@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/core/__tests__/trigger-migration.test.js

@@ -0,0 +1,48 @@
+// Regression for final-integrated-verdict finding #3: the v7 (`wakeups`) →
+// v9 (`triggers`) migration must preserve a deadline wakeup's `fire_at`
+// exactly, not just its `trigger_type`/`node_id`. Drives the real migration
+// steps (`MIGRATIONS[6]` = appendWakeupsTable/v7, `MIGRATIONS[8]` =
+// migrateWakeupsToTriggers/v9) directly against a bare `DatabaseSync`, seeding
+// a v7-shaped `wakeups` row by hand — see `src/core/canvas/db.ts`.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { MIGRATIONS } from '../canvas/db.js';
+let home;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-trigger-migration-'));
+});
+after(() => {
+    rmSync(home, { recursive: true, force: true });
+});
+test('v7->v9 migration preserves a deadline wakeup\'s fire_at exactly', () => {
+    const db = new DatabaseSync(join(home, 'migration.db'));
+    try {
+        db.exec('PRAGMA foreign_keys = ON;');
+        // v1 — nodes/edges baseline (MIGRATIONS[0]); triggers.node_id's FK needs a
+        // real nodes row to reference.
+        MIGRATIONS[0](db);
+        const created = new Date().toISOString();
+        db.prepare(`INSERT INTO nodes (node_id, name, kind, cwd, created) VALUES (?, ?, ?, ?, ?)`).run('target-node', 'target-node', 'general', '/tmp/work', created);
+        // v7 — the wakeups table (MIGRATIONS[6]).
+        MIGRATIONS[6](db);
+        const fireAt = '2026-01-01T12:34:56.000Z';
+        db.prepare(`INSERT INTO wakeups (wakeup_id, node_id, owner_id, fire_at, kind, recur, payload, created)
+       VALUES (?, ?, ?, ?, 'deadline', NULL, ?, ?)`).run('wk-1', 'target-node', 'target-node', fireAt, JSON.stringify({ body: 'time is up', timeout: true, label: 'deadline' }), created);
+        // v9 — generalize wakeups into triggers (MIGRATIONS[8]).
+        MIGRATIONS[8](db);
+        const row = db.prepare('SELECT * FROM triggers WHERE trigger_id = ?').get('wk-1');
+        assert.ok(row, 'migrated trigger row should exist under the preserved wakeup_id');
+        assert.equal(row['trigger_type'], 'until');
+        assert.equal(row['action_mode'], 'deadline_message');
+        // The literal required assertion (verdict finding #3): fire_at must survive
+        // the migration byte-for-byte, not just the trigger_type/action_mode shape.
+        assert.equal(row['fire_at'], fireAt);
+    }
+    finally {
+        db.close();
+    }
+});

package/dist/core/__tests__/wake-bearings.test.js

@@ -1,12 +1,13 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/wake-bearings.test.ts
 //
-// Wake-origin self-knowledge (the <crtr-wake> provenance block). Regression
+// Trigger-origin self-knowledge (the <crtr-wake> provenance block). Regression
 // guard for the observed gap: a node woken or BORN by a scheduled TIMER could
-// not tell it came from a timer — a scheduled wake arrived indistinguishable
+// not tell it came from a timer — a fired trigger arrived indistinguishable
 // from an ordinary refresh/message (the Invariant B/D anti-goal). These lock:
-//   • buildWakeBearings renders the right decision-first block per wake kind /
-//     cadence, and never crashes when the armer was reaped (no resolved name);
-//   • the bare-wake revive kickoff carries that block (so a scheduled alarm is
+//   • buildWakeBearings renders the right decision-first block per trigger
+//     kind / cadence, and never crashes when the armer was reaped (no resolved
+//     name);
+//   • the fresh-revive kickoff carries that block (so a scheduled alarm is
 //     distinguishable from a generic context-refresh), placed AFTER the kickoff
 //     sentinel (goal-capture keys on it) and BEFORE the roadmap/disk bearings;
 //   • an ordinary fresh revive (no wakeReason) carries NO block.
@@ -47,9 +48,9 @@ after(() => {
     delete process.env['CRTR_HOME'];
 });
 // --- buildWakeBearings: one per kind / cadence variant ----------------------
-test('spawn one-shot: names a deferred birth + the armer, and says it does not recur', () => {
+test('node_birth one-shot: names a deferred birth + the armer, and says it does not recur', () => {
     const o = {
-        kind: 'spawn',
+        kind: 'node_birth',
         ownerId: 'arm-1',
         ownerName: 'release-orch',
         armedAt: ARMED,
@@ -64,9 +65,9 @@ test('spawn one-shot: names a deferred birth + the armer, and says it does not r
     assert.match(b, /only run, not a recurring job/);
     assert.match(b, /Your task follows\./);
 });
-test('spawn cron: surfaces the cadence + frames it as one run of a standing job', () => {
+test('node_birth cron: surfaces the cadence + frames it as one run of a standing job', () => {
     const o = {
-        kind: 'spawn',
+        kind: 'node_birth',
         ownerId: 'arm-1',
         ownerName: 'nightly',
         armedAt: ARMED,
@@ -79,9 +80,9 @@ test('spawn cron: surfaces the cadence + frames it as one run of a standing job'
     assert.match(b, /one run of a standing job, not a one-off/);
     assert.match(b, /inherit nothing from prior runs but this task/);
 });
-test('spawn interval cron: renders the every-N cadence', () => {
+test('node_birth interval cron: renders the every-N cadence', () => {
     const o = {
-        kind: 'spawn',
+        kind: 'node_birth',
         ownerId: 'arm-1',
         ownerName: 'poller',
         armedAt: ARMED,
@@ -89,9 +90,9 @@ test('spawn interval cron: renders the every-N cadence', () => {
     };
     assert.match(buildWakeBearings(o), /firing every 6h/);
 });
-test('spawn with a reaped armer: renders the bare id, no name, never crashes', () => {
+test('node_birth with a reaped armer: renders the bare id, no name, never crashes', () => {
     const o = {
-        kind: 'spawn',
+        kind: 'node_birth',
         ownerId: 'gone-9',
         ownerName: undefined, // armer no longer exists → no resolved name
         armedAt: ARMED,
@@ -101,20 +102,21 @@ test('spawn with a reaped armer: renders the bare id, no name, never crashes', (
     assert.match(b, /armed by node gone-9 \(now gone\)/); // bare id, flagged reaped
     assert.doesNotMatch(b, /\("/); // never an empty/dangling name
 });
-test('bare one-shot: frames a timed re-check, NOT a new request', () => {
-    const o = { kind: 'bare', ownerId: 'n1', ownerName: 'n1', armedAt: ARMED, recur: null };
+test('fresh_revive one-shot: frames a timed re-check, NOT a new request', () => {
+    const o = { kind: 'fresh_revive', ownerId: 'n1', ownerName: 'n1', armedAt: ARMED, recur: null };
     const b = buildWakeBearings(o);
     assert.match(b, /a scheduled alarm fired/);
     assert.match(b, /a timer, NOT a new message or request/);
     assert.match(b, /timed re-check, not a new task/);
     assert.match(b, /re-read your roadmap/);
-    // No armer attribution on bare (could be `--node`-armed by another), no ISO.
+    // No armer attribution on a bare revive (could be `--node`-armed by another),
+    // no ISO.
     assert.doesNotMatch(b, /you set/);
     assert.doesNotMatch(b, new RegExp(ARMED));
 });
-test('bare recurring: frames one tick of a standing re-check + the cadence', () => {
+test('fresh_revive recurring: frames one tick of a standing re-check + the cadence', () => {
     const o = {
-        kind: 'bare',
+        kind: 'fresh_revive',
         ownerId: 'n1',
         ownerName: 'n1',
         armedAt: ARMED,
@@ -124,12 +126,12 @@ test('bare recurring: frames one tick of a standing re-check + the cadence', ()
     assert.match(b, /recurring scheduled alarm fired \(every 6h\)/);
     assert.match(b, /one tick of a standing re-check/);
 });
-// --- the bare-wake revive seam (Seam 2) -------------------------------------
-test('a bare scheduled wake makes the fresh-revive kickoff distinguishable from a refresh', () => {
+// --- the fresh-revive kickoff seam -------------------------------------
+test('a fresh_revive trigger makes the fresh-revive kickoff distinguishable from a refresh', () => {
     const id = 'b1';
     const meta = createNode(node(id));
     const wakeReason = {
-        kind: 'bare',
+        kind: 'fresh_revive',
         ownerId: id,
         ownerName: id,
         armedAt: ARMED,

package/dist/core/__tests__/wake-origin.test.js

@@ -1,37 +1,37 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/wake-origin.test.ts
 //
-// HEADLESS RETARGET (foundation-spec §C.16 + §E). Wake-origin self-knowledge at
-// the DAEMON FIRING seams (the other half of the regression — wake-bearings.test.ts
-// covers the pure block in isolation). The observed gap: a scheduled wake arrived
-// indistinguishable from an ordinary message/spawn (Invariant D). Both seams are
-// now driven model-only — ZERO tmux, ZERO boot:
+// HEADLESS RETARGET (foundation-spec §C.16 + §E). Trigger-origin self-knowledge
+// at the DAEMON FIRING seams (the other half of the regression — wake-bearings.
+// test.ts covers the pure block in isolation). The observed gap: a node woken
+// or born by a scheduled trigger arrived indistinguishable from an ordinary
+// message/spawn (Invariant D). Both seams are driven model-only — ZERO tmux,
+// ZERO boot:
 //
-// (1) BUG LOCKED — a node woken or BORN by a TIMER must, by construction, learn a
-//     CLOCK (not an event) caused it: a noted wake rides a ⏰-marked inbox label
-//     (distinct from a plain `node msg`), and a spawn wake prepends the
-//     <crtr-wake> birth block (armer + cadence) to the newborn's kickoff while an
-//     ordinary `node new` carries none.
+// (1) BUG LOCKED — a node woken or BORN by a TIMER must, by construction, learn
+//     a CLOCK (not an event) caused it: an inbox_message trigger rides a
+//     ⏰-marked inbox label (distinct from a plain `node msg`), and a node_birth
+//     trigger prepends the <crtr-wake> birth block (armer + cadence) to the
+//     newborn's kickoff while an ordinary `node new` carries none.
 //
-// (2) WHY MODEL-LEVEL, NOT TMUX CHROME — the noted seam is pure data layer
-//     (superviseTick's third pass → appendInbox; readInboxSince reads it back).
-//     The spawn-birth seam (spawn.ts) assembles the kickoff as
+// (2) WHY MODEL-LEVEL, NOT TMUX CHROME — the inbox_message seam is pure data
+//     layer (superviseTick's third pass → appendInbox; readInboxSince reads it
+//     back). The spawn-birth seam (spawn.ts) assembles the kickoff as
 //     `${buildWakeBearings(wakeOrigin)}\n\n${idBlock}${prompt}` ONLY when a
 //     wakeOrigin is present; `node new` passes none → no block. The load-bearing
-//     fact is the PURE rendering of buildWakeBearings for a spawn origin (and its
-//     absence without one) — reading it off a real booted pi's prompt was pure
-//     tmux/SDK overhead for a string a pure call already returns.
+//     fact is the PURE rendering of buildWakeBearings for a node_birth origin
+//     (and its absence without one) — reading it off a real booted pi's prompt
+//     was pure tmux/SDK overhead for a string a pure call already returns.
 //
 // (3) HOW THE DRIVE STILL FAILS IF THE BUG REGRESSES — drop the ⏰ label marker
-//     and the noted assert goes RED; drop the spawn-kind <crtr-wake> rendering
-//     and the spawn assert goes RED (the block / armer / cadence vanish).
+//     and the inbox_message assert goes RED; drop the node_birth <crtr-wake>
+//     rendering and the spawn assert goes RED (the block / armer / cadence
+//     vanish).
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode } from '../canvas/canvas.js';
-import { armWake } from '../canvas/wakeups.js';
-import { closeDb } from '../canvas/db.js';
+import { createNode, armTrigger, closeDb } from '../canvas/index.js';
 import { readInboxSince } from '../feed/inbox.js';
 import { superviseTick } from '../../daemon/crtrd.js';
 import { buildWakeBearings } from '../runtime/bearings.js';
@@ -62,16 +62,18 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-// --- noted seam (the daemon's third pass → inbox) ---------------------------
-test('a noted scheduled wake delivers a ⏰-marked inbox label, distinct from a plain message', async () => {
+// --- inbox_message seam (the daemon's third pass → inbox) -------------------
+test('a due inbox_message trigger delivers a ⏰-marked inbox label, distinct from a plain message', async () => {
     const armer = createNode(node('armer'));
     const target = createNode(node('tgt')); // no tmux placement → pass 1 skips it
-    armWake({
-        wakeup_id: 'wk-noted-1',
+    armTrigger({
+        trigger_id: 'trg-noted-1',
         node_id: target.node_id,
         owner_id: armer.node_id,
+        action: 'msg',
+        action_mode: 'inbox_message',
+        trigger_type: 'at',
         fire_at: new Date(Date.now() - 1000).toISOString(),
-        kind: 'noted',
         recur: null,
         payload: { body: 'CI should be green by now — check it', label: 'check CI' },
     });
@@ -79,22 +81,23 @@ test('a noted scheduled wake delivers a ⏰-marked inbox label, distinct from a
     await superviseTick(Date.now());
     closeDb();
     const entries = readInboxSince(target.node_id);
-    assert.equal(entries.length, 1, 'the noted wake delivered exactly one inbox entry');
+    assert.equal(entries.length, 1, 'the due trigger delivered exactly one inbox entry');
     // Invariant D: the timer signal rides the VISIBLE label (digests never surface
     // arbitrary data keys), so this is distinguishable from a plain `node msg`.
     assert.equal(entries[0].label, '⏰ scheduled wake — check CI');
     assert.notEqual(entries[0].label, 'check CI', 'a plain message would carry the bare label');
 });
-// --- spawn-birth seam (the headline; spawn.ts kickoff assembly) -------------
-test('a spawn scheduled wake renders a <crtr-wake> birth block (armer + cadence); a plain node new renders none', async () => {
+// --- node_birth seam (the headline; spawn.ts kickoff assembly) --------------
+test('a node_birth trigger renders a <crtr-wake> birth block (armer + cadence); a plain node new renders none', async () => {
     const armer = createNode(node('armer'));
     // The spawn-birth seam (spawn.ts): the newborn's pi kickoff is
     //   `${buildWakeBearings(wakeOrigin)}\n\n${idBlock}${prompt}`
     // when a wakeOrigin is present, and just `${idBlock}${prompt}` (no block)
-    // when it is not. The daemon's third pass builds the WakeOrigin from the fired
-    // recurring `spawn` row via wakeOriginFrom; here we assert the block it yields.
+    // when it is not. The daemon's third pass builds the WakeOrigin from the
+    // fired recurring node_birth trigger row via wakeOriginFrom; here we assert
+    // the block it yields.
     const origin = {
-        kind: 'spawn',
+        kind: 'node_birth',
         ownerId: armer.node_id,
         ownerName: 'armer',
         armedAt: new Date(Date.now() - 1000).toISOString(),
@@ -110,5 +113,5 @@ test('a spawn scheduled wake renders a <crtr-wake> birth block (armer + cadence)
     // prepends nothing — no <crtr-wake> in the newborn's kickoff.
     const wakeBlock = (o) => (o !== undefined ? `${buildWakeBearings(o)}\n\n` : '');
     assert.equal(wakeBlock(undefined), '', 'node new (no wakeOrigin) prepends no wake block');
-    assert.match(wakeBlock(origin), /<crtr-wake>/, 'a spawn wake prepends the block');
+    assert.match(wakeBlock(origin), /<crtr-wake>/, 'a node_birth trigger prepends the block');
 });

package/dist/core/__tests__/yield-ensures-daemon.test.js

@@ -0,0 +1,54 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/yield-ensures-daemon.test.ts
+//
+// Regression: `crtr node yield` timed out into "broker gone" instead of reviving
+// in the same pane (observed 2026-06-18). The yield arms intent='refresh' and
+// the broker shuts down expecting the DAEMON to relaunch it — but requestYield
+// never ensured the daemon was running, unlike the spawn/recycle paths. With a
+// dead daemon, the broker exited and nothing revived it; the viewer redialed its
+// view.sock for ~30s and reported "broker gone". This locks in that requestYield
+// ensures the supervisor before arming the refresh.
+import { test, before, beforeEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { requestYield } from '../runtime/promote.js';
+let home;
+function mkOrchestrator(id) {
+    const meta = {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'orchestrator', // already an orchestrator → yield skips the promote path
+        lifecycle: 'terminal',
+        status: 'active', // LIVE, so transition('yield') is legal
+    };
+    createNode(meta);
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-yield-ensure-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('requestYield ensures the daemon before arming intent=refresh', () => {
+    mkOrchestrator('n1');
+    let ensured = 0;
+    const res = requestYield('n1', {}, { ensure: () => { ensured += 1; } });
+    // The supervisor that performs the refresh-revive must have been ensured...
+    assert.equal(ensured, 1, 'requestYield must ensure the daemon is running');
+    // ...and the yield must still arm the refresh.
+    assert.equal(res.willRefresh, true);
+    assert.equal(getNode('n1')?.intent, 'refresh');
+});

package/dist/core/artifact.d.ts

@@ -1,37 +1,6 @@
-export type ArtifactKind = 'plans' | 'specs';
 export declare function mangleCwd(cwd?: string): string;
-export declare function artifactsRoot(kind: ArtifactKind, cwd?: string): string;
-/** Per-cwd interactions root, mirroring artifactsRoot construction.
- *  `~/.crouter/<mangled-cwd>/interactions/`. */
+export declare function workspaceRoot(cwd?: string): string;
 export declare function interactionsRoot(cwd?: string): string;
-/** Directory for one interaction. `id` is sanitized like an artifact name. */
 export declare function interactionDir(id: string, cwd?: string): string;
 export declare function sanitizeName(raw: string): string;
-export declare function artifactPath(kind: ArtifactKind, name: string, cwd?: string): string;
-/** Lines above this threshold trigger an oversize advisory in follow_up. */
-export declare const OVERSIZE_WARN_LINES = 200;
-export interface SaveArtifactResult {
-    path: string;
-    oversize: boolean;
-    lineCount: number;
-}
-/**
- * Atomically write an artifact. Prepends a minimal frontmatter block when
- * `meta` is non-empty so readers can extract structured fields without
- * parsing the full body. Returns the written path and oversize status.
- */
-export declare function saveArtifact(kind: ArtifactKind, name: string, body: string, meta?: Record<string, string>): SaveArtifactResult;
-export interface ArtifactRecord {
-    name: string;
-    path: string;
-    body: string;
-    /** Present only in plan artifacts; null if not set. */
-    spec: string | null;
-}
-export declare function readArtifact(kind: ArtifactKind, name: string): ArtifactRecord;
-export interface ArtifactListItem {
-    name: string;
-    path: string;
-    updated_at: string;
-}
-export declare function listArtifacts(kind: ArtifactKind): ArtifactListItem[];
+export declare function migrateLegacyWorkspaceDirs(): void;

package/dist/core/artifact.js

@@ -1,24 +1,20 @@
-// Core artifact primitives for plan and spec subtrees.
+// Core per-cwd workspace primitives for human interaction artifacts.
 // No commander, no spawn, no output helpers — pure data logic only.
-// Old registerArtifactCommand (commander-based) is removed; callers ported to JSON I/O.
 import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { writeFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { renameSync } from 'node:fs';
 import { CRTR_DIR_NAME } from '../types.js';
-import { ensureDir, pathExists, readText, walkFiles } from './fs-utils.js';
-import { notFound, usage } from './errors.js';
+import { ensureDir, listDirs, pathExists, removePath } from './fs-utils.js';
+import { usage } from './errors.js';
 export function mangleCwd(cwd = process.cwd()) {
     return cwd.replace(/\//g, '-');
 }
-export function artifactsRoot(kind, cwd) {
-    return join(homedir(), CRTR_DIR_NAME, mangleCwd(cwd), kind);
+export function workspaceRoot(cwd) {
+    return join(homedir(), CRTR_DIR_NAME, 'workspaces', mangleCwd(cwd));
 }
-/** Per-cwd interactions root, mirroring artifactsRoot construction.
- *  `~/.crouter/<mangled-cwd>/interactions/`. */
 export function interactionsRoot(cwd) {
-    return join(homedir(), CRTR_DIR_NAME, mangleCwd(cwd), 'interactions');
+    return join(workspaceRoot(cwd), 'interactions');
 }
-/** Directory for one interaction. `id` is sanitized like an artifact name. */
 export function interactionDir(id, cwd) {
     return join(interactionsRoot(cwd), sanitizeName(id));
 }
@@ -34,84 +30,28 @@ export function sanitizeName(raw) {
     }
     return trimmed;
 }
-export function artifactPath(kind, name, cwd) {
-    return join(artifactsRoot(kind, cwd), `${sanitizeName(name)}.md`);
-}
-/** Lines above this threshold trigger an oversize advisory in follow_up. */
-export const OVERSIZE_WARN_LINES = 200;
-/**
- * Atomically write an artifact. Prepends a minimal frontmatter block when
- * `meta` is non-empty so readers can extract structured fields without
- * parsing the full body. Returns the written path and oversize status.
- */
-export function saveArtifact(kind, name, body, meta = {}) {
-    const filePath = artifactPath(kind, name);
-    ensureDir(dirname(filePath));
-    const metaKeys = Object.keys(meta);
-    let content;
-    if (metaKeys.length > 0) {
-        const fm = '---\n' + metaKeys.map((k) => `${k}: ${meta[k]}`).join('\n') + '\n---\n';
-        content = fm + body;
-    }
-    else {
-        content = body;
-    }
-    const finalContent = content.endsWith('\n') ? content : content + '\n';
-    writeFileSync(filePath, finalContent, 'utf8');
-    const lineCount = finalContent.split('\n').length - 1;
-    return { path: filePath, oversize: lineCount > OVERSIZE_WARN_LINES, lineCount };
-}
-const FRONTMATTER_BLOCK_RE = /^---\s*\r?\n([\s\S]*?)\r?\n---\s*\r?\n?/;
-function parseArtifactFrontmatter(source) {
-    const match = source.match(FRONTMATTER_BLOCK_RE);
-    if (!match)
-        return { fields: {}, body: source };
-    const raw = match[1];
-    const body = source.slice(match[0].length);
-    const fields = {};
-    for (const line of raw.split(/\r?\n/)) {
-        const colon = line.indexOf(':');
-        if (colon === -1)
+const LEGACY_WORKSPACE_DIR_RE = /^-[A-Za-z0-9].*/;
+export function migrateLegacyWorkspaceDirs() {
+    const dataHome = join(homedir(), CRTR_DIR_NAME);
+    const workspaceHome = join(dataHome, 'workspaces');
+    if (!pathExists(dataHome))
+        return;
+    ensureDir(workspaceHome);
+    for (const entry of listDirs(dataHome)) {
+        if (entry === 'workspaces' || !LEGACY_WORKSPACE_DIR_RE.test(entry))
             continue;
-        const k = line.slice(0, colon).trim();
-        const v = line.slice(colon + 1).trim();
-        if (k !== '')
-            fields[k] = v;
-    }
-    return { fields, body };
-}
-export function readArtifact(kind, name) {
-    const filePath = artifactPath(kind, name);
-    if (!pathExists(filePath)) {
-        throw notFound(`${kind.slice(0, -1)} not found: ${name} (looked at ${filePath})`);
-    }
-    const raw = readText(filePath);
-    const { fields, body } = parseArtifactFrontmatter(raw);
-    const specField = fields['spec'];
-    return {
-        name,
-        path: filePath,
-        body,
-        spec: specField !== undefined ? specField : null,
-    };
-}
-export function listArtifacts(kind) {
-    const root = artifactsRoot(kind);
-    if (!pathExists(root))
-        return [];
-    const files = walkFiles(root, (n) => n.endsWith('.md'));
-    const items = files.map((abs) => {
-        const name = abs.substring(root.length + 1).replace(/\.md$/, '');
-        let updated_at = '';
+        const source = join(dataHome, entry);
+        const target = join(workspaceHome, entry);
+        if (pathExists(target)) {
+            removePath(source);
+            continue;
+        }
         try {
-            updated_at = statSync(abs).mtime.toISOString();
+            renameSync(source, target);
         }
         catch {
-            updated_at = new Date(0).toISOString();
+            // Leave the source in place only if the rename truly failed.
+            // The next startup will retry the same hard-cut move.
         }
-        return { name, path: abs, updated_at };
-    });
-    // Sort ascending by name (stable key for pagination cursor).
-    items.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    return items;
+    }
 }

package/dist/core/bootstrap.js

@@ -4,6 +4,7 @@ import { findProjectScopeRoot, resetScopeCache, userScopeRoot } from './scope.js
 import { ensureDir, pathExists, removePath, nowIso } from './fs-utils.js';
 import { readConfig, readState, updateConfig, updateState, ensureScopeInitialized } from './config.js';
 import { clone } from './git.js';
+import { migrateLegacyWorkspaceDirs } from './artifact.js';
 import { readMarketplaceManifest } from './manifest.js';
 import { CRTR_DIR_NAME } from '../types.js';
 export const OFFICIAL_MARKETPLACE_NAME = 'crouter-official-marketplace';
@@ -76,6 +77,7 @@ export function ensureProjectScope(argv) {
             return;
         if (shouldSkipForArgv(argv))
             return;
+        migrateLegacyWorkspaceDirs();
         // Already inside a project scope (here or in an ancestor) — nothing to do.
         if (findProjectScopeRoot() !== null)
             return;

package/dist/core/canvas/boot.d.ts

@@ -0,0 +1,48 @@
+/** The kernel's per-boot identity + a wall-clock fallback estimate. */
+export interface BootIdentity {
+    /** `/proc/sys/kernel/random/boot_id` (a fresh UUID per kernel boot), or null
+     *  when unreadable (non-Linux). Exact when present. */
+    bootId: string | null;
+    /** Best-effort wall-clock estimate of when the current boot started. Fallback
+     *  discriminator only, used when `bootId` is null on either side. */
+    bootEpochMs: number;
+}
+/** Identity of the CURRENT OS boot. `now` is injectable for tests. */
+export declare function currentBootIdentity(now?: number): BootIdentity;
+/** Pure decision core: does `current` belong to a DIFFERENT boot than the
+ *  persisted `known`? `known === null` (no history — a fresh install, or the
+ *  first run of a build that added this marker) is never a boot change: there
+ *  is nothing to contradict it, and treating "no history" as a change could
+ *  clear genuinely live pids that predate this feature.
+ *
+ *  When BOTH sides carry a kernel `boot_id`, that exact identity decides it — no
+ *  wall-clock window, so a real quick reboot/recreate (a short-lived prior boot
+ *  whose start is <60s away) is still detected. Only when a `boot_id` is missing
+ *  on either side (non-Linux dev) does it fall back to the epoch-drift window.
+ *  Unit-testable without real uptime/fs. */
+export declare function bootChanged(current: BootIdentity, known: BootIdentity | null): boolean;
+export interface BootReconcileResult {
+    /** True when a boot change was detected (and, therefore, pids were cleared). */
+    changed: boolean;
+    /** node_ids whose stale `pi_pid` was cleared. */
+    cleared: string[];
+}
+/** Idempotent and safe to call from every revive entry point (daemon startup,
+ *  reviveNode): compares the current boot's identity against the last one
+ *  recorded, and if they differ, clears `pi_pid` on every node that has one —
+ *  regardless of status, since reviveNode's double-launch guard reads `pi_pid`
+ *  unconditionally, not just on active/idle rows. The first caller after a
+ *  genuine boot change does the sweep and persists the new marker; every call
+ *  after that (in this process or another) reads a matching marker and no-ops.
+ *
+ *  SINGLE-WRITER: the whole read-marker + sweep + write-marker runs in one
+ *  `BEGIN IMMEDIATE` transaction. A concurrent caller (a manual revive racing
+ *  daemon startup, in a separate process) blocks on the SQLite write lock until
+ *  this commits, then reads the already-updated marker and no-ops — so it can
+ *  never `clearPid` a broker pid the first caller's revive just recorded, which
+ *  would otherwise hide a live broker behind `pi_pid=NULL` and risk a second
+ *  broker on the same session.
+ *
+ *  `current` defaults to the real identity; tests inject a synthetic one against
+ *  an isolated CRTR_HOME to simulate a boot change without a real reboot. */
+export declare function reconcileBootLiveness(current?: BootIdentity): BootReconcileResult;