@crouton-kit/crouter 0.3.21 → 0.3.22

package/dist/core/__tests__/revive.test.js

@@ -1,21 +1,44 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/revive.test.ts
 //
-// Covers the session-picker fix: a revive must resume by ABSOLUTE session-file
-// path (cwd-immune) when one was captured, falling back to the bare uuid for
-// older nodes — and the double-revive guard that keeps two pi processes off one
-// session file. The argv selection is unit-tested via the pure `resumeArgs` +
-// `buildPiArgv`; the guard is exercised against a REAL tmux window (gated on
-// tmux availability, like daemon-liveness.test.ts).
+// HEADLESS RETARGET (foundation-spec §C.13 + §E). Covers the session-picker fix
+// (resume by ABSOLUTE session-file path, cwd-immune, falling back to the bare
+// uuid for older nodes) AND the double-revive guard that keeps two pi processes
+// off one session file. The argv selection is unit-tested via the pure
+// `resumeArgs` + `buildPiArgv`; the guard + the cycle-counter bump are now driven
+// against a fabricated BROKER-hosted node — ZERO real tmux, ZERO real boot.
+//
+// (1) BUG LOCKED — the double-revive guard (revive.ts:114): a node already up
+//     (its engine container alive AND its pi pid live) must NOT be re-launched —
+//     a second pi on the same .jsonl corrupts the conversation. The complement:
+//     a revive that DOES proceed bumps the node's `cycles` BEFORE it spawns
+//     (revive.ts cycles++, then transition('revive'), then launch).
+//
+// (2) WHY MODEL-LEVEL, NOT TMUX CHROME — the guard's `isAlive` is host-keyed: a
+//     BROKER's container liveness IS `isPidAlive(pi_pid)` (host.ts headlessBrokerHost),
+//     so a fabricated broker row carrying a LIVE pid reproduces the exact "already
+//     up" state the guard short-circuits on — no pane, no window, no tmux server.
+//     The old tmux assertion ("no NEW window opened") was a tmux artifact; the
+//     real invariant is the model effect: `cycles` UNCHANGED on the guard path,
+//     and bumped to 1 when the revive proceeds (revive.ts bumps cycles
+//     synchronously before the detached launch — observable INSTANTLY, no
+//     awaitBoot). The taint-ignoring WINDOW placement decision is a genuine tmux
+//     concern and stays in full/placement-revive.test.ts.
+//
+// (3) HOW THE DRIVE STILL FAILS IF THE BUG REGRESSES — remove the guard's
+//     short-circuit and the live-pid broker revive bumps cycles (1, not 0) → the
+//     guard assert goes RED; break the cycles++ and the proceed test (expecting 1)
+//     goes RED.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { createNode, getNode } from '../canvas/canvas.js';
+import { spawn, spawnSync } from 'node:child_process';
+import { createNode } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { buildPiArgv } from '../runtime/launch.js';
 import { resumeArgs, reviveNode } from '../runtime/revive.js';
+import { createHarness } from './helpers/harness.js';
 let home;
 function node(id, over = {}) {
     return {
@@ -30,8 +53,20 @@ function node(id, over = {}) {
         ...over,
     };
 }
-function hasTmux() {
-    return spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0;
+/** A pid that is guaranteed dead — a crashed broker the guard must NOT see as up. */
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+/** A pid ALIVE for the test but EXPENDABLE — NEVER process.pid: the harness's
+ *  dispose() SIGKILLs every recorded pi_pid, which would take the test runner
+ *  down. A detached `sleep` is the live-engine stand-in; dispose reaps it. */
+const livePids = [];
+function disposableLivePid() {
+    const c = spawn('sleep', ['600'], { stdio: 'ignore', detached: true });
+    c.unref();
+    livePids.push(c.pid);
+    return c.pid;
 }
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-revive-'));
@@ -45,6 +80,14 @@ after(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    for (const pid of livePids) {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch {
+            /* already reaped by dispose() — fine */
+        }
+    }
 });
 // ---------------------------------------------------------------------------
 // resumeArgs — the pure resume-source selection
@@ -131,87 +174,54 @@ test('a resumed revive replays the persisted LaunchSpec (model, tools, extension
     assert.equal(env['CRTR_MODE'], 'orchestrator');
 });
 // ---------------------------------------------------------------------------
-// Double-revive guard — reviveNode no-ops when the window is already alive
-// (gated on tmux, which CI may not have; the guard needs a genuinely-live window
-// to short-circuit before any tmux mutation).
+// Double-revive guard — reviveNode no-ops when the node's engine is already up
+// (container alive AND pi pid live). Fabricated as a BROKER node, whose engine-
+// container liveness IS its pi-pid liveness (host.ts), so the guard is exercised
+// with NO tmux and NO real boot. A live pid → guard short-circuits (cycles flat);
+// a dead pid → revive proceeds (cycles bumped before the detached launch).
 // ---------------------------------------------------------------------------
-/** Hold a real, live tmux window open for the duration of `fn`, then tear down. */
-async function withLiveWindow(tag, fn) {
-    const session = `crtr-revivetest-${process.pid}-${tag}`;
-    spawnSync('tmux', ['new-session', '-d', '-s', session, '-c', '/tmp', 'sleep 600']);
+test('reviveNode no-ops when the broker engine is already up (live pid) — double-revive guard', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-guard' });
     try {
-        const r = spawnSync('tmux', ['list-windows', '-t', session, '-F', '#{window_id}'], { encoding: 'utf8' });
-        const window = (r.stdout ?? '').trim().split('\n')[0];
-        await fn(session, window);
+        // pi_pid = this process: a genuinely LIVE engine. The guard keys on the host's
+        // isAlive (a broker's IS isPidAlive(pi_pid)) AND pi-alive, so this models
+        // "another path already revived it" — re-launching would double-spawn onto the
+        // same .jsonl. reviveNode only READS isPidAlive here (never signals), so
+        // process.pid is NOT safe (dispose SIGKILLs every recorded pi_pid), so use a
+        // disposable live sleep as the alive-engine stand-in.
+        const M = h.fabricateBrokerNode({
+            status: 'active',
+            intent: null,
+            pi_pid: disposableLivePid(),
+            pi_session_id: 'uuid-1',
+        });
+        const before = h.node(M).cycles ?? 0;
+        const res = reviveNode(M, { resume: true });
+        assert.equal(res.resumed, false, 'guard path does not re-resume');
+        assert.equal(h.node(M).cycles ?? 0, before, 'cycle counter NOT bumped (guard returned early)');
     }
     finally {
-        spawnSync('tmux', ['kill-session', '-t', session], { stdio: 'ignore' });
+        await h.dispose();
     }
-}
-function windowCount(session) {
-    const r = spawnSync('tmux', ['list-windows', '-t', session, '-F', '#{window_id}'], { encoding: 'utf8' });
-    return (r.stdout ?? '').trim().split('\n').filter((s) => s !== '').length;
-}
-test('reviveNode no-ops when the node pane is alive AND its pi is LIVE (double-revive guard)', { skip: !hasTmux() }, async () => {
-    await withLiveWindow('guard', async (session, window) => {
-        // pi_pid = this process: a genuinely LIVE pi. The guard now keys on pane-
-        // alive AND pi-alive (Step 7), so this models "another path already revived
-        // it" — a no-op (re-launching would double-spawn onto the same session file).
-        createNode(node('M', {
-            tmux_session: session,
-            window,
-            cycles: 3,
-            pi_pid: process.pid,
-            pi_session_id: 'uuid-1',
-            pi_session_file: '/abs/m.jsonl',
-        }));
-        const before = windowCount(session);
-        const res = reviveNode('M', { resume: true });
-        assert.equal(res.window, window, 'returns the existing live window');
-        assert.equal(res.session, session, 'returns the existing session');
-        assert.equal(res.resumed, false, 'guard path does not re-resume');
-        assert.equal(windowCount(session), before, 'no new window opened');
-        assert.equal(getNode('M')?.cycles, 3, 'cycle counter NOT bumped (guard returned early)');
-    });
 });
-test('reviveNode PROCEEDS when the pane is alive but the pi is DEAD (F3 frozen-pane resume)', { skip: !hasTmux() }, async () => {
-    // The Step-7 guard fix: a FROZEN focus pane (remain-on-exit) is pane-alive but
-    // pi-DEAD — the resume-into-focus case. The OLD pane-only guard would no-op
-    // here (the bug that left a frozen focused-dormant node stuck); the new guard
-    // gates on pi liveness too, so reviveNode proceeds (bumps the cycle counter).
-    await withLiveWindow('frozen', async (session, window) => {
-        createNode(node('M', {
-            tmux_session: session,
-            window,
-            cycles: 3,
-            pi_pid: 0x7ffffffe, // implausible/dead pid → a frozen pane with no live pi
+test('reviveNode PROCEEDS when the broker engine is DOWN (dead pid) — cycle counter bumps 0→1', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-proceed' });
+    try {
+        // A crashed broker: container DOWN (dead pid) → the guard does NOT short-
+        // circuit → reviveNode proceeds. It bumps cycles BEFORE the detached (fake-
+        // engine) launch, so the bump is observable instantly; the throwaway broker is
+        // killed by dispose().
+        const M = h.fabricateBrokerNode({
+            status: 'active',
+            intent: null,
+            pi_pid: deadPid(),
             pi_session_id: 'uuid-1',
-            pi_session_file: '/abs/m.jsonl',
-        }));
-        reviveNode('M', { resume: true });
-        assert.equal(getNode('M')?.cycles, 4, 'cycle counter BUMPED — the guard did NOT short-circuit a frozen pane');
-    });
-});
-// ---------------------------------------------------------------------------
-// Step 5 (§5.3): reviveNode DELEGATES placement to reviveIntoPlacement — a
-// non-focused node targets its home_session, NEVER its (focus-tainted)
-// tmux_session. This is the reviveNode-level bug-kill proof. Gated to run when
-// tmux is ABSENT, so openNodeWindow no-ops (returns null) and no real pi is
-// launched — the placement DECISION (session + LOCATION) is set synchronously
-// regardless of whether a window actually opens, so the assertions are exact.
-// (The WITH-tmux window-placement behaviour is proven in placement-revive.test.ts.)
-// ---------------------------------------------------------------------------
-test('reviveNode delegates to home_session for a non-focused node, IGNORING the tainted tmux_session (§5.3)', { skip: hasTmux() }, async () => {
-    const back = `crtr-back-${process.pid}`;
-    const tainted = `crtr-user-${process.pid}`; // the focus taint that must be ignored
-    // A non-focused child: home_session is the backstage; tmux_session was tainted
-    // to a user session by a prior focus and never corrected. No focus row exists.
-    createNode(node('M', { home_session: back, tmux_session: tainted, window: '@7', pane: null }));
-    const res = reviveNode('M', { resume: false });
-    assert.equal(res.session, back, 'revive targets home_session, not the tainted user session');
-    assert.notEqual(res.session, tainted, 'NEVER the tainted tmux_session');
-    const m = getNode('M');
-    assert.equal(m.tmux_session, back, 'LOCATION repointed to the backstage (taint overwritten)');
-    assert.equal(m.window, null, 'no tmux present → openNodeWindow no-op, window null (decision still recorded)');
-    assert.equal(m.cycles, 1, 'a real (non-guard) revive bumped the cycle counter');
+        });
+        assert.equal(h.node(M).cycles ?? 0, 0, 'fabricated at cycle 0 (no revive yet)');
+        reviveNode(M, { resume: true });
+        assert.equal(h.node(M).cycles, 1, 'a real (non-guard) revive bumped the cycle counter to 1');
+    }
+    finally {
+        await h.dispose();
+    }
 });

package/dist/core/__tests__/subscription-delivery.test.js

@@ -1,18 +1,38 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/subscription-delivery.test.ts
 //
 // MULTI-LEVEL SUBSCRIPTION DELIVERY — the DELIVERY-vs-WAKE distinction across a
-// graph >=2 levels deep, driven through the FAITHFUL integration harness (real
-// CLI, real isolated tmux, real extension hooks in the fake-pi vehicle, real
-// daemon decision pass via superviseTick). Every assertion reads the canvas
+// graph >=2 levels deep. The whole split is pure canvas/feed/daemon model logic,
+// so this is driven by FABRICATING the topology + dormant states directly
+// (foundation-spec §E.2) and exercising the real model layer (feed.push,
+// evaluateStop, superviseTick) — NO real tmux session, NO pane chrome, and NO
+// real broker boot (which would cost ~5s each). Every assertion reads the canvas
 // data layer and is checked against the state-model ORACLE (§3b, §5, §6).
 //
-// This is the multi-level companion to the UNIT-level passive-subscription.test.ts
-// (which pins push→inbox vs push→passive.jsonl routing in-process). What that test
-// CANNOT show — and what is added here — is the runtime WAKE consequence of the
-// split when BOTH an active and a passive subscriber sit on the SAME target and
-// BOTH are DORMANT (terminal idle-released): the active one is daemon-REVIVED on
-// its unseen inbox entry; the passive one is NOT (its pointer lands in the passive
-// accumulator the daemon never reads), so it stays idle.
+// HEADLESS / FABRICATED RETARGET (foundation-spec §C.15 + §E). All nodes are
+// broker-hosted (paneless). Dormancy, which a tmux node shows as a closed pane,
+// a broker shows as an EXITED process (status=idle, intent=idle-release, pi_pid
+// dead) — fabricated directly. A daemon revive is observed via getNode().cycles
+// (reviveNode bumps cycles + transition('revive') BEFORE it spawns — revive.ts:
+// 114,145 — so the model effect is instant, no awaitBoot), never a real boot.
+//
+// (1) BUG LOCKED — the DELIVERY-vs-WAKE split (Invariant D + stop-guard): an
+//     ACTIVE subscriber's pointer lands in inbox.jsonl and the daemon's 2nd pass
+//     REVIVES it on that unseen entry; a PASSIVE subscriber's pointer lands in
+//     passive.jsonl and NEVER wakes; a PASSIVE-only tie does NOT legitimize an
+//     idle-release (hasActiveLiveSubscription filters active=1).
+// (2) WHY MODEL-LEVEL, NOT TMUX CHROME — routing (feed.ts), the active/passive
+//     edge filter (canvas.ts), the 2nd-pass inbox gate (crtrd.ts), and one-hop
+//     fan-out are all pure data-layer; the only thing a pane ever provided was a
+//     visible "dormant" signal, which a broker expresses as a dead pid — and
+//     which fabrication sets directly.
+// (3) HOW THE FABRICATED DRIVE STILL FAILS IF THE BUG REGRESSES — after T's
+//     pushFinal, one h.tick() must revive the ACTIVE subscriber B (cycles bumps,
+//     status→active) while the PASSIVE subscriber P stays idle with cycles==0. If
+//     inbox-vs-passive routing breaks, either B's entry never reaches its inbox
+//     (the 2nd-pass gate finds nothing → B not revived → cycles stays 0) or P
+//     gets an inbox entry and IS woken (its cycles/status asserts go RED).
+//     Verified by routing passive deliveries into the inbox (see bug-injection
+//     report).
 //
 // THE ORACLE CONTRACT under test:
 //   • feed.push fans to subscribersOf(target): active → inbox.jsonl (wakes),
@@ -30,24 +50,27 @@
 //            ├── T  (terminal)     B→T active seed  ── THE TARGET (level 2)
 //            ├── K  (terminal)     B→K active seed  ── keepalive (stays active)
 //            └── P  (terminal)     B→P active seed  ── PASSIVE subscriber of T
-//                  P→T passive  (wired via `crtr node subscribe --passive`)
-//                  P→K active   (wired — the ONLY tie that legitimizes P's release;
+//                  P→T passive  (wired via subscribe(P,T,false))
+//                  P→K active   (the ONLY tie that legitimizes P's release;
 //                                P→T passive is excluded from the stop-guard)
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { createHarness, hasTmux } from './helpers/harness.js';
+import { createHarness } from './helpers/harness.js';
 import { closeDb } from '../canvas/db.js';
+import { subscribe } from '../canvas/canvas.js';
+import { pushFinal, pushUpdate } from '../feed/feed.js';
 import { readPassive } from '../feed/passive.js';
-import { STALL_REPROMPT } from '../runtime/stop-guard.js';
-function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+import { evaluateStop, STALL_REPROMPT } from '../runtime/stop-guard.js';
+// A pid reaped (dead) by the time spawnSync returns — a released broker's exited
+// process (the headless analog of a closed pane).
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
 }
-// LOCAL helper (candidate for harness consolidation — see report): read a node's
-// PASSIVE accumulator (passive.jsonl) straight off the data layer, mirroring the
-// harness's own `inbox()` reader. closeDb() keeps it consistent with the harness's
-// cross-process WAL discipline (the push that wrote passive.jsonl ran in a `cli`
-// subprocess). The harness exposes inbox() but NOT passive() — this fills that gap.
+// LOCAL helper: read a node's PASSIVE accumulator (passive.jsonl) straight off
+// the data layer, mirroring the harness's own `inbox()` reader. The harness
+// exposes inbox() but NOT passive() — this fills that gap.
 function passive(nodeId) {
     closeDb();
     return readPassive(nodeId);
@@ -56,113 +79,77 @@ function passive(nodeId) {
 function edgeSet(arr) {
     return new Set(arr.map((e) => `${e.node_id}:${e.active ? 'active' : 'passive'}`));
 }
-test('multi-level subscription delivery: active subscriber WOKEN vs passive subscriber DELIVERED-not-woken, on the same dormant target', { skip: !hasTmux() ? 'tmux unavailable' : false, timeout: 180_000 }, async () => {
-    const h = await createHarness({ sessionPrefix: 'crtr-subdeliv' });
+test('multi-level subscription delivery: active subscriber WOKEN vs passive subscriber DELIVERED-not-woken, on the same dormant target', { timeout: 30_000 }, async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-subdeliv' });
     try {
         // ===================================================================
-        // S1 — Build the graph. A (resident root, virtual) ► B ► {T,K,P}.
-        //      Each spawn seeds an ACTIVE parent→child subscription (the spine).
-        // ===================================================================
-        const A = h.spawnRoot('front door');
-        const B = await h.spawnChild(A, 'mid manager', { kind: 'developer' });
-        const T = await h.spawnChild(B, 'the target worker');
-        const K = await h.spawnChild(B, 'a keepalive worker');
-        const P = await h.spawnChild(B, 'the passive observer');
-        // Spine seeds: A→B, B→T, B→K, B→P all ACTIVE. T's sole subscriber so far is B.
-        assert.deepEqual(edgeSet(h.subscribers(T)), new Set([`${B}:active`]), "T's only subscriber at birth is B (active spawn seed)");
-        assert.deepEqual(edgeSet(h.subscribers(B)), new Set([`${A}:active`]), 'A→B active seed');
-        // ===================================================================
-        // S2 — Wire the PASSIVE subscriber. P passively subscribes to T (the axis
-        //      under test), and ACTIVELY subscribes to K (the only tie that will
-        //      legitimize P's own idle-release — its passive tie to T does NOT count).
-        // ===================================================================
-        {
-            const passiveRes = h.cli(P, ['node', 'subscribe', T, '--passive']);
-            assert.equal(passiveRes.code, 0, `P→T passive subscribe exit 0\n${passiveRes.stderr}`);
-            assert.match(passiveRes.stdout, /\(passive\)/, 'P→T wired PASSIVE');
-            const activeRes = h.cli(P, ['node', 'subscribe', K]);
-            assert.equal(activeRes.code, 0, `P→K active subscribe exit 0\n${activeRes.stderr}`);
-            assert.match(activeRes.stdout, /\(active\)/, 'P→K wired ACTIVE');
-        }
-        // T now has BOTH an active (B) and a passive (P) subscriber — the crux.
+        // S1 — Build the graph by FABRICATION (no boots). A is a resident root
+        //      (inline, daemon-untouched); B/T/K/P/X are broker nodes whose
+        //      liveness fields are set directly. Each parent→child spine edge is
+        //      wired ACTIVE.
+        // ===================================================================
+        const A = h.spawnRoot('front door'); // resident root, active, no placement
+        // T (the target) and K (keepalive) are LIVE-active workers; B and P start
+        // already DORMANT (idle-released, broker exited = dead pid) — exactly the
+        // post-stop state the delivery split is judged against.
+        const T = h.fabricateBrokerNode({ status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-T' });
+        const K = h.fabricateBrokerNode({ status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-K' });
+        const B = h.fabricateBrokerNode({ status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: 'sess-B' });
+        const P = h.fabricateBrokerNode({ status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: 'sess-P' });
+        // Spine seeds: A→B, B→T, B→K, B→P all ACTIVE (subscriber, publisher).
+        subscribe(A, B, true);
+        subscribe(B, T, true);
+        subscribe(B, K, true);
+        subscribe(B, P, true);
+        // PASSIVE axis under test: P passively subscribes to T; P actively to K
+        // (the only tie that legitimizes P's own idle-release).
+        subscribe(P, T, false);
+        subscribe(P, K, true);
         assert.deepEqual(edgeSet(h.subscribers(T)), new Set([`${B}:active`, `${P}:passive`]), 'T has B(active) + P(passive) as subscribers — the same-target split');
+        assert.deepEqual(edgeSet(h.subscribers(B)), new Set([`${A}:active`]), 'A→B active seed');
         assert.deepEqual(edgeSet(h.subscriptions(P)), new Set([`${T}:passive`, `${K}:active`]), 'P subscribes_to T(passive) + K(active)');
         // ===================================================================
-        // S2b — PASSIVE-EXCLUSION, demonstrated directly (the stop-guard half of
-        //       the active/passive split). X subscribes PASSIVE-ONLY to the very
-        //       same live K that P subscribes to ACTIVELY. On stop, X holds NO
-        //       active live subscription — hasActiveLiveSubscription filters
-        //       active=1 (canvas.ts), so the passive K-tie is invisible to it →
-        //       the stop-guard returns 'stalled', NOT 'awaiting': X is re-prompted
-        //       (STALL_REPROMPT) and stays ACTIVE; it does NOT idle-release. Same
-        //       publisher K, opposite outcome purely by edge mode — ACTIVE holds a
-        //       node alive to await, PASSIVE does not (oracle §3b, §5). This is the
-        //       discriminating negative the rest of the test relies on.
+        // S2 — PASSIVE-EXCLUSION via the PURE stop-guard (the active/passive split
+        //      half). evaluateStop is pure given the canvas; X holds a PASSIVE-only
+        //      tie to the same live K that P holds ACTIVELY. hasActiveLiveSubscription
+        //      filters active=1 (canvas.ts), so X's passive K-tie is invisible →
+        //      'stalled' (STALL_REPROMPT); P's active K-tie → 'awaiting'. Same
+        //      publisher K, opposite outcome purely by edge mode (oracle §3b, §5).
         // ===================================================================
-        const X = await h.spawnChild(B, 'a passive-only observer');
-        {
-            const res = h.cli(X, ['node', 'subscribe', K, '--passive']);
-            assert.equal(res.code, 0, `X→K passive subscribe exit 0\n${res.stderr}`);
-            assert.match(res.stdout, /\(passive\)/, 'X→K wired PASSIVE-only (its ONLY subscription)');
-        }
+        const X = h.fabricateBrokerNode({ status: 'active' });
+        subscribe(X, K, false); // X→K PASSIVE-only — its ONLY subscription
         assert.deepEqual(edgeSet(h.subscriptions(X)), new Set([`${K}:passive`]), 'X holds exactly one tie: K(passive) — no active live subscription');
-        const injBeforeStall = h.injected(X).length;
-        await h.stop(X);
-        // The PASSIVE tie does NOT legitimize a release → 'stalled' → re-prompt.
-        await h.waitFor(() => h.injected(X).slice(injBeforeStall).find((e) => e.content.includes(STALL_REPROMPT)), { timeoutMs: 15_000, label: 'X (passive-only) → STALL_REPROMPT, not awaiting' });
-        assert.equal(h.status(X), 'active', 'X stays ACTIVE — a PASSIVE-only tie does NOT hold it as awaiting');
-        assert.equal(h.node(X).intent ?? null, null, 'X intent untouched — it did NOT idle-release');
-        // ===================================================================
-        // S3 — P goes DORMANT. P stops while holding an ACTIVE live sub to K →
-        //      stop-guard 'awaiting' → idle-release. (Its PASSIVE sub to T is
-        //      EXCLUDED from hasActiveLiveSubscription — proven directly by S2b:
-        //      a passive-only tie stalls; only the ACTIVE K-tie releases P here.)
-        // ===================================================================
-        await h.stop(P);
-        await h.waitForStatus(P, 'idle');
-        {
-            const p = h.node(P);
-            assert.equal(p.status, 'idle', 'P idle (released on the strength of its ACTIVE K-sub)');
-            assert.equal(p.intent, 'idle-release', 'P intent=idle-release');
-        }
-        await h.waitForPaneGone(P);
-        assert.equal(h.paneAlive(P), false, 'P unfocused → pane closed on idle-release (dormant)');
-        // ===================================================================
-        // S4 — B (the ACTIVE subscriber of T) goes DORMANT too. B awaits T,K
-        //      (active) and P (now idle) → 'awaiting' → idle-release, pane closes.
-        //      Now BOTH subscribers of T are dormant — one active, one passive.
-        // ===================================================================
-        await h.stop(B);
-        await h.waitForStatus(B, 'idle');
         {
-            const b = h.node(B);
-            assert.equal(b.status, 'idle', 'B idle (released, awaiting its live children)');
-            assert.equal(b.intent, 'idle-release', 'B intent=idle-release');
+            const xStop = evaluateStop(X, { pushedFinal: false, askedHuman: false });
+            assert.equal(xStop.action, 'reprompt', 'X (passive-only) → reprompt, NOT awaiting');
+            assert.equal(xStop.reason, 'stalled', 'X classified stalled — passive tie does not hold it');
+            assert.equal(xStop.message, STALL_REPROMPT, 'X gets the stall re-prompt');
+            const pStop = evaluateStop(P, { pushedFinal: false, askedHuman: false });
+            assert.equal(pStop.action, 'allow', 'P (active K-tie) → allow');
+            assert.equal(pStop.reason, 'awaiting', 'P classified awaiting on its ACTIVE K-sub — the discriminating positive');
         }
-        await h.waitForPaneGone(B);
-        assert.equal(h.paneAlive(B), false, 'B unfocused → pane closed on idle-release');
-        // Pre-push baseline: the keepalive is up, the grandparent is untouched.
-        assert.equal(h.status(K), 'active', 'K still active (keepalive holds P legitimately dormant)');
+        // Pre-push baseline: keepalive up, grandparent untouched, nothing delivered.
+        assert.equal(h.status(K), 'active', 'K active (keepalive holds P legitimately dormant)');
         assert.equal(h.status(A), 'active', 'A (resident root) untouched');
         assert.equal(h.inbox(A).length, 0, 'A inbox empty before the push');
-        assert.equal(h.inbox(B).length, 0, 'B inbox empty before the push (nothing delivered yet)');
+        assert.equal(h.inbox(B).length, 0, 'B inbox empty before the push');
         assert.equal(passive(P).length, 0, 'P passive accumulator empty before the push');
+        assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
+        assert.equal(h.node(P).cycles ?? 0, 0, 'P not yet revived');
         // ===================================================================
-        // S5 — T FINISHES (push final). feed.push fans the pointer to
-        //      subscribersOf(T) = {B(active), P(passive)} ONLY, by the delivery
-        //      split: B's lands in inbox.jsonl, P's in passive.jsonl. A (the
-        //      grandparent, NOT a subscriber of T) gets NOTHING — one-hop fan-out.
+        // S3 — T FINISHES via the model layer (pushFinal). feed.push fans the
+        //      pointer to subscribersOf(T) = {B(active), P(passive)} ONLY, by the
+        //      delivery split: B's lands in inbox.jsonl, P's in passive.jsonl. A
+        //      (the grandparent, NOT a subscriber of T) gets NOTHING — one-hop.
         // ===================================================================
         const TARGET_FINAL = 'TARGET-FINAL-BODY: the worker completed';
-        await h.finish(T, TARGET_FINAL);
+        await pushFinal(T, TARGET_FINAL);
+        closeDb();
         {
-            const t = h.node(T);
-            assert.equal(t.status, 'done', 'T done after push final');
-            assert.equal(t.intent, 'done', 'T intent=done');
-            assert.equal(h.paneAlive(T), false, 'T pane closed on done');
+            assert.equal(h.status(T), 'done', 'T done after pushFinal (transition finalize)');
+            assert.equal(h.node(T).intent, 'done', 'T intent=done');
             // ACTIVE delivery → B's INBOX (the wake channel).
-            const bInbox = h.inbox(B);
-            const bFinal = bInbox.find((e) => e.from === T && e.kind === 'final');
+            const bFinal = h.inbox(B).find((e) => e.from === T && e.kind === 'final');
             assert.ok(bFinal, 'ACTIVE subscriber B: T-final pointer DELIVERED to inbox.jsonl');
             // PASSIVE delivery → P's ACCUMULATOR, NOT its inbox (no wake channel).
             const pPassive = passive(P);
@@ -175,46 +162,39 @@ test('multi-level subscription delivery: active subscriber WOKEN vs passive subs
             assert.equal(h.inbox(K).length, 0, 'K (sibling, not a subscriber of T) NOT delivered');
         }
         // ===================================================================
-        // S6 — The DAEMON decision pass. Its 2nd pass revives an idle-released
-        //      node ONLY on an unseen INBOX entry. B has one (active) → REVIVED
-        //      (resume). P has none (its entry went to passive.jsonl) → stays idle.
-        //      This is the WAKE half of delivery-vs-wake, decided in ONE tick.
+        // S4 — The DAEMON decision pass. Its 2nd pass revives an idle-released node
+        //      ONLY on an unseen INBOX entry. B has one (active) → REVIVED. P has
+        //      none (its entry went to passive.jsonl) → stays idle. The WAKE half
+        //      of delivery-vs-wake, decided in ONE tick — observed via cycles.
         // ===================================================================
-        const injBeforeWake = h.injected(B).length;
         await h.tick();
-        // ACTIVE subscriber: WOKEN — status flips to active and a fresh pi resumes.
-        await h.waitForStatus(B, 'active');
+        // ACTIVE subscriber: WOKEN — reviveNode bumped cycles + transition(revive).
         {
             const b = h.node(B);
-            assert.equal(b.status, 'active', 'ACTIVE subscriber B: daemon-REVIVED → active');
-            assert.equal(b.intent ?? null, null, "B intent cleared by revive");
+            assert.equal(b.cycles ?? 0, 1, 'ACTIVE subscriber B: daemon pass-2 REVIVED (cycles bumped to 1)');
+            assert.equal(b.status, 'active', 'B revive → active');
+            assert.equal(b.intent ?? null, null, 'B intent cleared by revive');
+        }
+        // PASSIVE subscriber: NOT WOKEN — the same tick did NOT revive P.
+        {
+            const p = h.node(P);
+            assert.equal(p.cycles ?? 0, 0, 'PASSIVE subscriber P: NOT revived (cycles still 0)');
+            assert.equal(p.status, 'idle', 'P STILL idle — daemon did NOT wake it');
+            assert.equal(p.intent, 'idle-release', 'P still intent=idle-release (untouched)');
         }
-        await h.awaitBoot(B, { minCount: 2 }); // spawn boot + resume boot
-        // awaitWake THROWS on a 15s timeout unless an injected entry matching T's
-        // body arrives — that match-or-timeout IS the load-bearing oracle here. The
-        // resume-boot injects persona/bearings, never the report body, so only the
-        // real inbox-watcher delivery of T's final can satisfy the match.
-        await h.awaitWake(B, { sinceCount: injBeforeWake, match: /TARGET-FINAL-BODY/ });
-        // PASSIVE subscriber: NOT WOKEN — the synchronous tick that revived B did
-        // NOT revive P; P remains idle-released with its pane gone. (The tick's
-        // loop completed before tick() returned, so P's non-revive is settled.)
-        assert.equal(h.status(P), 'idle', 'PASSIVE subscriber P: STILL idle — daemon did NOT wake it');
-        assert.equal(h.node(P).intent, 'idle-release', 'P still intent=idle-release (untouched)');
-        assert.equal(h.paneAlive(P), false, 'P pane STILL gone — no resume happened');
         assert.equal(passive(P).length, 1, "P's passive entry is still pending (drained only on its next message)");
         assert.equal(h.inbox(P).length, 0, "P's inbox still empty");
         // The grandparent is STILL untouched even though B woke — one-hop confirmed.
         assert.equal(h.inbox(A).length, 0, 'A inbox STILL empty after B woke — wake did not propagate up');
         assert.equal(h.status(A), 'active', 'A unchanged');
         // ===================================================================
-        // S7 — SECOND SITE: one-hop fan-out on a re-push. The indirect ancestor A
+        // S5 — SECOND SITE: one-hop fan-out on a re-push. The indirect ancestor A
         //      hears B ONLY when B explicitly re-pushes up its own spine. B (now
         //      active) pushes an UPDATE → it fans to subscribersOf(B) = {A} only.
-        //      This corroborates the flagship one-hop finding at an independent site.
         // ===================================================================
+        await pushUpdate(B, 'B re-pushing the rolled-up result');
+        closeDb();
         {
-            const res = h.cli(B, ['push', 'update', 'B re-pushing the rolled-up result']);
-            assert.equal(res.code, 0, `B push update exit 0\n${res.stderr}`);
             const aInbox = h.inbox(A);
             assert.equal(aInbox.length, 1, "A inbox now has exactly B's update (one hop, on B's explicit re-push)");
             assert.equal(aInbox[0].from, B, "A's entry is from B");
@@ -226,8 +206,6 @@ test('multi-level subscription delivery: active subscriber WOKEN vs passive subs
         assert.equal(passive(P).length, 1, "P's passive backlog unchanged by B's re-push");
     }
     finally {
-        const session = h.session;
         await h.dispose();
-        assert.equal(sessionExists(session), false, 'isolated session killed — no stray');
     }
 });