@crouton-kit/crouter 0.3.33 → 0.3.34

package/dist/commands/view-pick.js

@@ -1,7 +1,7 @@
-// `crtr view pick` — hidden raw-ANSI picker over the available views.
+// `crtr surface view pick` — hidden raw-ANSI picker over the available views.
 //
 // Backs the /view popup: a minimal full-screen list of listViews(); j/k move,
-// Enter hands off to `crtr view run <id>` (execFileSync, stdio inherit — a
+// Enter hands off to the surface-view run command (execFileSync, stdio inherit — a
 // one-way handoff, the picker exits as the view takes over, same pattern as
 // browse's selectAndFocus), q/Esc/Ctrl-C quit. Outside a TTY it prints the
 // plain list and exits 0. Reuses the core/tui terminal + draw primitives.
@@ -14,7 +14,7 @@ export const viewPickLeaf = defineLeaf({
     name: 'pick',
     tier: 'hidden',
     description: 'raw-ANSI view picker (used by the /view popup)',
-    whenToUse: 'internal — the /view popup shells this to choose a view, then it execs `crtr view run <id>`. You normally run `crtr view run <name>` or `crtr view list` directly',
+    whenToUse: 'internal — the picker chooses a view for the popup, then hands off to the view host. You normally use run or list directly',
     help: {
         name: 'view pick',
         summary: 'interactive picker over available views; Enter runs the chosen view. Outside a TTY it prints the list and exits',
@@ -23,7 +23,7 @@ export const viewPickLeaf = defineLeaf({
         outputKind: 'object',
         effects: [
             'Inside a TTY: takes over the terminal in raw mode until you pick (Enter) or quit (q/Esc/Ctrl-C).',
-            'On Enter: execs `crtr view run <id>` (stdio inherited) — a one-way handoff; the picker exits.',
+            'On Enter: hands off to the chosen view host (stdio inherited) — a one-way handoff; the picker exits.',
             'Outside a TTY: prints the plain view list and exits 0.',
         ],
     },
@@ -38,7 +38,7 @@ export const viewPickLeaf = defineLeaf({
             return;
         }
         if (views.length === 0) {
-            process.stdout.write('No views found. Scaffold one with `crtr view new <name>`.\n');
+            process.stdout.write('No views found. Scaffold one with the view new leaf.\n');
             return;
         }
         const caps = detectColorCaps();
@@ -81,7 +81,7 @@ export const viewPickLeaf = defineLeaf({
             const launch = (id) => {
                 cleanup();
                 try {
-                    execFileSync('crtr', ['view', 'run', id], { stdio: 'inherit' });
+                    execFileSync('crtr', ['surface', 'view', 'run', id], { stdio: 'inherit' });
                 }
                 catch {
                     // The view takes the terminal over; a sync handoff may be interrupted.

package/dist/commands/view-run.js

@@ -1,10 +1,10 @@
-// `crtr view run <name>` — resolve, load, and host a view's TUI target.
+// `crtr surface view run` — resolve, load, and host a view's TUI target.
 //
 // Resolves the view across scopes (project→user→builtin), loads its core.mjs +
 // tui.mjs (+ optional text.mjs), then hands them to the dual-target core host.
 // The host owns the screen and the non-TTY path: when stdin is NOT a TTY it
-// prints the text presenter's dump and exits 0, so `crtr view run <name> | cat`
-// works anywhere. A view that ships no core.mjs is not a view — run fails with a
+// prints the text presenter's dump and exits 0, so a pipe gets a static
+// snapshot. A view that ships no core.mjs is not a view — run fails with a
 // clear error naming the contract, never a fallback. The interactive path is
 // tmux-only (crtr is tmux-only) — outside tmux with a TTY we notify + no-op,
 // never a non-tmux fallback. --port / --target forward verbatim onto
@@ -13,7 +13,7 @@
 // --window / --split open the view as a PERSISTENT MONITOR instead of taking
 // over the current pane: --window in a new background (non-focus-stealing)
 // tmux window, --split in a right-hand split of the current pane. Both shell a
-// plain inner `crtr view run <name>` into the new pane, which hosts the view
+// plain inner surface-view run command into the new pane, which hosts the view
 // there and self-tags the pane with @crtr_view so the Alt+V then ]/[ view-cycle
 // can flip it to the next/prev view in place. Both are tmux-only by nature; in
 // a pipe (non-TTY) placement is meaningless, so they degrade to the static dump.
@@ -27,7 +27,7 @@ import { inTmux, currentTmux, openNodeWindow, splitWindow, piCommand, setPaneOpt
 export const viewRunLeaf = defineLeaf({
     name: 'run',
     description: 'resolve, load, and host a view (in this pane, a new window, or a split)',
-    whenToUse: 'you want to OPEN a view by name — a full-screen raw-ANSI surface. By default it hosts in the current pane (tmux-only interactive; piped it prints a static snapshot). Pass --window to open it as a background monitor window, or --split to open it beside the current pane — both leave you where you are so a view becomes a live monitor you flip between with Alt+V then ]/[. Pass --port/--target to forward connection details. Use `crtr view list` first to see what is available, or `crtr view new` to scaffold one',
+    whenToUse: 'you want to open a view by name — a full-screen raw-ANSI surface. By default it hosts in the current pane (tmux-only interactive; piped it prints a static snapshot). Pass --window to open it as a background monitor window, or --split to open it beside the current pane so it stays available as a live monitor. Pass --port/--target to forward connection details. Use list first to see what is available, or new to scaffold one',
     help: {
         name: 'view run',
         summary: 'host a view in the current pane, a new window (--window), or a split (--split); outside a TTY it prints the view\'s static dump and exits 0',
@@ -35,8 +35,8 @@ export const viewRunLeaf = defineLeaf({
             { kind: 'positional', name: 'name', required: true, constraint: 'View id to run (its directory name). Resolves project→user→builtin.' },
             { kind: 'flag', name: 'window', type: 'bool', required: false, constraint: 'Open the view in a NEW background tmux window (non-focus-stealing) instead of the current pane — a persistent monitor. tmux-only; ignored (static dump) in a pipe. Mutually exclusive with --split.' },
             { kind: 'flag', name: 'split', type: 'bool', required: false, constraint: 'Open the view in a right-hand SPLIT of the current pane instead of taking it over — a side-by-side monitor. tmux-only; ignored (static dump) in a pipe. Mutually exclusive with --window.' },
-            { kind: 'flag', name: 'port', type: 'int', required: false, constraint: 'Forwarded verbatim to the view as options.port (e.g. a CDP debugging port).' },
-            { kind: 'flag', name: 'target', type: 'string', required: false, constraint: 'Forwarded verbatim to the view as options.target (e.g. a browser tab id).' },
+            { kind: 'flag', name: 'port', type: 'int', required: false, constraint: 'Forwarded verbatim to the view as options.port for views that connect to a network service.' },
+            { kind: 'flag', name: 'target', type: 'string', required: false, constraint: 'Forwarded verbatim to the view as options.target for views that need an external target identifier.' },
         ],
         output: [
             { name: 'hosted', type: 'string', required: false, constraint: 'For --window/--split: "window" or "split" — where the monitor opened. Absent for an in-pane host (which holds the terminal until you quit).' },
@@ -76,7 +76,7 @@ export const viewRunLeaf = defineLeaf({
                     error: 'view_invalid',
                     message: `'${name}' is not a valid view: ${dir} has no core.mjs`,
                     received: name,
-                    next: `A view is a directory containing core.mjs (the portable core) plus optional tui.mjs (render + keymap), web.jsx, and text.mjs. Scaffold the shape with \`crtr view new ${name}\`.`,
+                    next: 'A view is a directory containing core.mjs (the portable core) plus optional tui.mjs (render + keymap), web.jsx, and text.mjs. Use the surface view new leaf to scaffold the shape.',
                 });
             }
             const avail = listViews().map((v) => v.id);
@@ -85,8 +85,8 @@ export const viewRunLeaf = defineLeaf({
                 message: `no view: ${name}`,
                 received: name,
                 next: avail.length > 0
-                    ? `Available views: ${avail.join(', ')}. Or scaffold one with \`crtr view new ${name}\`.`
-                    : `No views found. Scaffold one with \`crtr view new ${name}\`.`,
+                    ? `Available views: ${avail.join(', ')}. Or scaffold one with the surface view new leaf.`
+                    : 'No views found. Scaffold one with the surface view new leaf.',
             });
         }
         const options = {};
@@ -116,7 +116,7 @@ export const viewRunLeaf = defineLeaf({
                 throw new InputError({
                     error: 'not_in_tmux',
                     message: '--window/--split are tmux-only — run crtr inside its tmux session',
-                    next: `Open it from inside tmux, or drop the flag to host in the current pane (or pipe for a snapshot: \`crtr view run ${name} | cat\`).`,
+                    next: 'Open it from inside tmux, or drop the placement flag to host in the current pane. For a static snapshot, pipe the command output.',
                 });
             }
             const here = currentTmux();
@@ -129,7 +129,7 @@ export const viewRunLeaf = defineLeaf({
             }
             // The inner command re-enters this leaf with NO placement flag, so it
             // hosts the view in its own (new) pane and self-tags it via @crtr_view.
-            const argv = ['view', 'run', name];
+            const argv = ['surface', 'view', 'run', name];
             if (port !== undefined)
                 argv.push('--port', String(port));
             if (target !== undefined)
@@ -164,8 +164,8 @@ export const viewRunLeaf = defineLeaf({
         if (process.stdin.isTTY && !inTmux()) {
             throw new InputError({
                 error: 'not_in_tmux',
-                message: 'crtr view is tmux-only — run it inside the crtr tmux session',
-                next: `Open it from inside tmux (e.g. the /view popup), or pipe for a static snapshot: \`crtr view run ${name} | cat\`.`,
+                message: 'crtr surface view is tmux-only — run it inside the crtr tmux session',
+                next: 'Open it from inside tmux, or pipe the command output for a static snapshot.',
             });
         }
         // Self-tag this pane with the view id (+ any forwarded --port/--target) so

package/dist/commands/view.js

@@ -1,4 +1,4 @@
-// `crtr view` — the TUI view library.
+// `crtr surface view` — the TUI view library.
 //
 // Views are switchable surfaces with two targets from one portable core.mjs:
 // the tmux TUI (`run`) and a React+Tailwind web page. This branch assembles the
@@ -6,7 +6,7 @@
 // target (interactive in tmux, static dump when piped), `new` scaffolds a fresh
 // view directory, and the hidden `pick` backs the /view popup. Each leaf owns
 // its own help one level down. The web target is no longer served per-view here:
-// it is hosted by the unified `crtr web serve` (the shell's /view/<id> route).
+// it is hosted by the unified surface web server (the shell's /view/<id> route).
 import { defineBranch } from '../core/command.js';
 import { viewListLeaf } from './view-list.js';
 import { viewRunLeaf } from './view-run.js';
@@ -24,7 +24,7 @@ export function registerView() {
         help: {
             name: 'view',
             summary: 'host and author switchable raw-ANSI terminal views',
-            model: '`list` when you do not know which views exist — a flat roster (id/title/description/scope) across project→user→builtin. `run <name>` opens the TUI target full-screen in the current pane (tmux-only interactive; piped it prints the view\'s static dump and exits 0), forwarding --port/--target onto the view; pass --window/--split to open it as a persistent monitor (new window / split) you flip between with Alt+V then ]/[. The web target (React+Tailwind) is served by the unified `crtr web serve` (the shell\'s /view/<id> route), not per-view here. `cycle` switches a monitor pane to the next/prev view in place (what those keys drive). `new <name>` scaffolds a runnable view directory (core.mjs + tui.mjs + web.jsx + text.mjs) you edit. `pick` is a hidden raw-ANSI picker the /view popup shells. Append `-h` at any leaf for its schema.',
+            model: 'The branch divides into listing, hosting, cycling, authoring, and the hidden picker. `list` is the roster; `run` hosts a named view in the current pane or a monitor pane; `cycle` advances a monitor in place; `new` scaffolds a view directory; `pick` backs the popup. The browser target is part of the web surface, not this branch.',
         },
         children: [viewListLeaf, viewRunLeaf, viewCycleLeaf, viewNewLeaf, viewPickLeaf],
     });

package/dist/commands/workspace.js

@@ -2,19 +2,19 @@
 //
 // Turns the current tmux window into an editor view for attached headless nodes:
 // a narrow LEFT rail (the `workspace-sidebar` view — this graph + other live
-// agents in this cwd, with ⚑ inbox flags) beside a CHAT pane (`crtr attach`).
+// agents in this cwd, with ⚑ inbox flags) beside a CHAT pane (surface attach).
 // Selecting a node in the rail swaps it into the chat pane.
 //
 // Layout build (the only two driver acts, both through placement's seam):
 //   1. splitWindow(here, before+size) → the rail pane, left of here, runs
-//      `crtr view run workspace-sidebar`.
+//      the workspace-sidebar view host.
 //   2. `crtr node focus <node> --pane <here>` → swaps the chat node's attach
 //      viewer into here's slot (here's old content relocates to the backstage).
 // The rail finds the chat pane by DISCOVERY (the `@crtr_node` tag attach sets),
 // so it is robust to that swap — no launch-time pane id is threaded into it.
 //
-// Command shape: the path-walker forbids a flat top-level leaf (same constraint
-// as attach), so this is a BRANCH wrapping one leaf: `crtr workspace enter`.
+// Command shape: under `crtr surface workspace`, this is a BRANCH wrapping one
+// leaf: `enter`.
 import { execFile } from 'node:child_process';
 import { defineBranch, defineLeaf } from '../core/command.js';
 import { InputError } from '../core/io.js';
@@ -37,10 +37,10 @@ function defaultChatNode(cwd) {
 const workspaceEnterLeaf = defineLeaf({
     name: 'enter',
     description: 'enter the editor view — a node rail beside a chat pane, in this window',
-    whenToUse: 'you want to work in the agent-centric editor layout: a left rail listing this graph + the other live agents in this working directory (with ⚑ inbox flags) beside a chat pane attached to a node. Selecting a node in the rail swaps it into the chat pane. Opens in the CURRENT tmux window. tmux-only.',
+    whenToUse: 'you want to work in the agent-centric editor layout: a left rail listing this graph plus the other live agents in this working directory (with ⚑ inbox flags) beside a chat pane attached to a node. Selecting a node in the rail swaps it into the chat pane. Opens in the current tmux window. tmux-only.',
     help: {
         name: 'workspace enter',
-        summary: 'split the current window into a left node-rail (the workspace-sidebar view) + a chat pane (crtr attach); ↵ in the rail swaps a node into the chat. tmux-only.',
+        summary: 'split the current window into a left node-rail (the workspace-sidebar view) + a chat pane (surface attach); ↵ in the rail swaps a node into the chat. tmux-only.',
         params: [
             {
                 kind: 'flag',
@@ -74,12 +74,12 @@ const workspaceEnterLeaf = defineLeaf({
         const node = input['node'];
         const width = input['width'] ?? RAIL_WIDTH;
         if (!process.stdout.isTTY) {
-            return { note: 'crtr workspace enter builds a tmux layout — run it in a tmux pane (a TTY), not a pipe.' };
+            return { note: 'surface workspace enter builds a tmux layout — run it in a tmux pane (a TTY), not a pipe.' };
         }
         if (!inTmux()) {
             throw new InputError({
                 error: 'not_in_tmux',
-                message: 'crtr workspace is tmux-only — run it inside the crtr tmux session',
+                message: 'surface workspace is tmux-only — run it inside the crtr tmux session',
                 next: 'Open it from inside tmux.',
             });
         }
@@ -109,7 +109,7 @@ const workspaceEnterLeaf = defineLeaf({
         }
         // 1. The rail — a narrow split to the LEFT of here. It discovers the chat
         //    pane itself (the @crtr_node tag), so no pane id is threaded in.
-        const railCmd = piCommand(['view', 'run', 'workspace-sidebar', '--target', here.pane], 'crtr');
+        const railCmd = piCommand(['surface', 'view', 'run', 'workspace-sidebar', '--target', here.pane], 'crtr');
         const rail = splitWindow(here.pane, {
             cwd: process.cwd(),
             env: {},
@@ -154,7 +154,7 @@ export function registerWorkspace() {
         help: {
             name: 'workspace',
             summary: 'enter the agent-centric editor view (node rail + chat pane) in the current tmux window',
-            model: '`enter` splits the current window into a narrow left rail (the workspace-sidebar view — this graph + other live agents in this cwd, ⚑ inbox flags) and a chat pane (`crtr attach`) attached to a node (--node, or the newest live root here). ↵ in the rail swaps the selected node into the chat pane. tmux-only; piped it prints a notice and exits 0.',
+            model: 'The branch is a two-pane editor layout: a narrow left rail and a chat pane. The rail shows this graph plus the other live agents in the working directory, and selecting a node swaps it into chat. tmux-only; piped input prints a notice and exits 0.',
         },
         children: [workspaceEnterLeaf],
     });

package/dist/core/__tests__/boot.test.js

@@ -0,0 +1,140 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/boot.test.ts
+//
+// BUG LOCKED (Hearth P6 Bug B — a sandbox/VM destroy+recreate, or a host
+// reboot, leaves stale `pi_pid` values in the durable canvas.db; a pid-reuse
+// collision on the fresh boot can fool `isPidAlive` into reading a dead
+// broker as alive, wedging the node forever). reconcileBootLiveness is the
+// fix: detect the boot change and clear every stale pid BEFORE any liveness
+// check trusts it.
+//
+// Exercises the pure decision core (bootChanged) and the impure, single-writer
+// sweep (reconcileBootLiveness) against a real isolated CRTR_HOME + canvas.db —
+// no real reboot, no real uptime: both take an injected BootIdentity (kernel
+// boot_id + wall-clock epoch) so a boot change is simulated by handing a
+// different identity between calls.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getRow, recordPid } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { bootChanged, reconcileBootLiveness } from '../canvas/boot.js';
+let home;
+/** Build a BootIdentity for injection. `bootId` null models the non-Linux
+ *  fallback (wall-clock window); a string models the exact kernel boot_id. */
+function ident(bootId, bootEpochMs) {
+    return { bootId, bootEpochMs };
+}
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...over,
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-boot-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+// ---------------------------------------------------------------------------
+// bootChanged — pure core
+// ---------------------------------------------------------------------------
+test('bootChanged: no persisted history is never a change (never clears a genuinely live pid)', () => {
+    assert.equal(bootChanged(ident('boot-A', 1_000_000), null), false);
+});
+test('bootChanged: same kernel boot_id is the SAME boot (daemon restart, no reboot)', () => {
+    assert.equal(bootChanged(ident('boot-A', 1_000_000 + 5_000), ident('boot-A', 1_000_000)), false, 'identical boot_id — same boot regardless of epoch');
+});
+test('bootChanged: a DIFFERENT boot_id under 60s wall-delta is still detected (Major-2 regression)', () => {
+    // A genuinely fast reboot/recreate: boot B starts only 42s after boot A
+    // (Hearth\'s measured recreate window), well inside the 60s wall tolerance.
+    // The exact kernel boot_id catches it with NO reliance on the wall-clock
+    // window — the case the old epoch-only compare false-negatived.
+    assert.equal(bootChanged(ident('boot-B', 1_000_000 + 42_000), ident('boot-A', 1_000_000)), true, 'distinct boot_id 42s apart — a real quick recreate, detected');
+});
+test('bootChanged: same boot_id with a huge epoch jump is NOT a boot change (NTP step within a boot)', () => {
+    assert.equal(bootChanged(ident('boot-A', 1_000_000 + 10 * 60_000), ident('boot-A', 1_000_000)), false, 'boot_id trumps the wall clock — an NTP correction mid-boot never false-positives');
+});
+test('bootChanged: wall-clock fallback (no boot_id) — epochs within tolerance are the SAME boot', () => {
+    assert.equal(bootChanged(ident(null, 1_000_000 + 5_000), ident(null, 1_000_000)), false, '5s drift — same boot');
+});
+test('bootChanged: wall-clock fallback (no boot_id) — epochs far apart are a DIFFERENT boot', () => {
+    assert.equal(bootChanged(ident(null, 1_000_000 + 10 * 60_000), ident(null, 1_000_000)), true, '10min apart — different boot');
+});
+// ---------------------------------------------------------------------------
+// reconcileBootLiveness — the impure sweep against a real canvas.db
+// ---------------------------------------------------------------------------
+test('reconcileBootLiveness: first-ever call seeds the marker and clears nothing', () => {
+    const m = node('n1');
+    createNode(m);
+    recordPid('n1', 12345);
+    const result = reconcileBootLiveness(ident('boot-A', 1_000_000));
+    assert.deepEqual(result, { changed: false, cleared: [] });
+    assert.equal(getRow('n1')?.pi_pid, 12345, 'a first-ever run never clears an existing pid');
+});
+test('reconcileBootLiveness: same boot (same boot_id) leaves pids untouched — MUST NOT weaken the normal daemon-restart case', () => {
+    const m = node('n1');
+    createNode(m);
+    recordPid('n1', 12345);
+    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed
+    const result = reconcileBootLiveness(ident('boot-A', 1_000_000 + 3_000)); // 3s later, same boot
+    assert.deepEqual(result, { changed: false, cleared: [] });
+    assert.equal(getRow('n1')?.pi_pid, 12345, 'a live pid on the same boot is never cleared');
+});
+test('reconcileBootLiveness: a boot change clears every recorded pid, regardless of status', () => {
+    const active = node('active-1', { status: 'active' });
+    const idle = node('idle-1', { status: 'idle' });
+    const dead = node('dead-1', { status: 'dead' }); // the guard reads pi_pid unconditionally
+    const noPid = node('no-pid-1', { status: 'active' });
+    for (const m of [active, idle, dead, noPid])
+        createNode(m);
+    recordPid('active-1', 111);
+    recordPid('idle-1', 222);
+    recordPid('dead-1', 333);
+    // no-pid-1 deliberately left without a recorded pid.
+    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
+    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000)); // boot B
+    assert.equal(result.changed, true);
+    assert.deepEqual(result.cleared.sort(), ['active-1', 'dead-1', 'idle-1']);
+    assert.equal(getRow('active-1')?.pi_pid, null);
+    assert.equal(getRow('idle-1')?.pi_pid, null);
+    assert.equal(getRow('dead-1')?.pi_pid, null, 'cleared even though status is dead — the double-launch guard reads pi_pid unconditionally');
+    assert.equal(getRow('no-pid-1')?.pi_pid, null, 'already null — no-op, not an error');
+});
+test('reconcileBootLiveness: a fast recreate (distinct boot_id, 42s wall) still sweeps (Major-2 regression)', () => {
+    const m = node('n1');
+    createNode(m);
+    recordPid('n1', 111);
+    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
+    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 42_000)); // 42s later — inside the wall window, but new boot_id
+    assert.equal(result.changed, true, 'distinct boot_id detected even 42s apart');
+    assert.deepEqual(result.cleared, ['n1']);
+    assert.equal(getRow('n1')?.pi_pid, null);
+});
+test('reconcileBootLiveness: after reconciling, the SAME boot no longer re-triggers (idempotent)', () => {
+    const m = node('n1');
+    createNode(m);
+    recordPid('n1', 111);
+    reconcileBootLiveness(ident('boot-A', 1_000_000)); // seed boot A
+    reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000)); // boot change → clears + persists boot B
+    recordPid('n1', 999); // a fresh broker re-records its pid post-revive
+    const result = reconcileBootLiveness(ident('boot-B', 1_000_000 + 60 * 60_000 + 2_000)); // still boot B, 2s later
+    assert.deepEqual(result, { changed: false, cleared: [] });
+    assert.equal(getRow('n1')?.pi_pid, 999, 'a pid recorded AFTER reconciliation, within the same boot, is never touched');
+});

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -12,9 +12,6 @@
 //        model provider is registered into the ModelRegistry and resolves onto
 //        the session. Plain createAgentSession never calls registerProvider, so a
 //        custom-provider node would get NO model.
-//   C4 — a project AGENTS.md is injected into the assembled system prompt (the
-//        services path loads project context; 0.78.1 has no project-trust gate so
-//        context is unconditionally loaded — see buildBrokerSession's C4 note).
 //   C2 — with ZERO viewers attached, the broker UI context resolves confirm() /
 //        select() / input() / editor() to deny/cancel IMMEDIATELY (noOp), instead
 //        of relying on a per-dialog timeout and hanging the agent turn forever.
@@ -23,7 +20,7 @@
 // dialog routing are all local. No tmux, no broker process — direct unit drives.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -86,29 +83,11 @@ test('C3b — broker splits model thinking suffix before SDK registry lookup', a
         rmSync(cwd, { recursive: true, force: true });
     }
 });
-// ===========================================================================
-// C4 — project context (AGENTS.md) is injected into the system prompt. The
-// services path loads project context files; on the 0.78.1 pin there is no
-// project-trust gate, so they load unconditionally (and buildBrokerSession does
-// NOT re-introduce the CLI's headless trust resolver, which would drop them).
-// ===========================================================================
-test('C4 — a project AGENTS.md is injected into the assembled system prompt', async () => {
-    const cwd = mkdtempSync(join(tmpdir(), 'crtr-c4-'));
-    try {
-        const marker = 'C4_AGENTS_MARKER_' + Math.random().toString(36).slice(2);
-        writeFileSync(join(cwd, 'AGENTS.md'), `# Project rules\n\n${marker}\n`);
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd));
-        try {
-            assert.ok(session.systemPrompt.includes(marker), 'C4: project AGENTS.md content is present in the assembled system prompt');
-        }
-        finally {
-            session.dispose();
-        }
-    }
-    finally {
-        rmSync(cwd, { recursive: true, force: true });
-    }
-});
+// (C4 — project AGENTS.md/CLAUDE.md injection — was removed: crouter now sets
+// `noContextFiles: true` in buildBrokerSession and re-renders project context
+// into the first-message <crtr-context> bearings instead of pi's system prompt
+// (broker.ts). That behavior is covered by context-intro.test.ts's "project
+// instructions ride the bearings, not the system prompt" test.)
 // ===========================================================================
 // C2 — zero-viewer dialogs resolve to deny/cancel IMMEDIATELY (noOp), never
 // hanging the turn and never waiting on a per-dialog timeout. Drives the REAL

package/dist/core/__tests__/daemon-boot.test.js

@@ -116,6 +116,28 @@ test('an unplaced active node is left alone before it boots', async () => {
     await superviseTick();
     assert.equal(getNode('S').status, 'active', 'unplaced active node is not reaped');
 });
+// Major-4: a correctly-dormant idle-release node whose recorded pid was cleared
+// to null by boot reconciliation must NOT be spuriously revived. Its pi_pid is
+// null and pi_session_id is set, so the pid-null branch would otherwise read it
+// as a "stranded relaunch" and grace-revive it — even though it freed itself on
+// purpose and has no unseen inbox. The pid-null branch must honor idle-release
+// dormancy the same way the dead-pid branch does: leave it idle; only the second
+// pass wakes it, and only on an unseen inbox entry.
+test('idle-release node with a boot-cleared (null) pid and no unseen inbox stays dormant', async () => {
+    createNode(node('D', {
+        status: 'idle',
+        intent: 'idle-release',
+        pi_pid: null, // cleared by boot reconciliation
+        pi_session_id: '019e8f00-freed-while-dormant', // set → would look like a stranded relaunch
+    }));
+    const t0 = Date.now();
+    await superviseTick(t0); // first observation
+    await superviseTick(t0 + 60_000); // well past the boot grace
+    const after = getNode('D');
+    assert.equal(after.status, 'idle', 'dormant idle-release node is left idle, not revived');
+    assert.equal(after.intent, 'idle-release', 'intent unchanged — no revive fired');
+    assert.equal(after.pi_pid, null, 'no fresh pid — reviveNode was never invoked');
+});
 // Daemon start guard: spawnDaemon must not report success before the daemon is
 // plausibly alive and has written its pidfile. This is a pure bounded poll over
 // injected clocks/probes, so we can lock it down deterministically without a

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -104,7 +104,7 @@ export class SessionManager {
 // ---------------------------------------------------------------------------
 // AgentSessionEvent stream synthesis (T8 / G1, G3, G4, G8). The fake emits a
 // REALISTIC streaming assistant turn through session.subscribe — the SAME channel
-// the real pi engine feeds the broker's fan-out — so the frames a `crtr attach`
+// the real pi engine feeds the broker's fan-out — so the frames a `crtr surface attach`
 // client receives are byte-for-byte real AgentSessionEvents. The EMITTED event
 // shapes are typed against the real `AgentSessionEvent` union from pi (whose full
 // 17 variants are message_start/update/end, tool_execution_start/update/end,

package/dist/core/__tests__/full/broker-attach-limits.test.js

@@ -3,7 +3,7 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
 // (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
 //
-// T8 — the `crtr attach` acceptance gate, gates G4/G7/G8/G9 (controller
+// T8 — the `crtr surface attach` acceptance gate, gates G4/G7/G8/G9 (controller
 // arbitration, decoder overflow caps, backpressure shedding, and the load-bearing
 // ONE-WRITER proof). Split out of broker-lifecycle.test.ts; the gates are the
 // original acceptance gate, unchanged.

package/dist/core/__tests__/full/broker-attach-stream.test.js

@@ -3,7 +3,7 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process
 // (~5s pi-SDK load), so it lives in full/ (CI), not the fast local loop.
 //
-// T8 — the `crtr attach` acceptance gate, gates G1/G1b/G2/G3 (controller drive,
+// T8 — the `crtr surface attach` acceptance gate, gates G1/G1b/G2/G3 (controller drive,
 // relay/coalescing, detach survival, catch-up snapshot). Split out of
 // broker-lifecycle.test.ts; the gates are the original acceptance gate, unchanged.
 //

package/dist/core/__tests__/full/broker-crash-teardown.test.js

@@ -12,7 +12,7 @@
 //     • items 4–6: a CRASHED broker (pid killed out from under the daemon) must
 //       grace-revive RESUMING the saved .jsonl, ONE-WRITER (the crashed pid is
 //       dead BEFORE the revive launches and never resurrects; the revived pid is
-//       distinct); and a clean `node close` tears the broker down (shutdown frame
+//       distinct); and a clean `node lifecycle close` tears the broker down (shutdown frame
 //       → exit, socket unlinked, status canceled, daemon leaves it).
 //     • M-1/M-2: a broker that DIES before session_start records NO pid and NO
 //       session EVER. Read pid==null unconditionally as "still booting" and the
@@ -40,7 +40,8 @@
 //     RED. Verified by reverting that branch (see bug-injection report).
 import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync } from 'node:fs';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { createHarness } from '../helpers/harness.js';
 import { subscribe } from '../../canvas/canvas.js';
 import { isPidAlive } from '../../canvas/pid.js';
@@ -84,13 +85,17 @@ test('CRASH → grace-revive RESUME (one-writer), then clean teardown on close',
     assert.ok(newPid != null && isPidAlive(newPid), 'the revived broker pid is alive');
     assert.notEqual(newPid, oldPid, 'the revived pid is distinct from the crashed one');
     assert.equal(isPidAlive(oldPid), false, 'one-writer: the crashed pid never resurrected');
-    // --- Item 5: clean teardown of the (revived, live) broker. node close marks
+    // --- Item 5: clean teardown of the (revived, live) broker. node lifecycle close marks
     //     canceled BEFORE teardown (crash-safe order), then hostFor(broker).teardown
     //     sends the `shutdown` frame → the broker disposes + exits, socket unlinked. ---
+    const sessionFile = h.node(id).pi_session_file;
+    assert.ok(sessionFile !== null && sessionFile !== undefined, 'revived broker has a session file');
+    mkdirSync(join(sessionFile, '..'), { recursive: true });
+    writeFileSync(sessionFile, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
     const sock = h.brokerSock(id);
     await h.waitFor(() => existsSync(sock), { label: 'revived broker created its view.sock' });
-    const res = h.cli(root, ['node', 'close', '--node', id]);
-    assert.equal(res.code, 0, `node close should exit 0\n--stderr--\n${res.stderr}`);
+    const res = h.cli(root, ['node', 'lifecycle', 'close', '--node', id]);
+    assert.equal(res.code, 0, `node lifecycle close should exit 0\n--stderr--\n${res.stderr}`);
     await h.waitFor(() => !isPidAlive(newPid), { label: 'broker process exited on shutdown frame' });
     await h.waitFor(() => !existsSync(sock), { label: 'broker unlinked its socket on exit' });
     assert.equal(h.status(id), 'canceled', 'the closed node is canceled');

package/dist/core/__tests__/full/broker-model-changed-broadcast.test.js

@@ -3,7 +3,7 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process,
 // so it lives in full/ (CI), not the fast local loop.
 //
-// BUG-REGRESSION (real, observed 2026-06-11 in `crtr attach`): switching the
+// BUG-REGRESSION (real, observed 2026-06-11 in `crtr surface attach`): switching the
 // model (/model <provider/id> or the picker) visibly did nothing — the viewer's
 // status bar kept showing the OLD model until some unrelated event happened to
 // arrive.

package/dist/core/__tests__/full/broker-navigate-tree-rewelcome.test.js

@@ -3,7 +3,7 @@
 // FULL TIER (real-boot-bound): tmux-free, but it boots a REAL broker process,
 // so it lives in full/ (CI), not the fast local loop.
 //
-// BUG-REGRESSION (real, observed 2026-06-11 in `crtr attach`): double-Esc (or
+// BUG-REGRESSION (real, observed 2026-06-11 in `crtr surface attach`): double-Esc (or
 // /tree) opened the session-tree picker, but SELECTING an entry visibly did
 // nothing — the viewer stayed on the old transcript instead of traveling back
 // to the chosen point in time.

package/dist/core/__tests__/full/broker-pane-resolution.test.js

@@ -6,7 +6,7 @@
 //
 // (1) Gap 1 — `nodeInPane()` (src/commands/node.ts) resolved a pane via
 //     window→node ONLY. A broker engine runs DETACHED with window=null, and its
-//     on-screen presence is a `crtr attach` VIEWER pane, so the window lookup
+//     on-screen presence is a `crtr surface attach` VIEWER pane, so the window lookup
 //     never found it: `node cycle`/`recycle`/`close`/`demote`/`lifecycle` all
 //     broke when the current pane was a broker viewer. The fix has attach
 //     self-tag its pane `@crtr_node=<id>` and nodeInPane resolve that tag first.