@crouton-kit/crouter 0.3.35 → 0.3.37

package/dist/core/preview-registry.js

@@ -57,7 +57,6 @@ export const HELP_ICON = String.fromCodePoint(HELP_ICON_CP);
  *  private-use-area icons chosen per family concept (see command-icons.md). */
 const FAMILY_ICON_CP = {
     canvas: 0xf0e8,
-    feed: 0xf09e,
     human: 0xf007,
     memory: 0xf02d,
     node: 0xf192,
@@ -80,17 +79,14 @@ const LEAF_ICON_CP = {
     'canvas history search': 0xf002,
     'canvas history read': 0xf02d,
     'canvas history show': 0xf1da,
-    'canvas daemon start': 0xf04b,
-    'canvas daemon status': 0xf111,
-    'canvas daemon stop': 0xf04d,
+    'sys daemon start': 0xf04b,
+    'sys daemon status': 0xf111,
+    'sys daemon stop': 0xf04d,
     'canvas chord': 0xf001,
-    'canvas tmux-spread': 0xf009,
+    'surface tmux-spread': 0xf009,
     'canvas issue new': 0xf188,
     'canvas prune': 0xf0c4,
     'canvas rebuild-index': 0xf0ad,
-    'feed read': 0xf02d,
-    'feed message': 0xf0e0,
-    'feed peek': 0xf06e,
     'human ask': 0xf059,
     'human review': 0xf044,
     'human notify': 0xf0f3,
@@ -262,7 +258,7 @@ function summarizeMemoryLint(text) {
     return null;
 }
 // ---------------------------------------------------------------------------
-// Shared table/count parsing helpers for the canvas/node/feed runtime cockpit
+// Shared table/count parsing helpers for the canvas/node runtime cockpit
 // batch below. These parse the exact markdown shapes core/render.ts's generic
 // renderArray/renderResult produce (a `- field: N` bullet for a scalar count,
 // an `N <label>:` count lead-in followed by a GFM table for an array of
@@ -738,7 +734,7 @@ function summarizeCanvasHistoryShow(text) {
     const digest = summarizeTopCounts(typeCounts, 5, (name, count) => `${name}s×${count}`);
     return [{ text: `${countMatch[1]} artifacts` }, { text: digest, tone: 'muted' }];
 }
-/** `crtr canvas daemon start` (src/commands/daemon.ts:40, `spawnDaemon()` in
+/** `crtr sys daemon start` (src/commands/sys/daemon.ts:40, `spawnDaemon()` in
  *  src/daemon/manage.ts:89) has no custom `render`; the generic renderer
  *  bullets `{started:true,pid}` or `{started:false,existing_pid}`. `pid` is
  *  unconditionally set alongside `started:true` (manage.ts:125) — a
@@ -747,7 +743,7 @@ function summarizeCanvasHistoryShow(text) {
  *  false branch (a `readPidfile() ?? undefined` race), so that one stays
  *  optional. Returns null when `started` isn't a plain boolean bullet, or
  *  is `true` without a `pid` bullet. */
-function summarizeCanvasDaemonStart(text) {
+function summarizeSysDaemonStart(text) {
     const m = /^- started:\s*(true|false)\s*$/m.exec(text);
     if (m === null)
         return null;
@@ -760,14 +756,14 @@ function summarizeCanvasDaemonStart(text) {
     const pid = /^- existing_pid:\s*(\d+)\s*$/m.exec(text)?.[1];
     return [{ text: `already running${pid !== undefined ? ` · pid ${pid}` : ''}`, tone: 'muted' }];
 }
-/** `crtr canvas daemon status` (src/commands/daemon.ts:65) has no custom
+/** `crtr sys daemon status` (src/commands/sys/daemon.ts:65) has no custom
  *  `render`; the generic renderer bullets `{running:true,pid}` or
  *  `{running:false}`. `pid` is unconditionally set alongside `running:true`
  *  (daemon.ts:70 — the true branch only fires once `readPidfile()` already
  *  returned a pid), so a true-with-no-pid shape is unrecognized. Returns
  *  null when `running` isn't a plain boolean bullet, or is `true` without a
  *  `pid` bullet. */
-function summarizeCanvasDaemonStatus(text) {
+function summarizeSysDaemonStatus(text) {
     const m = /^- running:\s*(true|false)\s*$/m.exec(text);
     if (m === null)
         return null;
@@ -779,13 +775,13 @@ function summarizeCanvasDaemonStatus(text) {
     }
     return [{ text: 'not running', tone: 'error' }];
 }
-/** `crtr canvas daemon stop` (src/commands/daemon.ts:93) has no custom
+/** `crtr sys daemon stop` (src/commands/sys/daemon.ts:93) has no custom
  *  `render`; the generic renderer bullets `{stopped:true,pid}` or
  *  `{stopped:false}`. `pid` is unconditionally set alongside `stopped:true`
  *  (daemon.ts:98 — the signaled pid is echoed back in the same return), so a
  *  true-with-no-pid shape is unrecognized. Returns null when `stopped` isn't
  *  a plain boolean bullet, or is `true` without a `pid` bullet. */
-function summarizeCanvasDaemonStop(text) {
+function summarizeSysDaemonStop(text) {
     const m = /^- stopped:\s*(true|false)\s*$/m.exec(text);
     if (m === null)
         return null;
@@ -982,97 +978,6 @@ function summarizeNodeTriggersList(text) {
         out.push({ text: `… ${remaining} more`, tone: 'muted' });
     return out;
 }
-/** `crtr feed read` (src/commands/push.ts:209) has two shapes: drained
- *  (`${n} unread pointer(s) drained from ${node_id}'s inbox.\n\n${digest}`,
- *  where the digest — `coalesce()`, src/core/feed/inbox.ts:225 — groups by
- *  sender as `From ${sender} — ${N} update(s):` sections) or empty (`No
- *  unread pointers for ${node_id} (unread=0).\n\n${explanation}`).
- *  `coalesce()` always groups drained entries under at least one
- *  From-section, so a positive drained count with zero parsed senders is a
- *  shape mismatch, not a 0-sender success. Returns null on any other
- *  shape. */
-function summarizeFeedRead(text) {
-    const lines = text.split('\n');
-    const first = lines[0] ?? '';
-    const drained = /^(\d+) unread pointers? drained from (.+)'s inbox\.$/.exec(first);
-    if (drained !== null) {
-        const n = Number(drained[1]);
-        const senders = [...new Set([...text.matchAll(/^From (.+?) — \d+ update/gm)].map((m) => m[1]))];
-        if (n > 0 && senders.length === 0)
-            return null;
-        const out = [{ text: `${n} pointer${n === 1 ? '' : 's'} drained from ${senders.length} node${senders.length === 1 ? '' : 's'}` }];
-        if (senders.length > 0) {
-            const shown = senders.slice(0, 5);
-            const remaining = senders.length - shown.length;
-            out.push({ text: remaining > 0 ? `${shown.join(', ')}, … ${remaining} more` : shown.join(', '), tone: 'muted' });
-        }
-        return out;
-    }
-    if (/^No unread pointers for .+ \(unread=0\)\.$/.test(first)) {
-        return [{ text: 'nothing unread', tone: 'muted' }];
-    }
-    return null;
-}
-/** Teaser cap for `feed message`'s body preview — mirrors
- *  MEMORY_READ_CONTENT_LINES's role for a different leaf. */
-const FEED_MESSAGE_TEASER_LINES = 3;
-/** `crtr feed message` (src/commands/push.ts:264) has two shapes: found
- *  (`Full message ${id} (from ${from}):\n\n${body}`) or not-found (a short
- *  line — left as null, the generic fallback is fine for one line). */
-function summarizeFeedMessage(text) {
-    const lines = text.split('\n');
-    const head = /^Full message (\S+) \(from (.+)\):$/.exec(lines[0] ?? '');
-    if (head === null)
-        return null;
-    const [, id, from] = head;
-    const bodyLines = lines.slice(1);
-    let idx = 0;
-    while (idx < bodyLines.length && bodyLines[idx].trim() === '')
-        idx++;
-    const content = bodyLines.slice(idx);
-    const teaser = content.slice(0, FEED_MESSAGE_TEASER_LINES);
-    const hasMore = content.slice(FEED_MESSAGE_TEASER_LINES).some((l) => l.trim() !== '');
-    if (hasMore)
-        teaser.push('…');
-    const out = [{ text: `${id} · from ${from}` }];
-    if (teaser.some((l) => l.trim() !== '')) {
-        out.push({ text: '' });
-        for (const l of teaser)
-            out.push({ text: l });
-    }
-    return out;
-}
-/** `crtr feed peek` (src/commands/push.ts:351) has two shapes: zero-kids
- *  (`No nodes below you (0 subscriptions, ${unread} unread). ${tail}` — the
- *  "0" is a hardcoded literal, not a variable) or nonzero (`${verdictLine}
- *  \n\n${N} node(s) below you — ${working} working, ${done} done, ${dead}
- *  dead, ${unread} unread:\n${rows}`). Returns null on any other shape. */
-function summarizeFeedPeek(text) {
-    const zero = /^No nodes below you \(0 subscriptions, (\d+) unread\)\./.exec(text.split('\n')[0] ?? '');
-    if (zero !== null) {
-        const unread = Number(zero[1]);
-        return unread > 0
-            ? [{ text: `0 below · ${unread} unread`, tone: 'warning' }]
-            : [{ text: 'PASS · nothing below', tone: 'success' }];
-    }
-    const m = /(\d+) nodes? below you — (\d+) working, (\d+) done, (\d+) dead, (\d+) unread:/.exec(text);
-    if (m === null)
-        return null;
-    const [, , workingStr, doneStr, deadStr, unreadStr] = m;
-    const working = Number(workingStr);
-    const done = Number(doneStr);
-    const dead = Number(deadStr);
-    const unread = Number(unreadStr);
-    const parts = [`${working} working`, `${done} done`];
-    if (dead > 0)
-        parts.push(`${dead} dead`);
-    const lines = [{ text: parts.join(' · ') }];
-    if (dead > 0)
-        lines.push({ text: `${dead} dead — will not wake you`, tone: 'warning' });
-    else if (unread > 0)
-        lines.push({ text: `${unread} unread`, tone: 'warning' });
-    return lines;
-}
 /** `crtr push final` (makeTierLeaf's shared render, src/commands/push.ts:161)
  *  leads with a fixed sentence ('Result recorded — node finished; ...')
  *  followed unconditionally by `\n\n- report: ${report_path}` (`report_path`
@@ -1996,18 +1901,15 @@ const SUMMARIZERS = [
     { path: 'canvas history search', run: summarizeCanvasHistorySearch },
     { path: 'canvas history read', run: summarizeCanvasHistoryRead },
     { path: 'canvas history show', run: summarizeCanvasHistoryShow },
-    { path: 'canvas daemon start', run: summarizeCanvasDaemonStart },
-    { path: 'canvas daemon status', run: summarizeCanvasDaemonStatus },
-    { path: 'canvas daemon stop', run: summarizeCanvasDaemonStop },
+    { path: 'sys daemon start', run: summarizeSysDaemonStart },
+    { path: 'sys daemon status', run: summarizeSysDaemonStatus },
+    { path: 'sys daemon stop', run: summarizeSysDaemonStop },
     { path: 'canvas issue new', run: summarizeCanvasIssueNew },
     { path: 'node new', run: summarizeNodeNew },
     { path: 'node msg', run: summarizeNodeMsg },
     { path: 'node yield', run: summarizeNodeYield },
     { path: 'node lifecycle close', run: summarizeNodeLifecycleClose },
     { path: 'node triggers list', run: summarizeNodeTriggersList },
-    { path: 'feed read', run: summarizeFeedRead },
-    { path: 'feed message', run: summarizeFeedMessage },
-    { path: 'feed peek', run: summarizeFeedPeek },
     { path: 'push urgent', run: summarizePushUrgent },
     { path: 'push final', run: summarizePushFinal },
     { path: 'human ask', run: summarizeHumanAsk },

package/dist/core/render.js

@@ -6,7 +6,7 @@
 // The raw JSON object is still available behind the `--json` global for tooling.
 //
 // A leaf may hand `defineLeaf` a bespoke `render(result)` for instruction-shaped
-// output that leads with the outcome (see `node new`, `push`, `feed read`).
+// output that leads with the outcome (see `node new`, `push`).
 // Everything else falls through to the schema-driven generic renderer here, so
 // every command obeys the markdown paradigm without a hand-written renderer.
 // `renderError` is the one sanctioned exception: a failure is a different domain

package/dist/core/runtime/busy.d.ts

@@ -6,3 +6,18 @@ export declare function clearBusy(nodeId: string): void;
  *  site — a stale marker from a crashed pi is harmless because the dead pid
  *  fails the AND. */
 export declare function isBusy(nodeId: string): boolean;
+/** Re-touch the mid-turn marker's mtime — the daemon's wedge-detection
+ *  heartbeat (crtrd.ts `handleWedgeDetection`). Called from canvas-stophook on
+ *  every engine-level sign of life WITHIN a turn (a tool starting/streaming/
+ *  ending, a streamed assistant token, a turn ending) so the marker's mtime
+ *  always reflects the last moment the engine visibly did something, not just
+ *  when the turn began. No-ops when the node isn't currently busy — a touch
+ *  arriving after `clearBusy` (e.g. a late/queued event racing agent_end) must
+ *  never resurrect a stale marker. Best-effort. */
+export declare function touchBusy(nodeId: string): void;
+/** The mid-turn marker's mtime: the last moment ANY engine-level progress was
+ *  observed while the node was busy (see `touchBusy`). Null when the node isn't
+ *  busy or the marker is unreadable. This is the sole heartbeat the daemon's
+ *  wedge detector reads — it needs no new instrumentation beyond re-touching an
+ *  already-existing file. */
+export declare function busySince(nodeId: string): number | null;

package/dist/core/runtime/busy.js

@@ -13,7 +13,7 @@
 // read site, so a stale marker (process crashed mid-turn without firing
 // agent_end) is harmless — the dead pid fails the AND and the node is reaped.
 // No db migration, atomic touch/unlink, best-effort (never throws).
-import { existsSync, writeFileSync, rmSync, mkdirSync } from 'node:fs';
+import { existsSync, writeFileSync, rmSync, mkdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { jobDir } from '../canvas/index.js';
 function busyPath(nodeId) {
@@ -44,3 +44,34 @@ export function clearBusy(nodeId) {
 export function isBusy(nodeId) {
     return existsSync(busyPath(nodeId));
 }
+/** Re-touch the mid-turn marker's mtime — the daemon's wedge-detection
+ *  heartbeat (crtrd.ts `handleWedgeDetection`). Called from canvas-stophook on
+ *  every engine-level sign of life WITHIN a turn (a tool starting/streaming/
+ *  ending, a streamed assistant token, a turn ending) so the marker's mtime
+ *  always reflects the last moment the engine visibly did something, not just
+ *  when the turn began. No-ops when the node isn't currently busy — a touch
+ *  arriving after `clearBusy` (e.g. a late/queued event racing agent_end) must
+ *  never resurrect a stale marker. Best-effort. */
+export function touchBusy(nodeId) {
+    try {
+        if (!existsSync(busyPath(nodeId)))
+            return;
+        writeFileSync(busyPath(nodeId), '');
+    }
+    catch {
+        /* best-effort */
+    }
+}
+/** The mid-turn marker's mtime: the last moment ANY engine-level progress was
+ *  observed while the node was busy (see `touchBusy`). Null when the node isn't
+ *  busy or the marker is unreadable. This is the sole heartbeat the daemon's
+ *  wedge detector reads — it needs no new instrumentation beyond re-touching an
+ *  already-existing file. */
+export function busySince(nodeId) {
+    try {
+        return statSync(busyPath(nodeId)).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/core/runtime/close.d.ts

@@ -1,3 +1,13 @@
+import { type SubscriptionRef } from '../canvas/index.js';
+/** The doctrine wake: fan a system notice to every given subscriber of a node
+ *  whose lifecycle just ended out from under it (closed, or crashed to dead) —
+ *  the runtime guarantee that a manager waiting dormant on a child always
+ *  learns of its terminal outcome instead of hanging forever. Active subscriber
+ *  → inbox (wakes a dormant manager via its live watcher / the daemon's
+ *  dormant-revive pass); passive → the passive accumulator (delivered, not
+ *  woken). Shared by closeNode (step 4, below) and reviveNode's launch-refusal
+ *  crash path (revive.ts). */
+export declare function fanDoctrineWake(fromId: string, subscribers: readonly SubscriptionRef[], label: string, data: Record<string, unknown>): void;
 export interface CloseNodeResult {
     /** The focused node that was closed — the cascade root. */
     root: string;

package/dist/core/runtime/close.js

@@ -36,6 +36,23 @@ import { headlessBrokerHost } from './host.js';
 import { tearDownNode, reapIfEmpty } from './placement.js';
 import { appendInbox } from '../feed/inbox.js';
 import { appendPassive } from '../feed/passive.js';
+/** The doctrine wake: fan a system notice to every given subscriber of a node
+ *  whose lifecycle just ended out from under it (closed, or crashed to dead) —
+ *  the runtime guarantee that a manager waiting dormant on a child always
+ *  learns of its terminal outcome instead of hanging forever. Active subscriber
+ *  → inbox (wakes a dormant manager via its live watcher / the daemon's
+ *  dormant-revive pass); passive → the passive accumulator (delivered, not
+ *  woken). Shared by closeNode (step 4, below) and reviveNode's launch-refusal
+ *  crash path (revive.ts). */
+export function fanDoctrineWake(fromId, subscribers, label, data) {
+    for (const sub of subscribers) {
+        const notice = { from: fromId, tier: 'normal', kind: 'message', label, data };
+        if (sub.active)
+            appendInbox(sub.node_id, notice);
+        else
+            appendPassive(sub.node_id, notice);
+    }
+}
 /** The set of nodes to close: the root plus every descendant reachable down the
  *  subscriptions spine, all of whose managers are themselves in the set. Grown
  *  to a fixpoint — a node added this pass can qualify its own children next
@@ -186,19 +203,7 @@ export function closeNode(rootId, opts = {}) {
             //    never fires inside a self-contained cascade. Active → inbox (wakes a
             //    dormant manager via its live watcher / the daemon's dormant-revive
             //    second pass); passive → passive accumulator (delivered, not woken).
-            for (const sub of survivors) {
-                const notice = {
-                    from: id,
-                    tier: 'normal',
-                    kind: 'message',
-                    label: `Child closed — ${m.name} (${id}) was closed from the canvas and is no longer running.`,
-                    data: { reason: 'child-closed', child: id },
-                };
-                if (sub.active)
-                    appendInbox(sub.node_id, notice);
-                else
-                    appendPassive(sub.node_id, notice);
-            }
+            fanDoctrineWake(id, survivors, `Child closed — ${m.name} (${id}) was closed from the canvas and is no longer running.`, { reason: 'child-closed', child: id });
             closed.push(id);
         }
         catch {

package/dist/core/runtime/fault-recovery.js

@@ -5,6 +5,10 @@ const POLICIES = {
     auth: { kind: 'auth', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
     protocol: { kind: 'protocol', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
     other: { kind: 'other', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
+    // A wedge is a daemon-detected stall, never auto-retried — recovery is a
+    // deliberate agent/operator decision (kill the runaway subprocess), not a
+    // provider back-off.
+    wedged: { kind: 'wedged', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
 };
 export function policyFor(kind) {
     return POLICIES[kind];

package/dist/core/runtime/kickoff.js

@@ -107,8 +107,8 @@ export function drainBearings(meta) {
     // Consume the one-shot yield note (deleted on read) BEFORE the kickoff lists
     // the context dir, so it never shows up there.
     const yieldMsg = consumeYieldMessage(nodeId);
-    // Drain the feed: read unread since the cursor and advance it past them, so a
-    // later `crtr feed read` shows only what arrives afterward.
+    // Drain the feed: read unread since the cursor and advance it past them, so
+    // only entries that arrive after this point still count as unread.
     const cursor = readCursor(nodeId);
     const entries = readInboxSince(nodeId, cursor);
     let unreadDigest = null;
@@ -178,10 +178,8 @@ function feedBlock(nodeId, unreadDigest) {
         const subj = n === 1 ? 'it is' : 'they are';
         const pron = n === 1 ? 'it' : 'they';
         const verb = n === 1 ? 'pushes' : 'push';
-        // State aliveness + the automatic wake at the source. Bare status ("— active")
-        // left earlier revives unsure whether the worker was really live, so they
-        // burned a turn on `feed read`/`feed peek` to confirm. Asserting it here
-        // removes the reason to check.
+        // State aliveness + the automatic wake at the source explicitly, so there is
+        // no reason to check, poll, or verify separately.
         lines.push(`Awaiting ${n} node${n === 1 ? '' : 's'} — ${subj} alive and running right now, and will wake you the moment ${pron} ${verb}. The wake is automatic; nothing to check, poll, or verify.`);
         for (const m of awaiting)
             lines.push(`  - ${m.name} (${m.node_id}) — ${m.status}`);
@@ -203,7 +201,7 @@ function feedBlock(nodeId, unreadDigest) {
         lines.push('', `Report history on disk (collapsed): ${total} report${total === 1 ? '' : 's'} across ${history.length} subscribed node${history.length === 1 ? '' : 's'}. This is a catch-up index for reports your cursor already passed; read only what matters.`, ...visible.map((h) => {
             const ref = `${h.nodeId}:reports/${h.latest}`;
             return `  - ${h.name} (${h.nodeId}): ${h.count} report${h.count === 1 ? '' : 's'}; latest ${reportKind(h.latest)}: ${ref}`;
-        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr canvas history show <node-id> --type report` for that node\'s full report list; `crtr feed read --all` for cursor-independent inbox history.');
+        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr canvas history show <node-id> --type report` for that node\'s full report list; `crtr canvas history show <node-id> --type inbox` for cursor-independent inbox history including full message bodies.');
     }
     return `<feed>\n${lines.join('\n')}\n</feed>`;
 }

package/dist/core/runtime/placement.js

@@ -38,7 +38,7 @@ import { isPidAlive } from '../canvas/pid.js';
 // verbs — respawnPane, respawnPaneDetached, swapPaneInPlace, breakPaneToSession,
 // joinPane, setWindowOption, setRemainOnExit — are deleted). `breakPane` +
 // `selectLayout` are FRESH minimal viewer-chrome helpers (not the deleted
-// engine-in-pane `breakPaneToSession`): `canvas tmux-spread` breaks the caller's
+// engine-in-pane `breakPaneToSession`): `surface tmux-spread` breaks the caller's
 // viewer pane into its own window and tiles sibling viewers beside it.
 // `piCommand` + `paneCurrentPath` are KEPT: the sessionless surface-view system
 // (view-cycle.ts / view-run.ts) builds its pane commands with them, and the §5.1

package/dist/core/runtime/revive.js

@@ -17,8 +17,9 @@
 //
 // reviveNode remains the ONLY sanctioned launcher of the node engine.
 import { existsSync } from 'node:fs';
-import { getNode, updateNode, clearPid, fullName, cancelDeadlinesFor, } from '../canvas/index.js';
+import { getNode, updateNode, clearPid, fullName, cancelDeadlinesFor, subscribersOf, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
+import { fanDoctrineWake } from './close.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { headlessBrokerHost } from './host.js';
@@ -163,6 +164,13 @@ export function reviveNode(nodeId, opts) {
     catch (error) {
         try {
             transition(nodeId, 'crash');
+            // Doctrine wake: a launch-refusal here marks the node dead with NOTHING
+            // else fanning that out — the daemon's own auto-revive is the most common
+            // caller (superviseTick, best-effort try/catch, stderr-only on failure), so
+            // without this a manager waiting dormant on this child hangs forever,
+            // never told it will not come back on its own. Mirrors closeNode's step-4
+            // fan-out (same subscribers table, same active/passive split).
+            fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child crashed — ${fullName(meta)} (${nodeId}) failed to relaunch and is now dead. It will NOT resume on its own.`, { reason: 'child-crashed', child: nodeId });
         }
         catch {
             /* best-effort cleanup */

package/dist/core/runtime/tmux.d.ts

@@ -78,7 +78,7 @@ export declare function renameWindow(window: string, name: string): boolean;
  *  the break never falls back to tmux's global current pane. The pane keeps its
  *  durable `%id` across the move (only its window changes), so callers can keep
  *  using the same pane handle. Returns the new `{window, pane}` location, or null
- *  if tmux fails. Used by `canvas tmux-spread` to lift the caller's viewer into a
+ *  if tmux fails. Used by `surface tmux-spread` to lift the caller's viewer into a
  *  fresh window before tiling sibling viewers beside it. */
 export declare function breakPane(pane: string): {
     window: string;
@@ -187,7 +187,7 @@ export declare function windowAlive(session: string | null | undefined, window:
  *  to `tmux select-window -t <session>:<window>`. Best-effort; never throws. */
 export declare function selectWindow(session: string, window: string): boolean;
 /** Apply a named tmux layout to a window (`tmux select-layout -t <window>
- *  <layout>`). `canvas tmux-spread` calls it with `tiled` to evenly grid every
+ *  <layout>`). `surface tmux-spread` calls it with `tiled` to evenly grid every
  *  viewer pane in the spread window (and between splits, to redistribute space so
  *  the next split has room). Best-effort; false if tmux fails. */
 export declare function selectLayout(window: string, layout: string): boolean;

package/dist/core/runtime/tmux.js

@@ -176,7 +176,7 @@ export function renameWindow(window, name) {
  *  the break never falls back to tmux's global current pane. The pane keeps its
  *  durable `%id` across the move (only its window changes), so callers can keep
  *  using the same pane handle. Returns the new `{window, pane}` location, or null
- *  if tmux fails. Used by `canvas tmux-spread` to lift the caller's viewer into a
+ *  if tmux fails. Used by `surface tmux-spread` to lift the caller's viewer into a
  *  fresh window before tiling sibling viewers beside it. */
 export function breakPane(pane) {
     const r = tmux([
@@ -369,7 +369,7 @@ export function selectWindow(session, window) {
     return tmux(['select-window', '-t', `${session}:${window}`]).ok;
 }
 /** Apply a named tmux layout to a window (`tmux select-layout -t <window>
- *  <layout>`). `canvas tmux-spread` calls it with `tiled` to evenly grid every
+ *  <layout>`). `surface tmux-spread` calls it with `tiled` to evenly grid every
  *  viewer pane in the spread window (and between splits, to redistribute space so
  *  the next split has room). Best-effort; false if tmux fails. */
 export function selectLayout(window, layout) {

package/dist/daemon/crtrd-cli.js

@@ -1,4 +1,4 @@
-// crtrd entry point — spawned detached by `crtr canvas daemon start` and by bin/crtrd.
+// crtrd entry point — spawned detached by `crtr sys daemon start` and by bin/crtrd.
 // Calls runDaemon() and never returns (the loop drives via setTimeout).
 import { runDaemon } from './crtrd.js';
 runDaemon();

package/dist/daemon/crtrd.d.ts

@@ -19,6 +19,30 @@ export declare const YIELD_STALL_GRACE_MS: number;
  *  after running `node yield` mid-turn, and a working engine must never be
  *  killed), and the state has persisted past YIELD_STALL_GRACE_MS. */
 export declare function yieldStallVerdict(piPidAlive: boolean | null, intent: NodeRow['intent'], busy: boolean, stalledFor: number | null): 'leave' | 'pending' | 'kill';
+export declare const WEDGE_QUIET_MS: number;
+export declare const WEDGE_CPU_MAX_PERCENT = 2;
+export type WedgeVerdict = 'leave' | 'pending' | 'wedged';
+/** Pure wedge decision — mirrors livenessVerdict/yieldStallVerdict: a total
+ *  function of the observed signals, no clock or process access of its own.
+ *  `busy` false — the turn already ended (however it routed) — is never a
+ *  wedge, regardless of how stale the marker looks. `quietForMs` null means
+ *  the heartbeat marker couldn't be read (treated as “not enough evidence”, not
+ *  “wedged”). `cpuPercent` null (sample failed/unavailable) or above the
+ *  ceiling — EITHER keeps the verdict at 'pending' (keep watching next tick)
+ *  rather than firing on an unconfirmed or contradicted signal. */
+export declare function wedgeVerdict(input: {
+    busy: boolean;
+    quietForMs: number | null;
+    cpuPercent: number | null;
+}): WedgeVerdict;
+/** Pure: sum CPU% across a process's entire tree (itself + every descendant).
+ *  Parses `ps -ax -o pid=,ppid=,pcpu=` output, builds a ppid→children map, and
+ *  DFS's from `rootPid` collecting root + all descendants; malformed/blank
+ *  lines are skipped. Returns `null` if `rootPid` never appears in the output
+ *  (can't measure at all — treated as UNKNOWN by wedgeVerdict, never as
+ *  “low”) or the output has no parsable rows. Exported for direct unit testing
+ *  — no process access of its own, mirroring wedgeVerdict's purity. */
+export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
 export type LivenessVerdict = 'leave' | 'pending' | 'revive';
 /** Decide what to do with a node whose engine pid is DEAD, from how long it's
  *  been dead. Pure — the time/revive side effects live in handleNodeLiveness;