@crouton-kit/crouter 0.3.18 → 0.3.20

package/dist/core/__tests__/child-death-wake.test.js

@@ -0,0 +1,245 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/child-death-wake.test.ts
+//
+// D-1 BUG REGRESSION + node/canvas LIFECYCLE — "the runtime wakes a dormant
+// parent on ANY terminal child outcome."
+//
+// The bug (D-1 finding, context/d1-finding.md): a parent that delegates and
+// then JUST STOPS — retaining its inbox-wait, arming no self-wake — was woken
+// ONLY when a child `push final`s or never boots. A child that crashes AFTER
+// booting, is daemon-finalized after a quiet turn, or is `node close`d marked
+// the child dead/done/canceled with NO push to the parent, so a purely-inbox-
+// waiting parent hung dormant forever. The wake doctrine ("delegate and stop;
+// the runtime wakes you") is only honest if EVERY terminal child outcome reaches
+// the parent — this locks that in.
+//
+// The fix fans a system inbox entry to subscribersOf(child) on three previously-
+// silent terminal outcomes — mirroring surfaceBootFailure:
+//   • daemon CRASH after boot   (crtrd pane-gone, mid-generation → 'dead')
+//   • daemon FINALIZE on quiet   (crtrd pane-gone, turn ended, nothing live → 'done')
+//   • `node close`               (close.ts, the surviving manager outside the set)
+//
+// THE CRUX (the whole risk): the wake must fire ONLY on genuine death/close —
+// NEVER on healthy dormancy. A child that ended its turn STILL waiting (an active
+// live grandchild, or a pending self-wake) is alive-and-dormant, not dead; waking
+// its parent then would re-create the spurious-wake storm the doctrine exists to
+// kill (the concrete case: a developer child that finished its edits, spawned its
+// own reviewer, and went dormant waiting on it — its parent must stay asleep).
+// The daemon draws that boundary EXACTLY where the stop-guard does:
+// hasActiveLiveSubscription || hasPendingSelfWake ⇒ healthy dormancy ⇒ release,
+// no wake.
+//
+// Faithful: REAL canvas data layer, REAL tmux panes, the REAL daemon decision
+// pass (superviseTick) and the REAL closeNode. The wake travels through the ONE
+// channel the d1-finding identified — an entry appended to the parent's
+// inbox.jsonl — so each direction asserts that channel: the system entry appears
+// (parent woken: its dormant pi is then revived by the daemon's second pass,
+// observed via a cycles bump) or it does NOT (parent stays asleep, cycles flat).
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createNode, getNode, subscribe } from '../canvas/canvas.js';
+import { armWake } from '../canvas/wakeups.js';
+import { closeDb } from '../canvas/db.js';
+import { readInboxSince } from '../feed/inbox.js';
+import { markBusy, clearBusy } from '../runtime/busy.js';
+import { closeNode } from '../runtime/close.js';
+import { superviseTick } from '../../daemon/crtrd.js';
+let home;
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...over,
+    };
+}
+function hasTmux() {
+    return spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0;
+}
+/** A pid that is guaranteed dead. */
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+const cyclesOf = (id) => getNode(id)?.cycles ?? 0;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-child-death-wake-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+/** Run `fn` with a real, live tmux session + its window's live `%pane_id`. The
+ *  PARENT occupies this (frozen) pane while pi-dead + idle-released — the
+ *  faithful shape of an unfocused dormant orchestrator the daemon's second pass
+ *  revives on an unseen inbox entry. */
+async function withLivePane(tag, fn) {
+    const session = `crtr-cdw-${process.pid}-${tag}`;
+    spawnSync('tmux', ['new-session', '-d', '-s', session, '-c', '/tmp', 'sleep 600']);
+    try {
+        const w = spawnSync('tmux', ['list-windows', '-t', session, '-F', '#{window_id}'], { encoding: 'utf8' });
+        const window = (w.stdout ?? '').trim().split('\n')[0];
+        const p = spawnSync('tmux', ['display-message', '-p', '-t', `${session}:${window}`, '#{pane_id}'], { encoding: 'utf8' });
+        const pane = (p.stdout ?? '').trim();
+        await fn(session, window, pane);
+    }
+    finally {
+        spawnSync('tmux', ['kill-session', '-t', session], { stdio: 'ignore' });
+    }
+}
+/** A guaranteed-DEAD pane id inside `window`: split a fresh pane, then kill it.
+ *  The window survives via its original pane. This is how a child's pane reads
+ *  "gone" to the daemon while the session/window are still alive. */
+function deadPaneIn(session, window) {
+    const sp = spawnSync('tmux', ['split-window', '-d', '-P', '-F', '#{pane_id}', '-t', `${session}:${window}`, 'sleep 600'], { encoding: 'utf8' });
+    const dead = (sp.stdout ?? '').trim();
+    spawnSync('tmux', ['kill-pane', '-t', dead], { stdio: 'ignore' });
+    return dead;
+}
+/** A dormant, unfocused PARENT: pi-dead, idle-released, frozen on the live pane,
+ *  home_session set so the daemon's second pass can revive it. */
+function dormantParent(id, session, window, pane) {
+    createNode(node(id, {
+        pane,
+        tmux_session: session,
+        window,
+        pi_pid: deadPid(),
+        pi_session_id: 'booted',
+        intent: 'idle-release',
+        status: 'idle',
+        home_session: session,
+    }));
+}
+// ===========================================================================
+// POSITIVE — a genuine terminal child outcome WAKES the dormant parent.
+// ===========================================================================
+test('CRASH after boot (mid-generation, pane gone) wakes the dormant inbox-waiting parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('crash', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true); // the spawn-time spine edge
+        markBusy('CHILD'); // pane died INSIDE a turn → genuine mid-run crash
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'dead', 'CHILD crashed → dead');
+        // THE WAKE CHANNEL: a system entry from CHILD lands in PARENT's inbox.
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'crash fanned a system inbox entry to the dormant parent (mirrors surfaceBootFailure)');
+        assert.match(wake.label, /died/i, 'the entry tells the parent WHICH child died and how');
+        // END-TO-END: the dormant parent is REVIVED on the same tick (second pass).
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the same tick — no longer hangs');
+        clearBusy('CHILD');
+    });
+});
+test('quiet-turn FINALIZE (pane gone, nothing live to wait for) wakes the dormant parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('finalize', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        // Booted, turn finished (NO busy marker), no live subscription, no pending
+        // self-wake → the daemon finalizes it (done): a dismissal of a finished node.
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true);
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'done', 'CHILD finalized → done');
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'finalize fanned a system inbox entry to the dormant parent');
+        assert.match(wake.label, /without a final report/i, 'the entry tells the parent the child ended with no final');
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the same tick');
+    });
+});
+test('node close of a child wakes its SURVIVING manager (the parent outside the closing set)', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('close', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const childPane = deadPaneIn(session, window); // any pane handle; closeNode tears it down
+        createNode(node('CHILD', {
+            pane: childPane, tmux_session: session, window,
+            pi_session_id: 'booted', status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true); // PARENT is a manager OUTSIDE the close set
+        // Closing CHILD: closingSet({CHILD}) cannot pull in PARENT (PARENT is a
+        // SUBSCRIBER of CHILD, never a descendant), so PARENT survives + must wake.
+        const res = closeNode('CHILD');
+        assert.deepEqual(res.closed, ['CHILD'], 'only CHILD is closed; PARENT spared');
+        assert.equal(getNode('CHILD').status, 'canceled', 'CHILD canceled by close');
+        const wake = readInboxSince('PARENT').find((e) => e.from === 'CHILD');
+        assert.ok(wake, 'node close fanned a child-closed entry to the surviving manager (D-1: previously none)');
+        assert.match(wake.label, /closed/i, 'the entry names the closed child');
+        // The dormant parent is then revived by the daemon's second pass.
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(cyclesOf('PARENT'), before + 1, 'dormant PARENT revived on the close entry — no longer hangs');
+    });
+});
+// ===========================================================================
+// NEGATIVE — HEALTHY DORMANCY must NOT wake the parent (the correctness crux).
+// ===========================================================================
+test('CRUX: a child dormant while awaiting its OWN live grandchild does NOT wake the parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('dorm-sub', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        // CHILD finished its turn (no busy) and its pane is gone, BUT it actively
+        // subscribes to a LIVE grandchild — exactly the developer-spawned-reviewer
+        // case. This is HEALTHY dormancy, not death.
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        createNode(node('GRANDCHILD', { status: 'active', pi_session_id: 'booted' })); // live, no pane (inline)
+        subscribe('PARENT', 'CHILD', true);
+        subscribe('CHILD', 'GRANDCHILD', true); // CHILD awaits a LIVE grandchild
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        // CHILD is RELEASED (revivable), NOT finalized — the daemon must not orphan
+        // its in-flight grandchild and must not wake the parent.
+        assert.equal(getNode('CHILD').status, 'idle', 'CHILD released (revivable), NOT finalized');
+        assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release');
+        assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — healthy dormancy raises no wake');
+        assert.equal(cyclesOf('PARENT'), before, 'dormant PARENT stays asleep (no revive) — no spurious wake');
+    });
+});
+test('CRUX: a child dormant on a pending self-wake (no live sub) does NOT wake the parent', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 60_000 }, async () => {
+    await withLivePane('dorm-wake', async (session, window, pane) => {
+        dormantParent('PARENT', session, window, pane);
+        const dead = deadPaneIn(session, window);
+        createNode(node('CHILD', {
+            pane: dead, tmux_session: session, window,
+            pi_pid: deadPid(), pi_session_id: 'booted', intent: null, status: 'active',
+        }));
+        subscribe('PARENT', 'CHILD', true);
+        // CHILD has NO live subscription, but holds a pending self-wake (far-future
+        // so the wakeups pass never fires it this tick). hasPendingSelfWake(CHILD)
+        // ⇒ the daemon treats it as STILL WAITING (the stop-guard's boundary), so
+        // it RELEASES instead of finalizing. NON-VACUOUS: drop the hasPendingSelfWake
+        // guard and CHILD finalizes → PARENT is spuriously woken.
+        const future = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString();
+        armWake({ wakeup_id: 'wk-cdw-child', node_id: 'CHILD', owner_id: 'CHILD', fire_at: future, kind: 'bare' });
+        const before = cyclesOf('PARENT');
+        await superviseTick();
+        assert.equal(getNode('CHILD').status, 'idle', 'CHILD with a pending self-wake is RELEASED, not finalized');
+        assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release (its clock will wake it)');
+        assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — a pending clock is healthy dormancy');
+        assert.equal(cyclesOf('PARENT'), before, 'dormant PARENT stays asleep — pending self-wake is not death');
+    });
+});

package/dist/core/__tests__/context-intro.test.js

@@ -1,28 +1,25 @@
-// Tests for the <crtr-context> bearings preamble + scoped memory:
-//   1. A plain spawned node gets NO MEMORY.md; promotion seeds it (the template).
-//   2. seedMemory is idempotent (never clobbers an evolved memory).
-//   3. Worker bearings = shared-doc framing only (no <memory> block);
-//      orchestrator bearings add the across-cycles framing + a <memory> block
-//      that MERGES the applicable stores, each a `label · dir` header over its
-//      live index POINTER LINES only (the how-to boilerplate is dropped — it
-//      lives once in the kernel); promotion delivers that same orchestrator
+// Tests for the <crtr-context> bearings preamble:
+//   1. Worker and orchestrator bearings carry the `## References` block
+//      (substrate reference docs + node-local docs as `###` sub-sections) in
+//      place of the removed `<memory>` block — no `label · dir` stanzas, no
+//      `(empty)` markers, no MEMORY.md index inlining. Orchestrators add the
+//      across-cycles framing; promotion delivers that same orchestrator
 //      context-dir framing to a node that spawned base.
-//   4. canvas-context-intro injects the block as its own session message at
+//   2. canvas-context-intro injects the block as its own session message at
 //      session_start (before the first prompt), idempotent across resumes.
 //
 // Run: node --import tsx/esm --test src/core/__tests__/context-intro.test.ts
 import { test, before, beforeEach, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { existsSync } from 'node:fs';
 import { closeDb } from '../canvas/db.js';
 import { contextDir } from '../canvas/paths.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { promote } from '../runtime/promote.js';
 import { personaDrift } from '../runtime/persona.js';
-import { memoryPath, memoryDir, readMemory, seedMemory, hasMemory, MEMORY_TEMPLATE, userMemoryDir, userMemoryPath, projectMemoryDir, projectMemoryPath, } from '../runtime/memory.js';
+import { memoryDir } from '../runtime/memory.js';
 import registerCanvasContextIntro, { buildContextIntro, renderContextMessage, CONTEXT_INTRO_CUSTOM_TYPE, } from '../../pi-extensions/canvas-context-intro.js';
 let home;
 before(() => {
@@ -39,69 +36,80 @@ after(() => {
     delete process.env['CRTR_HOME'];
     delete process.env['CRTR_NODE_ID'];
 });
-test('a plain spawned node gets NO memory; promotion seeds the index + dir', () => {
-    const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    assert.equal(hasMemory(meta.node_id), false, 'no memory before promotion');
-    promote(meta.node_id);
-    assert.ok(hasMemory(meta.node_id), 'MEMORY.md index exists after promotion');
-    assert.ok(existsSync(memoryDir(meta.node_id)), 'memory dir created for direct writes');
-    assert.ok(memoryPath(meta.node_id).endsWith('/memory/MEMORY.md'), 'index lives inside the memory dir');
-    assert.equal(readMemory(meta.node_id), MEMORY_TEMPLATE);
-});
-test('seedMemory is idempotent — never clobbers an evolved memory', () => {
-    const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    seedMemory(meta.node_id);
-    const evolved = '# Memory\n\n## Lessons\n- never trust the cache\n';
-    writeFileSync(memoryPath(meta.node_id), evolved);
-    assert.equal(seedMemory(meta.node_id), false, 'returns false when one exists');
-    assert.equal(readMemory(meta.node_id), evolved, 'left untouched');
-});
-test('worker bearings: shared-doc framing only, no orchestrator/memory framing', () => {
+test('worker bearings: base framing + ## References block (no <memory>, no label·dir stanzas), NO across-cycles framing', () => {
+    // Bug-regression: review finding M1 — buildContextBearings was changed from
+    // buildMemoryBlock (<memory> + label·dir per-store stanzas) to
+    // renderReferencesBlock (## References + ### <name> sub-sections). This test
+    // locks in the new contract.
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
+    // Seed a node-local substrate doc so the ## References block is non-empty.
+    const dir = memoryDir(meta.node_id);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'test-ref.md'), '---\nkind: reference\nwhen: when testing\nwhy: regression fixture\nsystem-prompt-visibility: preview\n---\nTest body.\n');
     const block = buildContextIntro(meta.node_id);
     assert.match(block, new RegExp(`<crtr-context dir="${contextDir(meta.node_id)}">`));
     assert.match(block, /shared document store, not a task tracker/, 'base = shared docs, not tasks');
-    assert.doesNotMatch(block, /MEMORY\.md/, 'no memory pointer for a memory-less worker');
-    assert.doesNotMatch(block, /<memory>/, 'no memory block for a memory-less worker');
+    // New contract: NO <memory> block — replaced by ## References.
+    assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
+    // New contract: NO label·dir stanza headers (the removed per-store format).
+    assert.doesNotMatch(block, /user-global · /, 'no user-global label·dir stanza');
+    assert.doesNotMatch(block, /node-local · /, 'no node-local label·dir stanza');
+    // New contract: NO (empty) placeholder (the removed empty-store marker).
+    assert.doesNotMatch(block, /\(empty\)/, 'no (empty) placeholder');
+    // Reference content renders as ## References + ### sub-sections — no other shape.
+    assert.match(block, /## References\n\n###/, '## References followed by ### sub-sections');
+    // A terminal worker must NOT carry the orchestrator across-cycles framing.
     assert.doesNotMatch(block, /refresh cycles/, 'no across-cycles framing for a terminal worker');
     assert.match(block, /<\/crtr-context>/);
 });
-test('orchestrator bearings: across-cycles framing + a <memory> block whose body is the live pointer lines under `label · dir`', () => {
+test('orchestrator bearings: across-cycles framing + node-local substrate docs ride into ## References; the MEMORY.md index never renders', () => {
+    // Bug-regression: review finding M1 — buildContextBearings replaced the old
+    // <memory> pointer-line block with ## References. Node-local substrate docs
+    // render as ### sub-sections at their rung; the old index file never surfaces.
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    seedMemory(meta.node_id);
-    // The seeded index carries the how-to comment + the empty marker; an evolved
-    // index adds a pointer line. The block must render ONLY the pointer line.
-    writeFileSync(memoryPath(meta.node_id), '# memory index — one pointer line per memory; how-to in "Your long-term memory".\n\n- [Flaky build](flaky-build.md) — first run fails\n');
+    promote(meta.node_id); // flip to orchestrator mode — the across-cycles gate
+    const dir = memoryDir(meta.node_id);
+    mkdirSync(dir, { recursive: true });
+    // Write a MEMORY.md file to verify it is never surfaced in the block.
+    const legacyIndexPath = join(dir, 'MEMORY.md');
+    writeFileSync(legacyIndexPath, '# memory index — one pointer line per memory; how-to in "Your long-term memory".\n\n- [Flaky build](flaky-build.md) — first run fails\n');
+    // A node-local substrate doc DOES ride into ## References at its rung.
+    writeFileSync(join(dir, 'flaky-build.md'), '---\nkind: reference\nwhen: when the build flakes\nwhy: first run fails\nsystem-prompt-visibility: preview\n---\nFirst run always fails; rerun once.\n');
     const block = buildContextIntro(meta.node_id);
     assert.match(block, /shared document store, not a task tracker/, 'still carries the base framing');
     assert.match(block, /refresh cycles/, 'orchestrator gets the across-cycles framing');
-    assert.match(block, /<memory>/, 'has a memory block');
-    // (a) the store renders just its pointer line under a `label · dir` header.
-    assert.ok(block.includes(`node-local · ${memoryDir(meta.node_id)}`), 'compact `label · dir` header');
-    assert.match(block, /- \[Flaky build\]\(flaky-build\.md\) — first run fails/, 'the live pointer line is inlined');
-    // (c) no `index:` line, no absolute index path, no inlined how-to boilerplate.
-    assert.ok(!block.includes('index:'), 'no index: substring');
-    assert.ok(!block.includes(memoryPath(meta.node_id)), 'no absolute index (MEMORY.md) path');
-    assert.ok(!block.includes('how-to in'), 'the index how-to boilerplate is NOT inlined');
+    assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
+    assert.match(block, /## References\n/, 'references block present');
+    assert.match(block, /### flaky-build\n/, 'node-local doc gets its ### sub-section');
+    assert.match(block, /when the build flakes, read this reference\. first run fails\./, 'preview rung renders the routing line');
+    // The index file itself never renders: no header comment, no pointer line, no path.
     assert.ok(!block.includes('# memory index'), 'the index header comment is NOT inlined');
+    assert.ok(!block.includes('- [Flaky build](flaky-build.md)'), 'index pointer lines are NOT inlined');
+    assert.ok(!block.includes(legacyIndexPath), 'no absolute index (MEMORY.md) path');
+    assert.ok(!block.includes('node-local · '), 'no label·dir stanza header');
     assert.match(block, /<\/crtr-context>/);
 });
-test('orchestrator bearings: a promoted node merges all THREE stores; template-only stores render (empty)', () => {
+test('orchestrator bearings: no per-store stanzas or (empty) markers; a rung-none node-local doc still surfaces as a ### title stub', () => {
+    // Bug-regression: review findings M1 + M6 — the three-store `label · dir`
+    // stanzas and (empty) markers are gone, and node-local docs are NOT filtered
+    // on rung: a migrated node-local reference defaults
+    // system-prompt-visibility: none and must still ride into ## References as
+    // its bare title (never its body).
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    promote(meta.node_id); // seeds user-global + project + node-local (all template-only)
+    promote(meta.node_id); // flip to orchestrator mode
+    const dir = memoryDir(meta.node_id);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'rung-none-fact.md'), '---\nkind: reference\n---\nbody that must not render at the none rung\n');
     const block = buildContextIntro(meta.node_id);
-    // Each scope present as a `label · dir` header.
-    assert.ok(block.includes(`user-global · ${userMemoryDir()}`), 'merges the user-global store');
-    assert.ok(block.includes(`project · ${projectMemoryDir('/tmp/work')}`), 'merges the project store');
-    assert.ok(block.includes(`node-local · ${memoryDir(meta.node_id)}`), 'merges the node-local store');
-    // (b) a template-only / not-yet-written store renders the (empty) marker.
-    assert.match(block, /user-global · .*\n\(empty\)/, 'template-only user store renders (empty)');
-    assert.equal(block.match(/\(empty\)/g)?.length, 3, 'all three template-only stores render (empty)');
-    // (c) no absolute index paths leak in.
-    assert.ok(!block.includes(userMemoryPath()), 'no user-global MEMORY.md path');
-    assert.ok(!block.includes(projectMemoryPath('/tmp/work')), 'no project MEMORY.md path');
-    // The type→store mapping is taught by the kernel; the block points at it.
-    assert.match(block, /type/, 'the block references the type that decides the store');
+    // No per-store stanza headers, no (empty) markers, no index paths.
+    assert.ok(!block.includes(`node-local · ${memoryDir(meta.node_id)}`), 'no node-local stanza header');
+    assert.ok(!block.includes('user-global · '), 'no user-global stanza header');
+    assert.ok(!block.includes('project · '), 'no project stanza header');
+    assert.doesNotMatch(block, /\(empty\)/, 'no (empty) markers');
+    assert.ok(!block.includes('MEMORY.md'), 'no MEMORY.md path in the block');
+    // M6: rung-none node-local doc surfaces as its title stub only.
+    assert.match(block, /### rung-none-fact\s*\n/, 'rung-none node-local doc surfaces as its title stub');
+    assert.ok(!block.includes('body that must not render'), 'none rung renders the title only, not the body');
 });
 test('promotion guidance delivers the orchestrator context-dir framing', () => {
     // A node spawns as a base worker (no orchestrator bearings). On promotion the
@@ -145,12 +153,18 @@ test('session_start injects the block as the first message of an empty session',
 test('session_start is idempotent across resume (skips if already in history)', () => {
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
     process.env['CRTR_NODE_ID'] = meta.node_id;
-    // Restored session already carries the block → no duplicate injection.
+    // Restored session already carries OUR block (which names this node id) → no
+    // duplicate injection. The content matters: the guard is fork-aware and only
+    // skips when the present bearings name THIS node (a fork inherits the
+    // SOURCE's bearings, which name a different node — see canvas-context-intro
+    // tests), so a realistic resume entry must carry the real block content.
     const pi = makeFakePi();
     registerCanvasContextIntro(pi);
-    const entries = [{ type: 'custom_message', customType: CONTEXT_INTRO_CUSTOM_TYPE }];
+    const entries = [
+        { type: 'custom_message', customType: CONTEXT_INTRO_CUSTOM_TYPE, content: buildContextIntro(meta.node_id) },
+    ];
     pi.handler({ reason: 'resume' }, fakeCtx(entries));
-    assert.equal(pi.sent.length, 0, 'block already in history → skip');
+    assert.equal(pi.sent.length, 0, 'our own block already in history → skip');
 });
 test('session_start is inert when CRTR_NODE_ID is absent', () => {
     delete process.env['CRTR_NODE_ID'];

package/dist/core/__tests__/daemon-boot.test.js

@@ -64,10 +64,14 @@ test('never-booted node is marked dead and surfaced to the parent as urgent', as
     assert.equal(inbox[0].from, 'C');
     assert.match(inbox[0].label, /Spawn failed/);
 });
-// A node that HAD booted (pi_session_id set) then lost its window is a genuine
-// crash, not a boot failure — it is marked dead but NOT surfaced as a spawn
-// failure (no false alarm to the parent).
-test('a crash after boot is marked dead without a boot-failure push', async () => {
+// A node that HAD booted (pi_session_id set) then died mid-generation is a
+// genuine crash, not a boot failure. It is marked dead AND wakes the inbox-
+// waiting parent — but with a "child died" notice (surfaceChildDeath), NOT a
+// "Spawn failed" boot-failure pointer (surfaceBootFailure). The parent-wake
+// itself was added by main's b5abf6e (parent-wake on child death) and is locked
+// in by child-death-wake.test.ts; this test preserves the discriminating intent
+// — a crash is never surfaced as a false spawn-failure alarm.
+test('a crash after boot wakes the parent with a child-death notice, not a boot-failure push', async () => {
     createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
     createNode(node('C2', {
         parent: 'P2',
@@ -85,7 +89,12 @@ test('a crash after boot is marked dead without a boot-failure push', async () =
     markBusy('C2');
     await superviseTick();
     assert.equal(getNode('C2').status, 'dead', 'crashed child is dead');
-    assert.equal(readInboxSince('P2').length, 0, 'a real crash does not push a boot-failure pointer');
+    const inbox = readInboxSince('P2');
+    assert.equal(inbox.length, 1, 'a genuine mid-run crash wakes the inbox-waiting parent (D-1 parent-wake)');
+    assert.equal(inbox[0].tier, 'urgent', 'mid-run crash is delivered as urgent');
+    assert.equal(inbox[0].from, 'C2');
+    assert.match(inbox[0].label, /died/i, 'the wake is a child-death notice (surfaceChildDeath), not silence');
+    assert.doesNotMatch(inbox[0].label, /Spawn failed/, 'a crash is NOT surfaced as a false boot-failure alarm');
     clearBusy('C2');
 });
 // A still-booting node whose window is alive must be left untouched — boot is

package/dist/core/__tests__/daemon-liveness.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { appendInbox } from '../feed/inbox.js';
@@ -32,6 +32,17 @@ function deadPid() {
     // spawnSync has reaped it by the time it returns; pid may be on r.pid.
     return r.pid ?? 0x7ffffffe; // fall back to an implausibly-high pid
 }
+/** A pid that is ALIVE for the test's duration but expendable. Pane-gone
+ *  fixtures must NEVER use process.pid for an alive pi: the gone-pane zombie
+ *  sweep (b92082e) SIGKILLs a pane-gone node's live pid, which took the whole
+ *  test runner down with it. The daemon (or the after hook) reaps these. */
+const livePids = [];
+function disposableLivePid() {
+    const child = spawn('sleep', ['600'], { stdio: 'ignore', detached: true });
+    child.unref();
+    livePids.push(child.pid);
+    return child.pid;
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-daemon-liveness-'));
     process.env['CRTR_HOME'] = home;
@@ -44,6 +55,14 @@ after(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    for (const pid of livePids) {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch {
+            /* already reaped by the daemon's zombie sweep — fine */
+        }
+    }
 });
 // ---------------------------------------------------------------------------
 // livenessVerdict — the pure grace-window decision
@@ -157,7 +176,7 @@ test('pane GONE while its old window is still alive → the gone-branch fires (c
             pane: dead,
             tmux_session: session,
             window,
-            pi_pid: process.pid, // alive — irrelevant once the pane reads gone
+            pi_pid: disposableLivePid(), // alive zombie — the gone-pane sweep SIGKILLs it
             pi_session_id: 'booted',
             intent: null,
         }));
@@ -172,7 +191,7 @@ test('pane GONE while its old window is still alive → the gone-branch fires (c
 // unconditional 'dead'. It routes on what the node was DOING at pane-kill time:
 //   • mid-generation (busy marker PRESENT)               → crash  ('dead')
 //   • finished its turn, awaiting nothing live           → finalize ('done')
-//   • finished its turn, still awaiting a LIVE child     → crash  ('dead'), for now
+//   • finished its turn, still awaiting a LIVE child     → release ('idle' + idle-release), revivable
 // (The mid-generation → dead leg is covered by node 'G' above.)
 // ---------------------------------------------------------------------------
 test('pane gone + booted + busy ABSENT + no live subscription → finalize (done): the pane was closed to dismiss a finished node', { skip: !hasTmux() }, async () => {
@@ -187,7 +206,7 @@ test('pane gone + booted + busy ABSENT + no live subscription → finalize (done
             pane: dead,
             tmux_session: session,
             window,
-            pi_pid: process.pid,
+            pi_pid: disposableLivePid(), // alive zombie — swept before finalize routing
             pi_session_id: 'booted',
             intent: null,
         }));
@@ -196,7 +215,7 @@ test('pane gone + booted + busy ABSENT + no live subscription → finalize (done
         assert.equal(getNode('FIN').status, 'done', 'a finished, unsubscribed node whose pane was closed finalizes to done');
     });
 });
-test('pane gone + booted + busy ABSENT but AWAITING a LIVE child → crash (dead), for now', { skip: !hasTmux() }, async () => {
+test('pane gone + booted + busy ABSENT but AWAITING a LIVE child → idle-release (revivable, NOT dead)', { skip: !hasTmux() }, async () => {
     await withLivePane('fin2', async (session, window) => {
         const sp = spawnSync('tmux', ['split-window', '-d', '-P', '-F', '#{pane_id}', '-t', `${session}:${window}`, 'sleep 600'], { encoding: 'utf8' });
         const dead = (sp.stdout ?? '').trim();
@@ -207,15 +226,21 @@ test('pane gone + booted + busy ABSENT but AWAITING a LIVE child → crash (dead
             pane: dead,
             tmux_session: session,
             window,
-            pi_pid: process.pid,
+            pi_pid: deadPid(), // the user closed the pane → pi is dead
             pi_session_id: 'booted',
             intent: null,
         }));
         subscribe('PARENT', 'CHILD', true); // active subscription to a LIVE node
-        // Parent finished its turn (no busy marker) but is still awaiting a live
-        // child → NOT a finalize. Routes to crash ('dead') for now.
+        // REGRESSION: closing the pane of a waiting orchestrator must NOT kill it.
+        // PARENT finished its turn (no busy marker) but still awaits a live child, so
+        // a hard 'dead' would orphan the child's report. It routes to idle-release
+        // (revivable); the second pass revives it on the next inbox push. No inbox
+        // entry here, so it stays dormant (idle + idle-release) — revivable, not dead.
         await superviseTick();
-        assert.equal(getNode('PARENT').status, 'dead', 'a finished node still awaiting a live child crashes (dead), not finalizes');
+        const p = getNode('PARENT');
+        assert.equal(p.status, 'idle', 'a finished node still awaiting a live child is RELEASED, not killed');
+        assert.equal(p.intent, 'idle-release', 'routed to idle-release so a child push revives it');
+        assert.equal(p.window ?? null, null, 'the stale window ref is dropped');
     });
 });
 // ---------------------------------------------------------------------------

package/dist/core/__tests__/detach-focus.test.d.ts

@@ -0,0 +1 @@
+export {};