@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/core/runtime/kickoff.js

@@ -8,7 +8,7 @@
 // Layout (the framing a revived node sees):
 //   <roadmap file=…>…</roadmap>            its evolving plan — the source of truth
 //   <context-dir path=…>…</context-dir>    what artifacts exist on disk
-//   <feed>Awaiting N nodes … digest</feed> who it waits on + unread reports
+//   <feed>Awaiting N nodes … digest</feed> live wait state + unread/catch-up feed
 //   <yield-message>…</yield-message>       the note its prior self left on yield
 //
 // The roadmap (NOT the original spawn prompt) carries the goal on a refresh: its
@@ -19,7 +19,6 @@
 // yield-message is one-shot (consumed on the next revive).
 import { existsSync, readFileSync, writeFileSync, rmSync, mkdirSync, readdirSync, } from 'node:fs';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { contextDir, reportsDir, getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
@@ -132,56 +131,41 @@ export function drainBearings(meta) {
 // conversation is gone AND the monotonic inbox cursor has already advanced past
 // everything drained pre-yield, so the revived node loses sight of reports its
 // subscriptions pushed BEFORE the yield. The bodies are never lost — they persist
-// at reports/<ts>-<kind>.md forever — but nothing pointed the revived node at
-// them. reportHistoryLines renders those existing on-disk paths so it can catch
-// up; PATHS ONLY (the node dereferences what it needs), no body read, no parse.
-const REPORT_HISTORY_PER_SOURCE = 5;
-const REPORT_HISTORY_TOTAL_CAP = 20;
-/** Collapse the home-dir prefix of an absolute path to a leading `~`, so report
- *  paths render as `~/.crouter/canvas/nodes/<id>/reports/<ts>.md` instead of
- *  repeating the long absolute home prefix on every catch-up line — cheaper
- *  context, still dereferenceable by the revived node. A path NOT under the home
- *  dir (e.g. a CRTR_HOME / project-scope home elsewhere) is returned unchanged,
- *  so we never mangle a non-home path. */
-function tildify(p) {
-    const home = homedir();
-    return p.startsWith(home) ? '~' + p.slice(home.length) : p;
+// at reports/<ts>-<kind>.md forever — but a fresh revive needs a bounded index
+// that says history exists and how to expand it, not every path preloaded.
+const REPORT_HISTORY_SOURCE_CAP = 8;
+function reportKind(filename) {
+    return filename.match(/^[0-9]{8}T[0-9]{6}-(.+)\.md$/)?.[1] ?? 'report';
 }
-/** Recent report file PATHS (most-recent-first), grouped by publisher, for each
- *  ACTIVE subscription of `nodeId` — independent of publisher liveness, so a
- *  finished worker's history still surfaces for catch-up. Skips subscriptions
- *  whose reports dir is empty/missing. Returns [] when the node has no active
- *  subscriptions or none have reports yet (caller renders nothing extra). */
-function reportHistoryLines(nodeId) {
-    const lines = [];
-    let total = 0;
+/** Condensed report-history index for each ACTIVE subscription of `nodeId` —
+ *  independent of publisher liveness, so a finished worker's history still
+ *  surfaces for catch-up. Each source carries only its count and newest report
+ *  ref; older refs stay one command away via `canvas history show`. */
+function reportHistorySources(nodeId) {
+    const out = [];
     for (const sub of subscriptionsOf(nodeId).filter((s) => s.active)) {
-        if (total >= REPORT_HISTORY_TOTAL_CAP)
-            break;
         const dir = reportsDir(sub.node_id);
         if (!existsSync(dir))
             continue;
         const files = readdirSync(dir)
             .filter((f) => f.endsWith('.md'))
             .sort() // YYYYMMDDTHHmmss-<kind>.md — lexical sort = chronological
-            .reverse() // most recent first
-            .slice(0, REPORT_HISTORY_PER_SOURCE);
+            .reverse(); // most recent first
         if (files.length === 0)
             continue;
         const pub = getNode(sub.node_id);
-        lines.push(`  ${pub !== null ? `${pub.name} (${sub.node_id})` : sub.node_id}:`);
-        for (const f of files) {
-            if (total >= REPORT_HISTORY_TOTAL_CAP)
-                break;
-            lines.push(`    ${tildify(join(dir, f))}`);
-            total++;
-        }
+        out.push({
+            nodeId: sub.node_id,
+            name: pub?.name ?? sub.node_id,
+            count: files.length,
+            latest: files[0],
+        });
     }
-    return lines;
+    return out.sort((a, b) => b.latest.localeCompare(a.latest));
 }
 /** Render the <feed> block PURELY: the live "awaiting" roster (a read), the
- *  already-drained unread digest (from drainBearings), and the on-disk report
- *  history of this node's subscriptions (catch-up pointers). No cursor write. */
+ *  already-drained unread digest (from drainBearings), and a progressive index
+ *  to on-disk report history. No cursor write. */
 function feedBlock(nodeId, unreadDigest) {
     // Awaiting = active subscriptions whose publisher is still live (active|idle).
     const awaiting = subscriptionsOf(nodeId)
@@ -210,14 +194,16 @@ function feedBlock(nodeId, unreadDigest) {
     }
     // Catch-up history. The unread digest above only covers what arrived since the
     // cursor; on a refresh-revive the cursor has already passed everything drained
-    // pre-yield, so point the node at the durable report history that persists on
-    // disk. Renders nothing when the node has no active subscriptions with reports.
-    const history = reportHistoryLines(nodeId);
+    // pre-yield, so preserve the breadcrumb without preloading every old report.
+    const history = reportHistorySources(nodeId);
     if (history.length > 0) {
-        lines.push('', 'Report history on disk — the nodes you subscribe to keep every push they made; ' +
-            'these persist across your context refresh (the unread digest above only covers ' +
-            'what arrived since your cursor). Most recent first; dereference any you need. ' +
-            '`crtr feed read --all` replays the full inbox history, cursor-independent.', ...history);
+        const visible = history.slice(0, REPORT_HISTORY_SOURCE_CAP);
+        const hidden = history.length - visible.length;
+        const total = history.reduce((sum, h) => sum + h.count, 0);
+        lines.push('', `Report history on disk (collapsed): ${total} report${total === 1 ? '' : 's'} across ${history.length} subscribed node${history.length === 1 ? '' : 's'}. This is a catch-up index for reports your cursor already passed; read only what matters.`, ...visible.map((h) => {
+            const ref = `${h.nodeId}:reports/${h.latest}`;
+            return `  - ${h.name} (${h.nodeId}): ${h.count} report${h.count === 1 ? '' : 's'}; latest ${reportKind(h.latest)}: ${ref}`;
+        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr canvas history show <node-id> --type report` for that node\'s full report list; `crtr feed read --all` for cursor-independent inbox history.');
     }
     return `<feed>\n${lines.join('\n')}\n</feed>`;
 }
@@ -282,7 +268,7 @@ export function buildReviveKickoff(meta, bearings, wakeReason) {
             'directly with the user, so stay available and continue the conversation when they ' +
             'write back.');
     // Persona-transition catch-up. If the node's mode/lifecycle was changed
-    // EXTERNALLY while it was dormant (e.g. a human ran `crtr node lifecycle` /
+    // EXTERNALLY while it was dormant (e.g. a human ran `crtr node config --lifecycle` /
     // `node promote --node` on it), it never saw the turn_end injector. drainBearings
     // captured the guidance for its new persona and committed the ack (the second
     // and only other delivery site); we just surface it. A clean fresh revive has

package/dist/core/runtime/launch.d.ts

@@ -1,4 +1,5 @@
 import type { NodeMeta, LaunchSpec, Mode, Lifecycle } from '../canvas/index.js';
+import type { ModelProvider, ModelStrength } from '../../types.js';
 export declare const CANVAS_STOPHOOK_PATH: string;
 export declare const CANVAS_INBOX_WATCHER_PATH: string;
 export declare const CANVAS_NAV_PATH: string;
@@ -7,32 +8,46 @@ export declare const CANVAS_GOAL_CAPTURE_PATH: string;
 export declare const CANVAS_PASSIVE_CONTEXT_PATH: string;
 export declare const CANVAS_CONTEXT_INTRO_PATH: string;
 export declare const CANVAS_DOC_SUBSTRATE_PATH: string;
-export declare const CANVAS_COMMANDS_PATH: string;
-export declare const CANVAS_RESUME_PATH: string;
-export declare const CANVAS_VIEW_PATH: string;
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
  *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
  *  conversation, shown above the manager line after 300s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block — carrying the
- *  <knowledge> catalog — as its own session message, once per brand-new chat),
- *  doc-substrate (the unified document substrate's two hooks: <preferences> +
- *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
- *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
- *  view pick` / `crtr view run <name>`).
+ *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
+ *  catalog as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: the
+ *  <memory kind="preference"> block at boot, on-read context injection).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
  *  reads the raw user text. */
 export declare const CANVAS_EXTENSIONS: string[];
-/** The named capability tiers a caller picks with `--model`, in descending
- *  strength. Each maps to a concrete pi model spec. `strong`/`medium`/`light`
- *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
-export declare const MODEL_TIERS: Record<string, string>;
-/** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
- *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
- *  with a `/` or an unknown name passes through. */
+/** Env var naming the DEFAULT provider for an UNqualified bare strength only.
+ *  `CRTR_MODEL_PROVIDER=openai` (case-insensitive) makes a bare `strong` resolve
+ *  on the OpenAI ladder; anything else defaults to Anthropic. A configured
+ *  defaultProvider in config.json wins over this env. */
+export declare const OPENAI_PROVIDER_ENV = "CRTR_MODEL_PROVIDER";
+export interface EquivalentProviderModel {
+    fromProvider: ModelProvider;
+    toProvider: ModelProvider;
+    strength: ModelStrength;
+    model: string;
+}
+/** Map a concrete ladder model back to its provider×strength cell, then return
+ *  the other configured provider's model at the same strength. `failedProviders`
+ *  is per-turn state: once a provider has produced a retryable outage error, do
+ *  not bounce back to it or keep reattempting the same failed provider. */
+export declare function equivalentOtherProviderModel(currentModel: string, failedProviders?: ReadonlySet<ModelProvider>): EquivalentProviderModel | null;
+/** Resolve a persona/caller `model:` token to the concrete `model:thinking`
+ *  spec pi gets via `--model`, in order:
+ *   1. `provider/rest` — apply strength aliases to `rest`; if `provider` is
+ *      `anthropic`/`openai` AND `rest` is a strength, return that ladder cell
+ *      (the word `openai` maps to the openai-codex ladder). Otherwise it is a
+ *      concrete `provider/id` (incl. any `:thinking` suffix) → pass through.
+ *   2. Bare strength (incl. aliases normal/weak) → the default-provider ladder
+ *      cell (config default provider, then CRTR_MODEL_PROVIDER, else anthropic).
+ *   3. Bare family alias (opus/sonnet/haiku) → the Anthropic ladder's
+ *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
+ *   4. Anything else → pass through unchanged. */
 export declare function normalizeModel(model: string): string;
 /** Compose a node's full pi launch recipe from its persona. The system prompt
  *  is composed from FOUR inputs: kind×mode (the persona body) plus lifecycle
@@ -49,7 +64,6 @@ export declare function buildLaunchSpec(kind: string, mode: Mode, opts: {
 }): {
     launch: LaunchSpec;
     lifecycle: 'terminal' | 'resident';
-    skills: string[];
 };
 export interface PiInvocation {
     /** argv after the `pi` binary. */
@@ -63,8 +77,12 @@ export interface PiInvocation {
  *    — pi COPIES that conversation into a NEW session for this node, then `prompt`
  *    is delivered as the next message. One-shot at birth: the node thereafter
  *    captures its OWN pi_session_file and revives by `--session` like any other.
- *  - revive idle/done: pass `resumeSessionPath` (absolute .jsonl path, preferred)
- *    or `resumeSessionId` (bare uuid fallback) to `--session` (keeps conversation).
+ *  - revive idle/done: pass `resumeSessionPath` (absolute .jsonl path) to
+ *    `--session` (keeps conversation). `resumeSessionId` (a bare uuid) is
+ *    accepted here too, but revive.ts's `resumeArgs` never produces one —
+ *    `headlessBrokerHost`'s preflight (host.ts) fatally rejects a bare
+ *    `--session` id before ever spawning the broker, so a real revive only
+ *    ever resumes by path (or falls through to fresh when no path exists).
  *  - refresh-yield: fresh again (no resume) — the node re-reads its roadmap. */
 export declare function buildPiArgv(meta: NodeMeta, opts?: {
     prompt?: string;
@@ -90,7 +108,9 @@ export interface BrokerSdkConfig {
     forkFrom?: string;
     /** Resume by absolute `.jsonl` path (preferred — `SessionManager.open`). */
     resumeSessionPath?: string;
-    /** Resume by bare session uuid (legacy fallback). */
+    /** Resume by bare session uuid. Accepted by the generic builder, but no live
+     *  caller sets it — revive resumes by absolute path only, and the broker
+     *  preflight rejects a bare `--session`. */
     resumeSessionId?: string;
     /** Model spec, e.g. `anthropic/sonnet` (`--model`). */
     model?: string;

package/dist/core/runtime/launch.js

@@ -2,17 +2,20 @@
 //
 // pi-only. No claude branch — we are a super-opinionated system. A node's
 // LaunchSpec (persisted in meta.json) is the canonical recipe the daemon
-// replays to revive it faithfully: `--session <id>` to wake a done/idle node
-// (keeps its conversation), or fresh (against the context dir) for a refresh-yield.
+// replays to revive it faithfully: `--session <path>` (the saved conversation's
+// absolute .jsonl) to wake a done/idle node, or fresh (against the context dir)
+// for a refresh-yield.
 // The spec is rewritten on every polymorph (base→orchestrator) so a node
 // always comes back as its *current* self.
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readConfig, configPath as userConfigPath } from '../config.js';
 import { resolve as resolvePersona } from '../personas/index.js';
 import { nodeEnv } from './nodes.js';
 import { editorLabel } from '../canvas/index.js';
 import { nodeDir } from '../canvas/paths.js';
+import { defaultScopeConfig } from '../../types.js';
 // ---------------------------------------------------------------------------
 // The two canvas pi-extensions every node loads. They self-gate on the live
 // {kind,mode} env, so the worker→orchestrator polymorph flips hook behavior
@@ -34,21 +37,16 @@ export const CANVAS_GOAL_CAPTURE_PATH = resolveExtension('canvas-goal-capture');
 export const CANVAS_PASSIVE_CONTEXT_PATH = resolveExtension('canvas-passive-context');
 export const CANVAS_CONTEXT_INTRO_PATH = resolveExtension('canvas-context-intro');
 export const CANVAS_DOC_SUBSTRATE_PATH = resolveExtension('canvas-doc-substrate');
-export const CANVAS_COMMANDS_PATH = resolveExtension('canvas-commands');
-export const CANVAS_RESUME_PATH = resolveExtension('canvas-resume');
-export const CANVAS_VIEW_PATH = resolveExtension('canvas-view');
 /** The canvas extensions every node loads, in order: stophook (routing +
  *  telemetry + session-id capture), inbox-watcher (wake), nav (in-editor
  *  graph chrome), recap (the per-node inactivity recap card — Haiku over the
  *  conversation, shown above the manager line after 300s of no message),
  *  goal-capture (persist the first user message as the goal),
  *  passive-context (drain passive backlog as pre-text on the next message),
- *  context-intro (inject the <crtr-context> bearings block — carrying the
- *  <knowledge> catalog — as its own session message, once per brand-new chat),
- *  doc-substrate (the unified document substrate's two hooks: <preferences> +
- *  <memory-guidance> at boot, on-read context injection), commands (the /promote slash-command), resume (the /resume-node
- *  whole-canvas picker → `crtr node focus`), view (the /view popup → `crtr
- *  view pick` / `crtr view run <name>`).
+ *  context-intro (inject the <crtr-bearings> block + the <memory kind="knowledge">
+ *  catalog as its own session message, once per brand-new chat),
+ *  doc-substrate (the unified document substrate's two hooks: the
+ *  <memory kind="preference"> block at boot, on-read context injection).
  *  All self-gate on CRTR_NODE_ID. goal-capture precedes passive-context so it
  *  reads the raw user text. */
 export const CANVAS_EXTENSIONS = [
@@ -60,37 +58,141 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_PASSIVE_CONTEXT_PATH,
     CANVAS_CONTEXT_INTRO_PATH,
     CANVAS_DOC_SUBSTRATE_PATH,
-    CANVAS_COMMANDS_PATH,
-    CANVAS_RESUME_PATH,
-    CANVAS_VIEW_PATH,
 ];
-/** The named capability tiers a caller picks with `--model`, in descending
- *  strength. Each maps to a concrete pi model spec. `strong`/`medium`/`light`
- *  resolve to the latest opus/sonnet/haiku; `ultra` to the frontier model. */
-export const MODEL_TIERS = {
-    ultra: 'anthropic/claude-fable-5',
-    strong: 'anthropic/claude-opus-4-8',
-    medium: 'anthropic/claude-sonnet-4-6',
-    light: 'anthropic/claude-haiku-4-5',
-};
-/** Bare family aliases → the same concrete versioned ids as the tiers. These
- *  MUST be real registry ids (see `pi --list-models`): an unversioned spec like
- *  `anthropic/sonnet` is NOT in the registry and silently falls back to the SDK
- *  default (opus), so it can never be the resolution target. */
-const BARE_ALIASES = {
-    opus: 'anthropic/claude-opus-4-8',
-    sonnet: 'anthropic/claude-sonnet-4-6',
-    haiku: 'anthropic/claude-haiku-4-5',
+// ---------------------------------------------------------------------------
+// Two-axis model resolution: (provider × strength) → concrete `model:thinking`.
+//
+// A persona declares ONE `model:` field valued `provider/strength` (e.g.
+// `openai/strong`, `anthropic/light`). The provider is a fixed per-persona
+// property; the caller/persona thinks only in strength; the concrete model id
+// AND the thinking level both fall out of the per-provider ladder below. The
+// ladder itself and the default provider are user-configurable in config.json;
+// pi accepts the `:thinking` suffix on `--model` (off,minimal,low,medium,high,
+// xhigh — confirmed via `pi --help`), so the resolved spec is exactly the
+// string buildPiArgv passes to `--model`; no extra launch plumbing.
+// ---------------------------------------------------------------------------
+/** Cached user config for model resolution. The launch path is hot and reads
+ *  config synchronously, so cache the merged config and invalidate on mtime/size
+ *  changes rather than rereading on every normalizeModel/buildLaunchSpec call. */
+let cachedUserConfig = null;
+function readUserConfigCached() {
+    const path = userConfigPath('user');
+    if (path === null)
+        return defaultScopeConfig();
+    try {
+        const stat = statSync(path);
+        if (cachedUserConfig !== null &&
+            cachedUserConfig.path === path &&
+            cachedUserConfig.mtimeMs === stat.mtimeMs &&
+            cachedUserConfig.size === stat.size) {
+            return cachedUserConfig.config;
+        }
+        const config = readConfig('user');
+        cachedUserConfig = { path, mtimeMs: stat.mtimeMs, size: stat.size, config };
+        return config;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            cachedUserConfig = null;
+            return defaultScopeConfig();
+        }
+        throw error;
+    }
+}
+const DEFAULT_MODEL_LADDERS = defaultScopeConfig().modelLadders;
+function modelLadders() {
+    return readUserConfigCached().modelLadders ?? DEFAULT_MODEL_LADDERS;
+}
+function ladderFor(provider, ladders = modelLadders()) {
+    return ladders[provider];
+}
+/** Env var naming the DEFAULT provider for an UNqualified bare strength only.
+ *  `CRTR_MODEL_PROVIDER=openai` (case-insensitive) makes a bare `strong` resolve
+ *  on the OpenAI ladder; anything else defaults to Anthropic. A configured
+ *  defaultProvider in config.json wins over this env. */
+export const OPENAI_PROVIDER_ENV = 'CRTR_MODEL_PROVIDER';
+function defaultProvider() {
+    const cfgProvider = readUserConfigCached().modelLadders.defaultProvider;
+    if (cfgProvider === 'anthropic' || cfgProvider === 'openai')
+        return cfgProvider;
+    return (process.env[OPENAI_PROVIDER_ENV] ?? '').toLowerCase() === 'openai' ? 'openai' : 'anthropic';
+}
+/** Strength synonyms accepted from personas/callers. */
+const STRENGTH_ALIASES = {
+    ultra: 'ultra',
+    strong: 'strong',
+    medium: 'medium',
+    light: 'light',
+    normal: 'medium',
+    weak: 'light',
 };
-/** Resolve a model token to the spec pi gets via `--model`. A named tier
- *  (ultra/strong/medium/light) maps to its concrete spec; a bare family alias
- *  (sonnet/opus/haiku) maps to that family's current versioned id; anything
- *  with a `/` or an unknown name passes through. */
+const MODEL_PROVIDER_KEYS = ['anthropic', 'openai'];
+const MODEL_STRENGTHS = ['ultra', 'strong', 'medium', 'light'];
+const THINKING_SUFFIXES = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+function stripThinkingSuffix(spec) {
+    const i = spec.lastIndexOf(':');
+    if (i <= 0)
+        return spec;
+    return THINKING_SUFFIXES.has(spec.slice(i + 1)) ? spec.slice(0, i) : spec;
+}
+/** Map a concrete ladder model back to its provider×strength cell, then return
+ *  the other configured provider's model at the same strength. `failedProviders`
+ *  is per-turn state: once a provider has produced a retryable outage error, do
+ *  not bounce back to it or keep reattempting the same failed provider. */
+export function equivalentOtherProviderModel(currentModel, failedProviders = new Set()) {
+    const ladders = modelLadders();
+    const currentComparable = stripThinkingSuffix(normalizeModel(currentModel));
+    for (const fromProvider of MODEL_PROVIDER_KEYS) {
+        for (const strength of MODEL_STRENGTHS) {
+            if (stripThinkingSuffix(ladders[fromProvider][strength]) !== currentComparable)
+                continue;
+            if (failedProviders.has(fromProvider))
+                return null;
+            const toProvider = fromProvider === 'anthropic' ? 'openai' : 'anthropic';
+            if (failedProviders.has(toProvider))
+                return null;
+            return { fromProvider, toProvider, strength, model: ladders[toProvider][strength] };
+        }
+    }
+    return null;
+}
+/** Resolve a persona/caller `model:` token to the concrete `model:thinking`
+ *  spec pi gets via `--model`, in order:
+ *   1. `provider/rest` — apply strength aliases to `rest`; if `provider` is
+ *      `anthropic`/`openai` AND `rest` is a strength, return that ladder cell
+ *      (the word `openai` maps to the openai-codex ladder). Otherwise it is a
+ *      concrete `provider/id` (incl. any `:thinking` suffix) → pass through.
+ *   2. Bare strength (incl. aliases normal/weak) → the default-provider ladder
+ *      cell (config default provider, then CRTR_MODEL_PROVIDER, else anthropic).
+ *   3. Bare family alias (opus/sonnet/haiku) → the Anthropic ladder's
+ *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
+ *   4. Anything else → pass through unchanged. */
 export function normalizeModel(model) {
-    if (model in MODEL_TIERS)
-        return MODEL_TIERS[model];
-    if (model in BARE_ALIASES)
-        return BARE_ALIASES[model];
+    const ladders = modelLadders();
+    // 1. Qualified provider/rest.
+    if (model.includes('/')) {
+        const slash = model.indexOf('/');
+        const provider = model.slice(0, slash);
+        const rest = model.slice(slash + 1);
+        const strength = STRENGTH_ALIASES[rest];
+        if (strength !== undefined && (provider === 'anthropic' || provider === 'openai')) {
+            return ladderFor(provider, ladders)[strength];
+        }
+        // Concrete `provider/id` (optionally `...:thinking`) — pass through.
+        return model;
+    }
+    // 2. Bare strength → default-provider ladder.
+    const strength = STRENGTH_ALIASES[model];
+    if (strength !== undefined)
+        return ladderFor(defaultProvider(), ladders)[strength];
+    // 3. Bare family alias → always Anthropic.
+    if (model === 'opus')
+        return ladders.anthropic.strong;
+    if (model === 'sonnet')
+        return ladders.anthropic.medium;
+    if (model === 'haiku')
+        return ladders.anthropic.light;
+    // 4. Unknown — pass through.
     return model;
 }
 // ---------------------------------------------------------------------------
@@ -105,10 +207,14 @@ export function normalizeModel(model) {
  *  declared extensions follow. */
 export function buildLaunchSpec(kind, mode, opts) {
     const p = resolvePersona(kind, mode, { lifecycle: opts.lifecycle, hasManager: opts.hasManager });
-    // A caller-supplied override (durable on `meta.model_override`, re-passed on
-    // every polymorph) wins over the persona's declared default; absent both, the
-    // model is left unset and the node inherits pi's default.
-    const chosenModel = opts.model ?? p.model;
+    const cfg = readUserConfigCached();
+    // Precedence, from strongest to weakest:
+    // 1. Caller-supplied override (durable on `meta.model_override`, re-passed on
+    //    every polymorph).
+    // 2. Configured persona strength for this kind.
+    // 3. The persona file's own frontmatter model.
+    // 4. Unset → pi default.
+    const chosenModel = opts.model ?? cfg.personaStrengths[kind] ?? p.model;
     const launch = {
         model: chosenModel !== undefined ? normalizeModel(chosenModel) : undefined,
         tools: p.tools,
@@ -116,7 +222,7 @@ export function buildLaunchSpec(kind, mode, opts) {
         systemPrompt: p.systemPrompt,
         env: { ...(opts.extraEnv ?? {}) },
     };
-    return { launch, lifecycle: p.lifecycle, skills: p.skills };
+    return { launch, lifecycle: p.lifecycle };
 }
 // ---------------------------------------------------------------------------
 // Build the pi argv to launch / revive a node
@@ -144,8 +250,12 @@ function writeSystemPromptFile(nodeId, prompt) {
  *    — pi COPIES that conversation into a NEW session for this node, then `prompt`
  *    is delivered as the next message. One-shot at birth: the node thereafter
  *    captures its OWN pi_session_file and revives by `--session` like any other.
- *  - revive idle/done: pass `resumeSessionPath` (absolute .jsonl path, preferred)
- *    or `resumeSessionId` (bare uuid fallback) to `--session` (keeps conversation).
+ *  - revive idle/done: pass `resumeSessionPath` (absolute .jsonl path) to
+ *    `--session` (keeps conversation). `resumeSessionId` (a bare uuid) is
+ *    accepted here too, but revive.ts's `resumeArgs` never produces one —
+ *    `headlessBrokerHost`'s preflight (host.ts) fatally rejects a bare
+ *    `--session` id before ever spawning the broker, so a real revive only
+ *    ever resumes by path (or falls through to fresh when no path exists).
  *  - refresh-yield: fresh again (no resume) — the node re-reads its roadmap. */
 export function buildPiArgv(meta, opts = {}) {
     const spec = meta.launch;
@@ -159,8 +269,10 @@ export function buildPiArgv(meta, opts = {}) {
     // absolute FILE path when present: pi resolves a bare id cwd-relative first
     // and shows a cross-project "Fork? [y/N]" prompt when the revive cwd differs
     // from the session's creation cwd, whereas a path (contains `/` or ends
-    // `.jsonl`) is opened directly — immune to any cwd discrepancy. The bare uuid
-    // is the fallback for older nodes booted before pi_session_file was captured.
+    // `.jsonl`) is opened directly — immune to any cwd discrepancy. In practice
+    // revive always passes the absolute path: a resume happens only when the saved
+    // `.jsonl` exists (resumeArgs), and the broker preflight rejects a bare id
+    // outright, so `resumeSessionId` is a generic builder param no live caller sets.
     // `--fork <path|id>` is the spawn-time branch: pi copies the source session
     // into a fresh one for this node (the source is untouched), then delivers the
     // kickoff prompt as the next message. Mutually exclusive with `--session`
@@ -223,9 +335,10 @@ export function piInvocationToSdkConfig(inv) {
                 break;
             case '--session': {
                 const v = argv[++i];
-                // A path (contains `/` or ends `.jsonl`) resumes via SessionManager.open;
-                // a bare uuid is the legacy fallback. Same classification buildPiArgv
-                // documents (path preferred, immune to cwd discrepancy).
+                // A path (contains `/` or ends `.jsonl`) resumes via SessionManager.open.
+                // A bare uuid is classified here for completeness but is rejected by the
+                // broker preflight and never produced by revive — the live path is always
+                // the absolute path. Same classification buildPiArgv documents.
                 if (v.includes('/') || v.endsWith('.jsonl'))
                     cfg.resumeSessionPath = v;
                 else

package/dist/core/runtime/lifecycle.js

@@ -35,7 +35,7 @@
 // row UPDATE directly via openDb — the one sanctioned exception to "only
 // canvas.ts touches the db" (see canvas/CLAUDE.md), exactly as db.ts's backfill
 // is the sanctioned exception for a data migration.
-import { openDb, getNode, cancelWakesFor, cancelSelfAlarms } from '../canvas/index.js';
+import { openDb, getNode, cancelTriggersFor, cancelSelfAlarms } from '../canvas/index.js';
 const ANY = '*';
 /** The supervised statuses — a live node the daemon watches. */
 const LIVE = ['active', 'idle'];
@@ -88,19 +88,19 @@ export function transition(nodeId, event) {
     else if (writeIntent) {
         db.prepare('UPDATE nodes SET intent = ? WHERE node_id = ?').run(spec.intent ?? null, nodeId);
     }
-    // Wakeups cleanup — writes a DIFFERENT table (wakeups) AFTER the atomic
+    // Triggers cleanup — writes a DIFFERENT table (triggers) AFTER the atomic
     // status/intent write above, so the single-(status,intent)-writer rule holds.
-    // Event-gated; exactly ONE delegated wakeups helper per event, never inline
-    // wakeups SQL here (design §6.7 / D2 / D6, Q1/Q2):
-    //   cancel   → cancelWakesFor: reap node-anchored AND owner-armed detached
-    //              wakes this node armed (ruling A) — covers both cancel sites
+    // Event-gated; exactly ONE delegated triggers helper per event, never inline
+    // triggers SQL here (design §6.7 / D2 / D6, Q1/Q2):
+    //   cancel   → cancelTriggersFor: reap node-anchored AND owner-armed detached
+    //              triggers this node armed (ruling A) — covers both cancel sites
     //              uniformly (close cascade · reapDescendants).
     //   finalize → cancelSelfAlarms: clear this node's one-shot self-alarms only;
     //              node-anchored declarative crons SURVIVE a finishing instance (Q1).
     //   crash    → NOTHING. A fault is not a deliberate end-of-waiting; self-alarms
     //              and crons MUST survive instance death (D2 / Invariant E / AC-R3).
     if (event === 'cancel')
-        cancelWakesFor(nodeId);
+        cancelTriggersFor(nodeId);
     else if (event === 'finalize')
         cancelSelfAlarms(nodeId);
     return getNode(nodeId);

package/dist/core/runtime/model-swap.d.ts

@@ -0,0 +1,18 @@
+import { type NodeMeta } from '../canvas/index.js';
+/** True when the node's broker engine is reachable: its recorded pid is alive
+ *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
+ *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
+export declare function isBrokerLive(meta: NodeMeta): boolean;
+/** Swap a LIVE node's model over its view.sock. Connects, claims controller
+ *  (hello + request_control, so an attached viewer never blocks the swap), sends
+ *  `set_model`, and resolves with the broker-resolved `provider/id` on its ack —
+ *  read back from the row the broker just persisted (model_changed.model carries
+ *  only the bare id). Rejects with the broker's message on an `error` frame (e.g.
+ *  `no model matching '<spec>' in the registry`), on connect failure, or timeout. */
+export declare function setModelLive(nodeId: string, spec: string): Promise<string>;
+/** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
+ *  what the broker's persistModelChoice writes on a live switch: `model_override`
+ *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
+ *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
+ *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline). */
+export declare function persistDormantModel(nodeId: string, spec: string): void;