@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/core/__tests__/hearth-bootstrap.test.js

@@ -0,0 +1,136 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildBootstrapScript } from '../hearth/providers/blaxel-bootstrap.js';
+const FIRST_BOOT_OPTS = {
+    guestHome: '/home/agent',
+    crtrVersion: '0.3.33',
+    relayToken: 'relay-token',
+    webPort: 7878,
+    piAuthJson: '{"anthropic":{"type":"oauth","refresh":"r","access":"a","expires":1}}',
+    piPackages: ['npm:pi-claude-oauth-adapter@0.1.2'],
+    modelLaddersJson: '{"modelLadders":{"anthropic":{"strong":"anthropic/claude-opus-4-8:high"},"openai":{"strong":"openai-codex/gpt-5.5:high"},"defaultProvider":"anthropic"}}',
+    isFirstProvision: true,
+};
+function indexOf(script, needle) {
+    const i = script.indexOf(needle);
+    assert.ok(i !== -1, `expected to find ${JSON.stringify(needle)} in script`);
+    return i;
+}
+test('first provision seeds config/ladders and pi settings, never the rotation pool, and never installs', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    // Seeds that DO belong (config template + model ladders + pi settings +
+    // optional single auth.json).
+    assert.match(script, /settings\.json/);
+    assert.match(script, /pi-crtr-extensions/);
+    assert.match(script, /CRTR_CONFIG_JSON/);
+    assert.match(script, /PI_AUTH_JSON/);
+    // The rotation pool is dead product — bridge/migration only, never emitted
+    // by the rewritten bootstrap regardless of opts shape.
+    assert.doesNotMatch(script, /ANTHROPIC_SUBSCRIPTIONS_JSON/);
+    assert.doesNotMatch(script, /OPENAI_CODEX_SUBSCRIPTIONS_JSON/);
+    assert.doesNotMatch(script, /PROVIDER_ROTATION_JSON/);
+    assert.doesNotMatch(script, /anthropic-subscriptions\.json/);
+    assert.doesNotMatch(script, /openai-codex-subscriptions\.json/);
+    assert.doesNotMatch(script, /provider-rotation\.json/);
+    // No boot-time install of any kind — the image bakes crtr; bootstrap only
+    // asserts it.
+    assert.doesNotMatch(script, /npm install/);
+});
+test('recreate (isFirstProvision:false) emits no seeds at all and revives the existing node', () => {
+    const script = buildBootstrapScript({
+        ...FIRST_BOOT_OPTS,
+        isFirstProvision: false,
+        nodeId: 'node-123',
+    });
+    assert.doesNotMatch(script, /settings\.json/);
+    assert.doesNotMatch(script, /CRTR_CONFIG_JSON/);
+    assert.doesNotMatch(script, /PI_AUTH_JSON/);
+    assert.doesNotMatch(script, /ANTHROPIC_SUBSCRIPTIONS_JSON/);
+    assert.doesNotMatch(script, /OPENAI_CODEX_SUBSCRIPTIONS_JSON/);
+    assert.doesNotMatch(script, /PROVIDER_ROTATION_JSON/);
+    assert.match(script, /'\/usr\/local\/bin\/crtr' canvas revive 'node-123'/);
+    assert.doesNotMatch(script, /node new --root/);
+});
+test('recreate without a nodeId fails fast at script-generation time, not inside the guest', () => {
+    assert.throws(() => buildBootstrapScript({ ...FIRST_BOOT_OPTS, isFirstProvision: false, nodeId: null }));
+    assert.throws(() => buildBootstrapScript({ ...FIRST_BOOT_OPTS, isFirstProvision: false, nodeId: '  ' }));
+});
+test('an empty relay token fails fast at script-generation time — the web lane must never bind unauthenticated', () => {
+    assert.throws(() => buildBootstrapScript({ ...FIRST_BOOT_OPTS, relayToken: '' }));
+    assert.throws(() => buildBootstrapScript({ ...FIRST_BOOT_OPTS, relayToken: '   ' }));
+});
+test('asserts the baked crtr command surface — never falls back to the retired top-level alias', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /'\/usr\/local\/bin\/crtr' surface web -h/);
+    assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve -h/);
+    assert.match(script, /command surface assertion FAILED/);
+    assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve --host 0\.0\.0\.0/);
+    // Never the retired top-level alias, anywhere in the script (e.g. as a
+    // fallback if the surface assertion fails).
+    assert.doesNotMatch(script, /[^/]crtr web serve/);
+});
+test('asserts the pinned crtr version against the baked binary and fails closed on mismatch', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /'\/usr\/local\/bin\/crtr' --json sys version/);
+    assert.match(script, /crtr version assertion FAILED/);
+    assert.match(script, /!= '0\.3\.33'/);
+});
+test('every web-serve invocation carries a non-empty --token, enforcing relay-token auth on every lane', () => {
+    const firstBoot = buildBootstrapScript(FIRST_BOOT_OPTS);
+    const recreate = buildBootstrapScript({ ...FIRST_BOOT_OPTS, isFirstProvision: false, nodeId: 'node-123' });
+    for (const script of [firstBoot, recreate]) {
+        const serveLine = script.split('\n').find((line) => line.includes('surface web serve --host'));
+        assert.ok(serveLine, 'expected a crtr surface web serve invocation');
+        assert.match(serveLine, /--token 'relay-token'/);
+    }
+});
+test('every crtr invocation targets the baked binary by absolute path, never a bare PATH lookup, defeating a stale volume-installed crtr shadowing it (review Major 1)', () => {
+    const firstBoot = buildBootstrapScript(FIRST_BOOT_OPTS);
+    const recreate = buildBootstrapScript({ ...FIRST_BOOT_OPTS, isFirstProvision: false, nodeId: 'node-123' });
+    for (const script of [firstBoot, recreate]) {
+        assert.match(script, /'\/usr\/local\/bin\/crtr' --json sys version/);
+        assert.match(script, /'\/usr\/local\/bin\/crtr' surface web -h/);
+        assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve -h/);
+        assert.match(script, /'\/usr\/local\/bin\/crtr' canvas daemon start/);
+        assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve --host 0\.0\.0\.0/);
+        // No bare `crtr <subcommand>` invocation anywhere — only the `command -v
+        // crtr` shadow-detection probe and human-readable error-message text are
+        // allowed to reference it by bare name.
+        const bareInvocations = script
+            .split('\n')
+            .filter((line) => !line.trim().startsWith('printf'))
+            .filter((line) => /(^|[\s(])crtr (canvas|surface|--json)/.test(line));
+        assert.deepEqual(bareInvocations, []);
+    }
+    assert.match(firstBoot, /'\/usr\/local\/bin\/crtr' --json node new --root/);
+});
+test('asserts a bare `crtr` PATH lookup resolves to the baked binary, catching a stale volume-installed crtr shadowing it', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /resolved_crtr="\$\(command -v crtr 2>\/dev\/null \|\| true\)"/);
+    assert.match(script, /if \[ "\$resolved_crtr" != '\/usr\/local\/bin\/crtr' \]; then/);
+    assert.match(script, /stale crtr shadowing baked binary/);
+});
+test('exports a PATH with the baked /usr/local/bin ahead of the legacy (dead) per-home runtime bin dir', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /export PATH='\/usr\/local\/bin:\/usr\/bin:\/bin'/);
+    assert.doesNotMatch(script, /crtr-runtime\/bin/);
+});
+test('mkdirs the tmpfs CRTR_SOCK_DIR/CRTR_PIDFILE dirs strictly before the daemon starts, and CRTR_CANVAS_DB stays unset', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /export CRTR_SOCK_DIR='\/run\/crtr\/socks'/);
+    assert.match(script, /export CRTR_PIDFILE='\/run\/crtr\/crtrd\.pid'/);
+    assert.match(script, /export CRTR_HOME='\/home\/agent\/\.crouter\/canvas'/);
+    assert.doesNotMatch(script, /CRTR_CANVAS_DB=/);
+    assert.match(script, /unset CRTR_CANVAS_DB/);
+    const mkdirIdx = indexOf(script, '/run/crtr/socks');
+    const daemonStartIdx = indexOf(script, "'/usr/local/bin/crtr' canvas daemon start");
+    assert.ok(mkdirIdx < daemonStartIdx, 'tmpfs mkdir must precede daemon start');
+    const mkdirLine = script.split('\n').find((line) => line.startsWith('mkdir -p') && line.includes('/run/crtr/socks'));
+    assert.ok(mkdirLine, 'expected a single mkdir line covering the tmpfs dirs');
+});
+test('primes the baked pi Claude OAuth adapter into the npm cache path pi resolves, existence-gated', () => {
+    const script = buildBootstrapScript(FIRST_BOOT_OPTS);
+    assert.match(script, /\/opt\/crouter\/node_modules\/pi-claude-oauth-adapter/);
+    assert.match(script, /\.pi\/agent\/npm\/node_modules\/pi-claude-oauth-adapter/);
+    assert.match(script, /cp -R/);
+});

package/dist/core/__tests__/helpers/harness.d.ts

@@ -76,7 +76,7 @@ export interface Harness {
     spawnHeadlessChild(parentId: string, task: string, o?: SpawnOpts): Promise<string>;
     spawnHeadlessChildNoBoot(parentId: string, task: string, o?: SpawnOpts): Promise<string>;
     turn(nodeId: string, text?: string): Promise<void>;
-    stop(nodeId: string, reason?: 'stop' | 'length' | 'aborted' | 'error'): Promise<void>;
+    stop(nodeId: string, reason?: 'stop' | 'length' | 'aborted' | 'error', errorMessage?: string): Promise<void>;
     finish(nodeId: string, finalText: string): Promise<void>;
     tick(now?: number): Promise<void>;
     awaitBoot(nodeId: string, o?: {

package/dist/core/__tests__/helpers/harness.js

@@ -344,7 +344,7 @@ export async function createHarness(opts = {}) {
         async spawnHeadlessChild(parentId, task, o = {}) {
             const before = new Set(nodeDirs());
             // POST-CUT: `--headless` is gone — EVERY node is a broker. spawnChild may
-            // still open a background `crtr attach` viewer WINDOW (the §A.3 spawn UX),
+            // still open a background `crtr surface attach` viewer WINDOW (the §A.3 spawn UX),
             // but that viewer connects to the broker over view.sock as a SEPARATE
             // process and never touches the engine — so the broker-socket gates here
             // (zero-viewer dialogs, controller arbitration, one-writer) are unaffected
@@ -389,9 +389,9 @@ export async function createHarness(opts = {}) {
             sendCmd(nodeId, { cmd: 'turn', id: `turn-${Date.now()}`, text });
             await awaitAgentEnd(nodeId, base, `turn agent_end for ${nodeId}`);
         },
-        async stop(nodeId, reason = 'stop') {
+        async stop(nodeId, reason = 'stop', errorMessage) {
             const base = eventCount(nodeId, 'agent_end');
-            sendCmd(nodeId, { cmd: 'stop', id: `stop-${Date.now()}`, reason });
+            sendCmd(nodeId, { cmd: 'stop', id: `stop-${Date.now()}`, reason, errorMessage });
             await awaitAgentEnd(nodeId, base, `stop agent_end for ${nodeId}`);
         },
         async finish(nodeId, finalText) {

package/dist/core/__tests__/human-stranded-deliver.test.js

@@ -22,7 +22,7 @@ import { closeDb } from '../canvas/db.js';
 import { readInboxSince } from '../feed/inbox.js';
 import { interactionDir, interactionsRoot } from '../artifact.js';
 import { atomicWriteJson, deckPath } from '@crouton-kit/humanloop';
-import { finalizeResolvedInteraction } from '../../commands/human/queue.js';
+import { finalizeResolvedInteraction, acquireInteractionClaim } from '../../commands/human/queue.js';
 let home;
 // A unique cwd so interactionDir (keyed off the REAL homedir + mangled cwd, NOT
 // CRTR_HOME) lands in an isolated, cleanable subtree.
@@ -96,6 +96,43 @@ test('a canceled-on-disk response reaps the bridge without delivering a result',
     const blob = JSON.stringify(readInboxSince('A'));
     assert.match(blob, /no answer is coming/);
 });
+test('the _run held-claim path delivers, and finalize without the claim self-conflicts', async () => {
+    // BUG REGRESSION (_run ask self-claim): the detached `_run` ask worker holds
+    // the exclusive resolve.lock across the blocking ask(), then must deliver the
+    // answer. If it calls finalizeResolvedInteraction WITHOUT passing its held
+    // claim, finalize re-acquires the same lock, sees this very process's live
+    // lock (EEXIST, owner.pid == self, pidAlive true) -> 'claimed' -> returns
+    // false, and the human's answer never reaches the asker. Passing the held
+    // claim lets finalize run under the worker's own lock.
+    createNode(node('A', null));
+    createNode(node('B', 'A'));
+    subscribe('A', 'B');
+    // Set up the deck + run.json but NOT the answer yet, then hold the claim
+    // exactly as the _run worker does (no opts) BEFORE ask() resolves the deck.
+    const idir = interactionDir('B', workCwd);
+    mkdirSync(idir, { recursive: true });
+    atomicWriteJson(deckPath(idir), { interactions: [] });
+    atomicWriteJson(join(idir, 'run.json'), { mode: 'ask', job_id: 'B' });
+    const claim = acquireInteractionClaim(idir, 'B');
+    assert.equal(typeof claim === 'object', true, 'claim must be acquired');
+    if (typeof claim !== 'object')
+        return;
+    // ask() then writes the human's answer to disk while the claim is held.
+    atomicWriteJson(join(idir, 'response.json'), {
+        responses: [{ id: 'q', selectedOptionId: 'resync', freetext: 'go ahead' }],
+        completedAt: '2026-06-10T22:27:07.000Z',
+    });
+    // Without the held claim, finalize from the SAME pid self-conflicts on the
+    // live lock and must NOT deliver (this is the stranding regression).
+    assert.equal(await finalizeResolvedInteraction('B'), false, 'self-held lock must block claimless finalize');
+    assert.equal(getNode('B')?.status, 'active', 'bridge must still be live after the self-conflicting call');
+    // Passing the held claim lets finalize run under the worker's own lock and
+    // deliver the answer back to the asker, then reap the bridge.
+    assert.equal(await finalizeResolvedInteraction('B', claim), true, 'held claim must deliver');
+    assert.equal(getNode('B')?.status, 'done', 'bridge reaped after held-claim deliver');
+    assert.match(JSON.stringify(readInboxSince('A')), /resync/, 'asker must receive the human selection');
+    claim.release();
+});
 test('an unresolved (no response.json) live bridge is left untouched', async () => {
     createNode(node('A', null));
     createNode(node('B', 'A'));

package/dist/core/__tests__/human-surface-target.test.js

@@ -1,6 +1,6 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/human-surface-target.test.ts
 //
-// BUG REGRESSION: `crtr human ask|approve|review|notify` surfaced its humanloop
+// BUG REGRESSION: `crtr human ask|review|notify` surfaced its humanloop
 // TUI in the backstage `crtr` session (the asking node's own pane) — a session
 // the user never watches — because spawnAndDetach was called with no `-t`
 // target. The fix routes the TUI to the HIGHEST FOCUSED node of the asking

package/dist/core/__tests__/kickoff.test.js

@@ -8,7 +8,7 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, subscribe } from '../canvas/canvas.js';
 import { reportsDir } from '../canvas/paths.js';
@@ -29,9 +29,7 @@ function node(id) {
     };
 }
 before(() => {
-    // Under homedir (not tmpdir) so report paths fall under the home prefix and
-    // exercise the tildify() collapse in reportHistoryLines.
-    home = mkdtempSync(join(homedir(), '.crtr-kickoff-'));
+    home = mkdtempSync(join(tmpdir(), 'crtr-kickoff-'));
     process.env['CRTR_HOME'] = home;
 });
 beforeEach(() => {
@@ -76,10 +74,10 @@ test('the feed block frames awaiting workers as alive + auto-waking, so a fresh
 test('a fresh revive is pointed at its subscriptions\' on-disk report history (catch-up bug)', () => {
     // Regression for the fresh-revive catch-up bug: on a refresh-yield
     // (resume:false) the old conversation is gone AND the inbox cursor has already
-    // advanced past everything drained pre-yield, so the revived node loses sight
-    // of reports its subscriptions pushed BEFORE the yield. The bodies persist
-    // forever at reports/<ts>-<kind>.md; the kickoff must point the node at those
-    // existing paths so it can catch up. Asserts the paths are rendered.
+    // advanced past everything drained pre-yield, so the revived node needs a
+    // durable catch-up breadcrumb for reports its subscriptions pushed BEFORE the
+    // yield. The bodies persist forever at reports/<ts>-<kind>.md; the kickoff
+    // surfaces a collapsed index with the newest ref and expansion commands.
     const parent = createNode(node('p1'));
     const worker = createNode(node('w1'));
     subscribe(parent.node_id, worker.node_id);
@@ -91,17 +89,18 @@ test('a fresh revive is pointed at its subscriptions\' on-disk report history (c
     writeFileSync(older, '---\n---\nearly progress', 'utf8');
     writeFileSync(newer, '---\n---\nthe result', 'utf8');
     const msg = buildReviveKickoff(parent, drainBearings(parent));
-    // Both existing report PATHS surface (most recent first), so the revived node
-    // can dereference the history its advanced cursor would otherwise hide. They
-    // render home-relative with a leading ~ (the absolute home prefix is wasted
-    // context tokens; ~ is still dereferenceable by the revived node).
-    const olderRel = '~' + older.slice(homedir().length);
-    const newerRel = '~' + newer.slice(homedir().length);
-    assert.ok(msg.includes(olderRel), 'older report path surfaced, home-relative (~)');
-    assert.ok(msg.includes(newerRel), 'newer report path surfaced, home-relative (~)');
-    assert.ok(!msg.includes(older), 'absolute home prefix not rendered');
-    assert.ok(msg.indexOf(newerRel) < msg.indexOf(olderRel), 'most recent report listed first');
-    // ...and the hint that the full inbox history is replayable cursor-independently.
+    // The feed block stays condensed: it reports that history exists and surfaces
+    // the newest report ref for immediate dereference, while older refs stay one
+    // command away instead of being preloaded into the revive prompt.
+    const olderRef = `${worker.node_id}:reports/20260608T120000-update.md`;
+    const newerRef = `${worker.node_id}:reports/20260608T130000-final.md`;
+    assert.ok(/Report history on disk \(collapsed\): 2 reports across 1 subscribed node/.test(msg));
+    assert.ok(msg.includes(`latest final: ${newerRef}`), 'newest report ref surfaced');
+    assert.ok(!msg.includes(olderRef), 'older report ref omitted from collapsed kickoff');
+    assert.ok(!msg.includes(older), 'absolute report paths not rendered');
+    assert.ok(!msg.includes(newer), 'absolute report paths not rendered');
+    assert.ok(/canvas history read <ref>/.test(msg), 'points at one-report expansion');
+    assert.ok(/canvas history show <node-id> --type report/.test(msg), 'points at full per-node expansion');
     assert.ok(/feed read --all/.test(msg), 'points at the cursor-independent full-history replay');
 });
 test('buildReviveKickoff is pure — building twice eats nothing', () => {

package/dist/core/__tests__/live-mutation-verbs.test.js

@@ -8,9 +8,9 @@
 //
 // THREE-PART LOCK HEADER ──────────────────────────────────────────────────
 // (1) BUG LOCKED — the demote/recycle SPLIT and the A4 steer-loss boundary:
-//     • `node demote` flips lifecycle→TERMINAL IN PLACE — keeps MODE, parentage,
+//     • `node lifecycle demote` flips lifecycle→TERMINAL IN PLACE — keeps MODE, parentage,
 //       and a live (active) status; NOT finalized. It is NOT a mode flip.
-//     • `node recycle` is FINISH+RECYCLE — pushes a final → done (mode KEPT), and
+//     • `node lifecycle recycle` is FINISH+RECYCLE — pushes a final → done (mode KEPT), and
 //       mints a DIFFERENT fresh general/base/resident root.
 //     • A4: a base→orchestrator yield auto-promotes (mode→orchestrator) and sets
 //       intent=refresh but NEVER commits persona_ack — the drift is left pending
@@ -49,16 +49,16 @@ function persona(m) {
 }
 // ===========================================================================
 // (b) THE demote / recycle SPLIT — two DISTINCT verbs:
-//   • `node demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
+//   • `node lifecycle demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
 //     its MODE and parentage, keeps running (active), is NOT finalized; it now
 //     merely owes a final up the spine (vision F5). MODE is untouched.
-//   • `node recycle` is FINISH+RECYCLE — push final → done, then recycle the pane
+//   • `node lifecycle recycle` is FINISH+RECYCLE — push final → done, then recycle the pane
 //     into a FRESH general/base/resident root (a DIFFERENT node). The recycled
 //     node keeps mode=orchestrator (it is merely `done`).
 // This test drives demote via the real CLI verb and recycle via the real
 // recycleNode, pinning each behavior at the model layer.
 // ===========================================================================
-test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RECYCLE', { timeout: 20_000 }, async () => {
+test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle recycle is FINISH+RECYCLE', { timeout: 20_000 }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-demote' });
     try {
         const A = h.spawnRoot('resident root');
@@ -66,7 +66,7 @@ test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RE
         subscribe(A, B, true);
         // Make B resident + orchestrator so the demote's flip→terminal is visible
         // and we can prove MODE/parentage survive it.
-        assert.equal(h.cli(B, ['node', 'lifecycle', 'resident', '--node', B]).code, 0, 'B → resident');
+        assert.equal(h.cli(B, ['node', 'config', '--lifecycle', 'resident', '--node', B]).code, 0, 'B → resident');
         assert.equal(h.cli(B, ['node', 'promote', '--kind', 'developer']).code, 0, 'promote B');
         {
             const b = h.node(B);
@@ -74,10 +74,10 @@ test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RE
             assert.equal(b.mode, 'orchestrator', 'B orchestrator before demote');
         }
         const bParent = h.node(B).parent;
-        // --- node demote: flip-to-terminal IN PLACE. Keeps B alive, MODE/parentage
+        // --- node lifecycle demote: flip-to-terminal IN PLACE. Keeps B alive, MODE/parentage
         //     untouched, NOT finalized.
-        const dem = h.cli(B, ['node', 'demote', '--node', B]);
-        assert.equal(dem.code, 0, `node demote exit 0\n${dem.stderr}`);
+        const dem = h.cli(B, ['node', 'lifecycle', 'demote', '--node', B]);
+        assert.equal(dem.code, 0, `node lifecycle demote exit 0\n${dem.stderr}`);
         assert.match(dem.stdout, /^Demoted /, `demote rendered\n${dem.stdout}`);
         {
             const b = h.node(B);
@@ -87,7 +87,7 @@ test('node demote flips lifecycle→terminal IN PLACE; node recycle is FINISH+RE
             assert.equal(b.status, 'active', 'demote does NOT finish B — it keeps running in place');
             assert.notEqual(b.intent ?? null, 'done', 'demote does NOT finalize B');
         }
-        // --- node recycle: FINISH + RECYCLE. Driven through the real recycleNode.
+        // --- node lifecycle recycle: FINISH + RECYCLE. Driven through the real recycleNode.
         //     Its FINISH+MINT model half runs fully; the pane respawn is the only
         //     tmux artifact (no pane for a broker node), so recycled:false while
         //     finalized:true and a fresh root IS minted — the bug-lock (recycle ≠

package/dist/core/__tests__/live-mutation.test.js

@@ -2,7 +2,7 @@
 //
 // HEADLESS RETARGET (foundation-spec §C.12 + §E). AXIS: LIVE MUTATION of the
 // 2×2 state vector (mode {base,orchestrator} × lifecycle {terminal,resident})
-// driven through the REAL `node lifecycle` / `node promote` CLI verbs against
+// driven through the REAL `node config --lifecycle` / `node promote` CLI verbs against
 // FABRICATED broker-hosted (paneless) nodes — no real tmux session, no pane
 // chrome, and NO real broker boot. The mutation verbs and the decisions they
 // gate are host-independent model logic, so the file never pays the ~5s SDK-boot
@@ -50,7 +50,7 @@ function persona(m) {
 }
 const SIGNALS = { pushedFinal: false, askedHuman: false };
 // ===========================================================================
-// (a) LIFECYCLE FLIP — `crtr node lifecycle` on a LIVE node, both directions,
+// (a) LIFECYCLE FLIP — `crtr node config --lifecycle` on a LIVE node, both directions,
 //     observing the idle-release DECISION change. A round-trip on ONE node
 //     (terminal→resident→terminal) proves both directions: a flipped-resident
 //     node no longer idle-releases (evaluateStop → dormant); flipped-terminal it
@@ -86,13 +86,13 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
         // --- FLIP 1: terminal → RESIDENT (live). Oracle §4: sets lifecycle + the
         //     launch spec, status/intent UNTOUCHED. ---
         {
-            const res = h.cli(B, ['node', 'lifecycle', 'resident', '--node', B]);
-            assert.equal(res.code, 0, `lifecycle resident exit 0\n${res.stderr}`);
+            const res = h.cli(B, ['node', 'config', '--lifecycle', 'resident', '--node', B]);
+            assert.equal(res.code, 0, `config --lifecycle resident exit 0\n${res.stderr}`);
             const b = h.node(B);
             assert.equal(b.lifecycle, 'resident', 'B → resident');
             assert.equal(b.mode, 'base', 'mode UNCHANGED by a lifecycle flip (orthogonal axis)');
-            assert.equal(b.status, 'active', 'status UNTOUCHED by node lifecycle (oracle §4)');
-            assert.equal(b.intent ?? null, null, 'intent UNTOUCHED by node lifecycle (oracle §4)');
+            assert.equal(b.status, 'active', 'status UNTOUCHED by node config --lifecycle (oracle §4)');
+            assert.equal(b.intent ?? null, null, 'intent UNTOUCHED by node config --lifecycle (oracle §4)');
         }
         // THE SUPPRESSION LOCK — as RESIDENT, B's stop is 'dormant' (NOT awaiting):
         // a resident node is never forced to submit a final, so it does NOT idle-
@@ -108,8 +108,8 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
         }
         // --- FLIP 2: resident → TERMINAL (live), on the now-resident node. ---
         {
-            const res = h.cli(B, ['node', 'lifecycle', 'terminal', '--node', B]);
-            assert.equal(res.code, 0, `lifecycle terminal exit 0\n${res.stderr}`);
+            const res = h.cli(B, ['node', 'config', '--lifecycle', 'terminal', '--node', B]);
+            assert.equal(res.code, 0, `config --lifecycle terminal exit 0\n${res.stderr}`);
             const b = h.node(B);
             assert.equal(b.lifecycle, 'terminal', 'B → terminal');
             assert.equal(b.status, 'active', 'status still UNTOUCHED by the flip');

package/dist/core/__tests__/migration.test.js

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { openDb, closeDb, migrate, MIGRATIONS } from '../canvas/db.js';
 import { canvasDbPath, ensureHome } from '../canvas/paths.js';
+import { listTriggers } from '../canvas/triggers.js';
 const RUNTIME_COLUMNS = ['intent', 'pi_pid', 'window', 'tmux_session'];
 let home;
 function userVersion(db) {
@@ -219,20 +220,178 @@ test('v4 is idempotent on re-open', () => {
     assert.equal(userVersion(db2), MIGRATIONS.length);
     assert.equal(edgeCount(db2), 1);
 });
-test('migration is idempotent on re-open and on re-run', () => {
-    // First open migrates v0 -> latest.
+function buildV4DbWithLaterColumns() {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    raw.exec(`
+    CREATE TABLE nodes (
+      node_id    TEXT PRIMARY KEY,
+      name       TEXT NOT NULL,
+      kind       TEXT NOT NULL,
+      mode       TEXT NOT NULL DEFAULT 'base',
+      lifecycle  TEXT NOT NULL DEFAULT 'terminal',
+      status     TEXT NOT NULL DEFAULT 'active',
+      cwd        TEXT NOT NULL,
+      parent     TEXT,
+      created    TEXT NOT NULL,
+      intent       TEXT,
+      pi_pid       INTEGER,
+      window       TEXT,
+      tmux_session TEXT,
+      pane         TEXT,
+      host_kind    TEXT
+    );
+    CREATE TABLE edges (
+      type     TEXT NOT NULL,
+      from_id  TEXT NOT NULL,
+      to_id    TEXT NOT NULL,
+      active   INTEGER NOT NULL DEFAULT 1,
+      created  TEXT NOT NULL,
+      PRIMARY KEY (type, from_id, to_id)
+    );
+    PRAGMA user_version = 4;
+  `);
+    raw
+        .prepare('INSERT INTO nodes (node_id, name, kind, status, cwd, created, pane, host_kind) VALUES (?,?,?,?,?,?,?,?)')
+        .run('stale', 'Stale', 'general', 'idle', '/tmp/work', '2020-01-01T00:00:00Z', '%9', 'broker');
+    return raw;
+}
+test('bug #99: a stale v4 db with later columns already present migrates cleanly', () => {
+    const raw = buildV4DbWithLaterColumns();
+    assert.equal(userVersion(raw), 4);
+    assert.equal(nodeColumns(raw).includes('pane'), true, 'precondition: pane already exists even though user_version is stale');
+    raw.close();
     const db = openDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
-    // Re-running migrate() directly is a no-op (the gate skips applied steps).
-    // If the gate were broken, the second ALTER ADD COLUMN would throw.
-    assert.doesNotThrow(() => migrate(db));
+    const cols = nodeColumns(db);
+    assert.ok(cols.includes('pane'), 'pane survives the migration');
+    assert.ok(cols.includes('host_kind'), 'host_kind survives the migration');
+    const row = db
+        .prepare('SELECT pane, host_kind FROM nodes WHERE node_id = ?')
+        .get('stale');
+    assert.equal(row.pane, '%9');
+    assert.equal(row.host_kind, 'broker');
+});
+// --- v9: wakeups → triggers (the unified node-trigger-grammar substrate) ---
+/** Build a hand-rolled db at exactly v8: baseline nodes/edges + the v7
+ *  `wakeups` table, `user_version = 8` — the shape the live fleet reaches just
+ *  before v9. Caller seeds `wakeups` rows, we close it; the next openDb() runs
+ *  only v9 over it. */
+function buildV8DbWithWakeups() {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    raw.exec(`
+    CREATE TABLE nodes (
+      node_id    TEXT PRIMARY KEY,
+      name       TEXT NOT NULL,
+      kind       TEXT NOT NULL,
+      mode       TEXT NOT NULL DEFAULT 'base',
+      lifecycle  TEXT NOT NULL DEFAULT 'terminal',
+      status     TEXT NOT NULL DEFAULT 'active',
+      cwd        TEXT NOT NULL,
+      parent     TEXT,
+      created    TEXT NOT NULL,
+      intent       TEXT,
+      pi_pid       INTEGER,
+      window       TEXT,
+      tmux_session TEXT,
+      pane         TEXT,
+      host_kind    TEXT
+    );
+    CREATE TABLE edges (
+      type     TEXT NOT NULL,
+      from_id  TEXT NOT NULL,
+      to_id    TEXT NOT NULL,
+      active   INTEGER NOT NULL DEFAULT 1,
+      created  TEXT NOT NULL,
+      PRIMARY KEY (type, from_id, to_id)
+    );
+    CREATE TABLE wakeups (
+      wakeup_id  TEXT PRIMARY KEY,
+      node_id    TEXT,
+      owner_id   TEXT NOT NULL,
+      fire_at    TEXT NOT NULL,
+      kind       TEXT NOT NULL,
+      recur      TEXT,
+      payload    TEXT,
+      created    TEXT NOT NULL,
+      FOREIGN KEY (node_id) REFERENCES nodes(node_id) ON DELETE CASCADE
+    );
+    PRAGMA user_version = 8;
+  `);
+    insertNode(raw, 'armer');
+    insertNode(raw, 'tgt');
+    return raw;
+}
+function insertWakeup(db, row) {
+    db.prepare('INSERT INTO wakeups (wakeup_id, node_id, owner_id, fire_at, kind, recur, payload, created) VALUES (?,?,?,?,?,?,?,?)').run(row.wakeup_id, row.node_id, row.owner_id, row.fire_at, row.kind, row.recur ?? null, row.payload ?? null, '2020-01-01T00:00:00Z');
+}
+test('v9 migrates every wakeups row into triggers, preserving ids/fire data, then drops wakeups', () => {
+    const raw = buildV8DbWithWakeups();
+    insertWakeup(raw, { wakeup_id: 'wk-bare', node_id: 'tgt', owner_id: 'armer', fire_at: '2026-01-01T00:00:00.000Z', kind: 'bare' });
+    insertWakeup(raw, {
+        wakeup_id: 'wk-noted',
+        node_id: 'tgt',
+        owner_id: 'armer',
+        fire_at: '2026-01-02T00:00:00.000Z',
+        kind: 'noted',
+        payload: JSON.stringify({ body: 'check CI', label: 'check CI' }),
+    });
+    insertWakeup(raw, {
+        wakeup_id: 'wk-deadline',
+        node_id: 'tgt',
+        owner_id: 'tgt',
+        fire_at: '2026-01-03T00:00:00.000Z',
+        kind: 'deadline',
+        payload: JSON.stringify({ body: 'timed out', timeout: true, label: 'timed out' }),
+    });
+    insertWakeup(raw, {
+        wakeup_id: 'wk-spawn-cron',
+        node_id: null,
+        owner_id: 'armer',
+        fire_at: '2026-01-04T00:00:00.000Z',
+        kind: 'spawn',
+        recur: JSON.stringify({ every: '6h' }),
+        payload: JSON.stringify({ kind: 'general', mode: 'base', cwd: '/tmp/work', prompt: 'go', parent: 'armer' }),
+    });
+    assert.equal(userVersion(raw), 8);
+    raw.close();
+    const db = openDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
-    // Re-opening from disk is likewise a no-op — no duplicate-column error.
-    closeDb();
-    const db2 = openDb();
-    assert.equal(userVersion(db2), MIGRATIONS.length);
-    const cols = nodeColumns(db2);
-    for (const c of RUNTIME_COLUMNS) {
-        assert.ok(cols.includes(c), `expected nodes.${c} to persist`);
-    }
+    // The old table is gone — not kept as a parallel alias.
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name);
+    assert.ok(!tables.includes('wakeups'), 'wakeups table is dropped after migration');
+    assert.ok(tables.includes('triggers'), 'triggers table exists');
+    const byId = (id) => db.prepare('SELECT * FROM triggers WHERE trigger_id = ?').get(id);
+    const bare = byId('wk-bare');
+    assert.equal(bare.owner_id, 'armer');
+    assert.equal(bare.node_id, 'tgt');
+    assert.equal(bare.action, 'msg');
+    assert.equal(bare.action_mode, 'fresh_revive');
+    assert.equal(bare.trigger_type, 'at');
+    assert.equal(bare.fire_at, '2026-01-01T00:00:00.000Z');
+    const noted = byId('wk-noted');
+    assert.equal(noted.action, 'msg');
+    assert.equal(noted.action_mode, 'inbox_message');
+    assert.equal(noted.trigger_type, 'at');
+    assert.deepEqual(JSON.parse(noted.payload), { body: 'check CI', label: 'check CI' });
+    const deadline = byId('wk-deadline');
+    assert.equal(deadline.action, 'msg');
+    assert.equal(deadline.action_mode, 'deadline_message');
+    assert.equal(deadline.trigger_type, 'until', "a deadline row's trigger_type is 'until', not 'at'");
+    assert.equal(deadline.node_id, 'tgt');
+    const spawnCron = byId('wk-spawn-cron');
+    assert.equal(spawnCron.action, 'new');
+    assert.equal(spawnCron.action_mode, 'node_birth');
+    assert.equal(spawnCron.trigger_type, 'every', 'a recurring spawn keeps trigger_type=every');
+    assert.equal(spawnCron.node_id, null, 'a detached spawn-cron stays canvas-detached');
+    assert.equal(spawnCron.recur, JSON.stringify({ every: '6h' }));
+    // The migrated rows are readable via the current triggers DAO, keyed by
+    // trigger_id (preserved from wakeup_id) and the current action/action_mode
+    // vocabulary rather than the dropped per-kind wakeups shape.
+    const allTriggers = listTriggers({ canvas: true });
+    assert.equal(allTriggers.length, 4);
+    const migratedBare = allTriggers.find((t) => t.trigger_id === 'wk-bare');
+    assert.equal(migratedBare.action_mode, 'fresh_revive');
+    assert.equal(migratedBare.node_id, 'tgt');
 });