@crouton-kit/crouter 0.3.28 → 0.3.30

package/dist/core/runtime/close.d.ts

@@ -10,5 +10,15 @@ export interface CloseNodeResult {
 }
 /** Close `rootId` and its exclusive subtree. Best-effort throughout: a tmux/db
  *  failure on one node never aborts the cascade. Throws only on an unknown root
- *  so the command can surface a clean not-found error. */
-export declare function closeNode(rootId: string): CloseNodeResult;
+ *  so the command can surface a clean not-found error.
+ *
+ *  `rootEvent` decides the ROOT's terminal status (descendants are always
+ *  `cancel`led — they did not finish their own work, they were torn down with the
+ *  parent):
+ *    'cancel'   (default) — the node was abandoned/torn down  → canceled (⊜).
+ *    'finalize'           — the user is marking it COMPLETE   → done (✓). Used by
+ *      the canvas browser's `x` (close-out) action. A root already in a terminal
+ *      status keeps it (finalize is only legal from a live status). */
+export declare function closeNode(rootId: string, opts?: {
+    rootEvent?: 'cancel' | 'finalize';
+}): CloseNodeResult;

package/dist/core/runtime/close.js

@@ -12,10 +12,12 @@
 //      only ever revives an active|idle node, so flipping to canceled first
 //      closes the race where the supervisor sees a window-gone live node and
 //      either revives it or marks it dead (overwriting our canceled).
-//   2. Kill its tmux PANE (the window closes once its last pane goes) — which
-//      kills pi and, with it, the inbox watcher. Pane-granular so that nodes
-//      the user co-located as panes in ONE window (via swap-pane focus) are not
-//      all taken down when one of them is closed.
+//   2. Tear down the broker ENGINE (the `shutdown` frame → SIGTERM fallback so
+//      the broker process exits and releases the sole .jsonl writer; this also
+//      ends the inbox watcher) AND proactively close the node's on-screen viewer
+//      pane + registry row. The viewer teardown is explicit because attach
+//      auto-reconnects: left to the socket drop alone, the viewer would sit in a
+//      misleading "reconnecting…" state for ~30s on a deliberate close.
 //   3. Append the cancellation notice to its inbox AFTER the watcher is gone.
 //      The watcher advances its cursor when it READS an entry, so appending
 //      while it is still live would let it consume + skip the notice (cursor
@@ -30,7 +32,8 @@
 // to by the agent being closed", generalized to any depth via a fixpoint.
 import { getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
-import { hostFor } from './host.js';
+import { headlessBrokerHost } from './host.js';
+import { tearDownNode } from './placement.js';
 import { appendInbox } from '../feed/inbox.js';
 import { appendPassive } from '../feed/passive.js';
 /** The set of nodes to close: the root plus every descendant reachable down the
@@ -102,10 +105,19 @@ function cancellationLabel(isRoot, deadChildren) {
 }
 /** Close `rootId` and its exclusive subtree. Best-effort throughout: a tmux/db
  *  failure on one node never aborts the cascade. Throws only on an unknown root
- *  so the command can surface a clean not-found error. */
-export function closeNode(rootId) {
+ *  so the command can surface a clean not-found error.
+ *
+ *  `rootEvent` decides the ROOT's terminal status (descendants are always
+ *  `cancel`led — they did not finish their own work, they were torn down with the
+ *  parent):
+ *    'cancel'   (default) — the node was abandoned/torn down  → canceled (⊜).
+ *    'finalize'           — the user is marking it COMPLETE   → done (✓). Used by
+ *      the canvas browser's `x` (close-out) action. A root already in a terminal
+ *      status keeps it (finalize is only legal from a live status). */
+export function closeNode(rootId, opts = {}) {
     if (getNode(rootId) === null)
         throw new Error(`closeNode: unknown node ${rootId}`);
+    const rootEvent = opts.rootEvent ?? 'cancel';
     const closing = closingSet(rootId);
     const order = killOrder(rootId, closing);
     // Descendants reachable from the subtree but kept alive (shared managers).
@@ -127,15 +139,24 @@ export function closeNode(rootId) {
             const deadChildren = subscriptionsOf(id)
                 .map((s) => s.node_id)
                 .filter((c) => closing.has(c));
-            // 1) Canceled + intent cleared BEFORE the window dies (daemon race).
-            transition(id, 'cancel');
-            // 2) Tear the node's ENGINE down through the Host seam (hostFor): a tmux
-            //    node runs tearDownNode (close any focus row it occupies, kill its
-            //    PANE — the window closes once its last pane goes, so sibling nodes the
-            //    user co-located in one window survive — and null its LOCATION); a
-            //    broker node sends the `shutdown` frame so the broker PROCESS exits and
-            //    releases the sole .jsonl writer (a paneless node has no pane to kill).
-            hostFor(m).teardown(id);
+            // 1) Terminal status set BEFORE the window dies (daemon race). The root may
+            //    finalize to `done` (a deliberate "mark complete" close-out); every
+            //    descendant, and the root by default, `cancel`s. finalize is legal only
+            //    from a live status — an already-terminal root keeps its status.
+            if (id === rootId && rootEvent === 'finalize') {
+                if (m.status === 'active' || m.status === 'idle')
+                    transition(id, 'finalize');
+            }
+            else {
+                transition(id, 'cancel');
+            }
+            // 2) Tear the node's ENGINE down: send the `shutdown` frame so the broker
+            //    PROCESS exits and releases the sole .jsonl writer. Then proactively
+            //    close the viewer pane + registry row — attach auto-reconnects, so on a
+            //    deliberate close the viewer must be torn down here or it lingers ~30s
+            //    showing a misleading "reconnecting…" instead of going away at once.
+            headlessBrokerHost.teardown(id);
+            tearDownNode(id);
             // 3) Leave the resume notice AFTER the watcher is gone, so it survives.
             appendInbox(id, {
                 from: null,

package/dist/core/runtime/front-door.js

@@ -23,17 +23,15 @@ function isDir(p) {
 }
 /** The `--`flags the front door OWNS (everything else after a bare `crtr` is a
  *  positional dir/prompt). A leading token in this set still boots a root —
- *  without it, `crtr --headless` / `crtr --name X` would fall through to the
- *  dispatcher and error as an unknown subcommand. */
-const FRONT_DOOR_FLAGS = new Set(['--name', '--kind', '--headless', '--no-headless']);
+ *  without it, `crtr --name X` would fall through to the dispatcher and error as
+ *  an unknown subcommand. */
+const FRONT_DOOR_FLAGS = new Set(['--name', '--kind']);
 /** Parse `[dir] [prompt]` positionals + the front-door flags out of the leftover
- *  tokens after the bare `crtr`. `headless` is tri-state: `true`/`false` from an
- *  explicit `--headless`/`--no-headless`, `undefined` to defer to the config. */
+ *  tokens after the bare `crtr`. */
 function parseRootArgs(tokens) {
     let cwd = process.cwd();
     let name;
     let kind;
-    let headless;
     const positionals = [];
     for (let i = 0; i < tokens.length; i++) {
         const t = tokens[i];
@@ -43,12 +41,6 @@ function parseRootArgs(tokens) {
         else if (t === '--kind') {
             kind = tokens[++i];
         }
-        else if (t === '--headless') {
-            headless = true;
-        }
-        else if (t === '--no-headless') {
-            headless = false;
-        }
         else if (t.startsWith('--')) {
             // ignore unknown flags for the front door
         }
@@ -61,7 +53,7 @@ function parseRootArgs(tokens) {
         cwd = resolvePath(positionals.shift());
     }
     const prompt = positionals.length > 0 ? positionals.join(' ') : undefined;
-    return { cwd, prompt, name, kind, headless };
+    return { cwd, prompt, name, kind };
 }
 /** Env marker set on every pi the front door boots. Its presence means we are
  *  already inside a front-door-booted root, so a nested front-door launch must
@@ -92,7 +84,7 @@ export function maybeBootRoot(root, argv) {
     //   • bare `crtr`                  (no tokens)
     //   • `crtr <dir> [prompt]`        (first positional is an existing dir)
     //   • `crtr "multi word prompt"`   (first token contains whitespace)
-    //   • `crtr --headless` / `crtr --name X`  (a leading front-door flag)
+    //   • `crtr --name X`              (a leading front-door flag)
     // Anything else — a bare word like `job`, or an UNKNOWN leading flag — is
     // treated as a mistyped/removed subcommand and handed to the dispatcher, which
     // errors with "unknown subcommand: <token>". Booting pi for such tokens is what

package/dist/core/runtime/host.d.ts

@@ -1,53 +1,33 @@
-import { type NodeMeta, type NodeRow } from '../canvas/index.js';
+import { type NodeRow } from '../canvas/index.js';
 import type { PiInvocation } from './launch.js';
-/** View-side launch hints the legacy host needs beyond the PiInvocation. This is
- *  today's ReviveLaunch (placement.ts) MINUS `command`/`env` — the host derives
- *  `command = piCommand(inv.argv)` and `env = inv.env` from the PiInvocation
- *  itself. The broker (Phase 3) uses only `cwd` + `resuming`. */
+/** View-side launch hints the broker host needs beyond the PiInvocation. The
+ *  broker uses `cwd` + `resuming`; `name` is carried for the node's display. */
 export interface LaunchPlacement {
     cwd: string;
     name: string;
     resuming: boolean;
 }
-/** A handle to a node's running engine container.
- *  §3.2 specifies { kind, pid }; Phase 1 carries the placement coords too,
- *  because launch REPLACES reviveIntoPlacement (which returned PlacementResult)
- *  and reviveNode's unchanged ReviveResult is built from window+session. The
- *  daemon never reads window/session/pane (it supervises via pid / isAlive); the
- *  broker (Phase 3) returns window=null, pane=null. */
+/** A handle to a node's running engine container. The broker host supervises via
+ *  the broker pid recorded as pi_pid; no tmux placement coords exist (the engine
+ *  is never in a pane). */
 export interface HostHandle {
-    kind: 'tmux' | 'broker';
-    /** Supervised pid (signal-0 target). null at launch for TmuxPaneHost: the
-     *  pane's fresh pi records its own pid via the stophook (session_start →
-     *  recordPid), and reviveNode clearPid()s right after launch — so no Phase-1
-     *  caller reads this. Present for the §3.2 contract + the daemon. */
+    /** Supervised pid (signal-0 target). May be null right at launch before the
+     *  detached child reports its pid; the broker re-records pi_pid during its
+     *  extension bind, and reviveNode clearPid()s right after launch. */
     pid: number | null;
-    window: string | null;
-    session: string;
-    pane: string | null;
 }
 export interface Host {
     /** Bring a node's ENGINE into existence from its launch recipe; return a
-     *  supervisable handle. TmuxPaneHost ALSO performs placement (the pane IS the
-     *  engine container). */
+     *  supervisable handle. */
     launch(nodeId: string, inv: PiInvocation, opts: LaunchPlacement): HostHandle;
-    /** Is this node's engine container present? PURE / non-mutating. §3.2 types
-     *  this `NodeRow`; we keep `string | NodeRow` to match isNodePaneAlive (which
-     *  it IS) so both call sites — the guard (passes the id) and the Phase-2 daemon
-     *  (passes a row) — stay one-token changes. */
+    /** Is this node's engine alive? PURE / non-mutating. `string | NodeRow` so
+     *  both call sites — the revive guard (passes the id) and the daemon (passes a
+     *  row) — share one selector. For the broker this IS isPidAlive(pi_pid). */
     isAlive(node: string | NodeRow): boolean;
     /** Tear the engine down (close/cancel teardown). */
     teardown(nodeId: string): void;
     /** Deliver an OS signal to the engine container — present so the daemon never
-     *  reaches around the abstraction. No Phase-1 call site. */
+     *  reaches around the abstraction. */
     signal(nodeId: string, sig: NodeJS.Signals): void;
 }
-/** The sole Phase-1 host: today's behavior, wrapped. Stateless → a frozen
- *  singleton, no class needed. Every method delegates verbatim. */
-export declare const tmuxPaneHost: Host;
 export declare const headlessBrokerHost: Host;
-/** Select the Host for a node by its persisted `host_kind` (NULL/'tmux' → the
- *  tmux host; 'broker' → the headless broker host). The param is `NodeMeta |
- *  NodeRow` so both call sites — reviveNode `hostFor(meta)` and the daemon
- *  `hostFor(row)` — share one selector. */
-export declare function hostFor(node: NodeMeta | NodeRow): Host;

package/dist/core/runtime/host.js

@@ -1,58 +1,26 @@
 // src/core/runtime/host.ts
 //
 // The Host abstraction (design §3): owns an engine PROCESS's lifecycle, not its
-// display. TWO impls live here: TmuxPaneHost — a thin wrapper over today's
-// placement functions (the pane IS the engine container) — and, since Phase 3,
-// HeadlessBrokerHost — a detached broker process with no tmux pane. `host_kind`
-// (on the node row/meta since Wave 1) selects between them via hostFor().
+// display. After the broker-is-the-host cut there is ONE impl —
+// HeadlessBrokerHost — a detached broker process with no tmux pane. Every node
+// (managed child, named node, --root, front-door root) runs on it; a tmux pane
+// is only an attach VIEWER. The `Host` interface is kept as a one-impl seam (the
+// test/future-host boundary).
 //
-// IMPORT-LINT (tmux-surface.test.ts §5.1): this file must NOT import './tmux.js'
-// directly. It reaches every driver verb (piCommand, reviveIntoPlacement,
-// isNodePaneAlive, tearDownNode) through placement.ts's re-exports — placement.ts
-// and tmux-chrome.ts are the only sanctioned tmux.ts importers. The broker host
-// needs no tmux verb at all.
+// This file imports neither './tmux.js' nor './placement.js' — the broker host
+// needs no tmux verb at all (it supervises via the broker pid, tears down over
+// the node's unix socket).
 import { spawn } from 'node:child_process';
 import { mkdirSync, writeFileSync, existsSync, unlinkSync, openSync, closeSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { connect } from 'node:net';
-import { reviveIntoPlacement, isNodePaneAlive, tearDownNode, piCommand, } from './placement.js';
 import { getNode } from '../canvas/index.js';
 import { nodeDir, jobDir } from '../canvas/paths.js';
 import { encodeFrame } from './broker-protocol.js';
 import { FRONT_DOOR_ENV } from './front-door.js';
+import { hostExecPath } from './branded-host.js';
 import { isPidAlive } from '../canvas/pid.js';
-/** The sole Phase-1 host: today's behavior, wrapped. Stateless → a frozen
- *  singleton, no class needed. Every method delegates verbatim. */
-export const tmuxPaneHost = {
-    launch(nodeId, inv, opts) {
-        const placed = reviveIntoPlacement(nodeId, {
-            command: piCommand(inv.argv),
-            env: inv.env,
-            cwd: opts.cwd,
-            name: opts.name,
-            resuming: opts.resuming,
-        });
-        return { kind: 'tmux', pid: null, window: placed.window, session: placed.session, pane: placed.pane };
-    },
-    isAlive(node) {
-        return isNodePaneAlive(node);
-    },
-    teardown(nodeId) {
-        tearDownNode(nodeId);
-    },
-    signal(nodeId, sig) {
-        const pid = getNode(nodeId)?.pi_pid;
-        if (pid != null) {
-            try {
-                process.kill(pid, sig);
-            }
-            catch {
-                /* already gone */
-            }
-        }
-    },
-};
 // ---------------------------------------------------------------------------
 // HeadlessBrokerHost (design §3.3): a detached broker PROCESS, no tmux pane. It
 // boots the dedicated broker-cli entry directly (NEVER src/cli.ts), supervises
@@ -84,7 +52,10 @@ export const headlessBrokerHost = {
         const logDir = jobDir(nodeId);
         mkdirSync(logDir, { recursive: true });
         const logFd = openSync(join(logDir, 'broker.log'), 'a');
-        const child = spawn(process.execPath, [resolveBrokerEntry(), nodeId], {
+        // Launch from the crouter-branded host binary (a copy of node) so the
+        // broker shows "crouter" in macOS Full Disk Access, not "node". On
+        // non-darwin / dev / tests this is just process.execPath (see branded-host).
+        const child = spawn(hostExecPath(), [resolveBrokerEntry(), nodeId], {
             cwd: opts.cwd,
             detached: true,
             stdio: ['ignore', logFd, logFd],
@@ -94,7 +65,7 @@ export const headlessBrokerHost = {
         // launching process (CLI or daemon) never leaks it.
         closeSync(logFd);
         child.unref();
-        return { kind: 'broker', pid: child.pid ?? null, window: null, session: '', pane: null };
+        return { pid: child.pid ?? null };
     },
     isAlive(node) {
         return isPidAlive((typeof node === 'string' ? getNode(node) : node)?.pi_pid);
@@ -177,10 +148,3 @@ export const headlessBrokerHost = {
         }
     },
 };
-/** Select the Host for a node by its persisted `host_kind` (NULL/'tmux' → the
- *  tmux host; 'broker' → the headless broker host). The param is `NodeMeta |
- *  NodeRow` so both call sites — reviveNode `hostFor(meta)` and the daemon
- *  `hostFor(row)` — share one selector. */
-export function hostFor(node) {
-    return node.host_kind === 'broker' ? headlessBrokerHost : tmuxPaneHost;
-}

package/dist/core/runtime/launch.d.ts

@@ -2,6 +2,7 @@ import type { NodeMeta, LaunchSpec, Mode, Lifecycle } from '../canvas/index.js';
 export declare const CANVAS_STOPHOOK_PATH: string;
 export declare const CANVAS_INBOX_WATCHER_PATH: string;
 export declare const CANVAS_NAV_PATH: string;
+export declare const CANVAS_RECAP_PATH: string;
 export declare const CANVAS_GOAL_CAPTURE_PATH: string;
 export declare const CANVAS_PASSIVE_CONTEXT_PATH: string;
 export declare const CANVAS_CONTEXT_INTRO_PATH: string;
@@ -11,12 +12,14 @@ export declare const CANVAS_RESUME_PATH: string;
 export declare const CANVAS_VIEW_PATH: string;
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
- *  graph chrome), goal-capture (persist the first user message as the goal),
+ *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
+ *  conversation, shown above the manager line after 300s of no message),
+ *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block as its own session
- *  message, once per brand-new chat), doc-substrate (the unified document
- *  substrate's two hooks: <skills> + <preferences> + <memory-guidance> at boot,
- *  on-read context injection), commands (the /promote slash-command), resume (the /resume-node
+ *  context-intro (inject the <crtr-context> bearings block — carrying the
+ *  <knowledge> catalog — as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: <preferences> +
+ *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
  *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
  *  view pick` / `crtr view run <name>`).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
@@ -27,9 +30,9 @@ export declare const CANVAS_EXTENSIONS: string[];
  *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
 export declare const MODEL_TIERS: Record<string, string>;
 /** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare alias
- *  (sonnet/opus/haiku) resolves to the anthropic provider under pi (avoids the
- *  bedrock default); anything with a `/` or an unknown name passes through. */
+ *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
+ *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
+ *  with a `/` or an unknown name passes through. */
 export declare function normalizeModel(model: string): string;
 /** Compose a node's full pi launch recipe from its persona. The system prompt
  *  is composed from FOUR inputs: kind×mode (the persona body) plus lifecycle
@@ -105,5 +108,5 @@ export interface BrokerSdkConfig {
  *  never drift. Safe because `buildPiArgv` is the SOLE producer of these flags
  *  (we own both ends). SIDE EFFECT: merges `inv.env` into `process.env` so the
  *  in-process engine + the bound canvas extensions see the same env a forked pi
- *  would (CRTR_NODE_ID, CRTR_ROOT_SESSION, CRTR_SUBTREE, …). */
+ *  would (CRTR_NODE_ID, CRTR_SUBTREE, …). */
 export declare function piInvocationToSdkConfig(inv: PiInvocation): BrokerSdkConfig;

package/dist/core/runtime/launch.js

@@ -29,6 +29,7 @@ function resolveExtension(name) {
 export const CANVAS_STOPHOOK_PATH = resolveExtension('canvas-stophook');
 export const CANVAS_INBOX_WATCHER_PATH = resolveExtension('canvas-inbox-watcher');
 export const CANVAS_NAV_PATH = resolveExtension('canvas-nav');
+export const CANVAS_RECAP_PATH = resolveExtension('canvas-recap');
 export const CANVAS_GOAL_CAPTURE_PATH = resolveExtension('canvas-goal-capture');
 export const CANVAS_PASSIVE_CONTEXT_PATH = resolveExtension('canvas-passive-context');
 export const CANVAS_CONTEXT_INTRO_PATH = resolveExtension('canvas-context-intro');
@@ -38,12 +39,14 @@ export const CANVAS_RESUME_PATH = resolveExtension('canvas-resume');
 export const CANVAS_VIEW_PATH = resolveExtension('canvas-view');
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
- *  graph chrome), goal-capture (persist the first user message as the goal),
+ *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
+ *  conversation, shown above the manager line after 300s of no message),
+ *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block as its own session
- *  message, once per brand-new chat), doc-substrate (the unified document
- *  substrate's two hooks: <skills> + <preferences> + <memory-guidance> at boot,
- *  on-read context injection), commands (the /promote slash-command), resume (the /resume-node
+ *  context-intro (inject the <crtr-context> bearings block — carrying the
+ *  <knowledge> catalog — as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: <preferences> +
+ *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
  *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
  *  view pick` / `crtr view run <name>`).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
@@ -52,6 +55,7 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_STOPHOOK_PATH,
     CANVAS_INBOX_WATCHER_PATH,
     CANVAS_NAV_PATH,
+    CANVAS_RECAP_PATH,
     CANVAS_GOAL_CAPTURE_PATH,
     CANVAS_PASSIVE_CONTEXT_PATH,
     CANVAS_CONTEXT_INTRO_PATH,
@@ -65,20 +69,28 @@ export const CANVAS_EXTENSIONS = [
  *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
 export const MODEL_TIERS = {
     ultra: 'anthropic/claude-fable-5',
-    strong: 'anthropic/opus',
-    medium: 'anthropic/sonnet',
-    light: 'anthropic/haiku',
+    strong: 'anthropic/claude-opus-4-8',
+    medium: 'anthropic/claude-sonnet-4-6',
+    light: 'anthropic/claude-haiku-4-5',
+};
+/** Bare family aliases → the same concrete versioned ids as the tiers. These
+ *  MUST be real registry ids (see `pi --list-models`): an unversioned spec like
+ *  `anthropic/sonnet` is NOT in the registry and silently falls back to the SDK
+ *  default (opus), so it can never be the resolution target. */
+const BARE_ALIASES = {
+    opus: 'anthropic/claude-opus-4-8',
+    sonnet: 'anthropic/claude-sonnet-4-6',
+    haiku: 'anthropic/claude-haiku-4-5',
 };
 /** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare alias
- *  (sonnet/opus/haiku) resolves to the anthropic provider under pi (avoids the
- *  bedrock default); anything with a `/` or an unknown name passes through. */
+ *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
+ *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
+ *  with a `/` or an unknown name passes through. */
 export function normalizeModel(model) {
     if (model in MODEL_TIERS)
         return MODEL_TIERS[model];
-    const bare = new Set(['sonnet', 'opus', 'haiku']);
-    if (bare.has(model))
-        return `anthropic/${model}`;
+    if (model in BARE_ALIASES)
+        return BARE_ALIASES[model];
     return model;
 }
 // ---------------------------------------------------------------------------
@@ -188,7 +200,7 @@ export function buildPiArgv(meta, opts = {}) {
  *  never drift. Safe because `buildPiArgv` is the SOLE producer of these flags
  *  (we own both ends). SIDE EFFECT: merges `inv.env` into `process.env` so the
  *  in-process engine + the bound canvas extensions see the same env a forked pi
- *  would (CRTR_NODE_ID, CRTR_ROOT_SESSION, CRTR_SUBTREE, …). */
+ *  would (CRTR_NODE_ID, CRTR_SUBTREE, …). */
 export function piInvocationToSdkConfig(inv) {
     for (const [k, v] of Object.entries(inv.env))
         process.env[k] = v;

package/dist/core/runtime/lifecycle.d.ts

@@ -2,7 +2,7 @@ import type { NodeMeta } from '../canvas/types.js';
 /** The lifecycle events — the only vocabulary for moving a node's status/intent.
  *  Each maps (in the table below) to a target status and/or intent plus the set
  *  of from-statuses it is legal from. */
-export type LifecycleEvent = 'finalize' | 'cancel' | 'crash' | 'yield' | 'release' | 'revive' | 'boot';
+export type LifecycleEvent = 'finalize' | 'cancel' | 'crash' | 'yield' | 'release' | 'revive';
 /** Enact a lifecycle event on a node: validate the from-status against the
  *  table, then write status+intent in ONE atomic statement (so they can never
  *  disagree). Returns the hydrated node view after the write.

package/dist/core/runtime/lifecycle.js

@@ -13,7 +13,7 @@
 // lifecycle.ts is the single source of which status/intent move is LEGAL. Two
 // parallel, legible state machines instead of scattered enactment.
 //
-// Crash-safety invariant (was a comment repeated in reset/close/reapDescendants):
+// Crash-safety invariant (was a comment repeated in close/reapDescendants):
 // "flip status to a non-supervised value + clear intent BEFORE killing the
 // host" (tmux pane or headless broker) — the daemon only ever revives
 // active|idle nodes, so a teardown must
@@ -22,12 +22,13 @@
 // and only THEN tear the host down.
 //
 // Unification (A5, human-confirmed 2026-06-06): an externally-reaped node — torn
-// down because the user moved on (close cascade) OR because a root reset/relaunch
-// superseded it — ends `canceled`, NOT `done`. `done` is reserved for a node that
-// finished its OWN work (finalize). The old `reap` event (→ done) was identical to
-// `cancel` in every field and side effect once unified on status, so it was
-// COLLAPSED into `cancel`; reset.ts's reapDescendants + relaunchRoot park-old now
-// route through `cancel`.
+// down because the user moved on (close cascade) OR because a root relaunch
+// superseded its workers — ends `canceled`, NOT `done`. `done` is reserved for a
+// node that finished its OWN work (finalize) — including a relaunched root, which
+// is parked `done` as history, not canceled. The old `reap` event (→ done) was
+// identical to `cancel` in every field and side effect once unified on status, so
+// it was COLLAPSED into `cancel`; reset.ts's reapDescendants routes through
+// `cancel`.
 //
 // Layering note: lifecycle.ts is runtime, but it is the canvas write surface's
 // `transition` verb (the only writer of status+intent), so it owns its atomic
@@ -42,11 +43,12 @@ const LIVE = ['active', 'idle'];
  *  the runtime actually wrote at its audited call sites, so behavior is preserved
  *  by construction. Each entry's comment names its writer(s). */
 const TRANSITIONS = {
-    // feed.push(final) · queue.cancelJob · markCleanExitDone (clean quit).
+    // feed.push(final) · queue.cancelJob · markCleanExitDone (clean quit) ·
+    // relaunchRoot park-old (a relaunched root is parked `done` as history).
     finalize: { status: 'done', intent: 'done', from: LIVE },
-    // closeNode cascade · reapDescendants · relaunchRoot park-old. Forced teardown
-    // of a node that did NOT finish its own work → canceled, intent cleared. (A5:
-    // done is reserved for finalize; every external reap unifies on canceled.)
+    // closeNode cascade · reapDescendants. Forced teardown of a node that did NOT
+    // finish its own work → canceled, intent cleared. (A5: done is reserved for
+    // finalize; every external reap unifies on canceled.)
     cancel: { status: 'canceled', intent: null, from: ANY },
     // daemon superviseTick: engine container gone (tmux pane or broker process)
     // with no yield/release intent. Intent KEPT (the dead log line still reports it).
@@ -57,11 +59,6 @@ const TRANSITIONS = {
     release: { status: 'idle', intent: 'idle-release', from: LIVE },
     // reviveNode · resetRoot · stophook boot-confirm (clear a pending refresh net).
     revive: { status: 'active', intent: null, from: ANY },
-    // reviveInPlace: re-exec a fresh pi in the SAME pane. Status (re)affirmed
-    // active; intent KEPT so a pending refresh survives as proof-of-boot until the
-    // fresh pi's session_start clears it (a premature clear is how a failed
-    // respawn became a silent death — see revive.ts).
-    boot: { status: 'active', from: LIVE },
 };
 /** Enact a lifecycle event on a node: validate the from-status against the
  *  table, then write status+intent in ONE atomic statement (so they can never
@@ -96,9 +93,8 @@ export function transition(nodeId, event) {
     // Event-gated; exactly ONE delegated wakeups helper per event, never inline
     // wakeups SQL here (design §6.7 / D2 / D6, Q1/Q2):
     //   cancel   → cancelWakesFor: reap node-anchored AND owner-armed detached
-    //              wakes this node armed (ruling A) — covers all three cancel
-    //              sites uniformly (close cascade · reapDescendants · relaunch
-    //              park-old).
+    //              wakes this node armed (ruling A) — covers both cancel sites
+    //              uniformly (close cascade · reapDescendants).
     //   finalize → cancelSelfAlarms: clear this node's one-shot self-alarms only;
     //              node-anchored declarative crons SURVIVE a finishing instance (Q1).
     //   crash    → NOTHING. A fault is not a deliberate end-of-waiting; self-alarms

package/dist/core/runtime/nodes.d.ts

@@ -7,58 +7,6 @@ export declare function newNodeId(): string;
  *  without an import cycle — `CRTR_SUBTREE` is emitted as `rootOfSpine(nodeId)`
  *  at every launch site. */
 export declare function rootOfSpine(nodeId: string): string;
-/** The single, shared tmux session that ALL canvas node windows live in.
- *  Overridable with CRTR_NODE_SESSION (default `crtr`). Every root and every
- *  child opens a window here rather than cluttering the user's own working
- *  session — switch to it to browse the whole live graph, ignore it otherwise.
- *  Pure policy (env only, no tmux call), so it lives in the node layer, not the
- *  driver; the tmux driver imports it from here for installMenuBinding's use. */
-export declare function nodeSession(): string;
-/** Resolve the tmux session a freshly-born node's window/pane opens into — and
- *  thus its durable REVIVE-HOME (`home_session`). Pure so the birth decision is
- *  unit-testable without a live tmux:
- *    - managed background child  (`adoptCaller=false`) → the shared backstage:
- *      the inherited `CRTR_ROOT_SESSION`, else `nodeSession()` (`crtr`).
- *    - independent `--root` / inline front door (`adoptCaller=true`) → the
- *      caller's CURRENT session when inside tmux (`here`), else the backstage.
- *  This is exactly the session each birth site already places the node into;
- *  centralizing it keeps `home_session` and the actual placement in lockstep. */
-export declare function resolveBirthSession(opts: {
-    /** True for an independent root or the inline front door (both adopt the
-     *  caller's session); false for a managed background child. */
-    adoptCaller: boolean;
-    /** The caller's current tmux location, or null when not inside tmux. */
-    here: {
-        session: string;
-    } | null;
-    /** The inherited CRTR_ROOT_SESSION (the backstage the subtree flows into). */
-    rootSession?: string | null;
-}): string;
-/** A node's durable REVIVE-HOME, with the legacy back-compat default. Nodes born
- *  before `home_session` existed have no such field in meta — they fall back to
- *  their last live LOCATION (`tmux_session`), then to the shared backstage
- *  (`nodeSession()`). The defaulted read for the placement layer; a present
- *  `home_session` is always returned verbatim. */
-export declare function homeSessionOf(nodeId: string): string;
-/** The session a node's CHILDREN spawn into — the value its pi process exports
- *  as CRTR_ROOT_SESSION (the subtree's backstage). NOT the same as where the
- *  node's OWN pane lives.
- *
- *  For a managed CHILD this is its `home_session`: a child's home_session is
- *  ALWAYS the backstage it was born into (focus may move its live pane into a
- *  user session, but home_session stays the taint-immune backstage), so its
- *  descendants correctly inherit that backstage.
- *
- *  For a ROOT (`parent === null`) `home_session` may be a USER session it
- *  ADOPTED — the inline front door keeps the root's own pane where the user is
- *  working (`home_session = cli`). Sourcing children's CRTR_ROOT_SESSION from
- *  that would exile the root's entire subtree into the user's session. A root's
- *  children must instead flow to the shared backstage `nodeSession()`, NEVER the
- *  user's session — mirroring spawnRoot's birth-time split (root pane → user
- *  session; children → nodeSession() via CRTR_ROOT_SESSION). The revive paths
- *  MUST honor the same split, or a refreshed front-door root re-points its whole
- *  subtree into the user's session on every yield (the bug this fixes). */
-export declare function childBackstageOf(nodeId: string): string;
 export interface NodeContext {
     nodeId: string | null;
     kind: string | null;
@@ -91,9 +39,6 @@ export interface SpawnNodeOpts {
      *  the boot intro can re-assert this node's OWN identity over the source's
      *  copied-in conversation. Omit for a fresh node. */
     forkFrom?: string | null;
-    /** Which HOST launches + supervises this node: a tmux pane (default) or the
-     *  headless broker. Persisted to `meta.host_kind` (NULL/'tmux' ⇒ tmux). */
-    hostKind?: 'tmux' | 'broker';
     /** New subscriptions this node opens default to passive when true. */
     passiveDefault?: boolean;
     /** Resolved pi launch recipe (from resolve(kind,mode)). */