@crouton-kit/crouter 0.3.28 → 0.3.30

package/dist/core/__tests__/child-death-wake.test.js

@@ -1,46 +1,26 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/child-death-wake.test.ts
 //
-// HEADLESS RETARGET (foundation-spec §C.7 + §E). D-1 BUG REGRESSION — "the
-// runtime wakes a dormant parent on EVERY terminal child outcome, and ONLY on a
-// genuine one." Drives the REAL daemon decision pass (superviseTick) + the REAL
-// closeNode against canvas rows fabricated DIRECTLY in an isolated home — NO real
-// tmux session, NO remain-on-exit pane, NO broker boot.
+// DOCTRINE WAKE — "a parent that delegated and went dormant is still woken when
+// its child reaches a genuine terminal outcome, and is NEVER spuriously woken on
+// healthy dormancy." Drives the REAL daemon decision pass (superviseTick) + the
+// REAL closeNode against canvas rows fabricated DIRECTLY in an isolated home — NO
+// real tmux session, NO broker boot.
 //
-// (1) BUG LOCKED — the D-1 finding (context/d1-finding.md): a parent that
-//     delegated and then JUST STOPPED (inbox-wait retained, no self-wake armed)
-//     was woken ONLY when a child `push final`d or never booted. A child that
-//     CRASHED after booting, was daemon-FINALIZED on a quiet turn, or was `node
-//     close`d marked the child dead/done/canceled with NO push to the parent — so
-//     a purely-inbox-waiting parent hung dormant forever. The fix fans a system
-//     inbox entry to subscribersOf(child) on those three previously-silent
-//     terminal outcomes (surfaceChildDeath crash/finalize + close.ts), mirroring
-//     surfaceBootFailure. THE CRUX: it must fire ONLY on genuine death — NEVER on
-//     healthy dormancy (a child that ended its turn still awaiting a LIVE
-//     grandchild, or holding a pending self-wake, is alive-and-dormant; waking its
-//     parent then re-creates the spurious-wake storm the doctrine exists to kill).
-//
-// (2) WHY MODEL-LEVEL, NOT TMUX CHROME — the wake travels through ONE pure
-//     data-layer channel the d1-finding identified: a system entry appended to
-//     the parent's inbox.jsonl (push() → appendInbox, no tmux). The death-vs-
-//     dormancy boundary is pure daemon logic — finishedTurn (isBusy) +
-//     hasActiveLiveSubscription || hasPendingSelfWake, the SAME boundary the
-//     stop-guard draws (crtrd.ts). The daemon reaches the pane-gone routing for
-//     ANY node whose pane is not alive; a row carrying a bogus pane id reads
-//     "gone" (paneExists echoes empty for an unknown/absent pane — and with no
-//     tmux server at all, the probe simply fails to false) with NO live session
-//     to stand up. So the exact "booted child, pane gone, branch on what it was
-//     doing" state reproduces with no real pane, and the parent stays an inline
-//     node (no placement → the supervise loop's inline-root carve-out skips it),
-//     so nothing in the test opens or needs a window.
-//
-// (3) HOW THE FABRICATED DRIVE STILL FAILS IF THE BUG REGRESSES — each direction
-//     asserts the inbox channel: a genuine terminal outcome (crash/finalize/close)
-//     MUST land a system entry from the child in the parent's inbox; healthy
-//     dormancy MUST leave it empty. Drop the crash-branch surfaceChildDeath call
-//     and the CRASH assertion goes RED (no entry); drop the stillWaiting guard and
-//     a healthy-dormant child finalizes → the CRUX asserts go RED (a spurious
-//     entry appears). Verified by reverting the crash-branch surfaceChildDeath
-//     call (see bug-injection report).
+// BROKER CUT (this worktree): the daemon's OLD parent-wake mechanism is GONE.
+// U7 deleted surfaceChildDeath and the entire pane-gone reaping block (the
+// crash/finalize/release routing that used to mark a pane-gone child dead/done/
+// idle and fan a system inbox entry to its subscribers). Liveness is now PID-ONLY
+// — a viewer pane/window closing is NOT a node death — so a booted child whose
+// engine pid is dead is REVIVED on its saved session, not surfaced as dead. The
+// doctrine wake therefore RELOCATED off the daemon:
+//   • child finishes → `crtr push final` wakes subscribers via the PUSH itself;
+//   • child crashes → daemon grace-REVIVES it (it comes back and pushes later);
+//   • child never boots → surfaceBootFailure still pushes urgent (daemon-boot.test);
+//   • child `node close`d → close.ts fans the child-closed wake (tested below).
+// So the daemon now fans NO liveness wake at all, which makes the old CRUX
+// (healthy dormancy must not wake the parent) hold by construction. This file
+// locks in (a) the new pid-only non-reaping + no-daemon-wake contract, and (b)
+// the one genuine-terminal wake that still lives in core: close.ts.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
@@ -48,10 +28,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { armWake } from '../canvas/wakeups.js';
 import { closeDb } from '../canvas/db.js';
 import { readInboxSince } from '../feed/inbox.js';
-import { markBusy, clearBusy } from '../runtime/busy.js';
 import { closeNode } from '../runtime/close.js';
 import { superviseTick } from '../../daemon/crtrd.js';
 let home;
@@ -73,16 +51,14 @@ function deadPid() {
     const r = spawnSync('true', [], { stdio: 'ignore' });
     return r.pid ?? 0x7ffffffe;
 }
-// A pane id no tmux server knows: paneExists echoes empty for it → isNodePaneAlive
-// is false → the supervise loop routes the row down its pane-gone branch with NO
-// live session required (and with no server at all the probe fails to false too).
+// A pane id no tmux server knows. In the broker cut the daemon IGNORES pane state
+// entirely (liveness is pid-only) — this just stands in for "the node once had a
+// viewer pane that is now gone," which must NOT count as a death.
 const GONE_PANE = '%999999';
-/** A booted child whose pane is GONE — the daemon's pane-gone routing input.
- *  `intent:null` so it takes the user-close branch (neither refresh nor
- *  idle-release); pi dead so the zombie-kill is skipped; pi_session_id set so it
- *  is "booted" (not the never-booted boot-failure leg). The caller layers on the
- *  busy marker / subscriptions that decide crash vs finalize vs release. */
-function paneGoneChild(id, over = {}) {
+/** A booted child whose engine pid is DEAD and whose viewer pane is gone — the
+ *  shape a crashed/finished child leaves behind. `pi_session_id` set so it is
+ *  "booted"; `intent:null` so it takes the crash (grace-revive RESUME) branch. */
+function deadEngineChild(id, over = {}) {
     createNode(node(id, {
         pane: GONE_PANE,
         tmux_session: 'crtr-cdw',
@@ -94,9 +70,8 @@ function paneGoneChild(id, over = {}) {
         ...over,
     }));
 }
-/** A dormant inbox-waiting PARENT — an INLINE node (no tmux placement), so the
- *  supervise loop's inline-root carve-out skips it entirely: it is only the wake
- *  TARGET, asserted via its inbox. */
+/** A dormant inbox-waiting PARENT — only ever the wake TARGET, asserted via its
+ *  inbox. */
 function inboxWaitingParent(id) {
     createNode(node(id, { status: 'active' }));
 }
@@ -115,32 +90,27 @@ after(() => {
     delete process.env['CRTR_HOME'];
 });
 // ===========================================================================
-// POSITIVE — a genuine terminal child outcome WAKES the inbox-waiting parent.
+// BROKER CUT — pid-only liveness REPLACES daemon pane-gone reaping. A booted
+// child whose engine pid is dead (and whose viewer pane is gone) is REVIVABLE,
+// not reaped, and the daemon fans NO wake to the dormant parent. This single
+// case subsumes the four deleted scenarios (crash / quiet-finalize / awaiting a
+// live grandchild / pending self-wake): with pane state ignored and
+// surfaceChildDeath gone, the daemon treats them all identically — grace-revive,
+// no liveness wake — so the old CRUX (no spurious wake on healthy dormancy)
+// holds by construction.
 // ===========================================================================
-test('CRASH after boot (mid-generation, pane gone) wakes the inbox-waiting parent', async () => {
+test('pid-only liveness: a dead-engine booted child is revivable, NOT reaped, and the daemon fans NO wake to its dormant parent', async () => {
     inboxWaitingParent('PARENT');
-    paneGoneChild('CHILD');
+    deadEngineChild('CHILD');
     subscribe('PARENT', 'CHILD', true); // the spawn-time spine edge
-    markBusy('CHILD'); // pane died INSIDE a turn → genuine mid-run crash
-    await superviseTick();
-    assert.equal(getNode('CHILD').status, 'dead', 'CHILD crashed → dead');
-    // THE WAKE CHANNEL: a system entry from CHILD lands in PARENT's inbox.
-    const wake = wakeFromChild('PARENT', 'CHILD');
-    assert.ok(wake, 'crash fanned a system inbox entry to the dormant parent (mirrors surfaceBootFailure)');
-    assert.match(wake.label, /died/i, 'the entry tells the parent WHICH child died and how');
-    clearBusy('CHILD');
-});
-test('quiet-turn FINALIZE (pane gone, nothing live to wait for) wakes the inbox-waiting parent', async () => {
-    inboxWaitingParent('PARENT');
-    // Booted, turn finished (NO busy marker), no live subscription, no pending
-    // self-wake → the daemon finalizes it (done): a dismissal of a finished node.
-    paneGoneChild('CHILD');
-    subscribe('PARENT', 'CHILD', true);
     await superviseTick();
-    assert.equal(getNode('CHILD').status, 'done', 'CHILD finalized → done');
-    const wake = wakeFromChild('PARENT', 'CHILD');
-    assert.ok(wake, 'finalize fanned a system inbox entry to the dormant parent');
-    assert.match(wake.label, /without a final report/i, 'the entry tells the parent the child ended with no final');
+    // A dead engine pid is REVIVABLE (grace-revive RESUME on the saved session),
+    // not reaped to dead/done/idle — a viewer pane closing is not a node death.
+    assert.equal(getNode('CHILD').status, 'active', 'CHILD stays revivable, NOT reaped');
+    // surfaceChildDeath is deleted: the daemon raises no liveness wake. The
+    // doctrine wake now rides the child's own `push final` (or close.ts), so a
+    // purely-inbox-waiting parent is never spuriously woken on dormancy/crash.
+    assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — no daemon liveness wake');
 });
 test('node close of a child wakes its SURVIVING manager (the parent outside the closing set)', async () => {
     inboxWaitingParent('PARENT');
@@ -156,38 +126,13 @@ test('node close of a child wakes its SURVIVING manager (the parent outside the
     assert.ok(wake, 'node close fanned a child-closed entry to the surviving manager (D-1: previously none)');
     assert.match(wake.label, /closed/i, 'the entry names the closed child');
 });
-// ===========================================================================
-// NEGATIVE — HEALTHY DORMANCY must NOT wake the parent (the correctness crux).
-// ===========================================================================
-test('CRUX: a child dormant while awaiting its OWN live grandchild does NOT wake the parent', async () => {
-    inboxWaitingParent('PARENT');
-    // CHILD finished its turn (no busy) and its pane is gone, BUT it actively
-    // subscribes to a LIVE grandchild — exactly the developer-spawned-reviewer
-    // case. This is HEALTHY dormancy, not death.
-    paneGoneChild('CHILD');
-    createNode(node('GRANDCHILD', { status: 'active', pi_session_id: 'booted' })); // live, inline
-    subscribe('PARENT', 'CHILD', true);
-    subscribe('CHILD', 'GRANDCHILD', true); // CHILD awaits a LIVE grandchild
-    await superviseTick();
-    // CHILD is RELEASED (revivable), NOT finalized — the daemon must not orphan
-    // its in-flight grandchild and must not wake the parent.
-    assert.equal(getNode('CHILD').status, 'idle', 'CHILD released (revivable), NOT finalized');
-    assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release');
-    assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — healthy dormancy raises no wake');
-});
-test('CRUX: a child dormant on a pending self-wake (no live sub) does NOT wake the parent', async () => {
-    inboxWaitingParent('PARENT');
-    paneGoneChild('CHILD');
-    subscribe('PARENT', 'CHILD', true);
-    // CHILD has NO live subscription, but holds a pending self-wake (far-future so
-    // the wakeups pass never fires it this tick). hasPendingSelfWake(CHILD) ⇒ the
-    // daemon treats it as STILL WAITING (the stop-guard's boundary), so it RELEASES
-    // instead of finalizing. NON-VACUOUS: drop the hasPendingSelfWake guard and
-    // CHILD finalizes → PARENT is spuriously woken.
-    const future = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString();
-    armWake({ wakeup_id: 'wk-cdw-child', node_id: 'CHILD', owner_id: 'CHILD', fire_at: future, kind: 'bare' });
-    await superviseTick();
-    assert.equal(getNode('CHILD').status, 'idle', 'CHILD with a pending self-wake is RELEASED, not finalized');
-    assert.equal(getNode('CHILD').intent, 'idle-release', 'CHILD routed to idle-release (its clock will wake it)');
-    assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — a pending clock is healthy dormancy');
-});
+// NOTE (broker cut): the two NEGATIVE "CRUX" tests that used to live here — a
+// child dormant while awaiting a live grandchild, and a child dormant on a
+// pending self-wake — asserted the daemon's pane-gone routing chose idle-release
+// (status 'idle', intent 'idle-release') over finalize, so it would not spuriously
+// wake the parent. U7 DELETED that routing entirely: pane state is ignored, the
+// daemon never finalizes/releases on liveness, and surfaceChildDeath is gone, so
+// the daemon raises no liveness wake at all. The no-spurious-wake invariant they
+// protected now holds by construction and is covered by the pid-only test above
+// (PARENT inbox stays empty). Removed rather than adapted because the
+// idle-release-vs-finalize distinction they asserted no longer exists.

package/dist/core/__tests__/close.test.js

@@ -4,7 +4,6 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { openFocusRow, getFocusByNode } from '../canvas/focuses.js';
 import { closeDb } from '../canvas/db.js';
 import { closeNode } from '../runtime/close.js';
 import { readInboxSince } from '../feed/inbox.js';
@@ -44,7 +43,7 @@ test('closes the root and its exclusive descendants; spares a shared node', () =
     // N ─▶ A ─▶ C        (A, C exclusive to the N subtree)
     // N ─▶ B ◀─ M        (B also subscribed to by external manager M)
     for (const id of ['N', 'A', 'B', 'C', 'M'])
-        createNode(node(id, { pane: `%${id.toLowerCase()}` }));
+        createNode(node(id));
     spawnEdge('N', 'A');
     spawnEdge('N', 'B');
     spawnEdge('A', 'C');
@@ -52,17 +51,15 @@ test('closes the root and its exclusive descendants; spares a shared node', () =
     const res = closeNode('N');
     assert.deepEqual([...res.closed].sort(), ['A', 'C', 'N']);
     assert.deepEqual(res.spared, ['B']);
-    // Closed nodes → canceled, intent cleared, presence (incl. the pane) dropped.
+    // Closed nodes → canceled + intent cleared. (Broker-host cut: nodes carry NO
+    // engine pane/window/session — the viewer lives in the focuses table and is
+    // torn down asynchronously when the broker socket drops, so close no longer
+    // nulls a meta `pane`; viewer teardown is covered in the full-tier broker
+    // lifecycle suite.)
     for (const id of ['N', 'A', 'C']) {
         const m = getNode(id);
         assert.equal(m.status, 'canceled', `${id} canceled`);
         assert.equal(m.intent, null, `${id} intent cleared`);
-        assert.equal(m.window ?? null, null, `${id} window cleared`);
-        assert.equal(m.tmux_session ?? null, null, `${id} session cleared`);
-        // Step 7: tearDownNode is pane-keyed and nulls the durable pane handle too.
-        // Non-vacuous: each node was given a pane (`%n`/`%a`/`%c`) above, so an impl
-        // that didn't route close through tearDownNode would leave it set.
-        assert.equal(m.pane ?? null, null, `${id} pane cleared`);
     }
     // Spared node and the unrelated manager are untouched.
     assert.equal(getNode('B').status, 'active');
@@ -135,14 +132,11 @@ test('closing a leaf node closes only itself', () => {
 test('throws on an unknown node', () => {
     assert.throws(() => closeNode('ghost'), /unknown node/);
 });
-test('Step 7: closing a FOCUSED node closes its focus row + nulls its pane (tearDownNode)', () => {
-    createNode(node('N', { pane: '%x' }));
-    openFocusRow('fN', '%x', 'Sa', 'N');
-    closeNode('N');
-    // tearDownNode closes the focus row the node occupied and nulls its LOCATION.
-    // Non-vacuous: pre-Step-7 close used closeWindow and never touched the focuses
-    // table, so getFocusByNode('N') would still return fN.
-    assert.equal(getFocusByNode('N'), null, 'focus row closed by tearDownNode');
-    assert.equal(getNode('N').pane ?? null, null, 'pane nulled (pane-keyed teardown)');
-    assert.equal(getNode('N').status, 'canceled', 'node canceled as before');
-});
+// NOTE (broker-host cut): the former "Step 7: closing a FOCUSED node closes its
+// focus row + nulls its pane (tearDownNode)" test was DELETED. close.ts no longer
+// routes through the synchronous tearDownNode — it sends the broker `shutdown`
+// frame (headlessBrokerHost.teardown) and the viewer pane/focus row close on
+// their own when the broker socket drops (GC'd by the daemon + focusOf prune).
+// That async viewer teardown is covered by the full-tier broker-crash-teardown /
+// broker-lifecycle suite, which runs a real broker; it cannot be unit-tested
+// without one.

package/dist/core/__tests__/context-intro.test.js

@@ -1,6 +1,6 @@
 // Tests for the <crtr-context> bearings preamble:
-//   1. Worker and orchestrator bearings carry the `<references>` block
-//      (substrate reference docs + node-local docs as a file tree).
+//   1. Worker and orchestrator bearings carry the `<knowledge>` block
+//      (substrate knowledge docs + node-local docs as a file tree).
 //      Orchestrators add the across-cycles framing; promotion delivers that
 //      same orchestrator context-dir framing to a node that spawned base.
 //   2. canvas-context-intro injects the block as its own session message at
@@ -34,27 +34,27 @@ after(() => {
     delete process.env['CRTR_HOME'];
     delete process.env['CRTR_NODE_ID'];
 });
-test('worker bearings: base framing + <references> block, NO across-cycles framing', () => {
+test('worker bearings: base framing + <knowledge> block, NO across-cycles framing', () => {
     // Bug-regression: review finding M1 — buildContextBearings renders the
-    // <references> block (renderReferencesBlock): a kind-wrapped file tree of
-    // reference docs. This test locks in that contract.
+    // <knowledge> block (renderKnowledgeBlock): a kind-wrapped file tree of
+    // knowledge docs. This test locks in that contract.
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
-    // Seed a node-local substrate doc so the ## References block is non-empty.
+    // Seed a node-local substrate doc so the knowledge block is non-empty.
     const dir = memoryDir(meta.node_id);
     mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, 'test-ref.md'), '---\nkind: reference\nwhen-and-why-to-read: When testing, this reference should be read because it is a regression fixture\nsystem-prompt-visibility: preview\n---\nTest body.\n');
+    writeFileSync(join(dir, 'test-ref.md'), '---\nkind: knowledge\nwhen-and-why-to-read: When testing, this reference should be read because it is a regression fixture\nsystem-prompt-visibility: preview\n---\nTest body.\n');
     const block = buildContextIntro(meta.node_id);
     assert.match(block, new RegExp(`<crtr-context dir="${contextDir(meta.node_id)}">`));
     assert.match(block, /shared document store, not a task tracker/, 'base = shared docs, not tasks');
-    // Reference content renders ONLY as the <references> file-tree block.
+    // Knowledge content renders ONLY as the <knowledge> file-tree block.
     assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
     // Per-store stanza headers (label · dir) never appear.
     assert.doesNotMatch(block, /user-global · /, 'no user-global label·dir stanza');
     assert.doesNotMatch(block, /node-local · /, 'no node-local label·dir stanza');
     // No (empty) placeholder marker.
     assert.doesNotMatch(block, /\(empty\)/, 'no (empty) placeholder');
-    assert.match(block, /<references>/, '<references> block present');
-    assert.match(block, /\nreferences\n/, 'tree headed by the `references` root label');
+    assert.match(block, /<knowledge>/, '<knowledge> block present');
+    assert.match(block, /\nknowledge\n/, 'tree headed by the `knowledge` root label');
     // The node-local preview-rung doc renders as a tree entry with a `# read when:`
     // routing line (verbatim previewLine output).
     assert.match(block, /test-ref {2}# read when: When testing, this reference should be read because it is a regression fixture\./, 'node-local preview doc renders its routing line');
@@ -62,8 +62,8 @@ test('worker bearings: base framing + <references> block, NO across-cycles frami
     assert.doesNotMatch(block, /refresh cycles/, 'no across-cycles framing for a terminal worker');
     assert.match(block, /<\/crtr-context>/);
 });
-test('orchestrator bearings: across-cycles framing + node-local substrate docs ride into <references>; a non-substrate .md file is never inlined', () => {
-    // Bug-regression: review finding M1 — buildContextBearings renders <references>.
+test('orchestrator bearings: across-cycles framing + node-local substrate docs ride into <knowledge>; a non-substrate .md file is never inlined', () => {
+    // Bug-regression: review finding M1 — buildContextBearings renders <knowledge>.
     // Node-local substrate docs render as tree entries at their rung; a
     // non-substrate .md file (no frontmatter `kind`) never surfaces.
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
@@ -73,13 +73,13 @@ test('orchestrator bearings: across-cycles framing + node-local substrate docs r
     // Write a non-substrate MEMORY.md file to verify it is never surfaced in the block.
     const legacyIndexPath = join(dir, 'MEMORY.md');
     writeFileSync(legacyIndexPath, '# memory index — one pointer line per memory; how-to in "Your long-term memory".\n\n- [Flaky build](flaky-build.md) — first run fails\n');
-    // A node-local substrate doc DOES ride into ## References at its rung.
-    writeFileSync(join(dir, 'flaky-build.md'), '---\nkind: reference\nwhen-and-why-to-read: When the build flakes, this reference should be read because the first run fails\nsystem-prompt-visibility: preview\n---\nFirst run always fails; rerun once.\n');
+    // A node-local substrate doc DOES ride into the knowledge block at its rung.
+    writeFileSync(join(dir, 'flaky-build.md'), '---\nkind: knowledge\nwhen-and-why-to-read: When the build flakes, this reference should be read because the first run fails\nsystem-prompt-visibility: preview\n---\nFirst run always fails; rerun once.\n');
     const block = buildContextIntro(meta.node_id);
     assert.match(block, /shared document store, not a task tracker/, 'still carries the base framing');
     assert.match(block, /refresh cycles/, 'orchestrator gets the across-cycles framing');
     assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
-    assert.match(block, /<references>/, 'references block present');
+    assert.match(block, /<knowledge>/, 'knowledge block present');
     assert.match(block, /flaky-build {2}# read when: When the build flakes, this reference should be read because the first run fails\./, 'node-local doc renders as a tree entry with its routing line');
     // The non-substrate file never renders: no header line, no pointer line, no path.
     assert.ok(!block.includes('# memory index'), 'the index header comment is NOT inlined');
@@ -89,16 +89,16 @@ test('orchestrator bearings: across-cycles framing + node-local substrate docs r
     assert.match(block, /<\/crtr-context>/);
 });
 test('orchestrator bearings: no per-store stanzas or (empty) markers; a rung-none node-local doc still surfaces as a bare-name tree entry', () => {
-    // Bug-regression: review findings M1 + M6 — the <references> block carries no
+    // Bug-regression: review findings M1 + M6 — the <knowledge> block carries no
     // per-store `label · dir` stanzas or (empty) markers, and node-local docs are
-    // NOT filtered on rung: a migrated node-local reference defaults
-    // system-prompt-visibility: none and must still ride into <references> as
+    // NOT filtered on rung: a migrated node-local doc defaults
+    // system-prompt-visibility: none and must still ride into <knowledge> as
     // its bare name (floored to the `name` rung; never its body).
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
     promote(meta.node_id); // flip to orchestrator mode
     const dir = memoryDir(meta.node_id);
     mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, 'rung-none-fact.md'), '---\nkind: reference\n---\nbody that must not render at the none rung\n');
+    writeFileSync(join(dir, 'rung-none-fact.md'), '---\nkind: knowledge\n---\nbody that must not render at the none rung\n');
     const block = buildContextIntro(meta.node_id);
     // No per-store stanza headers, no (empty) markers, no MEMORY.md paths.
     assert.ok(!block.includes(`node-local · ${memoryDir(meta.node_id)}`), 'no node-local stanza header');

package/dist/core/__tests__/daemon-boot.test.js

@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { readInboxSince } from '../feed/inbox.js';
@@ -27,6 +28,11 @@ function node(id, over = {}) {
 function spawnEdge(parent, child) {
     subscribe(parent, child, true);
 }
+/** A pid that is guaranteed dead (models a crashed engine). */
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-daemon-boot-'));
     process.env['CRTR_HOME'] = home;
@@ -56,7 +62,13 @@ test('never-booted node is marked dead and surfaced to the parent as urgent', as
         intent: null,
     }));
     spawnEdge('P', 'C');
-    await superviseTick();
+    // BROKER CUT: liveness is pid-only — the bogus window/session is irrelevant. A
+    // never-booted broker (pi_pid null AND pi_session_id null) is caught by the
+    // in-memory boot-grace clock, so the boot-failure fires on the SECOND tick,
+    // once REVIVE_GRACE_MS (~20s) of "still no pid, no session" has elapsed.
+    const t0 = Date.now();
+    await superviseTick(t0); // first observation: starts the boot-grace clock
+    await superviseTick(t0 + 60_000); // grace elapsed → crash + surfaceBootFailure
     assert.equal(getNode('C').status, 'dead', 'never-booted child is dead');
     const inbox = readInboxSince('P');
     assert.equal(inbox.length, 1, 'parent received exactly one pointer');
@@ -64,37 +76,32 @@ test('never-booted node is marked dead and surfaced to the parent as urgent', as
     assert.equal(inbox[0].from, 'C');
     assert.match(inbox[0].label, /Spawn failed/);
 });
-// A node that HAD booted (pi_session_id set) then died mid-generation is a
-// genuine crash, not a boot failure. It is marked dead AND wakes the inbox-
-// waiting parent — but with a "child died" notice (surfaceChildDeath), NOT a
-// "Spawn failed" boot-failure pointer (surfaceBootFailure). The parent-wake
-// itself was added by main's b5abf6e (parent-wake on child death) and is locked
-// in by child-death-wake.test.ts; this test preserves the discriminating intent
-// — a crash is never surfaced as a false spawn-failure alarm.
-test('a crash after boot wakes the parent with a child-death notice, not a boot-failure push', async () => {
+// BROKER CUT: surfaceChildDeath was DELETED and liveness is pid-only. A crashed
+// booted child (engine pid DEAD, pi_session_id set) is no longer marked `dead`
+// and no longer fans a "child died" notice — the daemon now grace-REVIVES it on
+// its saved session, so the row stays active/revivable and the doctrine wake
+// relocated (the revived child pushes when it truly finishes; a deliberate close
+// is woken by close.ts). This test preserves the discriminating intent in the
+// new model: a crash is never reaped to `dead` and never raises a false
+// boot-failure alarm.
+test('a crashed booted child is revivable, not reaped, and raises no false boot-failure alarm', async () => {
     createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
     createNode(node('C2', {
         parent: 'P2',
         kind: 'explore',
-        tmux_session: 'crtr-test-absent-session',
-        window: '@999992',
+        pi_pid: deadPid(), // engine crashed — its recorded pid is dead
         pi_session_id: '019e8f00-booted-once', // it booted before dying
         intent: null,
     }));
     spawnEdge('P2', 'C2');
-    // MID-GENERATION when the window vanished (busy marker present, agent_end
-    // never cleared it) → a genuine mid-run crash. Without the marker a booted,
-    // unsubscribed pane-gone node would FINALIZE to 'done' instead (it would read
-    // as a finished node dismissed) — see the gone-pane routing in crtrd.ts.
-    markBusy('C2');
+    markBusy('C2'); // died mid-generation
     await superviseTick();
-    assert.equal(getNode('C2').status, 'dead', 'crashed child is dead');
-    const inbox = readInboxSince('P2');
-    assert.equal(inbox.length, 1, 'a genuine mid-run crash wakes the inbox-waiting parent (D-1 parent-wake)');
-    assert.equal(inbox[0].tier, 'urgent', 'mid-run crash is delivered as urgent');
-    assert.equal(inbox[0].from, 'C2');
-    assert.match(inbox[0].label, /died/i, 'the wake is a child-death notice (surfaceChildDeath), not silence');
-    assert.doesNotMatch(inbox[0].label, /Spawn failed/, 'a crash is NOT surfaced as a false boot-failure alarm');
+    // pid-only liveness: a dead engine pid is REVIVABLE (grace-revive RESUME on the
+    // saved session), not reaped to `dead`; the row stays active across the grace.
+    assert.equal(getNode('C2').status, 'active', 'crashed booted child stays revivable, NOT marked dead');
+    // surfaceChildDeath is gone and this is not a never-booted node, so the daemon
+    // fans NO push here — no false boot-failure / child-death alarm on a crash.
+    assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
     clearBusy('C2');
 });
 // A still-booting node whose window is alive must be left untouched — boot is

package/dist/core/__tests__/draw-style.test.js

@@ -35,7 +35,7 @@ function baseChrome(over = {}) {
     return { status: null, banner: null, busy: false, loaded: true, lastRefresh: Date.now(), tick: 0, subtitle: null, mode: null, ...over };
 }
 const MANIFEST = {
-    id: 't', title: 'Test View', subtitle: '3 unread', description: 'd',
+    title: 'Test View', subtitle: '3 unread',
     keymap: [
         { keys: 'j/k', label: 'move' }, { keys: 'enter', label: 'open' },
         { keys: 'r', label: 'reply' }, { keys: 'g', label: 'refresh' }, { keys: 'q', label: 'quit' },

package/dist/core/__tests__/error-stall-recycle.test.d.ts

@@ -0,0 +1 @@
+export {};