@crouton-kit/crouter 0.3.17 → 0.3.19

package/dist/core/predicate.js

@@ -0,0 +1,189 @@
+/**
+ * Predicate matcher engine — vendored verbatim from pi's frontmatter-rules
+ * extension.
+ *
+ * Source: pi-personal-extensions/extensions/frontmatter-rules/index.ts
+ *         (the "Condition language" block, functions `asArray` … `evalCondition`).
+ *
+ * The unified document substrate uses this to evaluate a document's `gate`
+ * predicate against a node-config subject (e.g. `orchestration.depth: { gte: 2 }`).
+ *
+ * This is intentionally a COPY, not an import: the source lives in a separate,
+ * private, unpublished repo that crtr cannot depend on. The functions are pure
+ * TS over `unknown` / `Record<string, unknown>` with zero external imports, so
+ * vendoring them keeps this module standalone and dependency-free. Keep it in
+ * sync with the source by hand if the matcher language ever changes.
+ *
+ * Condition language (evaluated against the subject object):
+ *   A condition is a map of <field> -> <matcher>, AND-ed across fields.
+ *   `field` may be dotted to reach nested values (e.g. `orchestration.depth`).
+ *
+ *   Matcher forms:
+ *     scalar (string/number/bool/null)
+ *         field === value, OR (if the field is an array) the array includes value
+ *     array  [a, b, c]
+ *         membership/intersection: field is one of these, OR the field array
+ *         shares any element with these
+ *     object { <op>: <arg>, ... }   (multiple ops AND together)
+ *         eq          equals (scalar or array-includes)
+ *         ne          not eq
+ *         in          [..] — field (or any of its array elements) is in the list
+ *         nin         not in
+ *         exists      true|false — field is present / absent
+ *         contains    field array includes this value
+ *         containsAll [..] — field array includes all of these
+ *         containsAny [..] — field array includes any of these
+ *         matches     regex string, case-sensitive (tests String(field); arrays: any)
+ *         imatches    regex string, case-insensitive
+ *         gt gte lt lte   numeric comparison
+ *
+ *   Combinators (reserved keys at any condition level):
+ *     all: [ {..}, {..} ]   every sub-condition true (AND)
+ *     any: [ {..}, {..} ]   at least one true (OR)
+ *     not: { .. }           sub-condition false
+ *   Sibling field matchers next to combinators are AND-ed in.
+ *
+ *   Two load-bearing edge cases preserved from the source:
+ *     - An empty condition (`{}`) is INERT: it returns false, NOT match-all.
+ *     - An unknown op never matches.
+ */
+export function asArray(v) {
+    if (Array.isArray(v))
+        return v;
+    if (v === undefined)
+        return [];
+    return [v];
+}
+// Scalar equality with light, predictable coercion: exact match, or
+// string/number cross-compare so `version: 2` matches a subject "2".
+export function scalarEq(a, b) {
+    if (a === b)
+        return true;
+    if ((typeof a === 'number' || typeof a === 'string') &&
+        (typeof b === 'number' || typeof b === 'string')) {
+        return String(a) === String(b);
+    }
+    return false;
+}
+// Resolve a (possibly dotted) field path against the subject object.
+export function getField(subject, key) {
+    if (subject && typeof subject === 'object' && key in subject) {
+        return subject[key];
+    }
+    if (!key.includes('.'))
+        return undefined;
+    let cur = subject;
+    for (const part of key.split('.')) {
+        if (cur == null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+export function toRegExp(arg, flags) {
+    if (typeof arg !== 'string')
+        return null;
+    try {
+        return new RegExp(arg, flags);
+    }
+    catch {
+        return null;
+    }
+}
+export function applyOp(op, value, arg) {
+    const vals = asArray(value);
+    switch (op) {
+        case 'eq':
+            return Array.isArray(value) ? value.some((v) => scalarEq(v, arg)) : scalarEq(value, arg);
+        case 'ne':
+            return !applyOp('eq', value, arg);
+        case 'in':
+            return asArray(arg).some((a) => vals.some((v) => scalarEq(v, a)));
+        case 'nin':
+            return !applyOp('in', value, arg);
+        case 'exists':
+            return (value !== undefined) === (arg !== false);
+        case 'contains':
+            return vals.some((v) => scalarEq(v, arg));
+        case 'containsAll':
+            return asArray(arg).every((a) => vals.some((v) => scalarEq(v, a)));
+        case 'containsAny':
+            return asArray(arg).some((a) => vals.some((v) => scalarEq(v, a)));
+        case 'matches':
+        case 'imatches': {
+            const re = toRegExp(arg, op === 'imatches' ? 'i' : '');
+            if (!re)
+                return false;
+            return vals.some((v) => (typeof v === 'string' || typeof v === 'number' ? re.test(String(v)) : false));
+        }
+        case 'gt':
+        case 'gte':
+        case 'lt':
+        case 'lte': {
+            const n = Number(value);
+            const t = Number(arg);
+            if (Number.isNaN(n) || Number.isNaN(t))
+                return false;
+            if (op === 'gt')
+                return n > t;
+            if (op === 'gte')
+                return n >= t;
+            if (op === 'lt')
+                return n < t;
+            return n <= t;
+        }
+        default:
+            return false; // unknown op never matches
+    }
+}
+export function matchField(value, matcher) {
+    if (matcher === null || ['string', 'number', 'boolean'].includes(typeof matcher)) {
+        if (Array.isArray(value))
+            return value.some((v) => scalarEq(v, matcher));
+        return scalarEq(value, matcher);
+    }
+    if (Array.isArray(matcher)) {
+        const vals = asArray(value);
+        return matcher.some((m) => vals.some((v) => scalarEq(v, m)));
+    }
+    if (matcher && typeof matcher === 'object') {
+        return Object.entries(matcher).every(([op, arg]) => applyOp(op, value, arg));
+    }
+    return false;
+}
+/**
+ * Evaluate a `gate` predicate against a subject object.
+ *
+ * This is the one function consumers call. Returns true iff `condition`
+ * matches `subject`. A null/non-object condition and an empty object both
+ * return false (inert), never match-all.
+ */
+export function evalCondition(condition, subject) {
+    if (condition == null)
+        return false;
+    if (Array.isArray(condition))
+        return condition.every((sub) => evalCondition(sub, subject));
+    if (typeof condition !== 'object')
+        return false;
+    const c = condition;
+    const hasCombinator = 'all' in c || 'any' in c || 'not' in c;
+    if (hasCombinator) {
+        let ok = true;
+        if ('all' in c)
+            ok = ok && asArray(c.all).every((s) => evalCondition(s, subject));
+        if ('any' in c)
+            ok = ok && asArray(c.any).some((s) => evalCondition(s, subject));
+        if ('not' in c)
+            ok = ok && !evalCondition(c.not, subject);
+        for (const k of Object.keys(c)) {
+            if (k === 'all' || k === 'any' || k === 'not')
+                continue;
+            ok = ok && matchField(getField(subject, k), c[k]);
+        }
+        return ok;
+    }
+    const keys = Object.keys(c);
+    if (keys.length === 0)
+        return false; // empty condition is inert, not match-all
+    return keys.every((k) => matchField(getField(subject, k), c[k]));
+}

package/dist/core/resolver.js

@@ -5,6 +5,7 @@ import { listDirs, pathExists, readText, readTextIfExists, walkFiles, } from './
 import { readMarketplaceManifest, readPluginManifest } from './manifest.js';
 import { parseFrontmatter } from './frontmatter.js';
 import { ambiguous, notFound, usage } from './errors.js';
+import { warn } from './output.js';
 import { InputError } from './io.js';
 import { builtinSkillsRoot, marketplacesDir, pluginsDir, projectScopeRoot, scopeSkillsDir, userScopeRoot, } from './scope.js';
 function getBuiltinPlugin() {
@@ -94,6 +95,22 @@ export function effectiveSkillEnabled(pluginName, skillName, cfgs) {
     }
     return { enabled: true };
 }
+/** Parse one skill file's frontmatter at the COLLECTION layer: the strict
+ *  parser THROWS on invalid YAML (the frontmatter contract is "valid YAML"),
+ *  so a single malformed SKILL.md must not brick a whole `skill find`/catalog
+ *  scan across the corpus. On a parse error, emit a clear scoped notice naming
+ *  the file and return null so the iterator SKIPS it and continues. A doc with
+ *  no frontmatter block parses fine (data === null) and is kept. */
+function readSkillFrontmatterSafe(file) {
+    try {
+        return parseFrontmatter(readText(file));
+    }
+    catch (e) {
+        const msg = (e instanceof Error ? e.message : String(e)).split('\n')[0];
+        warn(`invalid frontmatter in ${file}: ${msg}`);
+        return null;
+    }
+}
 export function listSkillsInPlugin(plugin, cfgs) {
     const skillsRoot = join(plugin.root, SKILLS_DIR);
     if (!pathExists(skillsRoot))
@@ -106,8 +123,10 @@ export function listSkillsInPlugin(plugin, cfgs) {
         const name = rel.split(sep).join('/');
         if (!name)
             continue;
-        const source = readText(file);
-        const { data } = parseFrontmatter(source);
+        const parsed = readSkillFrontmatterSafe(file);
+        if (parsed === null)
+            continue;
+        const { data } = parsed;
         const { enabled, disabledIn } = effectiveSkillEnabled(plugin.name, name, configs);
         skills.push({
             name,
@@ -136,8 +155,10 @@ export function listScopeRootSkills(scope, cfgs) {
         const name = rel.split(sep).join('/');
         if (!name)
             continue;
-        const source = readText(file);
-        const { data } = parseFrontmatter(source);
+        const parsed = readSkillFrontmatterSafe(file);
+        if (parsed === null)
+            continue;
+        const { data } = parsed;
         const { enabled, disabledIn } = effectiveSkillEnabled(SCOPE_SKILL_PLUGIN, name, configs);
         skills.push({
             name,
@@ -639,7 +660,7 @@ export function buildCategoryIndex(cat) {
         lines.push(`- \`${fullId}\` — ${desc}`);
     }
     lines.push('');
-    lines.push(`Read one with \`crtr skill read <full-id>\`. Narrow with \`crtr skill find list --plugin ${cat.plugin ?? cat.id}\`.`);
+    lines.push('Read one with `crtr memory read <full-id>`. Search with `crtr memory find "<topic>"`.');
     return lines.join('\n');
 }
 export function scopeRootsLabel() {

package/dist/core/runtime/bearings.d.ts

@@ -1,20 +1,61 @@
+import { type WakeKind, type Wakeup } from '../canvas/index.js';
 /** Base framing — present for every node. No path baked in: the caller carries
- *  the dir in the <crtr-context dir="…"> attribute. */
+ *  the dir in the `<crtr-context dir="…">` attribute. */
 export declare const BASE_CONTEXT_NOTE: string;
 /** Orchestrator-only framing: a resident orchestrator survives refresh cycles,
  *  so its context dir is also where a future cycle of itself resumes the work.
  *  Used inside the bearings block AND in the promotion guidance dump, so a
  *  promoted node gets the same note a born-orchestrator gets. */
 export declare function orchestratorContextNote(nodeId: string): string;
-/** The <memory> block (orchestrators only): the scoped stores merged, each a
- *  `label · dir` header over its live index pointer lines. A memory's `type`
- *  decides which store it lands in — the mapping + the how-to live once in the
- *  orchestration kernel ("Your long-term memory"); here we carry only the live
- *  data + a one-line pointer back to it. user-global rides in when the node has
- *  a user store, project when it has a project store, node-local always (the
- *  orchestrator gate). */
-export declare function buildMemoryBlock(nodeId: string, cwd: string): string;
-/** The full <crtr-context> bearings block: base framing always, plus the
- *  orchestrator addendum + the merged three-store <memory> block when the node
- *  has a node-local memory store (the orchestrator gate). */
+/** The IDENTITY assertion that opens every boot intro — the load-bearing fix
+ *  for the `--fork-from` impersonation bug. A fork copies the SOURCE node's
+ *  entire first-person conversation into its own session, so without an explicit
+ *  re-assertion the forked agent reads that copied narrative as its own and
+ *  impersonates the source (it kept "monitoring itself" as a phantom child).
+ *  This block names the node unambiguously. ONLY when the node IS a fork does it
+ *  additionally name the source AND disown the copied first-person narrative as
+ *  inherited reference material — a non-fork node's bearings are its first session
+ *  entry, so there is no earlier narrative to disown (emitting a disown line there
+ *  is dead weight that reads as a contradiction with no referent). Always the FIRST
+ *  thing the node reads. Exported for testing. */
+export declare function buildIdentityAssertion(nodeId: string): string;
+/** Why a node woke or was born, as carried from the fired wakeup row to the
+ *  injection seam. `ownerName` is the armer's resolved display name when it
+ *  still exists (a reaped cron's armer renders as a bare id, never crashes). */
+export interface WakeOrigin {
+    /** The firing kind. The <crtr-wake> block is rendered for 'spawn' (birth) and
+     *  'bare' (revive); 'noted'/'deadline' self-mark at the message seam instead. */
+    kind: WakeKind;
+    /** The armer node id (wakeups.owner_id), or null if somehow absent. */
+    ownerId: string | null;
+    /** The armer's display name, resolved if it still exists. */
+    ownerName?: string;
+    /** wakeups.created — when the wake was armed (ISO). */
+    armedAt: string;
+    /** wakeups.recur JSON when recurring, else null/undefined for a one-shot. */
+    recur?: string | null;
+}
+/** Build a WakeOrigin from a fired wakeup row, resolving the armer's display
+ *  name if the node still exists. The daemon calls this at fire time for the
+ *  bare-revive and spawn-birth seams. */
+export declare function wakeOriginFrom(w: Wakeup): WakeOrigin;
+/** The <crtr-wake> provenance block — load-bearing agent-facing prose read by
+ *  every wake-born or wake-woken node. Decision-first: it leads with the fact a
+ *  TIMER (not a message/event) caused this turn, names the wake kind, surfaces
+ *  the cadence for a recurrence (so the agent knows it is one run of a standing
+ *  job, not a one-off), and ends with the directive. The spawn (birth) variant
+ *  names the ARMER explicitly ("armed by node X") so the newborn never reads that
+ *  id as its own; the bare (revive) variant drops armer attribution entirely — a
+ *  bare wake can be armed for a node by ANOTHER (`--node`), and who armed it is
+ *  not decision-relevant to a timed re-check. No timestamp is rendered ("to fire
+ *  now" / the cadence already carry the signal; a raw ISO instant is noise an
+ *  agent cannot cheaply turn into an elapsed delta). Rendered for 'spawn' and
+ *  'bare'; other kinds self-mark elsewhere. */
+export declare function buildWakeBearings(origin: WakeOrigin): string;
+/** The full boot intro: the IDENTITY assertion (always first, so it overrides
+ *  any copied-in persona) followed by the `<crtr-context>` bearings block. Base
+ *  framing rides for EVERY node; the across-cycles context-dir note is added
+ *  ONLY for an orchestrator (by mode) — the one node whose dir a future cycle
+ *  resumes from. The `## References` block (substrate reference docs +
+ *  node-local docs) replaces the old `<memory>` block. */
 export declare function buildContextBearings(nodeId: string): string;

package/dist/core/runtime/bearings.js

@@ -1,8 +1,15 @@
-// bearings.ts — the <crtr-context> framing prose, shared by the two paths that
-// deliver it so they can never drift:
+// bearings.ts — the boot-intro prose (the <crtr-identity> assertion + the
+// <crtr-context> framing), shared by the paths that deliver it so they can
+// never drift:
 //
 //   • the context-intro pi-extension injects buildContextBearings() as the
-//     node's first session message in every brand-new chat;
+//     node's first session message in every brand-new chat. It opens with a
+//     <crtr-identity> block (buildIdentityAssertion) that names the node and,
+//     ONLY for a fork, disowns the source's copied first-person narrative as
+//     inherited context — the fix for the `--fork-from` bug where a fork copies
+//     the source's whole conversation and then impersonates it. A non-fork
+//     node's bearings are its FIRST entry, so there is nothing earlier to
+//     disown; it gets only the declarative identity line;
 //   • promote.ts folds orchestratorContextNote() into the promotion guidance
 //     dump, so a node that becomes an orchestrator MID-LIFE gets the
 //     orchestrator framing it never received at spawn — it spawned as a base
@@ -12,17 +19,17 @@
 // one place other nodes on the canvas can read from, so it is for documents
 // worth a shared reference, NOT a task tracker, and NOT a "future memory-wiped
 // you" stash (a terminal worker has no future cycle — that framing only makes
-// sense once a node is a resident orchestrator).
+// sense once a node is a resident orchestrator). The `## References` block
+// (substrate reference docs + node-local docs) rides into the context message.
 //
-// Orchestrator addendum (resident orchestrators — i.e. nodes that have a
-// node-local memory store): the dir ALSO survives refresh cycles, so it is where
-// a future cycle of the orchestrator resumes; durable cross-goal lessons live in
-// the three scoped memory stores, whose index pointer lines are inlined into
-// <memory> (the how-to lives once in the kernel, not here).
-import { contextDir, getNode } from '../canvas/index.js';
-import { hasMemory, memoryDir, readMemory, hasUserMemory, userMemoryDir, readUserMemory, hasProjectMemory, projectMemoryDir, readProjectMemory, } from './memory.js';
+// Orchestrator addendum (gated on orchestrator MODE): the dir ALSO survives
+// refresh cycles, so it is where a future cycle of the orchestrator resumes.
+// This across-cycles note is the ONE thing a terminal worker's bearings drop.
+import { contextDir, getNode, fullName } from '../canvas/index.js';
+import { cadenceDisplay } from '../wake.js';
+import { renderReferencesBlock } from '../substrate/index.js';
 /** Base framing — present for every node. No path baked in: the caller carries
- *  the dir in the <crtr-context dir="…"> attribute. */
+ *  the dir in the `<crtr-context dir="…">` attribute. */
 export const BASE_CONTEXT_NOTE = 'This is your context directory — durable scratch space on disk, and the one place the other ' +
     'nodes on the canvas can read from. Put documents here that you want to share by reference ' +
     'instead of re-explaining them in a prompt: specs, designs, findings, notes worth pointing a ' +
@@ -36,57 +43,123 @@ export function orchestratorContextNote(nodeId) {
         `also where a future cycle of you resumes the work — keep the working notes and decisions a ` +
         `refreshed you would need there, alongside the docs you share with the nodes you spawn.`);
 }
-/** One labeled store stanza inside <memory>: a compact `label · dir` header (the
- *  scope name + where to WRITE this kind of memory), then the LIVE pointer lines
- *  extracted fresh from the store's index — only lines matching `- [...` — with
- *  the index's how-to boilerplate dropped (it lives once in the kernel) and
- *  detail files loaded on demand. Falls back to `(empty)` when the index carries
- *  no pointers, which also covers the not-seeded / template-only case. */
-function memoryStanza(label, dir, index) {
-    const pointers = (index ?? '')
-        .split('\n')
-        .filter((line) => /^\s*-\s*\[/.test(line))
-        .map((line) => line.trim());
-    const body = pointers.length > 0 ? pointers.join('\n') : '(empty)';
-    return `${label} · ${dir}\n${body}`;
+/** The IDENTITY assertion that opens every boot intro — the load-bearing fix
+ *  for the `--fork-from` impersonation bug. A fork copies the SOURCE node's
+ *  entire first-person conversation into its own session, so without an explicit
+ *  re-assertion the forked agent reads that copied narrative as its own and
+ *  impersonates the source (it kept "monitoring itself" as a phantom child).
+ *  This block names the node unambiguously. ONLY when the node IS a fork does it
+ *  additionally name the source AND disown the copied first-person narrative as
+ *  inherited reference material — a non-fork node's bearings are its first session
+ *  entry, so there is no earlier narrative to disown (emitting a disown line there
+ *  is dead weight that reads as a contradiction with no referent). Always the FIRST
+ *  thing the node reads. Exported for testing. */
+export function buildIdentityAssertion(nodeId) {
+    const meta = getNode(nodeId);
+    const name = meta?.name ?? nodeId;
+    const kind = meta?.kind ?? 'general';
+    const mode = meta?.mode ?? 'base';
+    const lines = [
+        '<crtr-identity>',
+        `You are node ${nodeId} — name "${name}", kind ${kind}, mode ${mode}.`,
+    ];
+    const forkFrom = meta?.fork_from;
+    if (forkFrom !== undefined && forkFrom !== null && forkFrom !== '') {
+        // Name the source: a known node id gets its human label; a raw path/uuid
+        // passes through as-is.
+        const src = getNode(forkFrom);
+        const sourceLabel = src !== null ? `${forkFrom} ("${fullName(src)}")` : forkFrom;
+        lines.push(`You are a FORK of ${sourceLabel}: at spawn pi COPIED that node's conversation into your ` +
+            `session as a starting point. You are NOT ${sourceLabel}. Everything earlier in this ` +
+            'conversation is THEIR first-person history — inherited reference material, not your own ' +
+            'past. Do not speak or act as them, do not continue their task as if it were yours, and do ' +
+            'not "monitor yourself" as though you were a child they spawned.');
+    }
+    lines.push('</crtr-identity>');
+    return lines.join('\n');
+}
+/** Build a WakeOrigin from a fired wakeup row, resolving the armer's display
+ *  name if the node still exists. The daemon calls this at fire time for the
+ *  bare-revive and spawn-birth seams. */
+export function wakeOriginFrom(w) {
+    const owner = w.owner_id != null ? getNode(w.owner_id) : null;
+    return {
+        kind: w.kind,
+        ownerId: w.owner_id ?? null,
+        ownerName: owner !== null ? fullName(owner) : undefined,
+        armedAt: w.created,
+        recur: w.recur,
+    };
 }
-/** The <memory> block (orchestrators only): the scoped stores merged, each a
- *  `label · dir` header over its live index pointer lines. A memory's `type`
- *  decides which store it lands in — the mapping + the how-to live once in the
- *  orchestration kernel ("Your long-term memory"); here we carry only the live
- *  data + a one-line pointer back to it. user-global rides in when the node has
- *  a user store, project when it has a project store, node-local always (the
- *  orchestrator gate). */
-export function buildMemoryBlock(nodeId, cwd) {
-    const stanzas = [];
-    if (hasUserMemory()) {
-        stanzas.push(memoryStanza('user-global', userMemoryDir(), readUserMemory()));
+/** The armer rendered for prose, ROLE-explicit so a newborn never mistakes the
+ *  id for its own: `node <id> ("<name>")` when the name resolved, `node <id>
+ *  (now gone)` when the armer was reaped, `an unknown node` only if the owner id
+ *  is somehow absent (owner_id is NOT NULL on every real row — defensive). */
+function armerPhrase(origin) {
+    if (origin.ownerId === null || origin.ownerId === '')
+        return 'an unknown node';
+    if (origin.ownerName !== undefined)
+        return `node ${origin.ownerId} ("${origin.ownerName}")`;
+    return `node ${origin.ownerId} (now gone)`;
+}
+/** The <crtr-wake> provenance block — load-bearing agent-facing prose read by
+ *  every wake-born or wake-woken node. Decision-first: it leads with the fact a
+ *  TIMER (not a message/event) caused this turn, names the wake kind, surfaces
+ *  the cadence for a recurrence (so the agent knows it is one run of a standing
+ *  job, not a one-off), and ends with the directive. The spawn (birth) variant
+ *  names the ARMER explicitly ("armed by node X") so the newborn never reads that
+ *  id as its own; the bare (revive) variant drops armer attribution entirely — a
+ *  bare wake can be armed for a node by ANOTHER (`--node`), and who armed it is
+ *  not decision-relevant to a timed re-check. No timestamp is rendered ("to fire
+ *  now" / the cadence already carry the signal; a raw ISO instant is noise an
+ *  agent cannot cheaply turn into an elapsed delta). Rendered for 'spawn' and
+ *  'bare'; other kinds self-mark elsewhere. */
+export function buildWakeBearings(origin) {
+    const recurring = origin.recur !== null && origin.recur !== undefined && origin.recur !== '';
+    const cadence = recurring ? cadenceDisplay(origin.recur) : null;
+    let body;
+    if (origin.kind === 'spawn') {
+        const armer = armerPhrase(origin);
+        body = recurring
+            ? `You were BORN by a scheduled wake, not spawned on demand — a recurring spawn-cron armed by ` +
+                `${armer}, firing ${cadence}. The runtime re-births a fresh node like you on this cadence whether ` +
+                `or not earlier runs survived: you are one run of a standing job, not a one-off, and you inherit ` +
+                `nothing from prior runs but this task. Your task follows.`
+            : `You were BORN by a scheduled wake, not spawned on demand — a one-shot deferred birth armed by ` +
+                `${armer} to fire now. You are its only run, not a recurring job. Your task follows.`;
     }
-    if (hasProjectMemory(cwd)) {
-        stanzas.push(memoryStanza('project', projectMemoryDir(cwd), readProjectMemory(cwd)));
+    else {
+        // bare scheduled alarm (the only kind delivered through this block at the
+        // revive seam; noted/deadline self-mark via their inbox label instead).
+        body = recurring
+            ? `You woke because a recurring scheduled alarm fired (${cadence}) — a timer, NOT a new message or ` +
+                `request. This is one tick of a standing re-check: re-read your roadmap and the disk bearings below ` +
+                `and decide what this moment calls for.`
+            : `You woke because a scheduled alarm fired — a timer, NOT a new message or request. This is a timed ` +
+                `re-check, not a new task: re-read your roadmap and the disk bearings below and decide what this ` +
+                `moment calls for.`;
     }
-    stanzas.push(memoryStanza('node-local', memoryDir(nodeId), readMemory(nodeId)));
-    const n = stanzas.length;
-    return ('<memory>\n' +
-        `Long-term memory, ${n} scope${n === 1 ? '' : 's'}. Each line ` +
-        '`- [Title](slug.md) — hook`; load a detail file by slug from the scope dir on demand. ' +
-        'Write a new fact to the scope matching its `type` (see "Your long-term memory").\n\n' +
-        stanzas.join('\n\n') +
-        '\n</memory>');
+    return `<crtr-wake>\n${body}\n</crtr-wake>`;
 }
-/** The full <crtr-context> bearings block: base framing always, plus the
- *  orchestrator addendum + the merged three-store <memory> block when the node
- *  has a node-local memory store (the orchestrator gate). */
+/** The full boot intro: the IDENTITY assertion (always first, so it overrides
+ *  any copied-in persona) followed by the `<crtr-context>` bearings block. Base
+ *  framing rides for EVERY node; the across-cycles context-dir note is added
+ *  ONLY for an orchestrator (by mode) — the one node whose dir a future cycle
+ *  resumes from. The `## References` block (substrate reference docs +
+ *  node-local docs) replaces the old `<memory>` block. */
 export function buildContextBearings(nodeId) {
+    const identity = buildIdentityAssertion(nodeId);
     const dir = contextDir(nodeId);
-    if (!hasMemory(nodeId)) {
-        // A terminal worker (no memory store): base framing only, no memory block.
-        return `<crtr-context dir="${dir}">\n${BASE_CONTEXT_NOTE}\n</crtr-context>`;
-    }
-    // An orchestrator: across-cycles framing + the merged three-store memory. The
-    // project store is keyed off the node's cwd (its working dir on disk).
-    const cwd = getNode(nodeId)?.cwd ?? process.cwd();
-    return (`<crtr-context dir="${dir}">\n` +
-        `${BASE_CONTEXT_NOTE}\n${orchestratorContextNote(nodeId)}\n${buildMemoryBlock(nodeId, cwd)}\n` +
-        '</crtr-context>');
+    const node = getNode(nodeId);
+    const parts = [BASE_CONTEXT_NOTE];
+    // Orchestrator-only: the across-cycles framing (a terminal has no future cycle).
+    if (node?.mode === 'orchestrator')
+        parts.push(orchestratorContextNote(nodeId));
+    // The substrate references block: eligible `reference` docs at their
+    // system-prompt rung + node-local memory docs; dropped (returns '') when
+    // nothing is eligible.
+    const references = renderReferencesBlock(nodeId);
+    if (references !== '')
+        parts.push(references);
+    return `${identity}\n<crtr-context dir="${dir}">\n${parts.join('\n')}\n</crtr-context>`;
 }

package/dist/core/runtime/broker-cli.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/runtime/broker-cli.js

@@ -0,0 +1,46 @@
+// broker-cli.ts — the headless broker's dedicated detached entry (plan T4 /
+// decision §1.13). Spawned directly via `spawn(execPath, [thisFile, nodeId], …)`
+// by HeadlessBrokerHost.launch (T6) — NEVER routed through src/cli.ts, which
+// would run the whole bootstrap chain (auto-update / scope-init / slash-template
+// rewrite) on every broker boot. Mirrors src/daemon/crtrd-cli.ts: parse the one
+// positional arg and hand off; keep this file a thin shim.
+import { runBroker, disposeActiveSession } from './broker.js';
+const nodeId = process.argv[2];
+if (nodeId === undefined || nodeId.trim() === '') {
+    process.stderr.write('[broker] usage: broker-cli <nodeId>\n');
+    process.exit(1);
+}
+// M3 (scout mq5thyli): dispose the live engine before a FATAL exit. The bash tool
+// spawns children `detached` (own pgid); only session.dispose() (→ abortBash /
+// agent.abort → killProcessTree) reaps them. The graceful path (shutdownHandler /
+// SIGTERM → disposeAndExit) already disposes; this routes the crash path —
+// uncaughtException / unhandledRejection / a runBroker reject — through dispose
+// too, so a fatal error never ORPHANS in-flight bash subprocesses. dispose is
+// idempotent + a no-op once the graceful path has run.
+function disposeAndExit(code) {
+    try {
+        disposeActiveSession();
+    }
+    catch {
+        /* dispose must not block the fatal exit */
+    }
+    process.exit(code);
+}
+// Last-resort safety net (review N-4): a stray throw/rejection from the SDK event
+// stream or an extension's async hook would otherwise crash the broker on Node's
+// default handler. Now that the host redirects the broker's stderr to the node's
+// job/broker.log (M-2), log it there and exit non-zero — pre-session_start this
+// folds into the daemon's boot-failure detection (M-1: pid stays null past the
+// boot grace → surfaceBootFailure); post-session_start it is a clean grace-revive.
+process.on('uncaughtException', (err) => {
+    process.stderr.write(`[broker] uncaughtException: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+    disposeAndExit(1);
+});
+process.on('unhandledRejection', (reason) => {
+    process.stderr.write(`[broker] unhandledRejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}\n`);
+    disposeAndExit(1);
+});
+runBroker(nodeId).catch((err) => {
+    process.stderr.write(`[broker] fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+    disposeAndExit(1);
+});