@crouton-kit/crouter 0.3.18 → 0.3.20

package/dist/core/runtime/{demote.js → recycle.js}

@@ -1,6 +1,6 @@
-// demote.ts — the "graduate this agent" action behind `crtr node demote`.
+// recycle.ts — the "finalize + reboot this pane" action behind `crtr node recycle`.
 //
-// Demote finishes the agent occupying a tmux pane and recycles that pane for
+// Recycle FINALIZES the agent occupying a tmux pane and recycles that pane for
 // fresh work, in three steps:
 //
 //   1. Finalize — push the agent's last surfaced message as a `final` report so
@@ -8,6 +8,10 @@
 //   2. Close    — kill the agent's pi (respawn-pane -k tears it down in place).
 //   3. Recycle  — boot a fresh resident root in that same pane (a new `crtr`).
 //
+// NOT to be confused with `node demote` (flip-to-terminal IN PLACE, which keeps
+// the agent focused and running): recycle ENDS this agent and boots a brand-new
+// resident root here.
+//
 // The agent's real conversation lives inside pi (not on disk), so the final
 // body is its newest report (which, on a natural stop, IS its last assistant
 // message) — falling back to a short note when it never reported.
@@ -16,10 +20,11 @@ import { join } from 'node:path';
 import { getNode, setPresence, updateNode, setFocusOccupant, fullName } from '../canvas/index.js';
 import { reportsDir } from '../canvas/paths.js';
 import { pushFinal } from '../feed/feed.js';
-import { spawnNode, nodeSession } from './nodes.js';
+import { spawnNode, nodeSession, rootOfSpine } from './nodes.js';
 import { buildLaunchSpec, buildPiArgv } from './launch.js';
 import { FRONT_DOOR_ENV } from './front-door.js';
 import { focusOf, recycleFocusPane, piCommand, paneLocation } from './placement.js';
+import { hostFor } from './host.js';
 import { ensureDaemon } from '../../daemon/manage.js';
 /** The agent's most recent surfaced message: the newest reports/*.md body with
  *  its YAML frontmatter stripped. Empty string when the node never reported. */
@@ -49,18 +54,18 @@ function lastReportBody(nodeId) {
 }
 /** Finish `nodeId` and recycle its pane into a fresh root. `callerPane` is the
  *  tmux pane the agent occupies (the Alt+C menu passes it as `#{pane_id}`).
- *  Best-effort; `demoted:false` when there is no pane to act on. */
-export async function demoteNode(nodeId, callerPane) {
+ *  Best-effort; `recycled:false` when there is no pane to act on. */
+export async function recycleNode(nodeId, callerPane) {
     const meta = getNode(nodeId);
     if (meta === null)
-        return { demoted: false, finalized: false, newRoot: null, delivered: [] };
+        return { recycled: false, finalized: false, newRoot: null, delivered: [] };
     const pane = callerPane ?? process.env['TMUX_PANE'];
     if (pane === undefined || pane === '') {
-        return { demoted: false, finalized: false, newRoot: null, delivered: [] };
+        return { recycled: false, finalized: false, newRoot: null, delivered: [] };
     }
     // 1. Finalize — fan the agent's last message out as a `final`, mark it done.
     const body = lastReportBody(nodeId) ||
-        `Closed via demote — no final summary was authored by ${meta.name}.`;
+        `Closed via recycle — no final summary was authored by ${meta.name}.`;
     let delivered = [];
     let finalized = false;
     try {
@@ -69,6 +74,17 @@ export async function demoteNode(nodeId, callerPane) {
         finalized = true;
     }
     catch { /* recycle the pane even if the report failed */ }
+    // A broker node has NO tmux pane, so recycleFocusPane below (respawn-pane -k)
+    // never kills its engine — route its teardown through the Host seam so the
+    // broker PROCESS exits and releases the sole .jsonl writer (mirrors the T12
+    // close.ts/reset.ts fix; review reuse MINOR-3). Status is already flipped done
+    // by pushFinal above (crash-safe order: the daemon won't revive a done node).
+    if (meta.host_kind === 'broker') {
+        try {
+            hostFor(meta).teardown(nodeId);
+        }
+        catch { /* best-effort */ }
+    }
     // Capture M's focus viewport (if any) BEFORE nulling — the fresh root inherits
     // it (the SAME focus row + pane). The demoted node no longer holds a pane: it is
     // being reclaimed.
@@ -93,7 +109,7 @@ export async function demoteNode(nodeId, callerPane) {
         parent: null,
         launch,
     });
-    // REVIVE-HOME: a demote-recycled root's durable revive target is the session
+    // REVIVE-HOME: a recycled root's durable revive target is the session
     // of the pane it was recycled into (the one place home_session is rewritten
     // after birth). Falls back to the backstage when the pane can't be located.
     updateNode(root.node_id, { home_session: loc?.session ?? nodeSession() });
@@ -107,9 +123,9 @@ export async function demoteNode(nodeId, callerPane) {
     }
     const fresh = getNode(root.node_id);
     const inv = buildPiArgv(fresh);
-    const env = { ...inv.env, CRTR_ROOT_SESSION: nodeSession(), [FRONT_DOOR_ENV]: '1' };
+    const env = { ...inv.env, CRTR_ROOT_SESSION: nodeSession(), CRTR_SUBTREE: rootOfSpine(root.node_id), [FRONT_DOOR_ENV]: '1' };
     const ok = recycleFocusPane(root.node_id, pane, {
         command: piCommand(inv.argv), env, cwd: meta.cwd, name: fullName(fresh), resuming: false,
     });
-    return { demoted: ok, finalized, newRoot: root.node_id, delivered };
+    return { recycled: ok, finalized, newRoot: root.node_id, delivered };
 }

package/dist/core/runtime/reset.js

@@ -22,7 +22,8 @@
 import { existsSync, rmSync } from 'node:fs';
 import { getNode, updateNode, setPresence, clearPid, setFocusOccupant, subscriptionsOf, unsubscribe, view, reportsDir, inboxPath, nodeDir, openDb, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
-import { paneLocation, tearDownNode, focusOf } from './placement.js';
+import { hostFor } from './host.js';
+import { paneLocation, focusOf } from './placement.js';
 import { buildLaunchSpec } from './launch.js';
 import { roadmapPath } from './roadmap.js';
 import { spawnNode, newNodeId, nodeSession } from './nodes.js';
@@ -49,11 +50,12 @@ export function reapDescendants(rootId) {
         try {
             // Reap BEFORE tearing down the placement (the crash-safety invariant the
             // `cancel` event encodes): a non-supervised status + cleared intent first, so
-            // the daemon can't revive a descendant mid-teardown. tearDownNode then
-            // closes any focus row it held, kills its pane (pane-keyed), and nulls its
-            // LOCATION.
-            transition(id, 'cancel');
-            tearDownNode(id);
+            // the daemon can't revive a descendant mid-teardown. Teardown then routes
+            // through the Host seam (hostFor): a tmux node closes any focus row it held,
+            // kills its pane (pane-keyed), and nulls its LOCATION; a broker node sends
+            // the `shutdown` frame so its PROCESS exits and releases the .jsonl writer.
+            const m = transition(id, 'cancel');
+            hostFor(m).teardown(id);
             reaped.push(id);
         }
         catch {
@@ -110,7 +112,7 @@ export function resetRoot(nodeId, newSessionId, newSessionFile) {
     //    Re-seed persona_ack to the fresh persona so the pristine `/new`
     //    conversation never gets a spurious mode/lifecycle transition steer (the
     //    persona injector compares against this ack).
-    const { launch } = buildLaunchSpec(meta.kind, 'base', { lifecycle: 'resident', hasManager: false });
+    const { launch } = buildLaunchSpec(meta.kind, 'base', { lifecycle: 'resident', hasManager: false, model: meta.model_override ?? undefined });
     updateNode(nodeId, {
         mode: 'base',
         lifecycle: 'resident',
@@ -178,7 +180,7 @@ export function relaunchRoot(oldId, pane, deps = {}) {
         window: oldMeta.window ?? null,
     };
     const newId = newNodeId();
-    const { launch } = buildLaunchSpec(oldMeta.kind, 'base', { lifecycle: 'resident', hasManager: false });
+    const { launch } = buildLaunchSpec(oldMeta.kind, 'base', { lifecycle: 'resident', hasManager: false, model: oldMeta.model_override ?? undefined });
     // Park-old + mint-new is the single most fragile spot in the runtime, so it is
     // ONE atomic unit: every ROW write below runs inside a sqlite transaction. A
     // failure anywhere — including the respawn DISPATCH — rolls the whole thing
@@ -204,6 +206,7 @@ export function relaunchRoot(oldId, pane, deps = {}) {
             parent: null,
             spawnedBy: oldId, // audit-only successor link; does NOT touch the spine
             nodeId: newId,
+            modelOverride: oldMeta.model_override,
             launch,
         });
         transition(newId, 'yield'); // active (from spawn) + intent=refresh safety net

package/dist/core/runtime/revive.d.ts

@@ -1,4 +1,5 @@
 import { type NodeMeta } from '../canvas/index.js';
+import type { WakeOrigin } from './bearings.js';
 import { type RespawnPaneOpts } from './placement.js';
 /** Pick the `--session` source for a revive. resume=true prefers the absolute
  *  session-file path (immune to cwd; pi opens it directly) and keeps the bare
@@ -25,6 +26,7 @@ export interface ReviveResult {
  */
 export declare function reviveNode(nodeId: string, opts: {
     resume: boolean;
+    wakeReason?: WakeOrigin;
 }): ReviveResult;
 /** Re-exec a node's pi FRESH in its EXISTING tmux pane (the refresh-yield
  *  path). Unlike `reviveNode`, this opens no new window: the pane's current pi

package/dist/core/runtime/revive.js

@@ -14,26 +14,15 @@
 //                  preferring the absolute session-file path (cwd-immune) over
 //                  the bare session id.
 //   resume=false → fresh pi invocation — the node re-reads its roadmap/context dir.
-import { getNode, updateNode, setPresence, clearPid, fullName, } from '../canvas/index.js';
+import { getNode, updateNode, setPresence, clearPid, fullName, cancelDeadlinesFor, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { FRONT_DOOR_ENV } from './front-door.js';
-import { reviveIntoPlacement, reconcile, isNodePaneAlive, homeSessionOf, piCommand, respawnPane, } from './placement.js';
-import { nodeSession } from './nodes.js';
-/** signal-0 liveness probe for a pi pid (mirrors the daemon's isPidAlive). A
- *  null pid (legacy / never-booted) reads dead. */
-function pidAlive(pid) {
-    if (pid == null)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (e) {
-        return e.code === 'EPERM';
-    }
-}
+import { reconcile, piCommand, respawnPane, } from './placement.js';
+import { hostFor } from './host.js';
+import { nodeSession, childBackstageOf, rootOfSpine } from './nodes.js';
+import { isPidAlive } from '../canvas/pid.js';
 // ---------------------------------------------------------------------------
 // resumeArgs — which session source a revive resumes from
 // ---------------------------------------------------------------------------
@@ -73,7 +62,7 @@ export function reviveNode(nodeId, opts) {
     // frozen pane), so the guard gates on pi liveness too, not pane-existence alone.
     reconcile(nodeId);
     const live = getNode(nodeId) ?? meta;
-    if (isNodePaneAlive(nodeId) && pidAlive(live.pi_pid)) {
+    if (hostFor(live).isAlive(nodeId) && isPidAlive(live.pi_pid)) {
         return {
             window: live.window ?? null,
             session: live.tmux_session ?? nodeSession(),
@@ -98,8 +87,12 @@ export function reviveNode(nodeId, opts) {
         inv = buildPiArgv(meta, resume);
     }
     else {
+        // A fresh revive: drain the one-shot bearings, then build the kickoff. When
+        // a scheduled bare self-alarm drove this revive, opts.wakeReason carries the
+        // wake provenance so the kickoff leads with a <crtr-wake> block ("a timer
+        // woke you"); every other reviveNode caller passes nothing → no block.
         const bearings = drainBearings(meta);
-        inv = buildPiArgv(meta, { prompt: buildReviveKickoff(meta, bearings) });
+        inv = buildPiArgv(meta, { prompt: buildReviveKickoff(meta, bearings, opts.wakeReason) });
     }
     // Placement owns WHERE this revive lands (§1.4): resume into a live focus pane
     // if the node occupies one, else a fresh window in its home_session (the
@@ -108,9 +101,14 @@ export function reviveNode(nodeId, opts) {
     // around it (the crash-safety ordering, unchanged). THIS is the bug-kill: a
     // non-focused background revive can no longer new-window into a user session.
     transition(nodeId, 'revive');
-    const placed = reviveIntoPlacement(nodeId, {
-        command: piCommand(inv.argv),
-        env: inv.env,
+    // Cancel-on-wake (design §6.4, AC-E1): every revive-for-any-reason (an inbox
+    // event, a different wake, a manual focus) drops this node's pending deadline,
+    // so the deadline always belongs to the dormancy being left. Writes only the
+    // wakeups table, after the atomic transition above. (reviveInPlace's
+    // transition('boot') needs NO hook — a refresh is the same node continuing,
+    // not leaving a dormancy.)
+    cancelDeadlinesFor(nodeId);
+    const placed = hostFor(meta).launch(nodeId, inv, {
         cwd: meta.cwd,
         name: fullName(meta),
         resuming,
@@ -150,14 +148,16 @@ export function reviveInPlace(nodeId, pane, respawn = respawnPane) {
     // then build purely.
     const bearings = drainBearings(meta);
     const inv = buildPiArgv(meta, { prompt: buildReviveKickoff(meta, bearings) });
-    // CRTR_ROOT_SESSION is the backstage this node's CHILDREN spawn into — it must
-    // be the durable REVIVE-HOME (home_session), NOT the pane's live `session`. A
-    // FOCUSED child's pane is in a USER session (focus taints meta.tmux_session),
-    // so sourcing it from `session` would land any child it spawns in the user's
-    // session, re-tainting that child's home_session (A-MAJOR-1). home_session is
-    // the taint-immune backstage `crtr` for a child; for a root it equals its own
-    // session, so this is behavior-preserving there.
-    const env = { ...inv.env, CRTR_ROOT_SESSION: homeSessionOf(nodeId) };
+    // CRTR_ROOT_SESSION is the backstage this node's CHILDREN spawn into — NOT the
+    // pane's live `session`. A FOCUSED child's pane is in a USER session (focus
+    // taints meta.tmux_session), so sourcing it from `session` would land any
+    // child it spawns in the user's session, re-tainting that child's
+    // home_session (A-MAJOR-1). childBackstageOf is the taint-immune backstage:
+    // home_session for a managed child, but `nodeSession()` for a ROOT (whose
+    // home_session may itself be a user session it adopted via the inline front
+    // door — sourcing children from it would re-point the root's whole subtree
+    // into the user's session on every refresh-yield).
+    const env = { ...inv.env, CRTR_ROOT_SESSION: childBackstageOf(nodeId), CRTR_SUBTREE: rootOfSpine(nodeId) };
     const ok = respawn({ pane, cwd: meta.cwd, env, command: piCommand(inv.argv) });
     if (!ok) {
         throw new Error(`reviveInPlace: respawn-pane dispatch failed for ${nodeId}`);
@@ -199,11 +199,11 @@ export function relaunchRootInPane(nodeId, pane) {
     }
     // No prompt, no resume → a brand-new root conversation at cycle 0.
     const inv = buildPiArgv(meta, {});
-    // Source CRTR_ROOT_SESSION from the durable REVIVE-HOME (home_session), the
-    // same taint-immunity rule as reviveInPlace. relaunchRootInPane runs only on a
-    // root, whose home_session IS its own session, so this is behavior-preserving
-    // — it keeps both in-pane revive paths sourced identically.
-    const env = { ...inv.env, CRTR_ROOT_SESSION: homeSessionOf(nodeId), [FRONT_DOOR_ENV]: '1' };
+    // Source CRTR_ROOT_SESSION from childBackstageOf, the same backstage rule as
+    // reviveInPlace. relaunchRootInPane runs only on a root, whose children must
+    // flow to the shared backstage `nodeSession()` — never the root's own adopted
+    // user session — so both in-pane revive paths stay sourced identically.
+    const env = { ...inv.env, CRTR_ROOT_SESSION: childBackstageOf(nodeId), CRTR_SUBTREE: rootOfSpine(nodeId), [FRONT_DOOR_ENV]: '1' };
     const ok = respawnPane({ pane, cwd: meta.cwd, env, command: piCommand(inv.argv) });
     if (!ok) {
         throw new Error(`relaunchRootInPane: respawn-pane dispatch failed for ${nodeId}`);

package/dist/core/runtime/spawn.d.ts

@@ -1,3 +1,4 @@
+import { type WakeOrigin } from './bearings.js';
 import { type NodeMeta, type Mode } from '../canvas/index.js';
 export interface BootRootOpts {
     cwd: string;
@@ -27,6 +28,21 @@ export interface SpawnChildOpts {
      *  new session for the child — the source is untouched — then `prompt` is the
      *  next message. A one-shot at birth; the child resumes its own session after. */
     forkFrom?: string;
+    /** Set ONLY by the daemon when a `spawn`/spawn-cron wake births this node: the
+     *  provenance of the timer that fired (see WakeOrigin). In-memory only — it is
+     *  NOT part of the stored recipe (the daemon spreads it in at fire time via
+     *  `spawnChild({ ...recipe, wakeOrigin })`); `node new` never sets it. When set,
+     *  a <crtr-wake> block is prepended to the kickoff so the newborn knows a clock
+     *  birthed it. */
+    wakeOrigin?: WakeOrigin;
+    /** Which HOST launches + supervises this node: a tmux pane (default) or the
+     *  headless broker. Persisted as `host_kind` at birth (resolved from
+     *  `--headless` / the `headless` config default by the caller). */
+    hostKind?: 'tmux' | 'broker';
+    /** Pin the node to a model TIER (ultra/strong/medium/light), overriding the
+     *  persona's declared default. Persisted to `meta.model_override` so it
+     *  survives polymorphs. Omit to use the persona default. */
+    model?: string;
 }
 /** Resolve a `--fork-from` value to the source pi gets as `--fork <path|id>`.
  *  A live node id resolves to its captured session FILE (absolute, cwd-immune),
@@ -38,6 +54,13 @@ export interface SpawnChildResult {
     window: string | null;
     session: string;
 }
+/** Resolve who a spawn is attributed to. A managed child needs a spine parent
+ *  (explicit `--parent` or the calling node's CRTR_NODE_ID). A --root spawn
+ *  does not: it is top-level by definition and the spawner identity is
+ *  provenance only — a human shell with no CRTR_NODE_ID is a legitimate root
+ *  spawner (regression: `crtr node new --root` from outside a node used to
+ *  throw here). */
+export declare function resolveSpawner(parent: string | undefined, ctxNodeId: string | null, root: boolean): string | null;
 /** Spawn a node from a live node. By default a managed terminal worker in a
  *  background window, with the spawner auto-subscribed (active) via spawnNode.
  *  With `root`: an independent resident root — parent=null, NO subscription back

package/dist/core/runtime/spawn.js

@@ -10,16 +10,17 @@
 //                provenance via spawned_by) brought forefront for direct driving.
 import { spawnSync } from 'node:child_process';
 import { FRONT_DOOR_ENV } from './front-door.js';
-import { spawnNode, currentNodeContext, resolveBirthSession, nodeSession } from './nodes.js';
+import { spawnNode, currentNodeContext, resolveBirthSession, nodeSession, rootOfSpine } from './nodes.js';
 import { buildLaunchSpec, buildPiArgv } from './launch.js';
 import { writeGoal } from './kickoff.js';
 import { hasRoadmap, seedRoadmap } from './roadmap.js';
-import { seedMemory, seedUserMemory, seedProjectMemory } from './memory.js';
 import { generateSessionName } from './naming.js';
-import { installMenuBinding, installNavBindings } from './tmux-chrome.js';
+import { buildIdentityAssertion, buildWakeBearings } from './bearings.js';
+import { installMenuBinding, installNavBindings, installViewNavBindings } from './tmux-chrome.js';
 import { setPresence, updateNode, getNode, fullName } from '../canvas/index.js';
 import { registerRootFocus, ensureSession, openNodeWindow, piCommand, currentTmux, inTmux, focusWindow, } from './placement.js';
 import { transition } from './lifecycle.js';
+import { headlessBrokerHost } from './host.js';
 import { ensureDaemon } from '../../daemon/manage.js';
 /** Create a root node and bring up its pi. Returns the node; for 'inline' this
  *  only returns after pi exits (it took over the terminal). */
@@ -57,8 +58,8 @@ export function bootRoot(opts) {
     // Every node window — root or child — lives in the one shared session.
     const session = nodeSession();
     ensureSession(session, opts.cwd);
-    // Make the Alt+C action menu + Alt+] / Alt+[ nav keys live on this server
-    // (idempotent, in-tmux only).
+    // Make the Alt+C action menu + Alt+] / Alt+[ node-nav keys + Alt+V then ]/[
+    // view-nav chord live on this server (idempotent, in-tmux only).
     if (inTmux()) {
         try {
             installMenuBinding();
@@ -68,6 +69,10 @@ export function bootRoot(opts) {
             installNavBindings();
         }
         catch { /* best-effort */ }
+        try {
+            installViewNavBindings();
+        }
+        catch { /* best-effort */ }
     }
     // inline: the root's pi takes over THIS terminal, so its own window stays
     // where the user is (its tmux_session tracks that real pane so supervision
@@ -93,7 +98,7 @@ export function bootRoot(opts) {
     }
     const withSession = getNode(meta.node_id);
     const inv = buildPiArgv(withSession, { prompt: opts.prompt });
-    const env = { ...process.env, ...inv.env, CRTR_ROOT_SESSION: session, [FRONT_DOOR_ENV]: '1' };
+    const env = { ...process.env, ...inv.env, CRTR_ROOT_SESSION: session, CRTR_SUBTREE: rootOfSpine(meta.node_id), [FRONT_DOOR_ENV]: '1' };
     const r = spawnSync('pi', inv.argv, { stdio: 'inherit', env });
     process.exit(r.status ?? 0);
 }
@@ -120,6 +125,19 @@ export function resolveForkSource(value) {
     // Not a known node — treat as a bare/partial pi session id for pi to resolve.
     return v;
 }
+/** Resolve who a spawn is attributed to. A managed child needs a spine parent
+ *  (explicit `--parent` or the calling node's CRTR_NODE_ID). A --root spawn
+ *  does not: it is top-level by definition and the spawner identity is
+ *  provenance only — a human shell with no CRTR_NODE_ID is a legitimate root
+ *  spawner (regression: `crtr node new --root` from outside a node used to
+ *  throw here). */
+export function resolveSpawner(parent, ctxNodeId, root) {
+    const spawner = parent ?? ctxNodeId ?? null;
+    if (!root && spawner === null) {
+        throw new Error('spawnChild requires a calling node (CRTR_NODE_ID) or an explicit parent');
+    }
+    return spawner;
+}
 /** Spawn a node from a live node. By default a managed terminal worker in a
  *  background window, with the spawner auto-subscribed (active) via spawnNode.
  *  With `root`: an independent resident root — parent=null, NO subscription back
@@ -131,11 +149,8 @@ export function spawnChild(opts) {
     }
     catch { /* daemon is best-effort */ }
     const ctx = currentNodeContext();
-    const spawner = opts.parent ?? ctx.nodeId;
-    if (spawner === null || spawner === undefined) {
-        throw new Error('spawnChild requires a calling node (CRTR_NODE_ID) or an explicit parent');
-    }
     const root = opts.root === true;
+    const spawner = resolveSpawner(opts.parent, ctx.nodeId ?? null, root);
     const mode = opts.mode ?? 'base';
     // Lifecycle keys on ROOT-ness only, independent of mode: an independent root
     // (or `--root`) is resident (a conversation that persists, woken by inbox/
@@ -146,7 +161,7 @@ export function spawnChild(opts) {
     // Spine: a managed child reports up to its spawner (has a manager); an
     // independent root sits top-of-spine with nobody to push to. Mirrors the
     // `parent` set below (root ? null : spawner), so hasManager === parent!==null.
-    const { launch } = buildLaunchSpec(opts.kind, mode, { lifecycle, hasManager: !root });
+    const { launch } = buildLaunchSpec(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model });
     // Name the worker from its task now, so its first editor label carries it.
     const meta = spawnNode({
         kind: opts.kind,
@@ -156,9 +171,16 @@ export function spawnChild(opts) {
         name: opts.name ?? opts.kind,
         description: generateSessionName(opts.prompt),
         // A root has no spine parent (top-level, nobody subscribes); it still
-        // records spawned_by=spawner. A child's parent IS its manager.
+        // records spawned_by=spawner when a node (not a human shell) spawned it.
+        // A child's parent IS its manager.
         parent: root ? null : spawner,
-        spawnedBy: root ? spawner : undefined,
+        spawnedBy: root ? (spawner ?? undefined) : undefined,
+        // Persist the RAW fork reference (not the resolved path) as provenance, so
+        // the boot intro can detect this is a fork and re-assert the node's own
+        // identity over the source's copied-in conversation.
+        forkFrom: opts.forkFrom,
+        hostKind: opts.hostKind,
+        modelOverride: opts.model,
         launch,
     });
     // Persist the task as the child's goal for a fresh revive to re-read.
@@ -168,6 +190,19 @@ export function spawnChild(opts) {
     // — not in buildPiArgv — so a bad reference fails the spawn loudly before any
     // window opens, rather than after pi is already booting.
     const forkFrom = opts.forkFrom !== undefined ? resolveForkSource(opts.forkFrom) : undefined;
+    // A fork inherits the SOURCE node's entire first-person conversation, so the
+    // identity re-assertion must ride the STRONGEST channel too, not only the
+    // session-start bearings (a trailing custom_message the model weighs only by
+    // recency). Prepend it to the kickoff PROMPT — the message that actually
+    // triggers the fork's first turn, so the model acts on "you are node X, a
+    // FORK of <source>, NOT them" as live instruction. When the daemon births this
+    // node from a scheduled `spawn` wake, the <crtr-wake> provenance block leads
+    // (so "a timer birthed you" precedes the task) — mirroring the fork-identity
+    // prepend. Only the pi argv prompt is reframed; the persisted goal (writeGoal
+    // above) keeps the raw task.
+    const wakeBlock = opts.wakeOrigin !== undefined ? `${buildWakeBearings(opts.wakeOrigin)}\n\n` : '';
+    const idBlock = forkFrom !== undefined ? `${buildIdentityAssertion(meta.node_id)}\n\n` : '';
+    const kickoff = `${wakeBlock}${idBlock}${opts.prompt}`;
     // A child created DIRECTLY as an orchestrator (mode='orchestrator') boots
     // with the orchestrator persona but bypasses promote(), which is where a
     // roadmap scaffold would normally be seeded. Lay one down here (goal
@@ -176,14 +211,8 @@ export function spawnChild(opts) {
     if (mode === 'orchestrator' && !hasRoadmap(meta.node_id)) {
         seedRoadmap(meta.node_id, { goal: opts.prompt.trim() });
     }
-    // Born an orchestrator ⇒ also lay down its three scoped long-term memory
-    // stores, the companions to the roadmap: user-global (key-less), project
-    // (keyed off the child's cwd), and node-local. Each guarded against clobber.
-    if (mode === 'orchestrator') {
-        seedUserMemory();
-        seedProjectMemory(opts.cwd);
-        seedMemory(meta.node_id);
-    }
+    // (The three scoped long-term memory stores are seeded for EVERY node at birth
+    // in spawnNode — no orchestrator-gated seeding needed here.)
     // A managed CHILD lands in the shared global session: inherited from the
     // parent's CRTR_ROOT_SESSION, else the default node session. A --root spawned
     // from inside tmux instead opens its window in the CALLER'S CURRENT session,
@@ -205,8 +234,33 @@ export function spawnChild(opts) {
     // backstage, never a user session — this is what keeps a background revive
     // off the user's screen (the focus taint cannot reach it).
     updateNode(meta.node_id, { home_session: session });
-    const inv = buildPiArgv(meta, { prompt: opts.prompt, forkFrom });
-    const env = { ...inv.env, CRTR_ROOT_SESSION: childSession, [FRONT_DOOR_ENV]: '1' };
+    const inv = buildPiArgv(meta, { prompt: kickoff, forkFrom });
+    // Belt-and-suspenders backstage routing emitted at EVERY launch site: the
+    // authoritative CRTR_ROOT_SESSION (this subtree's shared backstage) +
+    // CRTR_SUBTREE (this node's spine root). Hoisted ABOVE the host branch so the
+    // broker launch and the tmux command consume ONE authoritative env — the
+    // broker host merges inv.env, so a --headless --root broker would otherwise
+    // inherit the SPAWNER's subtree id via the lossy nodeEnv passthrough (review
+    // reuse MINOR-2). FRONT_DOOR is added per-consumer below (the broker host sets
+    // it itself; the tmux env const adds it).
+    inv.env = { ...inv.env, CRTR_ROOT_SESSION: childSession, CRTR_SUBTREE: rootOfSpine(meta.node_id) };
+    // Birth LAUNCH branch on the PERSISTED host_kind (set at birth by spawnNode).
+    // A broker birth diverts AWAY from the tmux pane: the headless broker host
+    // launches a detached broker process (which records its own pid as pi_pid via
+    // the stophook) and returns placement fields all null — so we open NO tmux
+    // window and write NO tmux placement (presence stays null for a broker). The
+    // tmux path below is left completely UNCHANGED (byte-identical) for every
+    // non-broker spawn. Mirrors reviveNode's `hostFor(meta).launch(...)` shape.
+    if (meta.host_kind === 'broker') {
+        const placed = headlessBrokerHost.launch(meta.node_id, inv, {
+            cwd: meta.cwd,
+            name: fullName(meta),
+            resuming: false,
+        });
+        const saved = getNode(meta.node_id);
+        return { node: saved, window: placed.window, session: placed.session };
+    }
+    const env = { ...inv.env, [FRONT_DOOR_ENV]: '1' };
     const command = piCommand(inv.argv);
     // openNodeWindow now returns {window, pane}; pane is unused until the
     // placement layer lands, so destructure the window and proceed unchanged.

package/dist/core/runtime/stop-guard.d.ts

@@ -6,7 +6,7 @@ export interface StopSignals {
 }
 export type StopAction = {
     action: 'allow';
-    reason: 'awaiting' | 'finished' | 'escalated' | 'dormant';
+    reason: 'awaiting' | 'scheduled' | 'finished' | 'escalated' | 'dormant';
 } | {
     action: 'reprompt';
     reason: 'stalled';

package/dist/core/runtime/stop-guard.js

@@ -16,7 +16,7 @@
 //                      Also fine.
 //   • otherwise      → a TERMINAL node with nothing live to wait for and no
 //                      final pushed. Re-prompt it to finish or escalate.
-import { hasActiveLiveSubscription, getNode } from '../canvas/index.js';
+import { hasActiveLiveSubscription, hasPendingSelfWake, getNode } from '../canvas/index.js';
 export const STALL_REPROMPT = "You've stopped but you're not waiting on anyone and haven't finished. " +
     'Run `crtr push final "<result>"` if the work is done, or `crtr human ask` if you are blocked or need the user.';
 /** Decide what to do when a node stops. Pure given the canvas + this turn's
@@ -35,6 +35,11 @@ export function evaluateStop(nodeId, signals) {
     if (node !== null && node.lifecycle === 'resident') {
         return { action: 'allow', reason: 'dormant' };
     }
+    // A terminal node with a pending self-scheduled wakeup is legitimately
+    // waiting on the clock: the daemon's wakeup sweep resumes it when the wake
+    // fires, so it should idle-release rather than busy-wait holding pi/window.
+    if (hasPendingSelfWake(nodeId))
+        return { action: 'allow', reason: 'scheduled' };
     // A terminal node holding something live to wake it is legitimately awaiting.
     if (hasActiveLiveSubscription(nodeId))
         return { action: 'allow', reason: 'awaiting' };

package/dist/core/runtime/tmux-chrome.d.ts

@@ -1 +1 @@
-export { installMenuBinding, installNavBindings, sendKeysEnter } from './tmux.js';
+export { installMenuBinding, installNavBindings, installViewNavBindings, sendKeysEnter } from './tmux.js';

package/dist/core/runtime/tmux-chrome.js

@@ -1,4 +1,4 @@
 // tmux-chrome.ts — chrome seam (§2.1): stateless keybind/input verbs.
 // The ONLY non-placement module allowed to import the tmux driver, per the
 // §5.1 lint. Re-exports the menu/nav/send-keys verbs callers (spawn, chord) need.
-export { installMenuBinding, installNavBindings, sendKeysEnter } from './tmux.js';
+export { installMenuBinding, installNavBindings, installViewNavBindings, sendKeysEnter } from './tmux.js';

package/dist/core/runtime/tmux.d.ts

@@ -96,6 +96,26 @@ export declare function paneLocation(pane: string): {
  *  liveness. We therefore require the echoed `#{pane_id}` to equal the requested
  *  pane: a live pane echoes its own id, a gone/bogus one yields empty. */
 export declare function paneExists(pane: string): boolean;
+/** Every live pane id on the server (`list-panes -a`), as a Set for membership
+ *  probes. Returns null when tmux is unreachable (no server / transient failure)
+ *  so callers can tell "no panes" apart from "can't tell" — a GC pass must skip,
+ *  never mass-delete, on a failed probe. One subprocess call total, so batch
+ *  liveness sweeps (e.g. the daemon's stale-focus GC) don't pay a per-pane
+ *  display-message each. */
+export declare function listLivePanes(): Set<string> | null;
+/** The working directory of a pane (`display-message -p -t <pane>
+ *  '#{pane_current_path}'`). Used to preserve a view monitor's cwd across a
+ *  view-cycle respawn so project-scoped views still resolve. Null if tmux fails. */
+export declare function paneCurrentPath(pane: string): string | null;
+/** Set a PANE-scoped tmux option (`tmux set-option -p -t <pane> <name> <value>`).
+ *  Used to tag a pane with the view id it currently hosts (`@crtr_view`) so the
+ *  view-nav cycle can read it back and switch to the next/prev view in place.
+ *  Best-effort; never throws. */
+export declare function setPaneOption(pane: string, name: string, value: string): boolean;
+/** Read a PANE-scoped tmux option value (`tmux show-options -p -t <pane> -q -v
+ *  <name>`): `-v` prints only the value, `-q` suppresses the unknown-option
+ *  error so an unset option yields an empty string. undefined if tmux fails. */
+export declare function getPaneOption(pane: string, name: string): string | undefined;
 /** Relocate a pane into another session as its own window WITHOUT killing the
  *  process in it — `break-pane -d` moves the pane out of its current window (the
  *  pi keeps generating) into a fresh window in `session`; `-d` leaves the caller's
@@ -197,3 +217,11 @@ export declare function installMenuBinding(): boolean;
  *  terminal/tmux disambiguate it from a raw CSI introducer (`extended-keys on`).
  */
 export declare function installNavBindings(): boolean;
+/** Bind Alt+V → (], [) to the view-monitor cycle. `M-v` enters the private
+ *  `crtr-view` key table (switch-client -T), then ] cycles next / [ cycles prev.
+ *  Best-effort; false if any of the three binds fail. Deliberately distinct from
+ *  installNavBindings' bare Alt+]/Alt+[ (node cycle): the two cycles coexist on
+ *  the same server — brackets alone walk the node graph, Alt+V-then-bracket flips
+ *  view monitors. The bracket keys are bound in the private table, so they NEVER
+ *  shadow the user's root ]/[ and carry no CSI-introducer ambiguity. */
+export declare function installViewNavBindings(): boolean;