@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/core/__tests__/canvas.test.js

@@ -1,6 +1,6 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs';
+import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, getRow, updateNode, setStatus, listNodes, subscribe, unsubscribe, setSubscriptionActive, recordSpawn, subscribersOf, subscriptionsOf, view, hasActiveLiveSubscription, rebuildIndex, } from '../canvas/canvas.js';
@@ -139,6 +139,42 @@ test('recordSpawn writes the audit-only spawned_by edge', () => {
     assert.equal(subscriptionsOf('child').length, 0);
     assert.equal(subscribersOf('parent').length, 0);
 });
+// --- Regression: Hearth M0 cold-boot 0-byte meta.json -----------------------
+// A bare write-temp-then-rename WITHOUT fsync left meta.json 0-byte on the guest's
+// durable NFS home after a sandbox recreate (the open inode is silly-renamed and the
+// new content never flushed). Cold-boot's `canvas rebuild-index` + `canvas revive`
+// then JSON.parse('') → "Unexpected end of JSON input" → the chain dies → guest
+// daemon-only, no web on 7878. Fix: writeMeta fsyncs temp+parent dir (durable), and
+// readMeta/rebuildIndex tolerate an empty/corrupt meta as MISSING instead of throwing.
+test('writeMeta produces a durable, non-empty, atomically-named meta.json', () => {
+    createNode(node('a'));
+    const p = nodeMetaPath('a');
+    assert.ok(statSync(p).size > 0, 'meta.json must be non-empty');
+    assert.ok(!existsSync(`${p}.tmp`), 'temp file must be renamed away, not left behind');
+    assert.equal(getNode('a')?.node_id, 'a');
+});
+test('getNode returns null (not throw) on a 0-byte meta.json', () => {
+    createNode(node('a'));
+    writeFileSync(nodeMetaPath('a'), ''); // the observed NFS 0-byte corruption
+    assert.equal(getNode('a'), null);
+});
+test('getNode returns null (not throw) on an unparseable meta.json', () => {
+    createNode(node('a'));
+    writeFileSync(nodeMetaPath('a'), '{ broken json');
+    assert.equal(getNode('a'), null);
+});
+test('rebuildIndex skips a corrupt-meta node instead of throwing', () => {
+    createNode(node('good'));
+    createNode(node('bad'));
+    writeFileSync(nodeMetaPath('bad'), ''); // 0-byte corruption on one node
+    closeDb();
+    rmSync(join(home, 'canvas.db'), { force: true });
+    rmSync(join(home, 'canvas.db-wal'), { force: true });
+    rmSync(join(home, 'canvas.db-shm'), { force: true });
+    assert.doesNotThrow(() => rebuildIndex());
+    assert.equal(getRow('good')?.node_id, 'good'); // healthy node reindexed
+    assert.equal(getRow('bad'), null); // corrupt node skipped, no crash
+});
 test('rebuildIndex reconstructs node rows from on-disk metas', () => {
     createNode(node('a', { parent: null }));
     createNode(node('b', { parent: 'a' }));

package/dist/core/__tests__/chat-view-reconnect.test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+// @ts-ignore -- chat core is a plain built view module with no generated .d.ts.
+import core from '../../builtin-views/chat/core.mjs';
+import { openLocalStream } from '../view/stream-local.js';
+const flushMicrotasks = async () => {
+    await Promise.resolve();
+};
+test('local invalid/no-node stream failures close asynchronously after the channel returns', async () => {
+    for (const target of ['not/valid', 'definitely-not-a-real-node-review-5362b32']) {
+        const events = [];
+        const channel = openLocalStream({ kind: 'stream', target, role: 'controller' }, {
+            onFrame() {
+                events.push('frame');
+            },
+            onClose(reason) {
+                events.push(`close:${reason}`);
+            },
+            onError(err) {
+                events.push(`error:${err.kind}`);
+            },
+        });
+        assert.equal(events.length, 0, `${target}: callbacks stay deferred until after openLocalStream returns`);
+        assert.equal(typeof channel.close, 'function', `${target}: channel is returned before failure callbacks fire`);
+        await flushMicrotasks();
+        assert.ok(events[0]?.startsWith('error:'), `${target}: reports the terminal open failure as an error`);
+        assert.equal(events[1]?.startsWith('close:'), true, `${target}: follows with streamClose`);
+    }
+});
+test('control_changed demotion updates reconnect intent without clobbering an explicit controller request', () => {
+    let current = {
+        target: 'n1',
+        desiredRole: 'controller',
+        channel: null,
+        clientId: 'client-1',
+        conn: 'open',
+        role: 'controller',
+        controllerId: 'client-1',
+        session: null,
+        transcript: [],
+        draft: '',
+        notices: [],
+        pendingDialog: null,
+        queued: [],
+        contextTokens: undefined,
+    };
+    const ctx = {
+        get state() {
+            return current;
+        },
+        set(next) {
+            current = typeof next === 'function' ? next(current) : next;
+        },
+        signal: {
+            clearBanner() { },
+            setBanner() { },
+            setStatus() { },
+            setSubtitle() { },
+            setMode() { },
+            quit() { },
+        },
+    };
+    core.intents.streamFrame(ctx, { type: 'control_changed', controller_id: 'other-client' });
+    assert.equal(current.role, 'observer');
+    assert.equal(current.desiredRole, 'observer');
+    current = { ...current, role: 'observer', desiredRole: 'controller' };
+    core.intents.streamFrame(ctx, { type: 'control_changed', controller_id: 'other-client' });
+    assert.equal(current.role, 'observer');
+    assert.equal(current.desiredRole, 'controller');
+});

package/dist/core/__tests__/child-death-wake.test.js

@@ -23,7 +23,7 @@
 // the one genuine-terminal wake that still lives in core: close.ts.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
@@ -46,6 +46,15 @@ function node(id, over = {}) {
         ...over,
     };
 }
+/** Write a minimal pi session with one assistant message so the node reads as
+ *  NON-empty (produced AI output) — otherwise closeNode reaps it outright. */
+function withSession(id) {
+    const dir = join(home, 'sessions');
+    mkdirSync(dir, { recursive: true });
+    const f = join(dir, `${id}.jsonl`);
+    writeFileSync(f, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
+    return f;
+}
 /** A pid that is guaranteed dead. */
 function deadPid() {
     const r = spawnSync('true', [], { stdio: 'ignore' });
@@ -115,7 +124,7 @@ test('pid-only liveness: a dead-engine booted child is revivable, NOT reaped, an
 test('node close of a child wakes its SURVIVING manager (the parent outside the closing set)', async () => {
     inboxWaitingParent('PARENT');
     // A booted child; closeNode tears its (paneless-for-the-test) engine down.
-    createNode(node('CHILD', { pane: GONE_PANE, tmux_session: 'crtr-cdw', window: '@1', pi_session_id: 'booted', status: 'active' }));
+    createNode(node('CHILD', { pane: GONE_PANE, tmux_session: 'crtr-cdw', window: '@1', pi_session_id: 'booted', pi_session_file: withSession('CHILD'), status: 'active' }));
     subscribe('PARENT', 'CHILD', true); // PARENT is a manager OUTSIDE the close set
     // Closing CHILD: closingSet({CHILD}) cannot pull in PARENT (PARENT is a
     // SUBSCRIBER of CHILD, never a descendant), so PARENT survives + must wake.

package/dist/core/__tests__/close.test.js

@@ -1,13 +1,25 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
+import { nodeDir } from '../canvas/paths.js';
 import { closeDb } from '../canvas/db.js';
 import { closeNode } from '../runtime/close.js';
 import { readInboxSince } from '../feed/inbox.js';
 let home;
+/** Write a minimal pi session containing one assistant message, so the node
+ *  reads as NON-empty (it produced AI output). Without this a node has no
+ *  session and closeNode reaps it outright instead of cancel+notice — see the
+ *  dedicated empty-reap test below. */
+function withSession(id) {
+    const dir = join(home, 'sessions');
+    mkdirSync(dir, { recursive: true });
+    const f = join(dir, `${id}.jsonl`);
+    writeFileSync(f, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
+    return f;
+}
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -18,6 +30,7 @@ function node(id, over = {}) {
         mode: 'base',
         lifecycle: 'terminal',
         status: 'active',
+        pi_session_file: withSession(id),
         ...over,
     };
 }
@@ -132,6 +145,31 @@ test('closing a leaf node closes only itself', () => {
 test('throws on an unknown node', () => {
     assert.throws(() => closeNode('ghost'), /unknown node/);
 });
+// Regression: empty nodes (engine never produced an assistant message) are
+// USELESS shells, so closing one must DELETE it from the graph + disk, not park
+// a canceled husk. (Reported: "many nodes on the canvas that haven't generated
+// anything yet, just taking up space" — close/detach now reap them.)
+test('closing an EMPTY node (no AI output) deletes it from the graph + disk', () => {
+    createNode(node('shell', { pi_session_file: null }));
+    const dir = nodeDir('shell');
+    assert.ok(existsSync(dir), 'dir exists before close');
+    const res = closeNode('shell');
+    assert.deepEqual(res.closed, ['shell']);
+    assert.equal(getNode('shell'), null, 'row deleted from the graph');
+    assert.equal(existsSync(dir), false, 'on-disk dir removed');
+});
+// A close that reaps an EMPTY child still wakes a SURVIVING manager — the child
+// is gone either way, so a parent that delegated must learn it vanished.
+test('reaping an empty child still notifies a surviving external manager', () => {
+    createNode(node('child', { pi_session_file: null })); // empty → reaped
+    createNode(node('mgr')); // external manager, NOT closed
+    spawnEdge('mgr', 'child');
+    closeNode('child');
+    assert.equal(getNode('child'), null, 'empty child reaped');
+    const note = readInboxSince('mgr').at(-1);
+    assert.match(note.label, /Child closed/);
+    assert.equal(note.data?.['child'], 'child');
+});
 // NOTE (broker-host cut): the former "Step 7: closing a FOCUSED node closes its
 // focus row + nulls its pane (tearDownNode)" test was DELETED. close.ts no longer
 // routes through the synchronous tearDownNode — it sends the broker `shutdown`

package/dist/core/__tests__/connection-reconnect-resume.test.js

@@ -0,0 +1,37 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/connection-reconnect-resume.test.ts
+//
+// BUG-REGRESSION: connection faults follow the shared broker-owned retry schedule.
+// The broker exercises this policy table directly.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { nextFaultRetry, policyFor } from '../runtime/fault-recovery.js';
+const NOW = Date.parse('2026-06-23T20:00:00.000Z');
+const ISO = (ms) => new Date(ms).toISOString();
+// ---------------------------------------------------------------------------
+// J1 — the policy table itself: connection faults retry on a 5s → 2x → 60s
+// cap, and the planner advances the next attempt.
+// ---------------------------------------------------------------------------
+test('J1 policy table: connection faults use the shared retry schedule', () => {
+    assert.deepEqual(policyFor('connection'), {
+        kind: 'connection',
+        gate: 'online',
+        max: 8,
+        baseDelayMs: 5_000,
+        capDelayMs: 60_000,
+        fatal: false,
+    });
+    const plan = nextFaultRetry({
+        link: 'pi→provider',
+        op: 'generation turn',
+        kind: 'connection',
+        retry: { disposition: 'auto', by: 'daemon' },
+        message: 'Connection error.',
+        since: ISO(NOW),
+        logPath: '/tmp/crtr-fault.log',
+    }, NOW);
+    assert.equal(plan.attempt, 1, 'the first plan primes attempt 1');
+    assert.equal(plan.max, 8, 'connection max attempts stay at 8');
+    assert.equal(plan.nextAt, ISO(NOW + 5_000), 'connection starts at 5s');
+    assert.equal(plan.fault.retry.attempt, 1, 'planned marker carries the primed attempt');
+    assert.equal(plan.fault.retry.disposition, 'auto', 'planned marker stays auto');
+});

package/dist/core/__tests__/context-intro.test.js

@@ -1,6 +1,6 @@
-// Tests for the <crtr-context> bearings preamble:
-//   1. Worker and orchestrator bearings carry the `<knowledge>` block
-//      (substrate knowledge docs + node-local docs as a file tree).
+// Tests for the <crtr-bearings> preamble:
+//   1. Worker and orchestrator bearings carry the `<memory kind="knowledge">`
+//      block (substrate knowledge docs + node-local docs as a file tree).
 //      Orchestrators add the across-cycles framing; promotion delivers that
 //      same orchestrator context-dir framing to a node that spawned base.
 //   2. canvas-context-intro injects the block as its own session message at
@@ -20,9 +20,14 @@ import { personaDrift } from '../runtime/persona.js';
 import { memoryDir } from '../runtime/memory.js';
 import registerCanvasContextIntro, { buildContextIntro, renderContextMessage, CONTEXT_INTRO_CUSTOM_TYPE, } from '../../pi-extensions/canvas-context-intro.js';
 let home;
+let prevAgentDir;
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-ctxintro-'));
     process.env['CRTR_HOME'] = home;
+    // Isolate pi's global agent dir to an empty path so buildProjectContextBlock
+    // can't pick up the dev machine's real ~/.pi/agent/AGENTS.md (hermeticity).
+    prevAgentDir = process.env['PI_CODING_AGENT_DIR'];
+    process.env['PI_CODING_AGENT_DIR'] = join(home, 'no-agent-dir');
 });
 beforeEach(() => {
     closeDb();
@@ -33,6 +38,10 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
     delete process.env['CRTR_NODE_ID'];
+    if (prevAgentDir === undefined)
+        delete process.env['PI_CODING_AGENT_DIR'];
+    else
+        process.env['PI_CODING_AGENT_DIR'] = prevAgentDir;
 });
 test('worker bearings: base framing + <knowledge> block, NO across-cycles framing', () => {
     // Bug-regression: review finding M1 — buildContextBearings renders the
@@ -44,23 +53,49 @@ test('worker bearings: base framing + <knowledge> block, NO across-cycles framin
     mkdirSync(dir, { recursive: true });
     writeFileSync(join(dir, 'test-ref.md'), '---\nkind: knowledge\nwhen-and-why-to-read: When testing, this reference should be read because it is a regression fixture\nsystem-prompt-visibility: preview\n---\nTest body.\n');
     const block = buildContextIntro(meta.node_id);
-    assert.match(block, new RegExp(`<crtr-context dir="${contextDir(meta.node_id)}">`));
+    assert.match(block, /<crtr-bearings>/, 'opens with the bearings section');
+    assert.ok(block.includes(contextDir(meta.node_id)), 'names the context-dir path inline (no dir= attribute)');
+    assert.doesNotMatch(block, /<crtr-context/, 'no legacy <crtr-context dir=…> wrapper');
+    assert.match(block, /## Your context directory/, 'context dir is its own markdown subsection');
     assert.match(block, /shared document store, not a task tracker/, 'base = shared docs, not tasks');
-    // Knowledge content renders ONLY as the <knowledge> file-tree block.
-    assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
+    // The catalog is a sibling <memory kind="knowledge"> block, never nested
+    // under anything dir-scoped.
+    assert.match(block, /<memory kind="knowledge">/, 'knowledge catalog present as a memory block');
     // Per-store stanza headers (label · dir) never appear.
     assert.doesNotMatch(block, /user-global · /, 'no user-global label·dir stanza');
     assert.doesNotMatch(block, /node-local · /, 'no node-local label·dir stanza');
     // No (empty) placeholder marker.
     assert.doesNotMatch(block, /\(empty\)/, 'no (empty) placeholder');
-    assert.match(block, /<knowledge>/, '<knowledge> block present');
     assert.match(block, /\nknowledge\n/, 'tree headed by the `knowledge` root label');
     // The node-local preview-rung doc renders as a tree entry with a `# read when:`
     // routing line (verbatim previewLine output).
     assert.match(block, /test-ref {2}# read when: When testing, this reference should be read because it is a regression fixture\./, 'node-local preview doc renders its routing line');
+    assert.match(block, /<project_context>/, 'project_context now rides the bearings even without project files');
+    assert.match(block, /<environment cwd="\/tmp\/work">/, 'environment block is always present');
+    assert.match(block, /Directory listing: unavailable \(cwd missing or unreadable\)\./, 'missing cwd degrades the directory listing');
+    assert.match(block, /Git: not a git repository\./, 'missing cwd degrades git info');
     // A terminal worker must NOT carry the orchestrator across-cycles framing.
     assert.doesNotMatch(block, /refresh cycles/, 'no across-cycles framing for a terminal worker');
-    assert.match(block, /<\/crtr-context>/);
+    assert.match(block, /<\/crtr-bearings>/);
+});
+test('project instructions (AGENTS.md/CLAUDE.md) ride the bearings, not the system prompt', () => {
+    // pi's <project_context> is suppressed in the system prompt (broker.ts
+    // noContextFiles) and re-rendered into the first-message bearings here. The
+    // discovery walks the node cwd ancestry, so a CLAUDE.md in the node's cwd must
+    // surface inside a <project_context> block AFTER the <crtr-bearings> block.
+    const proj = mkdtempSync(join(tmpdir(), 'crtr-proj-'));
+    writeFileSync(join(proj, 'CLAUDE.md'), 'PROJECT_MARKER: build then commit.\n');
+    const meta = spawnNode({ kind: 'general', cwd: proj, parent: null });
+    const block = buildContextIntro(meta.node_id);
+    assert.match(block, /<project_context>/, 'project_context block present in the bearings');
+    assert.match(block, new RegExp(`<project_instructions path="${join(proj, 'CLAUDE.md')}">`), 'the project CLAUDE.md is rendered with its path');
+    assert.match(block, /PROJECT_MARKER: build then commit\./, 'project file content rides the message');
+    assert.match(block, /<environment cwd=".*crtr-proj-.*">/, 'environment block is appended inside project_context');
+    assert.match(block, /Directory:\n  CLAUDE\.md\n/, 'environment block includes an ls-style listing');
+    assert.match(block, /Git: not a git repository\./, 'git snapshot degrades cleanly for a non-repo');
+    assert.match(block, /<environment[\s\S]*<\/environment>\n<\/project_context>$/, 'environment block closes project_context');
+    assert.ok(block.indexOf('</crtr-bearings>') < block.indexOf('<project_context>'), 'project_context follows the crtr-bearings block');
+    rmSync(proj, { recursive: true, force: true });
 });
 test('orchestrator bearings: across-cycles framing + node-local substrate docs ride into <knowledge>; a non-substrate .md file is never inlined', () => {
     // Bug-regression: review finding M1 — buildContextBearings renders <knowledge>.
@@ -78,21 +113,20 @@ test('orchestrator bearings: across-cycles framing + node-local substrate docs r
     const block = buildContextIntro(meta.node_id);
     assert.match(block, /shared document store, not a task tracker/, 'still carries the base framing');
     assert.match(block, /refresh cycles/, 'orchestrator gets the across-cycles framing');
-    assert.doesNotMatch(block, /<memory>/, 'no <memory> block');
-    assert.match(block, /<knowledge>/, 'knowledge block present');
+    assert.match(block, /<memory kind="knowledge">/, 'knowledge catalog present as a memory block');
     assert.match(block, /flaky-build {2}# read when: When the build flakes, this reference should be read because the first run fails\./, 'node-local doc renders as a tree entry with its routing line');
     // The non-substrate file never renders: no header line, no pointer line, no path.
     assert.ok(!block.includes('# memory index'), 'the index header comment is NOT inlined');
     assert.ok(!block.includes('- [Flaky build](flaky-build.md)'), 'index pointer lines are NOT inlined');
     assert.ok(!block.includes(legacyIndexPath), 'no absolute index (MEMORY.md) path');
     assert.ok(!block.includes('node-local · '), 'no label·dir stanza header');
-    assert.match(block, /<\/crtr-context>/);
+    assert.match(block, /<\/crtr-bearings>/);
 });
 test('orchestrator bearings: no per-store stanzas or (empty) markers; a rung-none node-local doc still surfaces as a bare-name tree entry', () => {
     // Bug-regression: review findings M1 + M6 — the <knowledge> block carries no
     // per-store `label · dir` stanzas or (empty) markers, and node-local docs are
     // NOT filtered on rung: a migrated node-local doc defaults
-    // system-prompt-visibility: none and must still ride into <knowledge> as
+    // system-prompt-visibility: none and must still ride into the knowledge memory block as
     // its bare name (floored to the `name` rung; never its body).
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
     promote(meta.node_id); // flip to orchestrator mode
@@ -147,7 +181,7 @@ test('session_start injects the block as the first message of an empty session',
     assert.equal(pi.sent.length, 1, 'one message injected');
     assert.equal(pi.sent[0].customType, CONTEXT_INTRO_CUSTOM_TYPE);
     assert.equal(pi.sent[0].display, true);
-    assert.match(pi.sent[0].content, /<crtr-context dir=/);
+    assert.match(pi.sent[0].content, /<crtr-bearings>/);
 });
 test('session_start is idempotent across resume (skips if already in history)', () => {
     const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null });
@@ -177,7 +211,7 @@ test('renderer registered for the customType; collapsed hides body, ctrl+o expan
     registerCanvasContextIntro(pi);
     const renderer = pi.renderers[CONTEXT_INTRO_CUSTOM_TYPE];
     assert.ok(renderer, 'message renderer registered for crtr-context');
-    const body = '<crtr-context dir="/x">\nshared document store\n</crtr-context>';
+    const body = '<crtr-bearings>\nshared document store\n</crtr-bearings>';
     const message = { customType: CONTEXT_INTRO_CUSTOM_TYPE, content: body };
     const theme = {}; // no fg → plain text, easy to assert
     // Collapsed (default): a single stub line, NONE of the body.

package/dist/core/__tests__/daemon-boot.test.js

@@ -1,13 +1,18 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, spawn } from 'node:child_process';
+import { createServer } from 'node:net';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { readInboxSince } from '../feed/inbox.js';
-import { superviseTick } from '../../daemon/crtrd.js';
+import { superviseTick, readPidfile } from '../../daemon/crtrd.js';
+import { verifyDaemonStartup } from '../../daemon/manage.js';
+import { waitForBrokerViewSocket } from '../runtime/placement.js';
+import { viewSocketPath } from '../canvas/paths.js';
+import { signBrandedHostArtifacts, brandedHostWorks } from '../runtime/branded-host.js';
 import { markBusy, clearBusy } from '../runtime/busy.js';
 let home;
 function node(id, over = {}) {
@@ -104,13 +109,203 @@ test('a crashed booted child is revivable, not reaped, and raises no false boot-
     assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
     clearBusy('C2');
 });
-// A still-booting node whose window is alive must be left untouched — boot is
-// slow, and an alive window means pi may still be coming up.
-test('a node with a live window is left alone even before it boots', async () => {
-    // No tmux_session/window → treated as an inline root and skipped entirely,
-    // which exercises the "no placement → not daemon-managed" guard rather than a
-    // false reap. (We avoid depending on a real live tmux window in the test env.)
+// An unplaced active node is not daemon-managed; the daemon leaves it untouched
+// rather than treating the missing broker/session fields as a boot failure.
+test('an unplaced active node is left alone before it boots', async () => {
     createNode(node('S', { status: 'active', pi_session_id: null }));
     await superviseTick();
     assert.equal(getNode('S').status, 'active', 'unplaced active node is not reaped');
 });
+// Major-4: a correctly-dormant idle-release node whose recorded pid was cleared
+// to null by boot reconciliation must NOT be spuriously revived. Its pi_pid is
+// null and pi_session_id is set, so the pid-null branch would otherwise read it
+// as a "stranded relaunch" and grace-revive it — even though it freed itself on
+// purpose and has no unseen inbox. The pid-null branch must honor idle-release
+// dormancy the same way the dead-pid branch does: leave it idle; only the second
+// pass wakes it, and only on an unseen inbox entry.
+test('idle-release node with a boot-cleared (null) pid and no unseen inbox stays dormant', async () => {
+    createNode(node('D', {
+        status: 'idle',
+        intent: 'idle-release',
+        pi_pid: null, // cleared by boot reconciliation
+        pi_session_id: '019e8f00-freed-while-dormant', // set → would look like a stranded relaunch
+    }));
+    const t0 = Date.now();
+    await superviseTick(t0); // first observation
+    await superviseTick(t0 + 60_000); // well past the boot grace
+    const after = getNode('D');
+    assert.equal(after.status, 'idle', 'dormant idle-release node is left idle, not revived');
+    assert.equal(after.intent, 'idle-release', 'intent unchanged — no revive fired');
+    assert.equal(after.pi_pid, null, 'no fresh pid — reviveNode was never invoked');
+});
+// Daemon start guard: spawnDaemon must not report success before the daemon is
+// plausibly alive and has written its pidfile. This is a pure bounded poll over
+// injected clocks/probes, so we can lock it down deterministically without a
+// real daemon process.
+test('verifyDaemonStartup waits for pidfile + live pid, then reports success for the spawned pid', async () => {
+    let now = 0;
+    let pidfileReady = false;
+    let pidAliveReady = false;
+    let slept = 0;
+    const existingPid = await verifyDaemonStartup(42, 50, {
+        now: () => now,
+        readPidfile: () => (pidfileReady ? 42 : null),
+        isPidAlive: () => pidAliveReady,
+        sleepMs: (ms) => {
+            slept += ms;
+            now += ms;
+            if (now >= 20)
+                pidfileReady = true;
+            if (now >= 30)
+                pidAliveReady = true;
+        },
+    });
+    assert.equal(existingPid, null, 'the spawned daemon owns the pidfile when startup succeeds');
+    assert.equal(pidfileReady, true, 'pidfile must have appeared before success');
+    assert.equal(pidAliveReady, true, 'pid must have been alive before success');
+    assert.equal(slept > 0, true, 'the guard must actually poll');
+});
+// Regression for the cold-guest recreate blocker: the production startup window
+// must tolerate a slower cold start than the old 500ms bound.
+test('verifyDaemonStartup default window tolerates a slower cold start', async () => {
+    let now = 0;
+    let pidfileReady = false;
+    let pidAliveReady = false;
+    const existingPid = await verifyDaemonStartup(42, undefined, {
+        now: () => now,
+        readPidfile: () => (pidfileReady ? 42 : null),
+        isPidAlive: () => pidAliveReady,
+        sleepMs: (ms) => {
+            now += ms;
+            if (now >= 600)
+                pidfileReady = true;
+            if (now >= 700)
+                pidAliveReady = true;
+        },
+    });
+    assert.equal(existingPid, null, 'the production startup window must allow a cold guest to settle');
+});
+// A concurrent start race is success when another live daemon already owns the
+// pidfile; the loser must return that existing pid instead of timing out.
+test('verifyDaemonStartup returns the existing live daemon when another pid won the startup race', async () => {
+    let now = 0;
+    let slept = 0;
+    const existingPid = await verifyDaemonStartup(42, 50, {
+        now: () => now,
+        readPidfile: () => 7,
+        isPidAlive: (pid) => pid === 7,
+        sleepMs: (ms) => {
+            slept += ms;
+            now += ms;
+        },
+    });
+    assert.equal(existingPid, 7, 'the live pidfile owner must be reported back');
+    assert.equal(slept, 0, 'no polling is needed once another live daemon is visible');
+});
+// The guard stays bounded: if the daemon never becomes ready, it throws instead
+// of claiming "started" forever.
+test('verifyDaemonStartup throws after its tiny startup window expires', async () => {
+    let now = 0;
+    await assert.rejects(async () => verifyDaemonStartup(99, 25, {
+        now: () => now,
+        readPidfile: () => null,
+        isPidAlive: () => false,
+        sleepMs: (ms) => {
+            now += ms;
+        },
+    }), /did not become ready within 25ms/);
+});
+// REGRESSION (bug #102): the verifier polls with a real async sleep, NOT a
+// synchronous Atomics.wait, so the event loop stays free to dispatch the spawned
+// child's `exit` event. We spawn a REAL child that exits immediately and let the
+// real wall clock + real setTimeout sleep drive the loop: the exit event fires
+// mid-wait, childExited() flips non-null, and the verifier fails fast with the
+// exit reason — well inside the 2s window. If the loop blocked the event loop
+// (the old bug), the exit event would never fire and this would time out with the
+// generic message instead.
+test('verifyDaemonStartup throws when the spawned daemon exits before it can become ready', async () => {
+    let exited = null;
+    const child = spawn(process.execPath, ['-e', 'process.exit(1)'], { stdio: 'ignore' });
+    child.once('exit', (code, signal) => {
+        exited = { code, signal };
+    });
+    const started = Date.now();
+    await assert.rejects(async () => verifyDaemonStartup(77, 2_000, {
+        readPidfile: () => null,
+        isPidAlive: () => false,
+        childExited: () => exited,
+    }), /exited before becoming ready \(with exit code 1\)/);
+    assert.ok(Date.now() - started < 1_500, 'must fail fast on the real child exit, not run out the window');
+});
+test('the daemon honours an explicit CRTR_PIDFILE override', () => {
+    const home = mkdtempSync(join(tmpdir(), 'crtr-pidfile-home-'));
+    const pidfile = join(home, 'crtrd.pid');
+    const prevHome = process.env['CRTR_HOME'];
+    const prevPidfile = process.env['CRTR_PIDFILE'];
+    process.env['CRTR_HOME'] = mkdtempSync(join(tmpdir(), 'crtr-home-'));
+    process.env['CRTR_PIDFILE'] = pidfile;
+    writeFileSync(pidfile, '321');
+    try {
+        assert.equal(readPidfile(), 321, 'the daemon must read its pidfile from CRTR_PIDFILE, not CRTR_HOME');
+    }
+    finally {
+        if (prevHome === undefined)
+            delete process.env['CRTR_HOME'];
+        else
+            process.env['CRTR_HOME'] = prevHome;
+        if (prevPidfile === undefined)
+            delete process.env['CRTR_PIDFILE'];
+        else
+            process.env['CRTR_PIDFILE'] = prevPidfile;
+    }
+});
+// REGRESSION (bug #102 follow-up): with NO exit promise, the readiness loop must
+// still observe a real `connect`. A buggy `?? Promise.resolve('retry')` race lost
+// to the probe instantly, so live-broker callers (focus on an already-alive node,
+// canvas-tmux-spread) could never return true and stalled the full 30s deadline.
+test('waitForBrokerViewSocket returns true on a live socket when given no exit promise', async () => {
+    // CRTR_SOCK_DIR override keeps the AF_UNIX path short — the temp CRTR_HOME path
+    // would blow past macOS's 104-byte sun_path limit (listen EINVAL).
+    const sockDir = mkdtempSync('/tmp/crtr-sock-');
+    process.env['CRTR_SOCK_DIR'] = sockDir;
+    const nodeId = 'lb';
+    const sockPath = viewSocketPath(nodeId);
+    const server = createServer();
+    await new Promise((resolve) => server.listen(sockPath, () => resolve()));
+    try {
+        const started = Date.now();
+        const ready = await waitForBrokerViewSocket(nodeId);
+        assert.equal(ready, true, 'a live accepting socket must report ready even without an exit promise');
+        assert.ok(Date.now() - started < 1_000, 'readiness must resolve promptly, not stall the full deadline');
+    }
+    finally {
+        await new Promise((resolve) => server.close(() => resolve()));
+        delete process.env['CRTR_SOCK_DIR'];
+        rmSync(sockDir, { recursive: true, force: true });
+    }
+});
+test('waitForBrokerViewSocket returns false as soon as the real broker process exits', async () => {
+    const child = spawn(process.execPath, ['-e', 'process.exit(1)'], { stdio: 'ignore' });
+    const exited = new Promise((resolve) => {
+        child.once('exit', (code, signal) => {
+            resolve({ code, signal });
+        });
+    });
+    const started = Date.now();
+    const ready = await waitForBrokerViewSocket('dead-broker-for-readiness-test', exited);
+    assert.equal(ready, false, 'an exited broker must fail readiness');
+    assert.ok(Date.now() - started < 1000, 'the readiness guard must fail fast instead of waiting for the socket deadline');
+});
+test('signBrandedHostArtifacts signs the copied libnode before the branded binary', () => {
+    const signed = [];
+    signBrandedHostArtifacts('/tmp/crouter', '/tmp/libnode.dylib', (path) => signed.push(path));
+    assert.deepEqual(signed, ['/tmp/libnode.dylib', '/tmp/crouter']);
+});
+test('brandedHostWorks health-checks if a binary is executable', () => {
+    // Issue #102: the branded host binary can be corrupted or killed by macOS
+    // before exec, causing spawn() to fail silently. The health-check detects this.
+    const goodBin = process.execPath; // a real, executable binary
+    const badBin = '/nonexistent/crouter-broken';
+    assert.equal(brandedHostWorks(goodBin), true, 'health-check passes for a real executable binary');
+    assert.equal(brandedHostWorks(badBin), false, 'health-check fails for a nonexistent binary');
+});