        // Symmetric pathological case — leading slash, no provider
+        // prefix. Don't fire.
+        var cfg = HermesConfig.empty
+        cfg.model = "/claude-sonnet-4.6"
+        cfg.provider = "nous"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+
+    @Test func detectMismatchHandlesModelsWithMultipleSlashes() {
+        // Some provider/model strings carry path-style segments after
+        // the first slash (e.g. an OpenRouter style path). The first
+        // slash separates prefix from bare model; the rest of the
+        // string is the bare model verbatim.
+        var cfg = HermesConfig.empty
+        cfg.model = "openrouter/anthropic/claude-sonnet-4.6"
+        cfg.provider = "anthropic"
+        let mismatch = ModelPreflight.detectMismatch(cfg)
+        #expect(mismatch?.prefixProvider == "openrouter")
+        #expect(mismatch?.activeProvider == "anthropic")
+        #expect(mismatch?.bareModel == "anthropic/claude-sonnet-4.6")
+    }
+
+    @Test func detectMismatchTrimsWhitespaceBeforeComparing() {
+        // A stray newline in a hand-edited config.yaml shouldn't read
+        // as a mismatch when the trimmed values agree.
+        var cfg = HermesConfig.empty
+        cfg.model = "anthropic/claude-sonnet-4.6  "
+        cfg.provider = " anthropic\n"
+        #expect(ModelPreflight.detectMismatch(cfg) == nil)
+    }
+}

scarf/scarf/Features/Cron/ViewModels/CronViewModel.swift

@@ -40,10 +40,14 @@ final class CronViewModel {
         let selectedID = selectedJob?.id
         Task.detached { [weak self] in
             // Three sync transport ops on remote — keep them off main.
+            // v2.8: instrumented so we can see how many SSH RTTs the
+            // Cron tab actually costs in captures.
+            await ScarfMon.measureAsync(.diskIO, "cron.load") {
                 let jobs = svc.loadCronJobs()
                 let skills = svc.loadSkills().flatMap { $0.skills.map(\.id) }.sorted()
                 let refreshed = selectedID.flatMap { id in jobs.first(where: { $0.id == id }) }
                 let output = refreshed.flatMap { svc.loadCronOutput(jobId: $0.id) }
+                ScarfMon.event(.diskIO, "cron.load.jobs", count: jobs.count)
                 await MainActor.run { [weak self] in
                     guard let self else { return }
                     self.jobs = jobs
@@ -54,6 +58,7 @@ final class CronViewModel {
                 }
             }
         }
+    }
 
     func selectJob(_ job: HermesCronJob) {
         selectedJob = job

scarf/scarf/Features/Memory/ViewModels/MemoryViewModel.swift

@@ -43,13 +43,17 @@ final class MemoryViewModel {
         let svc = fileService
         let currentProfile = activeProfile
         // Sync transport calls would beach-ball the UI on remote — dispatch
-        // off main, then commit results back on MainActor.
+        // off main, then commit results back on MainActor. v2.8: wrapped
+        // in ScarfMon so we can see how many SSH RTTs this load actually
+        // costs (4 sequential SFTP reads on the slow path).
         Task.detached { [weak self] in
+            await ScarfMon.measureAsync(.diskIO, "memory.load") {
                 let config = svc.loadConfig()
                 let profiles = svc.loadMemoryProfiles()
                 let profile = currentProfile.isEmpty ? config.memoryProfile : currentProfile
                 let memory = svc.loadMemory(profile: profile)
                 let user = svc.loadUserProfile(profile: profile)
+                ScarfMon.event(.diskIO, "memory.load.bytes", count: 0, bytes: memory.utf8.count + user.utf8.count)
                 await MainActor.run { [weak self] in
                     guard let self else { return }
                     self.memoryProvider = config.memoryProvider
@@ -61,6 +65,7 @@ final class MemoryViewModel {
                 }
             }
         }
+    }
 
     func switchProfile(_ profile: String) {
         activeProfile = profile