@crouton-kit/crouter 0.3.39 → 0.3.41

package/dist/core/__tests__/session-cycles.test.js

@@ -0,0 +1,77 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/session-cycles.test.ts
+//
+// `cycleAwareMessages` reuses pi's own `buildSessionContext` to replay a PRIOR
+// cycle's branch, so a cycle that was compacted before it yielded renders its
+// compaction summary (and only the kept + post-compaction messages) instead of
+// every raw pre-compaction message. This is a light smoke test — the
+// compaction resolution itself is SDK behavior being delegated to, not
+// reimplemented here; this only proves the wiring is real.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildSessionContext } from '@earendil-works/pi-coding-agent';
+import { cycleAwareMessages, CRTR_CYCLE_CUSTOM_TYPE } from '../runtime/session-cycles.js';
+function userMsg(id, parentId, text) {
+    return {
+        type: 'message',
+        id,
+        parentId,
+        timestamp: new Date(0).toISOString(),
+        message: { role: 'user', content: text, timestamp: 0 },
+    };
+}
+test('cycleAwareMessages: a compacted prior cycle replays via buildSessionContext (one summary, no raw pre-compaction messages)', () => {
+    // Cycle 0: m1 -> m2 -> [compaction c1, keeping from m2] -> m3 (cycle 0's leaf
+    // at yield time). Cycle marker cy1 roots a FRESH branch (parentId: null, per
+    // resetLeaf()+appendCustomEntry semantics), fromLeaf points back at m3. Cycle
+    // 1: m4 is the live leaf.
+    const m1 = userMsg('m1', null, 'pre-compaction message — must NOT appear in the replay');
+    const m2 = userMsg('m2', 'm1', 'kept message — compaction keeps from here');
+    const c1 = {
+        type: 'compaction',
+        id: 'c1',
+        parentId: 'm2',
+        timestamp: new Date(0).toISOString(),
+        summary: 'summary of the abandoned context',
+        firstKeptEntryId: 'm2',
+        tokensBefore: 12_000,
+    };
+    const m3 = userMsg('m3', 'c1', 'post-compaction message, cycle 0 leaf at yield');
+    const cy1 = {
+        type: 'custom',
+        id: 'cy1',
+        parentId: null,
+        timestamp: new Date(1).toISOString(),
+        customType: CRTR_CYCLE_CUSTOM_TYPE,
+        data: { cycle: 2, fromLeaf: 'm3' },
+    };
+    const m4 = userMsg('m4', 'cy1', 'cycle 1 live message');
+    const entries = [m1, m2, c1, m3, cy1, m4];
+    const byId = new Map(entries.map((e) => [e.id, e]));
+    function branchFrom(fromId) {
+        const path = [];
+        let current = fromId ? byId.get(fromId) : undefined;
+        while (current) {
+            path.push(current);
+            current = current.parentId ? byId.get(current.parentId) : undefined;
+        }
+        return path.reverse();
+    }
+    // Minimal fake mirroring the real SDK's SessionManager just enough to drive
+    // cycleAwareMessages: buildSessionContext() (current leaf only, m4) plus the
+    // tree accessors it reads (getEntries/getBranch).
+    const sm = {
+        buildSessionContext: () => buildSessionContext(entries, 'm4', byId),
+        getEntries: () => entries,
+        getBranch: (fromId) => branchFrom(fromId ?? 'm4'),
+    };
+    const out = cycleAwareMessages(sm);
+    const summaries = out.filter((m) => m.role === 'compactionSummary');
+    assert.equal(summaries.length, 1, 'exactly one compactionSummary message from the replayed prior cycle');
+    const texts = out.map((m) => (typeof m.content === 'string' ? m.content : ''));
+    assert.ok(!texts.some((t) => t.includes('pre-compaction message')), 'the pre-compaction raw message (m1) must NOT appear');
+    assert.ok(texts.some((t) => t.includes('kept message')), 'the kept message (m2) DOES appear');
+    assert.ok(texts.some((t) => t.includes('cycle 0 leaf at yield')), 'the post-compaction message (m3) DOES appear');
+    assert.ok(texts.some((t) => t.includes('cycle 1 live message')), 'the live cycle (m4) DOES appear');
+    const dividers = out.filter((m) => m.customType === 'crtr-cycle-divider');
+    assert.equal(dividers.length, 1, 'one divider between the replayed prior cycle and the live one');
+});

package/dist/core/__tests__/worktree.test.js

@@ -0,0 +1,85 @@
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, existsSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { gitSync } from '../git.js';
+import { createManagedWorktree, closeManagedWorktree, managedWorktreePath } from '../worktree.js';
+import { createNode, getNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+let home;
+let remoteDir;
+let sourceDir;
+function run(args, cwd) {
+    const res = gitSync(args, cwd);
+    if (res.status !== 0) {
+        throw new Error(`git ${args.join(' ')} failed in ${cwd}: ${res.stderr || res.stdout}`);
+    }
+}
+function node(id, over = {}) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...over,
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-worktree-home-'));
+    process.env['CRTR_HOME'] = home;
+    // Bare "remote" the source repo pushes to, so `origin/main` resolves.
+    remoteDir = mkdtempSync(join(tmpdir(), 'crtr-worktree-remote-'));
+    run(['init', '--bare'], remoteDir);
+    sourceDir = mkdtempSync(join(tmpdir(), 'crtr-worktree-source-'));
+    run(['init', '-b', 'main'], sourceDir);
+    run(['config', 'user.email', 'test@example.com'], sourceDir);
+    run(['config', 'user.name', 'Test'], sourceDir);
+    writeFileSync(join(sourceDir, 'README.md'), 'hello\n');
+    run(['add', '.'], sourceDir);
+    run(['commit', '-m', 'init'], sourceDir);
+    run(['remote', 'add', 'origin', remoteDir], sourceDir);
+    run(['push', '-u', 'origin', 'main'], sourceDir);
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    process.env['CRTR_HOME'] = home;
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(remoteDir, { recursive: true, force: true });
+    rmSync(sourceDir, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+// Regression for #120: `git worktree remove` deletes the checkout directory
+// that IS the calling node's own pi-process cwd. A process can never chdir
+// itself out of a directory that vanishes out from under it, so once that
+// dir is gone every subsequent bash in that node fails permanently and the
+// mandated post-close `crtr push final` can never run. closeManagedWorktree
+// must leave the path resolvable (as an empty tombstone dir) even though the
+// git worktree registration itself is gone.
+test('closeManagedWorktree recreates the worktree path as a tombstone dir so the node cwd still resolves', () => {
+    const nodeId = 'wt-close-1';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    assert.equal(wt.path, managedWorktreePath(nodeId));
+    assert.ok(existsSync(wt.path), 'worktree checkout should exist after create');
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const result = closeManagedWorktree(nodeId);
+    assert.equal(result.worktree_removed, true);
+    // The path must still resolve as a directory — this is the actual fix: a
+    // node whose cwd was wt.path can still chdir there / run bash / push final.
+    assert.ok(existsSync(wt.path), 'worktree path must still exist after close (tombstone)');
+    assert.ok(statSync(wt.path).isDirectory(), 'recreated path must be a directory');
+    assert.deepEqual(readdirSync(wt.path), [], 'tombstone dir should be empty — git already removed the real checkout');
+    // git itself no longer tracks it as a worktree.
+    const list = gitSync(['worktree', 'list', '--porcelain'], sourceDir);
+    assert.ok(!list.stdout.includes(wt.path), 'git should no longer register the removed worktree');
+    const meta = getNode(nodeId);
+    assert.equal(meta?.managed_worktree?.state, 'closed');
+});

package/dist/core/canvas/boot.js

@@ -1,6 +1,6 @@
 // Detects a boot change (a host reboot, or — the case this exists for — a
-// Blaxel/Firecracker microVM destroy+recreate) so callers can stop trusting any
-// `pi_pid` recorded before it.
+// VM/sandbox destroy+recreate) so callers can stop trusting any `pi_pid`
+// recorded before it.
 //
 // canvas.db is durable — it survives a VM/sandbox destroy+recreate or a host
 // reboot on whatever volume it lives on (see paths.ts / the storage-tiers
@@ -14,13 +14,13 @@
 //
 // The signal (primary): the Linux kernel's per-boot identity at
 // `/proc/sys/kernel/random/boot_id` — a fresh random UUID minted on every
-// kernel boot. A Firecracker microVM recreate (Blaxel's deployment shape) boots
+// kernel boot. A microVM recreate (a remote/guest deployment's shape) boots
 // a brand-new kernel, so `boot_id` changes; a plain daemon restart within the
 // same boot leaves it identical. This is an EXACT identity, so on Linux we need
 // no wall-clock window at all. NOTE this detects a *kernel boot*, not an
 // arbitrary container recreate: an ordinary container that shares the host
 // kernel keeps the host's `boot_id` across recreation, so this would NOT fire
-// there — that shape is out of scope (Hearth runs on Firecracker microVMs).
+// there — that shape is out of scope.
 //
 // The signal (fallback, non-Linux dev only): `os.uptime()` resets to ~0 on a
 // reboot and is otherwise monotonic, so `now - uptime` estimates the current
@@ -44,8 +44,8 @@ import { openDb } from './db.js';
  *  dev). A false positive would clear a genuinely live pid and let reviveNode
  *  double-spawn onto the same session; a false negative just falls back to the
  *  manual `--fresh` status quo — so it is kept generous, biased against the
- *  dangerous direction. The production target (Linux/Firecracker) never reaches
- *  this branch; there `boot_id` is exact. */
+ *  dangerous direction. The production target (Linux microVM guests) never
+ *  reaches this branch; there `boot_id` is exact. */
 const BOOT_EPOCH_TOLERANCE_MS = 60_000;
 function readKernelBootId() {
     try {
@@ -135,7 +135,12 @@ export function reconcileBootLiveness(current = currentBootIdentity()) {
         const rows = db
             .prepare('SELECT node_id FROM nodes WHERE pi_pid IS NOT NULL')
             .all();
-        const upd = db.prepare('UPDATE nodes SET pi_pid = NULL WHERE node_id = ?');
+        // Clear the launch-time identity baseline (crouter#98 review finding 1)
+        // alongside `pi_pid` — a boot resets the OS process table, so any recorded
+        // identity is as meaningless as the pid it was captured for; leaving it
+        // behind would let a coincidentally-reused pid on the NEW boot compare
+        // against a stale baseline from the OLD one.
+        const upd = db.prepare('UPDATE nodes SET pi_pid = NULL, pi_pid_identity = NULL WHERE node_id = ?');
         const cleared = [];
         for (const row of rows) {
             upd.run(row.node_id);

package/dist/core/canvas/canvas.d.ts

@@ -32,9 +32,23 @@ export declare function setPresence(nodeId: string, presence: {
     window?: string | null;
     pane?: string | null;
 }): void;
-/** Record the live pi pid (daemon liveness signal). Atomic single-column write. */
+/** Record the live pi pid (daemon liveness signal) PLUS its launch-time
+ *  identity fingerprint, in one atomic write (crouter#98 review finding 1):
+ *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
+ *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
+ *  therefore definitely still exists — this is the LAUNCH-time baseline
+ *  `headlessBrokerHost.teardown()` later compares against before signaling
+ *  anything. A failed probe (rare — `ps` itself misbehaving) or a probe that
+ *  finds no row for `pid` (raced away in the instant between spawn and this
+ *  call) both write `NULL`: no baseline recorded, so the teardown guard fails
+ *  open exactly like a node booted before this column existed — never a false
+ *  identity that could itself cause a false mismatch later. */
 export declare function recordPid(nodeId: string, pid: number): void;
-/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it). */
+/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it)
+ *  AND its recorded launch-time identity — the two are written together by
+ *  `recordPid` and must be cleared together, or a subsequent relaunch that
+ *  reuses the pid namespace could compare its own fresh pid against a STALE
+ *  identity left over from the pid this row held before. */
 export declare function clearPid(nodeId: string): void;
 /** All rows, optionally filtered by status. */
 export declare function listNodes(filter?: {
@@ -121,14 +135,19 @@ export declare function pruneNodes(opts: {
  *  `max(maxNodes, liveCount)`. Bounds the otherwise-unbounded growth the TTL
  *  sweep can't (a canvas that never crosses the TTL still grows without limit).
  *
- *  Liveness (protected, always kept): status active|idle AND a live `pi_pid` —
- *  the SAME signal `pruneNodes`'s `includeStale` and placement use (`isPidAlive`).
- *  The caller ($CRTR_NODE_ID) is also always protected.
+ *  Protected (never a prune candidate, regardless of recency rank): any
+ *  non-terminal node — status active|idle — REGARDLESS of `pi_pid` liveness.
+ *  A crashed-but-non-terminal row (dead pid, status still active/idle) must
+ *  survive for daemon crash-recovery to resume, not be hard-deleted by a
+ *  count-based sweep — only a genuinely terminal/dead-lifecycle row is
+ *  eligible for count-based pruning. The caller ($CRTR_NODE_ID) is also always
+ *  protected.
  *
  *  Algorithm: order ALL nodes by recency DESC (telemetry.json mtime, falling back
- *  to `created`); `target = max(maxNodes, liveCount)`; delete every node ranked
- *  beyond `target` (0-indexed rank >= target) that is NOT live and NOT the caller.
- *  Retained = all live + the newest terminal nodes up to `target`.
+ *  to `created`); `target = max(maxNodes, protectedCount)`; delete every node
+ *  ranked beyond `target` (0-indexed rank >= target) that is NOT protected and
+ *  NOT the caller. Retained = all protected + the newest terminal nodes up to
+ *  `target`.
  *
  *  Mirrors {@link pruneNodes} exactly for the delete (shared `deletePrunedNodes`:
  *  transactioned row sweep + FK edge cascade + best-effort dir removal). `dryRun`

package/dist/core/canvas/canvas.js

@@ -7,7 +7,7 @@
 import { existsSync, readFileSync, renameSync, readdirSync, rmSync, openSync, writeSync, fsyncSync, closeSync, statSync, } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { openDb } from './db.js';
-import { isPidAlive } from './pid.js';
+import { isPidAlive, capturePidIdentities } from './pid.js';
 import { cancelTriggersFor } from './triggers.js';
 import { ensureHome, ensureNodeDirs, nodeMetaPath, nodeDir, nodesRoot, jobDir, } from './paths.js';
 // ---------------------------------------------------------------------------
@@ -23,7 +23,7 @@ import { ensureHome, ensureNodeDirs, nodeMetaPath, nodeDir, nodesRoot, jobDir, }
 const IDENTITY_KEYS = [
     'node_id', 'name', 'description', 'cycles', 'created', 'cwd', 'host_kind', 'profile_id', 'kind', 'mode',
     'lifecycle', 'persona_ack', 'parent', 'spawned_by', 'fork_from', 'passive_default',
-    'pi_session_id', 'pi_session_file', 'model_override', 'launch',
+    'pi_session_id', 'pi_session_file', 'cycle_pending', 'model_override', 'launch', 'managed_worktree',
 ];
 /** Project any node object down to its durable-identity subset. */
 function toIdentity(m) {
@@ -45,9 +45,9 @@ function readMeta(nodeId) {
     // Tolerate an EMPTY or unparseable meta.json by treating it as MISSING (null)
     // rather than throwing. A bare write-temp-then-rename without fsync can leave a
     // 0-byte meta.json on an NFS-backed home after the holding process/sandbox dies
-    // (see writeMeta + the Hearth M0 cold-boot bug); a single corrupt node must not
-    // crash rebuildIndex/revive for the whole canvas. Recovery (re-seed from a
-    // durable snapshot) is the caller's job.
+    // (see writeMeta + the guest cold-boot bug it guards against); a single corrupt
+    // node must not crash rebuildIndex/revive for the whole canvas. Recovery
+    // (re-seed from a durable snapshot) is the caller's job.
     const raw = readFileSync(p, 'utf8');
     if (raw.trim() === '')
         return null;
@@ -62,12 +62,13 @@ function readMeta(nodeId) {
  *
  *  Durable write: fsync the temp file before the rename, then fsync the parent
  *  directory so the rename itself is on disk. A bare writeFileSync+rename can
- *  leave a 0-byte meta.json on an NFS-backed home (Hearth's durable Volume mounts
- *  `local_lock=none,noac`): when meta.json is held open, the rename silly-renames
- *  the open inode and the new content is never flushed, so a sandbox
+ *  leave a 0-byte meta.json on an NFS-backed guest home (a durable network Volume
+ *  mounted `local_lock=none,noac`): when meta.json is held open, the rename
+ *  silly-renames the open inode and the new content is never flushed, so a sandbox
  *  recreate-from-template loses it. meta.json is written rarely (birth, polymorph,
  *  session-id capture, naming) so the per-write fsync cost is negligible.
- *  Bug: Hearth M0 cold-boot — 0-byte meta.json → rebuild-index/revive JSON.parse(''). */
+ *  Bug guarded against: a guest cold-boot 0-byte meta.json → rebuild-index/revive
+ *  JSON.parse(''). */
 function writeMeta(meta) {
     const p = nodeMetaPath(meta.node_id);
     const tmp = `${p}.tmp`;
@@ -143,6 +144,7 @@ function rowFrom(r) {
         created: r['created'],
         intent: r['intent'] ?? null,
         pi_pid: r['pi_pid'] ?? null,
+        pi_pid_identity: r['pi_pid_identity'] ?? null,
         window: r['window'] ?? null,
         tmux_session: r['tmux_session'] ?? null,
         pane: r['pane'] ?? null,
@@ -152,7 +154,7 @@ function rowFrom(r) {
  *  no row exists yet (the hydration then falls back to whatever the meta held). */
 function runtimeFromRow(nodeId) {
     const r = openDb()
-        .prepare('SELECT status, intent, pi_pid, "window", tmux_session, pane FROM nodes WHERE node_id = ?')
+        .prepare('SELECT status, intent, pi_pid, pi_pid_identity, "window", tmux_session, pane FROM nodes WHERE node_id = ?')
         .get(nodeId);
     if (r === undefined)
         return null;
@@ -160,6 +162,7 @@ function runtimeFromRow(nodeId) {
         status: r['status'] ?? 'active',
         intent: r['intent'] ?? null,
         pi_pid: r['pi_pid'] ?? null,
+        pi_pid_identity: r['pi_pid_identity'] ?? null,
         window: r['window'] ?? null,
         tmux_session: r['tmux_session'] ?? null,
         pane: r['pane'] ?? null,
@@ -244,13 +247,30 @@ export function setPresence(nodeId, presence) {
         .prepare('UPDATE nodes SET tmux_session = ?, "window" = ?, pane = ? WHERE node_id = ?')
         .run(presence.tmux_session ?? null, presence.window ?? null, presence.pane ?? null, nodeId);
 }
-/** Record the live pi pid (daemon liveness signal). Atomic single-column write. */
+/** Record the live pi pid (daemon liveness signal) PLUS its launch-time
+ *  identity fingerprint, in one atomic write (crouter#98 review finding 1):
+ *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
+ *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
+ *  therefore definitely still exists — this is the LAUNCH-time baseline
+ *  `headlessBrokerHost.teardown()` later compares against before signaling
+ *  anything. A failed probe (rare — `ps` itself misbehaving) or a probe that
+ *  finds no row for `pid` (raced away in the instant between spawn and this
+ *  call) both write `NULL`: no baseline recorded, so the teardown guard fails
+ *  open exactly like a node booted before this column existed — never a false
+ *  identity that could itself cause a false mismatch later. */
 export function recordPid(nodeId, pid) {
-    openDb().prepare('UPDATE nodes SET pi_pid = ? WHERE node_id = ?').run(pid, nodeId);
-}
-/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it). */
+    const identity = capturePidIdentities([pid])?.get(pid) ?? null;
+    openDb()
+        .prepare('UPDATE nodes SET pi_pid = ?, pi_pid_identity = ? WHERE node_id = ?')
+        .run(pid, identity, nodeId);
+}
+/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it)
+ *  AND its recorded launch-time identity — the two are written together by
+ *  `recordPid` and must be cleared together, or a subsequent relaunch that
+ *  reuses the pid namespace could compare its own fresh pid against a STALE
+ *  identity left over from the pid this row held before. */
 export function clearPid(nodeId) {
-    openDb().prepare('UPDATE nodes SET pi_pid = NULL WHERE node_id = ?').run(nodeId);
+    openDb().prepare('UPDATE nodes SET pi_pid = NULL, pi_pid_identity = NULL WHERE node_id = ?').run(nodeId);
 }
 /** All rows, optionally filtered by status. */
 export function listNodes(filter) {
@@ -522,14 +542,19 @@ function recencyMs(nodeId, created) {
  *  `max(maxNodes, liveCount)`. Bounds the otherwise-unbounded growth the TTL
  *  sweep can't (a canvas that never crosses the TTL still grows without limit).
  *
- *  Liveness (protected, always kept): status active|idle AND a live `pi_pid` —
- *  the SAME signal `pruneNodes`'s `includeStale` and placement use (`isPidAlive`).
- *  The caller ($CRTR_NODE_ID) is also always protected.
+ *  Protected (never a prune candidate, regardless of recency rank): any
+ *  non-terminal node — status active|idle — REGARDLESS of `pi_pid` liveness.
+ *  A crashed-but-non-terminal row (dead pid, status still active/idle) must
+ *  survive for daemon crash-recovery to resume, not be hard-deleted by a
+ *  count-based sweep — only a genuinely terminal/dead-lifecycle row is
+ *  eligible for count-based pruning. The caller ($CRTR_NODE_ID) is also always
+ *  protected.
  *
  *  Algorithm: order ALL nodes by recency DESC (telemetry.json mtime, falling back
- *  to `created`); `target = max(maxNodes, liveCount)`; delete every node ranked
- *  beyond `target` (0-indexed rank >= target) that is NOT live and NOT the caller.
- *  Retained = all live + the newest terminal nodes up to `target`.
+ *  to `created`); `target = max(maxNodes, protectedCount)`; delete every node
+ *  ranked beyond `target` (0-indexed rank >= target) that is NOT protected and
+ *  NOT the caller. Retained = all protected + the newest terminal nodes up to
+ *  `target`.
  *
  *  Mirrors {@link pruneNodes} exactly for the delete (shared `deletePrunedNodes`:
  *  transactioned row sweep + FK edge cascade + best-effort dir removal). `dryRun`
@@ -538,20 +563,23 @@ export function pruneToLimit(opts) {
     const dryRun = opts.dryRun ?? false;
     const selfId = process.env['CRTR_NODE_ID'] ?? '';
     const rows = listNodes();
-    // Rank ALL nodes by recency DESC, tagging liveness as we go.
+    // Rank ALL nodes by recency DESC, tagging protection as we go. Protection is
+    // status-only (active|idle) — NOT gated on pi_pid liveness — so a node whose
+    // broker crashed but whose row is still non-terminal stays protected for
+    // crash-recovery instead of being hard-deleted here.
     const ranked = rows
         .map((r) => ({
         node_id: r.node_id,
         status: r.status,
         created: r.created,
         recency: recencyMs(r.node_id, r.created),
-        live: (r.status === 'active' || r.status === 'idle') && isPidAlive(r.pi_pid),
+        protected: r.status === 'active' || r.status === 'idle',
     }))
         .sort((a, b) => b.recency - a.recency);
-    const liveCount = ranked.filter((r) => r.live).length;
-    const target = Math.max(opts.maxNodes, liveCount);
+    const protectedCount = ranked.filter((r) => r.protected).length;
+    const target = Math.max(opts.maxNodes, protectedCount);
     const candidates = ranked
-        .filter((r, rank) => rank >= target && !r.live && r.node_id !== selfId)
+        .filter((r, rank) => rank >= target && !r.protected && r.node_id !== selfId)
         .map((r) => ({ node_id: r.node_id, status: r.status, created: r.created }));
     if (dryRun || candidates.length === 0)
         return { pruned: candidates, dryRun };

package/dist/core/canvas/db.js

@@ -359,6 +359,19 @@ function addProfileIdColumn(db) {
     const columns = nodeColumns(db);
     addNodeColumnIfMissing(db, columns, 'profile_id', `ALTER TABLE nodes ADD COLUMN profile_id TEXT;`);
 }
+/** v12 — additive runtime column `pi_pid_identity`: the LAUNCH-time process-
+ *  identity fingerprint (`pid.ts`'s `composeIdentity`) recorded alongside
+ *  `pi_pid` (v2) by `recordPid`, so `headlessBrokerHost.teardown()` can refuse
+ *  to signal a `pi_pid` the OS has since recycled for an unrelated process
+ *  (crouter#98 final review, Fix 1 — see `NodeRuntime.pi_pid_identity`).
+ *  Defaults NULL ⇒ no baseline ⇒ the guard fails open, exactly like a node
+ *  booted before this column existed. No data backfill: an existing `pi_pid`
+ *  with no recorded identity simply has no launch-time baseline to compare
+ *  against. Additive, forward-only. */
+function addPidIdentityColumn(db) {
+    const columns = nodeColumns(db);
+    addNodeColumnIfMissing(db, columns, 'pi_pid_identity', `ALTER TABLE nodes ADD COLUMN pi_pid_identity TEXT;`);
+}
 /** The ordered migration list. Index `i` is migration version `i + 1`; the db's
  *  `user_version` tracks how many have been applied. Append only. */
 export const MIGRATIONS = [
@@ -373,6 +386,7 @@ export const MIGRATIONS = [
     /* v9 */ migrateWakeupsToTriggers,
     /* v10 */ addCanvasMetaTable,
     /* v11 */ addProfileIdColumn,
+    /* v12 */ addPidIdentityColumn,
 ];
 /** Bring `db` up to the latest schema version. Reads `user_version`, runs each
  *  pending migration in order, and bumps `user_version` after each so the work

package/dist/core/canvas/history.js

@@ -409,6 +409,7 @@ export function nodeArtifacts(nodeId, types) {
         created: node.created,
         intent: node.intent ?? null,
         pi_pid: node.pi_pid ?? null,
+        pi_pid_identity: node.pi_pid_identity ?? null,
         window: node.window ?? null,
         tmux_session: node.tmux_session ?? null,
         pane: node.pane ?? null,

package/dist/core/canvas/paths.d.ts

@@ -6,19 +6,20 @@ export declare function crtrHome(): string;
 /** Absolute path to the SQLite canvas db file. Defaults to `canvas.db` under
  *  the canvas home, but `CRTR_CANVAS_DB` overrides ONLY this file's location
  *  (its `-wal`/`-shm` siblings follow it) while leaving `nodesRoot()` and all
- *  other node data under `crtrHome()`. This split exists for the Hearth guest:
- *  node data (meta.json/sessions, plain-file writes) stays on the durable NFS
- *  Volume via `CRTR_HOME`, but canvas.db's SQLite fcntl/WAL locks would hang on
- *  NFS (`local_lock=none`) — so it must live on local disk. Parent dir is
- *  created on use so an unset-default and an override both just work. */
+ *  other node data under `crtrHome()`. This split exists for a remote/guest
+ *  deployment: node data (meta.json/sessions, plain-file writes) stays on a
+ *  durable NFS-backed Volume via `CRTR_HOME`, but canvas.db's SQLite fcntl/WAL
+ *  locks would hang on NFS (`local_lock=none`) — so it must live on local disk.
+ *  Parent dir is created on use so an unset-default and an override both just
+ *  work. */
 export declare function canvasDbPath(): string;
 /** Absolute path to a node's broker `view.sock`. Defaults to `view.sock` under
  *  the node dir, but `CRTR_SOCK_DIR` overrides the PARENT dir (the socket becomes
  *  `<CRTR_SOCK_DIR>/<nodeId>.sock`) while node data stays under `crtrHome()`.
- *  Sibling of `CRTR_CANVAS_DB`, and exists for the same Hearth-guest reason: an
- *  AF_UNIX socket cannot be bound on the durable NFS Volume (`bind()` → EACCES,
- *  even where plain file writes into the same dir succeed), so the broker socket
- *  must live on local disk. Unset (the default) is unchanged for normal
+ *  Sibling of `CRTR_CANVAS_DB`, and exists for the same remote/guest-deployment
+ *  reason: an AF_UNIX socket cannot be bound on the durable NFS-backed Volume
+ *  (`bind()` → EACCES, even where plain file writes into the same dir succeed),
+ *  so the broker socket must live on local disk. Unset (the default) is unchanged for normal
  *  local-disk hosts. Parent dir is created on use so both paths just work. */
 export declare function viewSocketPath(nodeId: string): string;
 export declare function nodesRoot(): string;

package/dist/core/canvas/paths.js

@@ -30,11 +30,12 @@ export function crtrHome() {
 /** Absolute path to the SQLite canvas db file. Defaults to `canvas.db` under
  *  the canvas home, but `CRTR_CANVAS_DB` overrides ONLY this file's location
  *  (its `-wal`/`-shm` siblings follow it) while leaving `nodesRoot()` and all
- *  other node data under `crtrHome()`. This split exists for the Hearth guest:
- *  node data (meta.json/sessions, plain-file writes) stays on the durable NFS
- *  Volume via `CRTR_HOME`, but canvas.db's SQLite fcntl/WAL locks would hang on
- *  NFS (`local_lock=none`) — so it must live on local disk. Parent dir is
- *  created on use so an unset-default and an override both just work. */
+ *  other node data under `crtrHome()`. This split exists for a remote/guest
+ *  deployment: node data (meta.json/sessions, plain-file writes) stays on a
+ *  durable NFS-backed Volume via `CRTR_HOME`, but canvas.db's SQLite fcntl/WAL
+ *  locks would hang on NFS (`local_lock=none`) — so it must live on local disk.
+ *  Parent dir is created on use so an unset-default and an override both just
+ *  work. */
 export function canvasDbPath() {
     const override = process.env['CRTR_CANVAS_DB'];
     if (override !== undefined && override !== '') {
@@ -46,10 +47,10 @@ export function canvasDbPath() {
 /** Absolute path to a node's broker `view.sock`. Defaults to `view.sock` under
  *  the node dir, but `CRTR_SOCK_DIR` overrides the PARENT dir (the socket becomes
  *  `<CRTR_SOCK_DIR>/<nodeId>.sock`) while node data stays under `crtrHome()`.
- *  Sibling of `CRTR_CANVAS_DB`, and exists for the same Hearth-guest reason: an
- *  AF_UNIX socket cannot be bound on the durable NFS Volume (`bind()` → EACCES,
- *  even where plain file writes into the same dir succeed), so the broker socket
- *  must live on local disk. Unset (the default) is unchanged for normal
+ *  Sibling of `CRTR_CANVAS_DB`, and exists for the same remote/guest-deployment
+ *  reason: an AF_UNIX socket cannot be bound on the durable NFS-backed Volume
+ *  (`bind()` → EACCES, even where plain file writes into the same dir succeed),
+ *  so the broker socket must live on local disk. Unset (the default) is unchanged for normal
  *  local-disk hosts. Parent dir is created on use so both paths just work. */
 export function viewSocketPath(nodeId) {
     const override = process.env['CRTR_SOCK_DIR'];