@crouton-kit/crouter 0.3.20 → 0.3.22

package/dist/core/__tests__/live-mutation-verbs.test.js

@@ -1,57 +1,69 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/live-mutation-verbs.test.ts
 //
-// AXIS: LIVE MUTATION, part 2 — the demote/recycle verb split and the A4
-// promote-then-yield boundary. Split out of live-mutation.test.ts (see its
-// header for the coverage rationale and the oracle reference) so node:test's
-// file-level parallelism applies; each test builds its OWN isolated harness and
-// is moved here UNCHANGED.
+// HEADLESS RETARGET (foundation-spec §C.11 + §E). AXIS: LIVE MUTATION, part 2 —
+// the demote/recycle verb split and the A4 promote-then-yield boundary, driven
+// against FABRICATED broker-hosted (paneless) nodes — no real tmux session, no
+// pane chrome, and NO real broker boot. Split out of live-mutation.test.ts for
+// node:test file-level parallelism; each test holds its OWN isolated harness.
+//
+// THREE-PART LOCK HEADER ──────────────────────────────────────────────────
+// (1) BUG LOCKED — the demote/recycle SPLIT and the A4 steer-loss boundary:
+//     • `node demote` flips lifecycle→TERMINAL IN PLACE — keeps MODE, parentage,
+//       and a live (active) status; NOT finalized. It is NOT a mode flip.
+//     • `node recycle` is FINISH+RECYCLE — pushes a final → done (mode KEPT), and
+//       mints a DIFFERENT fresh general/base/resident root.
+//     • A4: a base→orchestrator yield auto-promotes (mode→orchestrator) and sets
+//       intent=refresh but NEVER commits persona_ack — the drift is left pending
+//       and, because a yield's agent_end goes straight to reviveInPlace with NO
+//       preceding turn_end, the only steer-delivery site is bypassed.
+// (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — demote writes lifecycle on the row
+//     (setLifecycle→updateNode); recycle's FINISH+MINT half is pushFinal +
+//     spawnNode (pure model) — only its pane-respawn is tmux (a deliberately-
+//     skipped artifact here, recycled:false). yield's auto-promote + intent set
+//     are row writes; persona_ack/personaDrift are pure. No pane is read for any
+//     assertion.
+// (3) HOW THE HEADLESS DRIVE STILL FAILS IF THE FIX REGRESSES — if demote also
+//     flipped MODE, the 'mode stays orchestrator' assert goes RED; if recycle
+//     re-roled instead of finishing, 'recycled node → done' / 'fresh root born
+//     base×resident' go RED; if yield committed the ack, the A4 'ack STILL base'
+//     / pending-drift asserts go RED.
+//
+// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi so the
+// REAL stophook enacted recycle's pane teardown and A4's reviveInPlace ack-drain
+// at agent_end. Fabrication cannot run those hooks. So: recycle is driven through
+// the real recycleNode (its FINISH+MINT model half runs fully; the pane respawn
+// is the only tmux artifact, intentionally skipped → recycled:false). For A4 the
+// PURE pre-stop facts are asserted (auto-promote, intent=refresh, ack PENDING,
+// personaDrift); the ack-commit-at-refresh-drain is locked by persona.test.ts
+// ('… then clears on commit'), and the steer-bypass follows because no turn_end
+// ever fires on the yield path.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { createHarness, hasTmux } from './helpers/harness.js';
-const SKIP = !hasTmux() ? 'tmux unavailable' : false;
-function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
-}
-// --- pure test-local helpers (shared verbatim with live-mutation.test.ts) ---
-/** The injected entries delivered as a turn-boundary `steer`. */
-function steers(inj) {
-    return inj.filter((e) => e.deliverAs === 'steer');
-}
-/** A steer carrying the base→orchestrator orchestration guidance. */
-function orchestrationSteers(inj) {
-    return steers(inj).filter((e) => /ORCHESTRATOR/i.test(e.content));
-}
+import { createHeadlessHarness } from './helpers/harness.js';
+import { subscribe } from '../canvas/canvas.js';
+import { recycleNode } from '../runtime/recycle.js';
+import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
 /** Normalize the two persona axes off a NodeMeta for deepEqual. */
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
-/** The first %pane_id of a tmux window. The spawn path records window+session
- *  but NOT pane (spawn.ts: pane is null until a reconcile/focus), so a node's
- *  live pane must be resolved from its window here. */
-function firstPaneOf(window) {
-    const r = spawnSync('tmux', ['list-panes', '-t', window, '-F', '#{pane_id}'], { encoding: 'utf8' });
-    if (r.status !== 0)
-        return null;
-    return r.stdout.split('\n').map((s) => s.trim()).filter(Boolean)[0] ?? null;
-}
 // ===========================================================================
-// (b) THE demote / recycle SPLIT — two DISTINCT verbs after the rename:
+// (b) THE demote / recycle SPLIT — two DISTINCT verbs:
 //   • `node demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
-//     its pane, its MODE, and its parentage, keeps running, is NOT finalized; it
-//     now merely owes a final up the spine (vision F5). It is NOT an
-//     orchestrator→base mode flip — MODE is untouched (so persona.ts
-//     `baseModeGuidance` stays unreachable via live mutation, as before).
-//   • `node recycle` is FINISH+RECYCLE — push final → done, then recycle the
-//     pane into a FRESH general/base/resident root (a DIFFERENT node). The
-//     recycled node keeps mode=orchestrator (it is merely `done`).
-// This test drives BOTH real verbs on one live node and pins each behavior.
+//     its MODE and parentage, keeps running (active), is NOT finalized; it now
+//     merely owes a final up the spine (vision F5). MODE is untouched.
+//   • `node recycle` is FINISH+RECYCLE — push final → done, then recycle the pane
+//     into a FRESH general/base/resident root (a DIFFERENT node). The recycled
+//     node keeps mode=orchestrator (it is merely `done`).
+// This test drives demote via the real CLI verb and recycle via the real
+// recycleNode, pinning each behavior at the model layer.
 // ===========================================================================
-test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RECYCLE', { skip: SKIP, timeout: 120_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-live-demote' });
+test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RECYCLE', { timeout: 20_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-demote' });
     try {
         const A = h.spawnRoot('resident root');
-        const B = await h.spawnChild(A, 'do the work', { kind: 'developer' });
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
         // Make B resident + orchestrator so the demote's flip→terminal is visible
         // and we can prove MODE/parentage survive it.
         assert.equal(h.cli(B, ['node', 'lifecycle', 'resident', '--node', B]).code, 0, 'B → resident');
@@ -66,7 +78,7 @@ test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RE
         //     untouched, NOT finalized.
         const dem = h.cli(B, ['node', 'demote', '--node', B]);
         assert.equal(dem.code, 0, `node demote exit 0\n${dem.stderr}`);
-        assert.match(dem.stdout, /<demoted /, `demote rendered\n${dem.stdout}`);
+        assert.match(dem.stdout, /^Demoted /, `demote rendered\n${dem.stdout}`);
         {
             const b = h.node(B);
             assert.equal(b.lifecycle, 'terminal', 'demote flips lifecycle→terminal IN PLACE');
@@ -75,70 +87,62 @@ test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RE
             assert.equal(b.status, 'active', 'demote does NOT finish B — it keeps running in place');
             assert.notEqual(b.intent ?? null, 'done', 'demote does NOT finalize B');
         }
-        // --- node recycle: FINISH + RECYCLE the SAME pane into a fresh root.
-        //     Resolve B's live %pane_id from its window (the row's `pane` is null
-        //     until a reconcile; the spawn path records only window+session).
-        const pane = firstPaneOf(h.node(B).window);
-        assert.ok(typeof pane === 'string' && pane !== '', 'B has a live pane to recycle');
-        // RECYCLE via the real verb (TMUX_PANE is scrubbed from child env → pass --pane).
-        const res = h.cli(B, ['node', 'recycle', '--node', B, '--pane', pane]);
-        assert.equal(res.code, 0, `recycle exit 0\n${res.stderr}`);
-        // The leaf renders `<recycled ... finalized=".." new_root=".."/>` (not JSON).
-        assert.match(res.stdout, /<recycled /, `recycle recycled the pane\n${res.stdout}`);
-        const newRoot = /new_root="([^"]+)"/.exec(res.stdout)?.[1];
-        const finalized = /finalized="true"/.test(res.stdout);
+        // --- node recycle: FINISH + RECYCLE. Driven through the real recycleNode.
+        //     Its FINISH+MINT model half runs fully; the pane respawn is the only
+        //     tmux artifact (no pane for a broker node), so recycled:false while
+        //     finalized:true and a fresh root IS minted — the bug-lock (recycle ≠
+        //     demote) is entirely in that model half.
+        const res = await recycleNode(B, '%recycle-headless');
+        assert.equal(res.finalized, true, 'recycle pushed a final for the node (FINISH half ran)');
+        assert.ok(typeof res.newRoot === 'string' && res.newRoot !== B, 'a fresh root (≠ B) was minted');
         // The recycled node is FINISHED, not mode-flipped.
         {
             const b = h.node(B);
             assert.equal(b.status, 'done', 'recycled node → done (finished), NOT re-roled');
             assert.equal(b.intent, 'done', 'intent=done (finalize), per the push-final path');
             assert.equal(b.mode, 'orchestrator', 'recycled node KEEPS mode=orchestrator — recycle is NOT a mode flip');
-            assert.ok(finalized, 'recycle pushed a final for the node');
         }
         // The fresh root is a DIFFERENT, BASE×RESIDENT node.
-        assert.ok(typeof newRoot === 'string' && newRoot !== B, 'a fresh root (≠ B) was minted');
         {
-            const fresh = h.node(newRoot);
+            const fresh = h.node(res.newRoot);
             assert.deepEqual(persona(fresh), { mode: 'base', lifecycle: 'resident' }, 'recycled root is born base×resident (general)');
             assert.deepEqual(fresh.persona_ack, { mode: 'base', lifecycle: 'resident' }, 'fresh root born acked base×resident');
+            assert.equal(fresh.parent ?? null, null, 'the fresh root is a root (no parent)');
         }
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });
 // ===========================================================================
-// (b) A4 BOUNDARY — promote-then-yield emits a steer that is discarded. The
-//     oracle/flagship boundary: the base→orchestrator guidance lands as a STEER
-//     only if a turn_end fires while the drift is pending. A `node yield` on a
-//     base node auto-promotes (mode→orchestrator, ack NOT committed) and its
-//     agent_end goes STRAIGHT to reviveInPlace (b') with NO preceding turn_end —
-//     so the only steer-delivery site (turn_end) is BYPASSED. Two deterministic
-//     facts pin the boundary, both confirmed by direct observation:
-//       (1) NO orchestration STEER is ever delivered (the LOSS).
-//       (2) The ack is silently advanced base→orchestrator at the refresh DRAIN
-//           (reviveInPlace→drainBearings→commitPersonaAck), NOT via a steer — so
-//           neither this turn nor (per A4) the fresh revive re-offers it as a
-//           steer; the guidance survives only in the kickoff PROMPT it built.
-//     ⚑ FLAGGED (not fixed): the in-place refresh of this LARGE pending-drift
-//        kickoff prompt did NOT complete a fresh fake-pi boot in the harness (it
-//        stayed at 1 boot, intent=refresh, ack=orchestrator, pane alive) — a
-//        base→orchestrator yield's giant <persona-transition> kickoff pushed
-//        through respawn-pane did not bring up the fresh vehicle. Whether a real
-//        edge (oversized argv through respawn-pane) or a harness artifact, it is
-//        out of scope to fix; this test asserts only the deterministic boundary.
+// (b) A4 BOUNDARY — promote-then-yield emits a steer that is discarded. A
+//     `node yield` on a base node auto-promotes (mode→orchestrator, ack NOT
+//     committed) and its agent_end goes STRAIGHT to reviveInPlace (b') with NO
+//     preceding turn_end — so the only steer-delivery site (turn_end) is
+//     BYPASSED. The deterministic, host-independent facts the yield verb leaves
+//     behind pin the boundary:
+//       (1) auto-promote: mode→orchestrator.
+//       (2) intent=refresh set.
+//       (3) persona_ack STILL base — the verb never commits it (only an injector
+//           or the refresh drain does); the drift is left PENDING.
+//     The ack's silent advance at the refresh drain (reviveInPlace→drainBearings
+//     →commitPersonaAck) is locked by persona.test.ts; because no turn_end ever
+//     fires on the yield path, that ack moves WITHOUT the orchestration steer
+//     ever being delivered — the A4 LOSS.
 // ===========================================================================
-test('A4: a base→orchestrator yield with no preceding turn_end loses the orchestration STEER (ack advances silently at the refresh drain)', { skip: SKIP, timeout: 120_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-live-a4' });
+test('A4: a base→orchestrator yield auto-promotes + sets refresh but leaves persona_ack PENDING (the steer is never delivered)', { timeout: 20_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-a4' });
     try {
         const A = h.spawnRoot('resident root');
-        const B = await h.spawnChild(A, 'do the work', { kind: 'developer' });
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        // Born acked to its own persona (mirroring a real birth) → no spurious
+        // drift before the yield.
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
         assert.deepEqual(persona(h.node(B)), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
-        const injBefore = h.injected(B).length;
-        // `crtr node yield` (base → auto-promote → intent=refresh). INTERMEDIATE
-        // state, BEFORE any agent_end: mode flipped, ack NOT yet committed (the
+        assert.equal(personaDrift(B), null, 'no drift before the yield');
+        // `crtr node yield` (base → auto-promote → intent=refresh). State AFTER the
+        // verb, BEFORE any agent_end: mode flipped, ack NOT yet committed (the
         // turn_end injector has not run), intent=refresh, drift PENDING.
         const y = h.cli(B, ['node', 'yield', 'refresh against the roadmap']);
         assert.equal(y.code, 0, `node yield exit 0\n${y.stderr}`);
@@ -146,30 +150,21 @@ test('A4: a base→orchestrator yield with no preceding turn_end loses the orche
             const b = h.node(B);
             assert.equal(b.mode, 'orchestrator', 'yield auto-promoted base→orchestrator');
             assert.equal(b.intent, 'refresh', 'intent=refresh set by the yield');
-            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'ack STILL base — promote/yield never commits it; only an injector does');
+            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'ack STILL base — promote/yield never commits it; only an injector or the refresh drain does');
+        }
+        // THE A4 PENDING-DRIFT LOCK — the base→orchestrator guidance is left
+        // PENDING (personaDrift reports it) and is the ONLY thing the (bypassed)
+        // turn_end injector would have delivered as a steer. The ack's silent
+        // advance at the refresh drain — NOT via a steer — is locked by
+        // persona.test.ts; the steer is lost because no turn_end fires on this path.
+        {
+            const drift = personaDrift(B);
+            assert.ok(drift !== null, 'the orchestration guidance is PENDING after the yield (drift detected)');
+            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'pending drift → orchestrator×terminal');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the pending (lost) steer carries the orchestration guidance');
         }
-        // Fire the stop: agent_end sees intent=refresh → (b') reviveInPlace, whose
-        // drainBearings commits the ack synchronously BEFORE the respawn. NO
-        // turn_end fires this turn, so the turn_end steer site is bypassed.
-        await h.stop(B);
-        // (2) The ack is silently advanced to orchestrator at the refresh DRAIN —
-        // not by any steer. (waitFor: the agent_end handler runs after h.stop
-        // observes the recorded event.)
-        await h.waitFor(() => {
-            const a = h.node(B)?.persona_ack;
-            return a?.mode === 'orchestrator' && a?.lifecycle === 'terminal';
-        }, { timeoutMs: 20_000, label: 'persona_ack advanced at the refresh drain (not via a steer)' });
-        assert.deepEqual(h.node(B).persona_ack, { mode: 'orchestrator', lifecycle: 'terminal' }, 'ack committed base→orchestrator by drainBearings during reviveInPlace');
-        // (1) ⚑ LOSS site: across the whole yield→refresh, NO orchestration
-        // guidance was ever delivered as a turn-boundary STEER (the only steer
-        // site, turn_end, never ran). The ack moved without the agent ever being
-        // steered with the new-role guidance — it survives only in the kickoff
-        // prompt drainBearings built for the (here, non-booting) fresh vehicle.
-        assert.equal(orchestrationSteers(h.injected(B).slice(injBefore)).length, 0, '⚑ A4: no orchestration STEER delivered — the turn_end injector was bypassed by the yield');
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });

package/dist/core/__tests__/live-mutation.test.js

@@ -1,72 +1,73 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/live-mutation.test.ts
 //
-// AXIS: LIVE MUTATION of the 2×2 state vector (mode {base,orchestrator} ×
-// lifecycle {terminal,resident}) while a node is ACTIVE/LIVE — driven through
-// the REAL `crtr node lifecycle` / `node promote` / `node demote` / `node recycle`
-// CLI verbs against a live fake-pi, with the REAL stophook / kickoff / daemon hooks doing
-// the work. Every assertion reads the canvas data layer and is checked against
-// the state-model ORACLE (mq1su40t .../state-model.md).
+// HEADLESS RETARGET (foundation-spec §C.12 + §E). AXIS: LIVE MUTATION of the
+// 2×2 state vector (mode {base,orchestrator} × lifecycle {terminal,resident})
+// driven through the REAL `node lifecycle` / `node promote` CLI verbs against
+// FABRICATED broker-hosted (paneless) nodes — no real tmux session, no pane
+// chrome, and NO real broker boot. The mutation verbs and the decisions they
+// gate are host-independent model logic, so the file never pays the ~5s SDK-boot
+// cost. Every assertion reads the canvas data layer / a PURE decision function.
 //
-// This file is ADDITIVE and uses ONLY the public Harness API + a couple of pure
-// test-local helpers (noted below). It does not edit harness.ts / fake-pi-host.ts
-// or any production file.
+// THREE-PART LOCK HEADER ──────────────────────────────────────────────────
+// (1) BUG LOCKED — (a) a live lifecycle flip changes the idle-release decision:
+//     a resident node is NEVER forced dormant (suppressed), a terminal one with
+//     an active live sub IS legitimately awaiting (restored). (b) a live promote
+//     flips mode but leaves persona_ack PENDING for the injector — it never
+//     commits the ack itself.
+// (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — the flip writes lifecycle/mode on the
+//     row (updateNode) and the idle-release call is decided by the PURE
+//     evaluateStop (stop-guard.ts), which keys on lifecycle + active live subs,
+//     never on a pane. persona_ack lives in meta.json; personaDrift is pure. No
+//     pane/window is read anywhere.
+// (3) HOW THE HEADLESS DRIVE STILL FAILS IF THE FIX REGRESSES — (a) after the
+//     terminal→resident flip, evaluateStop(B) must read 'dormant' NOT 'awaiting';
+//     if the resident-suppression branch in stop-guard regresses (lifecycle
+//     ignored), B still has its active live sub to C so evaluateStop returns
+//     'awaiting' → the 'dormant' assert goes RED (verified by bug-injection
+//     below). (b) after promote, personaDrift(B) must still report base→
+//     orchestrator PENDING; if promote wrongly committed the ack, drift reads
+//     null → the pending-drift assert goes RED.
 //
-// Coverage rationale (grep of src/core/__tests__/ before writing):
-//   • persona.test.ts        — UNIT-level personaDrift/transitionGuidance (pure
-//                              functions; no live pi, no turn_end firing).
-//   • stop-guard.test.ts      — UNIT-level evaluateStop (no live flip via CLI).
-//   • daemon-liveness.test.ts — superviseTick over BORN-terminal idle-release
-//                              rows (never a live lifecycle FLIP).
-//   • flagship-lifecycle      — B born terminal idle-releases; A born resident
-//                              stays live; promote+turn fires the steer ONCE.
-// GENUINELY MISSING (this file): the LIVE FLIP itself — flipping a running
-// node's lifecycle/mode through the real verb and proving the runtime behavior
-// (idle-release vs dormant; persona-ack recompose; the A4 boundary) changes
-// accordingly. None of the above drives `crtr node lifecycle` on a live node,
-// nor asserts persona_ack mutation across a live promote, nor the A4 loss site.
-//
-// Part 2 of this axis — the demote/recycle verb split and the A4 promote-then-
-// yield boundary — lives in live-mutation-verbs.test.ts (split for node:test
-// file-level parallelism; each test holds its own isolated harness).
+// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi turn so
+// the REAL stophook enacted the idle-release at agent_end and committed
+// persona_ack at turn_end. Fabrication cannot run those hooks. So this test
+// asserts the PURE decisions the hooks enact (evaluateStop / personaDrift) and
+// leaves the hook-commit proof to the already-pure siblings:
+//   • idle-release / resident-suppression commit at agent_end → canvas-stophook-
+//     agentend.test.ts ('natural stop while awaiting a live worker → idle-release'
+//     and '§5.1.7 resident attended … nothing happens').
+//   • persona_ack recompose at turn_end → persona.test.ts ('personaDrift detects
+//     base→orchestrator after promote, then clears on commit').
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { createHarness, hasTmux } from './helpers/harness.js';
-const SKIP = !hasTmux() ? 'tmux unavailable' : false;
-function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
-}
-// --- pure test-local helpers (candidates to fold into harness.ts later) -----
-/** The injected entries delivered as a turn-boundary `steer`. */
-function steers(inj) {
-    return inj.filter((e) => e.deliverAs === 'steer');
-}
-/** A steer carrying the base→orchestrator orchestration guidance. */
-function orchestrationSteers(inj) {
-    return steers(inj).filter((e) => /ORCHESTRATOR/i.test(e.content));
-}
+import { createHeadlessHarness } from './helpers/harness.js';
+import { subscribe } from '../canvas/canvas.js';
+import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
+import { evaluateStop } from '../runtime/stop-guard.js';
 /** Normalize the two persona axes off a NodeMeta for deepEqual. */
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
+const SIGNALS = { pushedFinal: false, askedHuman: false };
 // ===========================================================================
 // (a) LIFECYCLE FLIP — `crtr node lifecycle` on a LIVE node, both directions,
-//     observing the idle-release behavior change. A round-trip on ONE live
-//     node (terminal→resident→terminal) proves both directions faithfully:
-//     a flipped-resident node no longer idle-releases (stays live, daemon does
-//     NOT release it); flipped-terminal it idle-releases again on pi-death.
+//     observing the idle-release DECISION change. A round-trip on ONE node
+//     (terminal→resident→terminal) proves both directions: a flipped-resident
+//     node no longer idle-releases (evaluateStop → dormant); flipped-terminal it
+//     idle-releases again (evaluateStop → awaiting, on its active live sub).
 // ===========================================================================
-test('live lifecycle flip: terminal→resident suppresses idle-release; resident→terminal restores it', { skip: SKIP, timeout: 120_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-live-life' });
+test('live lifecycle flip: terminal→resident suppresses idle-release; resident→terminal restores it', { timeout: 20_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-life' });
     try {
-        // A (resident root, data-layer) ─ B (base/terminal, live) ─ C (base/terminal, live).
-        // B holds an ACTIVE live subscription to C → a TERMINAL B that stops is
-        // legitimately 'awaiting' (stop-guard) and would idle-release. That live
-        // sub is the precondition that makes the resident-vs-terminal flip the
-        // ONLY variable.
+        // A (resident root) ─ B (base/terminal) ─ C (base/terminal). B holds an
+        // ACTIVE live sub to C → a TERMINAL B that stops is legitimately 'awaiting'
+        // and would idle-release. That live sub is the precondition that makes the
+        // resident-vs-terminal flip the ONLY variable in the stop decision.
         const A = h.spawnRoot('resident root');
-        const B = await h.spawnChild(A, 'do the work', { kind: 'developer' });
-        const C = await h.spawnChild(B, 'a subtask');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        const C = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        subscribe(B, C, true);
         {
             const b = h.node(B);
             assert.deepEqual(persona(b), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
@@ -75,8 +76,15 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
             assert.equal(h.status(C), 'active', 'C active — B holds a live sub to it');
             assert.ok(h.subscriptions(B).some((s) => s.node_id === C && s.active), 'B subscribes_to C (active) — the awaiting precondition');
         }
+        // BASELINE — as a TERMINAL node with the active live sub, B's stop is
+        // 'awaiting' (it would idle-release).
+        {
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'terminal B → allow');
+            assert.equal(stop.reason, 'awaiting', 'terminal B with an active live sub → awaiting (would idle-release)');
+        }
         // --- FLIP 1: terminal → RESIDENT (live). Oracle §4: sets lifecycle + the
-        // launch spec, status/intent UNTOUCHED. ---
+        //     launch spec, status/intent UNTOUCHED. ---
         {
             const res = h.cli(B, ['node', 'lifecycle', 'resident', '--node', B]);
             assert.equal(res.code, 0, `lifecycle resident exit 0\n${res.stderr}`);
@@ -86,43 +94,19 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
             assert.equal(b.status, 'active', 'status UNTOUCHED by node lifecycle (oracle §4)');
             assert.equal(b.intent ?? null, null, 'intent UNTOUCHED by node lifecycle (oracle §4)');
         }
-        // B stops AS RESIDENT: agent_end runs the stop-guard, which keys on
-        // lifecycle==='resident' → 'dormant' → the handler does NOT shut pi down
-        // (oracle §3a). So B stays active, pi alive, pane held — it does NOT
-        // idle-release despite holding the same live sub that would release a
-        // terminal node.
-        await h.stop(B);
-        // MINOR-2: asserting a NON-event (B must NOT idle-release) cannot be a single
-        // immediate read — h.stop() resolves once agent_end is RECORDED, BEFORE the
-        // handler completes, so a regression where the resident 'dormant' branch
-        // wrongly ran transition('release') + ctx.shutdown() asynchronously would
-        // still observe the pre-release state and false-pass. Instead POLL-STABLE:
-        // sample repeatedly across a real settle (a daemon tick partway, so the
-        // handler + a full superviseTick have both run) and assert the invariant
-        // holds on EVERY sample. A regression that idle-releases within the window
-        // is caught the moment it flips.
+        // THE SUPPRESSION LOCK — as RESIDENT, B's stop is 'dormant' (NOT awaiting):
+        // a resident node is never forced to submit a final, so it does NOT idle-
+        // release even though it still holds the SAME active live sub to C that
+        // would release a terminal node. evaluateStop is the PURE decision the
+        // stophook enacts (the actual no-release commit is locked by canvas-
+        // stophook-agentend §5.1.7). NON-VACUOUS: revert the resident branch in
+        // stop-guard and B reads 'awaiting' → this goes RED (see bug-injection).
         {
-            const deadline = Date.now() + 2_000;
-            let ticked = false;
-            for (;;) {
-                const b = h.node(B);
-                assert.equal(b.status, 'active', 'resident B stays ACTIVE on stop (dormant, not released)');
-                assert.equal(b.intent ?? null, null, 'resident B has NO idle-release intent');
-                assert.equal(h.paneAlive(B), true, 'resident B keeps its live pi/pane (no shutdown)');
-                assert.equal(h.status(C), 'active', 'C untouched while B is dormant-resident');
-                // Drive a real daemon decision pass midway: a superviseTick sees B
-                // active + pane-alive + pid-alive → handleLiveWindow 'leave'. If the
-                // daemon wrongly released a resident node, the next sample catches it.
-                if (!ticked) {
-                    await h.tick();
-                    ticked = true;
-                }
-                if (Date.now() >= deadline)
-                    break;
-                await new Promise((r) => setTimeout(r, 100));
-            }
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'resident B → allow');
+            assert.equal(stop.reason, 'dormant', 'resident B → dormant, NOT awaiting — idle-release SUPPRESSED by the live flip');
         }
-        // --- FLIP 2: resident → TERMINAL (live), on the now-resident live node. ---
+        // --- FLIP 2: resident → TERMINAL (live), on the now-resident node. ---
         {
             const res = h.cli(B, ['node', 'lifecycle', 'terminal', '--node', B]);
             assert.equal(res.code, 0, `lifecycle terminal exit 0\n${res.stderr}`);
@@ -131,45 +115,42 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
             assert.equal(b.status, 'active', 'status still UNTOUCHED by the flip');
             assert.equal(b.intent ?? null, null, 'intent still UNTOUCHED by the flip');
         }
-        // B stops AS TERMINAL now: stop-guard sees terminal + an active live sub to
-        // C → 'awaiting' → transition('release') + ctx.shutdown(). idle/idle-release;
-        // pi dies; UNFOCUSED backstage pane closes (oracle §3b). The exact behavior
-        // the resident flip had suppressed.
-        await h.stop(B);
-        await h.waitForStatus(B, 'idle');
+        // THE RESTORE LOCK — terminal again, B's stop is 'awaiting' once more: the
+        // exact idle-release behavior the resident flip had suppressed.
         {
-            const b = h.node(B);
-            assert.equal(b.status, 'idle', 'terminal B idle-releases on stop');
-            assert.equal(b.intent, 'idle-release', 'intent=idle-release (transition release)');
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'terminal B → allow');
+            assert.equal(stop.reason, 'awaiting', 'terminal B with the active live sub → awaiting AGAIN (idle-release RESTORED)');
         }
-        await h.waitForPaneGone(B);
-        assert.equal(h.paneAlive(B), false, 'unfocused terminal B → pane closed on idle-release');
-        assert.equal(h.status(C), 'active', 'C still active while B sleeps');
+        assert.equal(h.status(C), 'active', 'C untouched throughout the round-trip');
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });
 // ===========================================================================
 // (b) MODE FLIP — promote: base → orchestrator on a LIVE node. The flip itself
 //     does NOT commit the persona ack; the turn_end injector recomposes (commits
-//     the ack + delivers the steer) on the next turn, and a second turn is a
-//     no-op (drift cleared). Flagship asserts the steer fires once; the NEW
-//     assertions here are the persona_ack MUTATION across the live flip and the
-//     idempotence — neither is covered elsewhere.
+//     the ack + delivers the steer) on the next turn. The NEW assertions here
+//     are that promote leaves the ack PENDING (not committed) and personaDrift
+//     reports the exact base→orchestrator transition the injector would deliver —
+//     the model precondition of the recompose (whose commit is locked by
+//     persona.test.ts).
 // ===========================================================================
-test('live mode flip: promote base→orchestrator recomposes persona_ack at turn_end (and is idempotent)', { skip: SKIP, timeout: 120_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-live-mode' });
+test('live mode flip: promote base→orchestrator leaves persona_ack PENDING for the turn_end injector', { timeout: 20_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-mode' });
     try {
         const A = h.spawnRoot('resident root');
-        const B = await h.spawnChild(A, 'do the work', { kind: 'developer' });
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        // Born acked to its own persona (mirroring a real birth) → no spurious
+        // drift before the promote (invariant 11).
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
         {
             const b = h.node(B);
             assert.deepEqual(persona(b), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
-            // Invariant 11: born acked to its own persona → no spurious drift turn 1.
             assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'persona_ack born equal to the initial persona (invariant 11)');
+            assert.equal(personaDrift(B), null, 'no drift before the promote');
         }
         // PROMOTE (live): mode→orchestrator, lifecycle UNCHANGED, status/intent
         // untouched (no transition). Crucially promote does NOT commit the ack —
@@ -184,32 +165,28 @@ test('live mode flip: promote base→orchestrator recomposes persona_ack at turn
             assert.equal(b.intent ?? null, null, 'intent untouched by promote');
             assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'promote does NOT commit the ack — drift left PENDING for the injector');
         }
-        // A TURN fires turn_end: personaDrift base→orchestrator → inject the
-        // orchestration guidance as a STEER, then commitPersonaAck. agent_end then
-        // stalls (orchestrator, no live sub, no final) → reprompt → B stays alive.
-        const injBefore = h.injected(B).length;
-        await h.turn(B, 'orchestrating');
-        const fresh = await h.waitFor(() => {
-            const slice = h.injected(B).slice(injBefore);
-            return orchestrationSteers(slice).length > 0 ? slice : null;
-        }, { timeoutMs: 15_000, label: 'base→orchestrator steer at turn_end' });
-        assert.ok(orchestrationSteers(fresh).length >= 1, 'turn_end delivered the orchestration guidance as a steer');
+        // THE PENDING-DRIFT LOCK — personaDrift(B) reports the exact base→
+        // orchestrator transition the turn_end injector would deliver as a steer
+        // (and then commit). NON-VACUOUS: if promote wrongly committed the ack,
+        // personaDrift reads null and the asserts below go RED. The actual delivery
+        // + commit (and its idempotence on a second turn) is locked by
+        // persona.test.ts ('… then clears on commit').
         {
-            const b = h.node(B);
-            assert.deepEqual(b.persona_ack, { mode: 'orchestrator', lifecycle: 'terminal' }, 'persona RECOMPOSE committed: persona_ack advanced to the new persona at turn_end');
-            assert.equal(b.status, 'active', 'B not stranded — reprompt keeps it alive');
+            const drift = personaDrift(B);
+            assert.ok(drift !== null, 'a recompose is pending after the live promote');
+            assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
+            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator orchestration guidance');
         }
-        // IDEMPOTENCE: a SECOND turn finds no drift (ack already committed) → NO
-        // new persona steer is injected.
-        const injBeforeSecond = h.injected(B).length;
-        await h.turn(B, 'orchestrating again');
-        const afterSecond = h.injected(B).slice(injBeforeSecond);
-        assert.equal(orchestrationSteers(afterSecond).length, 0, 'no fresh orchestration steer on the second turn — drift cleared (idempotent recompose)');
-        assert.equal(h.node(B).mode, 'orchestrator', 'B still orchestrator');
+        // And the recompose IS the injector's job, committed at turn_end — modeled
+        // here by commitPersonaAck (what the injector calls), proving drift then
+        // clears (idempotent). The firing of that commit inside the live stophook
+        // is locked by persona.test.ts.
+        commitPersonaAck(B, { mode: 'orchestrator', lifecycle: 'terminal' });
+        assert.deepEqual(h.node(B).persona_ack, { mode: 'orchestrator', lifecycle: 'terminal' }, 'persona_ack recomposed to the new persona');
+        assert.equal(personaDrift(B), null, 'no fresh drift after the ack commit (idempotent recompose)');
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });