@crouton-kit/crouter 0.3.36 → 0.3.38

package/dist/core/canvas/types.d.ts

@@ -58,6 +58,13 @@ export interface NodeIdentity {
      *  `cwd`, re-derived on index rebuild), NOT live runtime like `pane`.
      *  NULL ⇒ 'tmux' (every pre-broker node). */
     host_kind?: 'tmux' | 'broker' | null;
+    /** The profile this node runs under, a stable profile-directory id
+     *  (`<slug>-<id>`, see `core/profiles/manifest.ts`). Durable IDENTITY mirrored
+     *  to the row (like `cwd`/`host_kind`), NOT re-derived by `rebuildIndex()` —
+     *  it is chosen once at spawn (inherited from the spawner, or `--profile`) and
+     *  is the runtime→resolver seam (`CRTR_PROFILE_ID`) the memory/gate substrate
+     *  reads. NULL for a root/no-profile node — never invent a literal root id. */
+    profile_id?: string | null;
     /** Role the node was born as: explore | developer | plan | review | general… */
     kind: string;
     mode: Mode;
@@ -161,6 +168,9 @@ export interface NodeRow {
     cwd: string;
     /** Which HOST launches + supervises this node; see NodeIdentity.host_kind. */
     host_kind: 'tmux' | 'broker' | null;
+    /** The profile this node runs under; see NodeIdentity.profile_id. NULL for a
+     *  root/no-profile node. */
+    profile_id: string | null;
     parent: string | null;
     created: string;
     /** Authoritative runtime columns (see NodeRuntime). */

package/dist/core/config.d.ts

@@ -1,4 +1,4 @@
-import type { Scope, ScopeConfig, ScopeState } from '../types.js';
+import type { Scope, ScopeConfig, ScopeState, KindConfig, ModelLaddersConfig } from '../types.js';
 export declare function configPath(scope: Scope): string | null;
 export declare function statePath(scope: Scope): string | null;
 export declare function readConfig(scope: Scope): ScopeConfig;
@@ -6,5 +6,48 @@ export declare function readState(scope: Scope): ScopeState;
 export declare function writeConfig(scope: Scope, config: ScopeConfig): void;
 export declare function writeState(scope: Scope, state: ScopeState): void;
 export declare function ensureScopeInitialized(scope: Scope, root: string): void;
+export interface MergedLaunchConfig {
+    kinds: Record<string, KindConfig>;
+    modelLadders: ModelLaddersConfig;
+}
+/** Merge launch knobs (`kinds`, `modelLadders`) across scopes in
+ *  project stack > profile > user > builtin precedence — the same precedence
+ *  order used for memory resolution. A kind or ladder cell declared at a
+ *  more-specific scope shadows the same key from a less-specific scope; the
+ *  project STACK (`findProjectScopeRoots` — every ancestor `.crouter/`,
+ *  widened by a selected profile's `projects`) layers nearest-root-strongest;
+ *  a key no scope declares falls through to the builtin default registry
+ *  (`defaultScopeConfig().kinds` / `.modelLadders`).
+ *
+ *  Layers RAW (un-defaulted) partial config per scope, not `readConfig(scope)`
+ *  — `readConfig` already fills in every default kind for a scope that
+ *  customizes even one, so naively overlaying two already-defaulted
+ *  `ScopeConfig.kinds` objects would let an untouched project-scope kind
+ *  (silently defaulted) clobber a real user-scope customization of that same
+ *  kind. Layering the raw partials avoids that.
+ *
+ *  Callers (launch, kind registry) go through this function rather than
+ *  `readConfig` directly, so `ScopeConfig.kinds`/`modelLadders`/tools/
+ *  extensions/`availableTo` all honor the same profile + multi-project
+ *  precedence. */
+export declare function readMergedLaunchConfig(): MergedLaunchConfig;
+/** The effective `KindConfig` for one full kind string (top-level, e.g.
+ *  `developer`, or sub-kind, e.g. `plan/reviewers/security`), across
+ *  project > user > builtin precedence. Returns `undefined` for a kind no
+ *  scope registers — existence is deliberately NOT validated here (kind
+ *  existence/launch-menu enumeration is a Phase 3 caller concern); this only
+ *  resolves the config for a kind the caller already knows about. */
+export declare function resolveKindConfig(kind: string): KindConfig | undefined;
+/** The sub-kinds available to spawn FROM a given top-level kind — every
+ *  registered sub-kind (full path contains `/`) whose `availableTo` (default:
+ *  its own top-level ancestor, e.g. `plan/reviewers/security` defaults to
+ *  `['plan']`) includes `kind` or `'*'`. The single source both `sys
+ *  prompt-review --list`'s `subPersonas` metadata and the live sub-persona
+ *  spawn-menu splice (`core/substrate/render.ts`) read, so the two can never
+ *  drift apart. Sorted by full kind name for stable rendering. */
+export declare function subKindsAvailableTo(kind: string): {
+    kind: string;
+    whenToUse: string;
+}[];
 export declare function updateConfig(scope: Scope, mutate: (cfg: ScopeConfig) => void): ScopeConfig;
 export declare function updateState(scope: Scope, mutate: (s: ScopeState) => void): ScopeState;

package/dist/core/config.js

@@ -1,7 +1,8 @@
 import { join } from 'node:path';
-import { CONFIG_FILE, STATE_FILE, defaultScopeConfig, defaultScopeState, defaultCanvasNavConfig, defaultModelLaddersConfig } from '../types.js';
+import { CONFIG_FILE, STATE_FILE, defaultScopeConfig, defaultScopeState, defaultCanvasNavConfig, defaultModelLaddersConfig, defaultKindsConfig } from '../types.js';
 import { readJsonIfExists, writeJson, ensureDir } from './fs-utils.js';
-import { scopeRoot, requireScopeRoot } from './scope.js';
+import { scopeRoot, requireScopeRoot, findProjectScopeRoots } from './scope.js';
+import { profileRoot } from './profiles/manifest.js';
 function configPathFor(root) {
     return join(root, CONFIG_FILE);
 }
@@ -150,14 +151,15 @@ function mergeCanvasNav(raw) {
         graphBinds: mergeBinds(defaults.graphBinds, r.graphBinds, normalizeGraphBind),
     };
 }
-function mergeModelLadders(raw) {
-    const defaults = defaultModelLaddersConfig();
+function mergeModelLadders(raw, base = defaultModelLaddersConfig()) {
+    const defaults = base;
     if (raw === null || typeof raw !== 'object')
         return defaults;
     const r = raw;
     const out = {
         anthropic: { ...defaults.anthropic },
         openai: { ...defaults.openai },
+        ...(defaults.defaultProvider !== undefined ? { defaultProvider: defaults.defaultProvider } : {}),
     };
     if (r.defaultProvider === 'anthropic' || r.defaultProvider === 'openai') {
         out.defaultProvider = r.defaultProvider;
@@ -174,13 +176,42 @@ function mergeModelLadders(raw) {
     }
     return out;
 }
-function mergePersonaStrengths(raw) {
-    const out = {};
+/** Validate one raw `kinds.<name>` entry into a `KindConfig`, or drop it
+ *  (return null) rather than throwing — an invalid kind entry in config.json
+ *  must not break config parsing for every other kind. `whenToUse` is the
+ *  only required field. */
+function normalizeKindEntry(raw) {
     if (raw === null || typeof raw !== 'object')
-        return out;
-    for (const [persona, value] of Object.entries(raw)) {
-        if (value === 'ultra' || value === 'strong' || value === 'medium' || value === 'light') {
-            out[persona] = value;
+        return null;
+    const r = raw;
+    if (typeof r.whenToUse !== 'string' || r.whenToUse.trim() === '')
+        return null;
+    const out = { whenToUse: r.whenToUse };
+    if (typeof r.model === 'string' && r.model.trim() !== '')
+        out.model = r.model;
+    if (typeof r.orchestratorModel === 'string' && r.orchestratorModel.trim() !== '')
+        out.orchestratorModel = r.orchestratorModel;
+    const isStringArray = (v) => Array.isArray(v) && v.every((item) => typeof item === 'string');
+    if (isStringArray(r.tools))
+        out.tools = r.tools;
+    if (isStringArray(r.extensions))
+        out.extensions = r.extensions;
+    if (isStringArray(r.availableTo))
+        out.availableTo = r.availableTo;
+    return out;
+}
+/** Merge a raw `kinds` block over `base` (defaulting to the builtin registry):
+ *  each valid entry adds or shadows a kind by name; invalid entries are
+ *  dropped, never thrown. Mirrors `mergeModelLadders`'s layer-over-defaults
+ *  shape so a user/project config.json can add or override a single kind
+ *  without restating the whole registry. */
+function mergeKinds(raw, base = defaultKindsConfig()) {
+    const out = { ...base };
+    if (raw !== null && typeof raw === 'object') {
+        for (const [kind, value] of Object.entries(raw)) {
+            const normalized = normalizeKindEntry(value);
+            if (normalized !== null)
+                out[kind] = normalized;
         }
     }
     return out;
@@ -215,8 +246,120 @@ function mergeConfig(partial) {
         : defaults.max_panes_per_window;
     const canvasNav = mergeCanvasNav(partial.canvasNav);
     const modelLadders = mergeModelLadders(partial.modelLadders);
-    const personaStrengths = mergePersonaStrengths(partial.personaStrengths);
-    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, canvasNav, modelLadders, personaStrengths };
+    const kinds = mergeKinds(partial.kinds);
+    return { schema_version, marketplaces, plugins, auto_update, max_panes_per_window, canvasNav, modelLadders, kinds };
+}
+/** Raw (un-defaulted) partial config for one scope, or null if the scope has
+ *  no root or no config.json. Used by `readMergedLaunchConfig` to layer
+ *  scopes onto each other WITHOUT each scope's own default-fill masking a
+ *  lower-precedence scope's real customization (see that function's comment
+ *  for why `readConfig(scope)`, which already defaults-fills, is unusable
+ *  for cross-scope layering). */
+function readRawScopeConfig(scope) {
+    const root = scopeRoot(scope);
+    if (!root)
+        return null;
+    return readJsonIfExists(configPathFor(root));
+}
+/** Raw partial config at `<profileRoot(profileId)>/config.json`, or null when
+ *  no profile is selected, the profile id no longer resolves (deleted/
+ *  invalid), or it has no config.json. `profileRoot` centralizes the id-shape
+ *  + containment checks (never a raw path join), and any resolution failure
+ *  is swallowed here — launch config resolution is a hot path that must never
+ *  throw on a stale `CRTR_PROFILE_ID`. */
+function readRawProfileConfig(profileId) {
+    if (profileId === null || profileId === '')
+        return null;
+    try {
+        return readJsonIfExists(configPathFor(profileRoot(profileId)));
+    }
+    catch {
+        return null;
+    }
+}
+/** Raw partial configs for the whole project-scope STACK (`findProjectScopeRoots`
+ *  — every ancestor `.crouter/`, widened by a selected profile's `projects`),
+ *  ordered FARTHEST-first so `readMergedLaunchConfig` can layer them on last
+ *  and have the NEAREST root win — mirroring the resolver's nearest-project-
+ *  strongest replacement precedence. */
+function readRawProjectScopeConfigs() {
+    const nearestFirst = findProjectScopeRoots();
+    const farthestFirst = [...nearestFirst].reverse();
+    const out = [];
+    for (const root of farthestFirst) {
+        const raw = readJsonIfExists(configPathFor(root));
+        if (raw !== null)
+            out.push(raw);
+    }
+    return out;
+}
+/** Merge launch knobs (`kinds`, `modelLadders`) across scopes in
+ *  project stack > profile > user > builtin precedence — the same precedence
+ *  order used for memory resolution. A kind or ladder cell declared at a
+ *  more-specific scope shadows the same key from a less-specific scope; the
+ *  project STACK (`findProjectScopeRoots` — every ancestor `.crouter/`,
+ *  widened by a selected profile's `projects`) layers nearest-root-strongest;
+ *  a key no scope declares falls through to the builtin default registry
+ *  (`defaultScopeConfig().kinds` / `.modelLadders`).
+ *
+ *  Layers RAW (un-defaulted) partial config per scope, not `readConfig(scope)`
+ *  — `readConfig` already fills in every default kind for a scope that
+ *  customizes even one, so naively overlaying two already-defaulted
+ *  `ScopeConfig.kinds` objects would let an untouched project-scope kind
+ *  (silently defaulted) clobber a real user-scope customization of that same
+ *  kind. Layering the raw partials avoids that.
+ *
+ *  Callers (launch, kind registry) go through this function rather than
+ *  `readConfig` directly, so `ScopeConfig.kinds`/`modelLadders`/tools/
+ *  extensions/`availableTo` all honor the same profile + multi-project
+ *  precedence. */
+export function readMergedLaunchConfig() {
+    const defaults = defaultScopeConfig();
+    const userRaw = readRawScopeConfig('user');
+    const profileRaw = readRawProfileConfig(process.env['CRTR_PROFILE_ID'] || null);
+    const projectRawsFarthestFirst = readRawProjectScopeConfigs();
+    let kinds = mergeKinds(userRaw?.kinds, defaults.kinds);
+    let modelLadders = mergeModelLadders(userRaw?.modelLadders, defaults.modelLadders);
+    if (profileRaw !== null) {
+        kinds = mergeKinds(profileRaw.kinds, kinds);
+        modelLadders = mergeModelLadders(profileRaw.modelLadders, modelLadders);
+    }
+    for (const raw of projectRawsFarthestFirst) {
+        kinds = mergeKinds(raw.kinds, kinds);
+        modelLadders = mergeModelLadders(raw.modelLadders, modelLadders);
+    }
+    return { kinds, modelLadders };
+}
+/** The effective `KindConfig` for one full kind string (top-level, e.g.
+ *  `developer`, or sub-kind, e.g. `plan/reviewers/security`), across
+ *  project > user > builtin precedence. Returns `undefined` for a kind no
+ *  scope registers — existence is deliberately NOT validated here (kind
+ *  existence/launch-menu enumeration is a Phase 3 caller concern); this only
+ *  resolves the config for a kind the caller already knows about. */
+export function resolveKindConfig(kind) {
+    return readMergedLaunchConfig().kinds[kind];
+}
+/** The sub-kinds available to spawn FROM a given top-level kind — every
+ *  registered sub-kind (full path contains `/`) whose `availableTo` (default:
+ *  its own top-level ancestor, e.g. `plan/reviewers/security` defaults to
+ *  `['plan']`) includes `kind` or `'*'`. The single source both `sys
+ *  prompt-review --list`'s `subPersonas` metadata and the live sub-persona
+ *  spawn-menu splice (`core/substrate/render.ts`) read, so the two can never
+ *  drift apart. Sorted by full kind name for stable rendering. */
+export function subKindsAvailableTo(kind) {
+    const registry = readMergedLaunchConfig().kinds;
+    const out = [];
+    for (const [full, cfg] of Object.entries(registry)) {
+        const slash = full.indexOf('/');
+        if (slash === -1)
+            continue;
+        const topAncestor = full.slice(0, slash);
+        const availableTo = cfg.availableTo ?? [topAncestor];
+        if (!(availableTo.includes('*') || availableTo.includes(kind)))
+            continue;
+        out.push({ kind: full, whenToUse: cfg.whenToUse });
+    }
+    return out.sort((a, b) => a.kind.localeCompare(b.kind));
 }
 export function updateConfig(scope, mutate) {
     const cfg = readConfig(scope);

package/dist/core/fault-classifier.d.ts

@@ -1,5 +1,5 @@
-export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa';
-export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'other';
+export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa' | 'daemon→node';
+export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'other' | 'wedged';
 export type FaultRetryDisposition = 'auto' | 'manual' | 'fatal';
 export type FaultRetryOwner = 'sdk' | 'daemon' | 'client';
 export interface FaultRetry {

package/dist/core/feed/inbox.d.ts

@@ -1,11 +1,10 @@
 export type InboxTier = 'critical' | 'urgent' | 'normal' | 'deferred';
 export type InboxKind = 'update' | 'urgent' | 'final' | 'message' | 'completed';
-/** A single inbox entry — a pointer, not a copy of the content. */
+/** A single inbox entry: a push pointer (`ref` to a report, no inline body),
+ *  or a direct message/system notice (short bodies inline via `data.body`;
+ *  bodies too long to inline spill to `messages/` and carry both `ref` and a
+ *  bounded inline preview). */
 export interface InboxEntry {
-    /** Short stable handle for addressing this entry from the CLI (`feed message
-     *  <id>`). Set when the entry carries an inline body too long to fully inline
-     *  in the digest, so the receiver can read the full text back by id. */
-    id?: string;
     /** ISO 8601 timestamp of delivery. */
     ts: string;
     /** Node id of the sender, or null for system-generated entries. */
@@ -14,7 +13,9 @@ export interface InboxEntry {
     tier: InboxTier;
     /** Semantic kind of the push event. */
     kind: InboxKind;
-    /** Absolute path to the report file, when this entry is a push pointer. */
+    /** Absolute path to the sender-side report file (push pointer) or, for a
+     *  direct message/system notice too long to inline, the spilled body file
+     *  under `messages/`. */
     ref?: string;
     /** First ~80 chars of the body's first line — enough to decide if it matters. */
     label: string;
@@ -26,8 +27,6 @@ export interface InboxEntry {
  * Fills `ts` (current ISO time). Returns the completed entry.
  */
 export declare function appendInbox(nodeId: string, entry: Omit<InboxEntry, 'ts'>): InboxEntry;
-/** Find one inbox entry by its short `id` handle (see `feed message <id>`). */
-export declare function readInboxEntryById(nodeId: string, id: string): InboxEntry | undefined;
 /**
  * Return all inbox entries strictly after `cursorIso`.
  * When `cursorIso` is undefined, returns every entry in the file.
@@ -42,10 +41,6 @@ export declare function readCursor(nodeId: string): string | undefined;
  * Persist a new cursor ISO for a node's inbox (atomic tmp+rename).
  */
 export declare function writeCursor(nodeId: string, iso: string): void;
-/** True when an entry's inline body is long enough that the digest will clip it
- *  — the trigger for minting an addressable `id` so the full text stays
- *  recoverable via `feed message <id>`. */
-export declare function bodyExceedsPreview(e: Pick<InboxEntry, 'data' | 'label'>): boolean;
 /** Clip a body to a bounded preview, reporting whether anything was dropped. */
 export declare function clipBody(body: string): {
     text: string;

package/dist/core/feed/inbox.js

@@ -1,16 +1,18 @@
 // Per-node inbox.jsonl primitive for the pi-native canvas runtime.
 //
-// An inbox entry is a lightweight POINTER (~30 tokens), never content.
-// The report body lives in nodes/<id>/reports/; the inbox line carries only
-// enough to find it and decide whether to dereference.
+// An inbox entry is a lightweight pointer for a push (~30 tokens, body lives
+// in nodes/<id>/reports/) or carries a direct message inline. A direct
+// message short enough to inline stays entirely in the jsonl line; one that
+// would clip spills its full body to nodes/<id>/messages/ and the entry
+// carries `ref` to it alongside a bounded inline preview.
 //
 // Layout:
 //   nodes/<id>/inbox.jsonl          — one JSON line per entry, append-only
 //   nodes/<id>/inbox.jsonl.cursor   — ISO 8601 of last-read entry (sidecar)
 import { appendFileSync, existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, } from 'node:fs';
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { inboxPath } from '../canvas/index.js';
+import { inboxPath, messagesDir } from '../canvas/index.js';
 // ---------------------------------------------------------------------------
 // Cursor sidecar path
 // ---------------------------------------------------------------------------
@@ -20,16 +22,42 @@ function cursorPath(nodeId) {
 // ---------------------------------------------------------------------------
 // Append
 // ---------------------------------------------------------------------------
+/** Spill an oversized inline body to a durable file — the SAME atomic
+ *  tmp+rename pattern a push report uses — and return its absolute path.
+ *  Called only when the body would clip in the digest; short bodies never
+ *  touch disk beyond the jsonl line itself. */
+function writeMessageBody(nodeId, ts, body) {
+    const dir = messagesDir(nodeId);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const stamp = ts.replace(/[^0-9]/g, '');
+    const finalPath = join(dir, `${stamp}-${randomUUID().slice(0, 6)}.md`);
+    const tmpPath = `${finalPath}.tmp`;
+    writeFileSync(tmpPath, body, 'utf8');
+    renameSync(tmpPath, finalPath);
+    return finalPath;
+}
 /**
  * Atomically append one inbox entry to `nodes/<nodeId>/inbox.jsonl`.
  * Fills `ts` (current ISO time). Returns the completed entry.
  */
 export function appendInbox(nodeId, entry) {
     const full = { ts: new Date().toISOString(), ...entry };
-    // A message that carries an inline body the digest will clip needs a stable
-    // handle so the receiver can read the full text back (`feed message <id>`).
-    if (full.id === undefined && bodyExceedsPreview(full))
-        full.id = randomUUID().slice(0, 8);
+    // A push pointer already carries `ref` (the report file) — its body lives
+    // there, never inline. A direct message / system notice has no ref yet: when
+    // its inline body would clip in the digest, spill the FULL text to a durable
+    // file (same atomic tmp+rename as a report) and point `ref` at it, exactly
+    // like a push, then keep only the bounded preview inline. A short body is
+    // left fully inline, untouched — uniform with how a push's body always
+    // lives in a file, never inline, dereferenced by reading `ref`.
+    if (full.ref === undefined) {
+        const body = inlineBody(full);
+        const { text, clipped } = clipBody(body);
+        if (clipped) {
+            full.ref = writeMessageBody(nodeId, full.ts, body);
+            full.data = { ...full.data, body: text };
+        }
+    }
     const line = JSON.stringify(full) + '\n';
     // Ensure the parent directory exists (inbox.jsonl lives directly under the
     // node dir, which ensureNodeDirs creates — but guard anyway for callers that
@@ -46,10 +74,6 @@ export function appendInbox(nodeId, entry) {
 // ---------------------------------------------------------------------------
 // Read
 // ---------------------------------------------------------------------------
-/** Find one inbox entry by its short `id` handle (see `feed message <id>`). */
-export function readInboxEntryById(nodeId, id) {
-    return readInboxSince(nodeId, undefined).find((e) => e.id === id);
-}
 /**
  * Return all inbox entries strictly after `cursorIso`.
  * When `cursorIso` is undefined, returns every entry in the file.
@@ -108,13 +132,6 @@ function inlineBody(e) {
     const body = typeof e.data?.['body'] === 'string' ? e.data['body'].trim() : '';
     return body === '' || body === e.label ? '' : body;
 }
-/** True when an entry's inline body is long enough that the digest will clip it
- *  — the trigger for minting an addressable `id` so the full text stays
- *  recoverable via `feed message <id>`. */
-export function bodyExceedsPreview(e) {
-    const body = inlineBody(e);
-    return body !== '' && clipBody(body).clipped;
-}
 /** Clip a body to a bounded preview, reporting whether anything was dropped. */
 export function clipBody(body) {
     let text = body;
@@ -135,10 +152,11 @@ export function clipBody(body) {
  *
  * A push pointer (has a `ref`) stays a pointer — the body lives in the report
  * file, dereferenced on demand by reading that path. A direct `node msg` or
- * system alert has NO report to dereference; its full body lives in the
- * inbox.jsonl entry itself (`data.body`), so we inline a bounded preview. When
- * that preview clips, the entry carries a short `id` and we point at the CLI
- * command that reads the full body back from the jsonl (`feed message <id>`).
+ * system alert without a `ref` inlines its full body (already bounded — a
+ * clipping body is spilled to a file and `ref`'d at append time, see
+ * appendInbox). When an entry DOES carry both an inline preview and a `ref`
+ * (the clipped case), the tail points at the ref path, same shape as a push —
+ * read the file for the rest, no special dereference verb.
  */
 function renderEntry(e) {
     const body = inlineBody(e);
@@ -149,11 +167,9 @@ function renderEntry(e) {
     }
     const { text, clipped } = clipBody(body);
     const indented = text.split('\n').map((l) => `    ${l}`).join('\n');
-    const more = clipped
-        ? (e.id !== undefined
-            ? `\n    … (clipped — full message: \`crtr feed message ${e.id}\`)`
-            : '\n    … (body clipped)')
-        : '';
+    const more = e.ref !== undefined
+        ? `\n    … (full body: ${e.ref})`
+        : clipped ? '\n    … (body clipped)' : '';
     return `  [${e.kind}]\n${indented}${more}`;
 }
 /**

package/dist/core/hearth/providers/blaxel-bootstrap.js

@@ -129,7 +129,7 @@ export function buildBootstrapScript(opts) {
     }
     appendOauthAdapterCachePrime(lines, opts.guestHome);
     // Tmpfs sock/pidfile dirs are already mkdir'd above, before this line.
-    lines.push(`${shellQuote(BAKED_CRTR_PATH)} canvas daemon start </dev/null >>"$HOME/.crtr-runtime/daemon.log" 2>&1`);
+    lines.push(`${shellQuote(BAKED_CRTR_PATH)} sys daemon start </dev/null >>"$HOME/.crtr-runtime/daemon.log" 2>&1`);
     if (opts.isFirstProvision) {
         lines.push('home_node_output="$(', `${shellQuote(BAKED_CRTR_PATH)} --json node new --root --kind general --name home <<'SEED'`, 'Hearth home seed for the Blaxel home backend.', 'SEED', ')"', "home_node_id=\"$(node -e 'const o = JSON.parse(process.argv[1]); process.stdout.write(String(o.node_id ?? o.nodeId ?? o.id ?? \"\"));' \"$home_node_output\")\"", 'if [ -z "$home_node_id" ]; then', '  printf "failed to parse home node id from crtr node new output\n%s\n" "$home_node_output" >&2', '  exit 1', 'fi', 'printf "__HEARTH_NODE_ID__=%s\n" "$home_node_id"', 
         // The provisioner polls this file (background exec stdout is not captured).

package/dist/core/memory-resolver.d.ts

@@ -2,18 +2,20 @@ import type { InstalledPlugin, Scope } from '../types.js';
 /**
  * Thin memory-document resolver for the document substrate. Resolution is scope
  * + leaf/path only: qualifier parse → scope precedence → direct path lookup →
- * leaf-name fallback. The three memory scopes resolve in precedence order
- * project > user > builtin. It returns the raw parsed
- * frontmatter + body; it does NOT interpret the schema, kind, gate, or rungs —
- * that is the schema/gate layer's job (callers filter by `frontmatter.kind`).
- * Project resolution is a nearest-first stack of every ancestor `.crouter/`,
- * while user and builtin remain singleton scopes.
+ * leaf-name fallback. The memory scopes resolve in precedence order project
+ * stack > profile > user > builtin. It returns the raw parsed frontmatter +
+ * body; it does NOT interpret the schema, kind, gate, or rungs — that is the
+ * schema/gate layer's job (callers filter by `frontmatter.kind`). Project
+ * resolution is a nearest-first stack of every ancestor `.crouter/` (widened by
+ * a selected profile's `projects` manifest entries — see `findProjectScopeRoots`
+ * in scope.ts), profile is the selected profile's own singleton `memory/` store
+ * (from `CRTR_PROFILE_ID`), and user/builtin remain singleton scopes.
  */
 export interface MemoryDoc {
     /** Path-derived identity: the doc's path under the scope's memory/ root, no
      *  extension, slash-separated — e.g. memory/taste/foo.md → "taste/foo". */
     name: string;
-    scope: Scope;
+    scope: MemoryScope;
     /** Absolute path to the resolved .md file. */
     path: string;
     /** Raw, uncoerced frontmatter record (null when the doc has no frontmatter). */
@@ -21,26 +23,35 @@ export interface MemoryDoc {
     /** Document body, with the frontmatter block stripped. */
     body: string;
 }
+/** The memory-only scope union: the global `Scope` (`user|project|builtin`)
+ *  plus `profile`. Confined to the memory resolver/list/read/write/render
+ *  paths — deliberately NOT folded into the global `Scope` union, because that
+ *  would leak `profile` into config, plugin, marketplace, view, and doctor/
+ *  sys-config surfaces the spec does not extend. */
+export type MemoryScope = Scope | 'profile';
 export interface MemoryResolutionOpts {
     /** Restrict resolution to a single scope. Conflicts with a scope prefix on
      *  the identifier (e.g. `user/foo` with scope=project) throw. */
-    scope?: Scope;
+    scope?: MemoryScope;
 }
 /** Canonical, unambiguous identifier for a memory document: `<scope>/<name>`. */
 export declare function memoryDocId(doc: MemoryDoc): string;
 /** All native memory docs for a scope. Project scope is a nearest-first stack of
- *  every ancestor `.crouter/memory/`; user and builtin are singleton stores. */
-export declare function listMemoryDocs(scope: Scope): MemoryDoc[];
+ *  every ancestor `.crouter/memory/` (widened by a selected profile's project
+ *  stack); profile is the selected profile's own singleton store, resolved
+ *  through `loadProfileManifest`; user and builtin are singleton stores. */
+export declare function listMemoryDocs(scope: MemoryScope, quiet?: boolean): MemoryDoc[];
 /** All of one plugin's substrate docs, mounted under the virtual `<pluginName>/`
  *  namespace. Walks `pluginMemoryDir(plugin)` recursively for *.md, deriving each
  *  doc's name exactly as `listMemoryDocs` does (path-relative, no extension,
  *  slash-separated) then prefixing the plugin name. Builtin has no plugins. */
-export declare function listPluginMemoryDocs(plugin: InstalledPlugin, scope: Scope): MemoryDoc[];
+export declare function listPluginMemoryDocs(plugin: InstalledPlugin, scope: MemoryScope, quiet?: boolean): MemoryDoc[];
 /** All memory docs across the resolved sources, in precedence order: each
- *  ancestor project `.crouter/` from nearest to farthest, then user, then
- *  builtin. Within each source, native docs are emitted before enabled-plugin
- *  docs, so native wins on the caller's first-wins dedup. */
-export declare function listAllMemoryDocs(scope?: Scope): MemoryDoc[];
+ *  ancestor project `.crouter/` from nearest to farthest, then the selected
+ *  profile's memory (if any), then user, then builtin. Within each source,
+ *  native docs are emitted before enabled-plugin docs, so native wins on the
+ *  caller's first-wins dedup. */
+export declare function listAllMemoryDocs(scope?: MemoryScope, quiet?: boolean): MemoryDoc[];
 /**
  * Resolve a path-derived name to a single memory document.
  *