@crouton-kit/crouter 0.3.67 → 0.3.70

package/dist/core/runtime/revive.js

@@ -23,13 +23,13 @@
 //
 // reviveNode remains the ONLY sanctioned launcher of the node engine.
 import { existsSync } from 'node:fs';
-import { getNode, updateNode, clearPid, recordPid, fullName, cancelDeadlinesFor, subscribersOf, } from '../canvas/index.js';
+import { getNode, updateNode, clearPid, recordPid, fullName, cancelDeadlinesFor, subscribersOf, openDb, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
 import { fanDoctrineWake } from './close.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { headlessBrokerHost } from './host.js';
-import { recordedPidLiveness } from '../canvas/pid.js';
+import { isRecordedPidAlive } from '../canvas/pid.js';
 import { reconcileBootLiveness } from '../canvas/boot.js';
 import { clearFault } from './fault.js';
 import { clearInjectedDocs } from '../substrate/injected-store.js';
@@ -89,147 +89,194 @@ export function reviveNode(nodeId, opts) {
     // actually matters, so it's safe to call on every revive regardless of
     // entry point (daemon tick, or a direct/manual `node lifecycle revive`).
     reconcileBootLiveness();
-    // Double-revive guard: identity-aware liveness on pi_pid, requiring
-    // CONFIRMED alive — not the fail-open-to-alive boolean adapter. A node
-    // whose broker pid is CONFIRMED still running as that same broker (not a
-    // reused pid) was already revived by another path — re-launching would put
-    // a SECOND broker on the same session file. No-op. A bare isPidAlive would
-    // misread a reused pid (heavy forking, esp. Linux) as "still alive" and
-    // skip the relaunch forever; conversely, treating an INDETERMINATE read
-    // (can't confirm either way, e.g. a transient `ps` probe failure) as
-    // "alive" here would risk the opposite failure — silently skipping a
-    // needed relaunch and stranding the node with no engine. So this guard
-    // blocks ONLY on a positively confirmed-alive read; `dead` AND
-    // `indeterminate` both proceed to relaunch. We accept that tradeoff: an
-    // `indeterminate` read CAN come from a genuinely live broker whose identity
-    // `ps` probe transiently failed, so proceeding risks a rare double-launch —
-    // but stranding a truly-dead node with no engine is the worse failure, and
-    // recovering from it is far harder, so we bias toward relaunching.
-    const live = getNode(nodeId) ?? meta;
-    if (recordedPidLiveness(live.pi_pid, live.pi_pid_identity) === 'alive') {
-        return {
-            window: null,
-            session: live.tmux_session ?? null,
-            resumed: false,
-        };
-    }
-    // Every (re)launch is a new cycle — bump the counter so CRTR_CYCLES and the
-    // footer stay in sync. Mutate the in-memory meta too so buildPiArgv below
-    // launches with the incremented count.
-    meta.cycles = (meta.cycles ?? 0) + 1;
-    updateNode(nodeId, { cycles: meta.cycles });
-    // Decide whether to wake the saved pi conversation, cycle it in place (a
-    // refresh-yield reusing the same `.jsonl`), or start fresh. resumeArgs
-    // resumes/cycles ONLY by the absolute session-file path (cwd-immune) and ONLY
-    // when that .jsonl actually exists; there is no bare-id fallback (the broker
-    // preflight rejects a bare `--session`). No file on disk yet ⇒ a fresh launch.
-    const resume = resumeArgs(meta, opts.resume);
-    // hasSessionPath: there is a real `.jsonl` to hand pi via `--session`, whether
-    // as a true resume OR a cycling refresh-yield (resumeArgs sets `newCycle` in
-    // the latter case). cycling and resuming are mutually exclusive; `resuming`
-    // keeps the STRICT true-resume-only meaning `ReviveResult.resumed` and the
-    // launch-placement hint below have always carried.
-    const hasSessionPath = resume.resumeSessionPath !== undefined;
-    const cycling = hasSessionPath && resume.newCycle === true;
-    const resuming = hasSessionPath && !cycling;
-    // Mirror THIS launch attempt's cycling-ness durably, BEFORE launching, so a
-    // pre-session_start crash-retry (crtrd.ts) can tell "was the attempt I'm
-    // retrying a cycle" apart from an ordinary resume/crash. Cleared by
-    // canvas-stophook's session_start handler the instant this boot is confirmed.
-    // Written unconditionally (true for cycling, false otherwise) so it never
-    // goes stale across launch kinds.
-    updateNode(nodeId, { cycle_pending: cycling });
-    meta.cycle_pending = cycling;
-    // A truly fresh launch — no `.jsonl` to resume OR cycle from — starts a NEW
-    // pi session, so the old session identity is dead. Clear it from meta NOW,
-    // before launch, so the recorded state matches what we're about to do. This
-    // is load-bearing for boot-failure classification: if this fresh broker dies
-    // BEFORE session_start (recording no new pid and no new session), the
-    // daemon's pid-null branch keys on pi_session_id — a leftover stale id would
-    // be misread as a "stranded relaunch" and retried forever instead of surfaced
-    // via transition('crash') + surfaceBootFailure. Clearing it makes the failure
-    // show as pid=NULL + session=NULL → boot failure, the correct terminal
-    // outcome. A cycling refresh keeps BOTH ids — the `.jsonl` and its recorded
-    // session id are exactly what's being reused — so a cycling broker that dies
-    // pre-session_start reads as a "stranded relaunch" and is retried, same class
-    // as a resume revive today.
-    if (!hasSessionPath && (meta.pi_session_id != null || meta.pi_session_file != null)) {
-        updateNode(nodeId, { pi_session_id: null, pi_session_file: null });
-        meta.pi_session_id = null;
-        meta.pi_session_file = null;
-    }
-    // A true resume needs no kickoff — the saved conversation just continues. A
-    // fresh revive OR a cycling refresh-yield both get one so the (re-rooted)
-    // window re-reads its roadmap and continues: drainBearings is the one-shot
-    // consuming step (yield note + feed cursor + persona ack); the builder is
-    // then pure. `resume` carries `resumeSessionPath`/`newCycle` through
-    // unchanged (empty for true-fresh, both set for cycling) so buildPiArgv emits
-    // the right argv either way.
-    let inv;
-    if (resuming) {
-        inv = buildPiArgv(meta, resume);
-    }
-    else {
-        // Fresh or cycling: drain the one-shot bearings, then build the kickoff.
-        // When a scheduled bare self-alarm drove this revive, opts.wakeReason
-        // carries the wake provenance so the kickoff leads with a <crtr-wake> block
-        // ("a timer woke you"); every other reviveNode caller passes nothing → no
-        // block.
-        const bearings = drainBearings(meta);
-        inv = buildPiArgv(meta, {
-            ...resume,
-            prompt: buildReviveKickoff(meta, bearings, opts.wakeReason),
-        });
-        // Fresh or cycling revive starts a NEW LLM context — reset the on-read doc
-        // dedup so it surfaces docs from scratch (a true resume above instead KEEPS
-        // the persisted set, continuing the same transcript).
-        clearInjectedDocs(nodeId);
-    }
-    // The broker host launches the detached engine. reviveNode keeps
-    // transition+clearPid around it (the crash-safety ordering, unchanged). It
-    // opens NO viewer — engine-only; existing viewers reconnect, and a viewer-less
-    // node is brought on screen by the next `focus`.
-    transition(nodeId, 'revive');
-    // Clear any active fault the instant this node is (re)launched — don't wait
-    // for the fresh agent_start. A revive (auto or on-demand) is the recovery
-    // this marker advertised.
-    clearFault(nodeId);
-    // Cancel-on-wake (design §6.4, AC-E1): every revive-for-any-reason (an inbox
-    // event, a different wake, a manual focus) drops this node's pending deadline,
-    // so the deadline always belongs to the dormancy being left. Writes only the
-    // wakeups table, after the atomic transition above.
-    cancelDeadlinesFor(nodeId);
-    let launched;
+    // Cross-invocation revive lock (the duplicate-broker leak this fixes — live
+    // incident: repeated revive attempts against one node under socket thrash
+    // left MULTIPLE live `broker-cli` processes for the same node id, with
+    // canvas `pi_pid` overwritten and the older brokers untracked/leaked). The
+    // guard below reads `pi_pid` liveness and then, several statements later,
+    // launches + records a NEW pid — a classic check-then-act race. Two
+    // `reviveNode` calls for the SAME node (typically two separate OS processes:
+    // a retried `crtr node lifecycle revive`/web-relay bridge call racing the
+    // daemon's own auto-revive tick, or a burst of reconnect retries) can both
+    // read the SAME stale not-alive pid before either one's `recordPid` commits,
+    // both launch a broker, and the second `recordPid` silently overwrites the
+    // first's pid — leaking the first broker as an untracked live process
+    // forever. A `BEGIN IMMEDIATE` write transaction around the guard-check
+    // through `recordPid` serializes every `reviveNode` call sharing this
+    // canvas.db (same process or a concurrent one — SQLite's write lock plus the
+    // WAL/`busy_timeout` already set on every connection, see db.ts): whichever
+    // call wins the lock finishes its guard check, launch, and `recordPid`
+    // BEFORE the next contender's guard check ever runs, so a second contender
+    // always sees the freshly-recorded ALIVE pid and no-ops instead of
+    // double-launching. Committed UNCONDITIONALLY in `finally` — never rolled
+    // back — because every write inside (the cycle bump, the crash-path
+    // `transition('crash')`/`clearPid` on a launch failure, etc.) must persist
+    // exactly as it would with no transaction at all (each statement
+    // auto-committing today); this adds only the missing mutual exclusion, it
+    // changes no write's durability or the function's existing throw/return
+    // semantics.
+    const db = openDb();
+    db.exec('BEGIN IMMEDIATE');
     try {
-        launched = headlessBrokerHost.launch(nodeId, inv, {
-            cwd: meta.cwd,
-            name: fullName(meta),
-            resuming,
-        });
-    }
-    catch (error) {
+        // Double-revive guard: identity-aware liveness on pi_pid. Only a
+        // CONFIRMED-dead read proceeds to relaunch; `alive` AND `indeterminate`
+        // both no-op. A node whose broker pid is still running as that same broker
+        // was already revived by another path — re-launching would put a SECOND
+        // broker on the same session file.
+        //
+        // Why `indeterminate` must NOT relaunch (live incident, 2026-07-10, 4GB
+        // Hearth home): the `dead` verdict comes from the fork-free signal-0
+        // syscall (`isPidAlive`), which cannot fail under resource pressure — a
+        // truly dead broker ALWAYS reads `dead`. `indeterminate` therefore means
+        // "the pid EXISTS but the `ps` identity probe failed" — and the probe is a
+        // fork+exec, so it fails exactly when the host is out of memory (ENOMEM)
+        // or thrashing (>2s timeout). Those failures are CORRELATED and
+        // persistent, not transient: under sustained OOM every guard read went
+        // `indeterminate`, every daemon grace window relaunched a broker whose
+        // predecessor was still alive, and `recordPid` below overwrote the row's
+        // pid — leaking each older broker untracked. That compounded to 7 live
+        // engines on one node (35 total on the home), which itself sustained the
+        // OOM that kept the probes failing. Relaunching on uncertainty is
+        // self-amplifying in precisely the regime where uncertainty occurs.
+        //
+        // The cost of no-opping on `indeterminate` is bounded and small: the only
+        // dead-but-indeterminate cases are a zombie or a reused pid whose `ps`
+        // probe failed — both re-read next daemon tick, and read `dead` the
+        // moment a probe succeeds. `isRecordedPidAlive` is the exact adapter for
+        // this direction (false ONLY on confirmed `dead`).
+        const live = getNode(nodeId) ?? meta;
+        if (isRecordedPidAlive(live.pi_pid, live.pi_pid_identity)) {
+            return {
+                window: null,
+                session: live.tmux_session ?? null,
+                resumed: false,
+            };
+        }
+        // Every (re)launch is a new cycle — bump the counter so CRTR_CYCLES and the
+        // footer stay in sync. Mutate the in-memory meta too so buildPiArgv below
+        // launches with the incremented count.
+        meta.cycles = (meta.cycles ?? 0) + 1;
+        updateNode(nodeId, { cycles: meta.cycles });
+        // Decide whether to wake the saved pi conversation, cycle it in place (a
+        // refresh-yield reusing the same `.jsonl`), or start fresh. resumeArgs
+        // resumes/cycles ONLY by the absolute session-file path (cwd-immune) and ONLY
+        // when that .jsonl actually exists; there is no bare-id fallback (the broker
+        // preflight rejects a bare `--session`). No file on disk yet ⇒ a fresh launch.
+        const resume = resumeArgs(meta, opts.resume);
+        // hasSessionPath: there is a real `.jsonl` to hand pi via `--session`, whether
+        // as a true resume OR a cycling refresh-yield (resumeArgs sets `newCycle` in
+        // the latter case). cycling and resuming are mutually exclusive; `resuming`
+        // keeps the STRICT true-resume-only meaning `ReviveResult.resumed` and the
+        // launch-placement hint below have always carried.
+        const hasSessionPath = resume.resumeSessionPath !== undefined;
+        const cycling = hasSessionPath && resume.newCycle === true;
+        const resuming = hasSessionPath && !cycling;
+        // Mirror THIS launch attempt's cycling-ness durably, BEFORE launching, so a
+        // pre-session_start crash-retry (crtrd.ts) can tell "was the attempt I'm
+        // retrying a cycle" apart from an ordinary resume/crash. Cleared by
+        // canvas-stophook's session_start handler the instant this boot is confirmed.
+        // Written unconditionally (true for cycling, false otherwise) so it never
+        // goes stale across launch kinds.
+        updateNode(nodeId, { cycle_pending: cycling });
+        meta.cycle_pending = cycling;
+        // A truly fresh launch — no `.jsonl` to resume OR cycle from — starts a NEW
+        // pi session, so the old session identity is dead. Clear it from meta NOW,
+        // before launch, so the recorded state matches what we're about to do. This
+        // is load-bearing for boot-failure classification: if this fresh broker dies
+        // BEFORE session_start (recording no new pid and no new session), the
+        // daemon's pid-null branch keys on pi_session_id — a leftover stale id would
+        // be misread as a "stranded relaunch" and retried forever instead of surfaced
+        // via transition('crash') + surfaceBootFailure. Clearing it makes the failure
+        // show as pid=NULL + session=NULL → boot failure, the correct terminal
+        // outcome. A cycling refresh keeps BOTH ids — the `.jsonl` and its recorded
+        // session id are exactly what's being reused — so a cycling broker that dies
+        // pre-session_start reads as a "stranded relaunch" and is retried, same class
+        // as a resume revive today.
+        if (!hasSessionPath && (meta.pi_session_id != null || meta.pi_session_file != null)) {
+            updateNode(nodeId, { pi_session_id: null, pi_session_file: null });
+            meta.pi_session_id = null;
+            meta.pi_session_file = null;
+        }
+        // A true resume needs no kickoff — the saved conversation just continues. A
+        // fresh revive OR a cycling refresh-yield both get one so the (re-rooted)
+        // window re-reads its roadmap and continues: drainBearings is the one-shot
+        // consuming step (yield note + feed cursor + persona ack); the builder is
+        // then pure. `resume` carries `resumeSessionPath`/`newCycle` through
+        // unchanged (empty for true-fresh, both set for cycling) so buildPiArgv emits
+        // the right argv either way.
+        let inv;
+        if (resuming) {
+            inv = buildPiArgv(meta, resume);
+        }
+        else {
+            // Fresh or cycling: drain the one-shot bearings, then build the kickoff.
+            // When a scheduled bare self-alarm drove this revive, opts.wakeReason
+            // carries the wake provenance so the kickoff leads with a <crtr-wake> block
+            // ("a timer woke you"); every other reviveNode caller passes nothing → no
+            // block.
+            const bearings = drainBearings(meta);
+            inv = buildPiArgv(meta, {
+                ...resume,
+                prompt: buildReviveKickoff(meta, bearings, opts.wakeReason),
+            });
+            // Fresh or cycling revive starts a NEW LLM context — reset the on-read doc
+            // dedup so it surfaces docs from scratch (a true resume above instead KEEPS
+            // the persisted set, continuing the same transcript).
+            clearInjectedDocs(nodeId);
+        }
+        // The broker host launches the detached engine. reviveNode keeps
+        // transition+clearPid around it (the crash-safety ordering, unchanged). It
+        // opens NO viewer — engine-only; existing viewers reconnect, and a viewer-less
+        // node is brought on screen by the next `focus`.
+        transition(nodeId, 'revive');
+        // Clear any active fault the instant this node is (re)launched — don't wait
+        // for the fresh agent_start. A revive (auto or on-demand) is the recovery
+        // this marker advertised.
+        clearFault(nodeId);
+        // Cancel-on-wake (design §6.4, AC-E1): every revive-for-any-reason (an inbox
+        // event, a different wake, a manual focus) drops this node's pending deadline,
+        // so the deadline always belongs to the dormancy being left. Writes only the
+        // wakeups table, after the atomic transition above.
+        cancelDeadlinesFor(nodeId);
+        let launched;
         try {
-            transition(nodeId, 'crash');
-            // Doctrine wake: a launch-refusal here marks the node dead with NOTHING
-            // else fanning that out — the daemon's own auto-revive is the most common
-            // caller (superviseTick, best-effort try/catch, stderr-only on failure), so
-            // without this a manager waiting dormant on this child hangs forever,
-            // never told it will not come back on its own. Mirrors closeNode's step-4
-            // fan-out (same subscribers table, same active/passive split).
-            fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child crashed — ${fullName(meta)} (${nodeId}) failed to relaunch and is now dead: ${error.message}\n\n` +
-                `It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`, { reason: 'child-crashed', child: nodeId });
+            launched = headlessBrokerHost.launch(nodeId, inv, {
+                cwd: meta.cwd,
+                name: fullName(meta),
+                resuming,
+            });
         }
-        catch {
-            /* best-effort cleanup */
+        catch (error) {
+            try {
+                transition(nodeId, 'crash');
+                // Doctrine wake: a launch-refusal here marks the node dead with NOTHING
+                // else fanning that out — the daemon's own auto-revive is the most common
+                // caller (superviseTick, best-effort try/catch, stderr-only on failure), so
+                // without this a manager waiting dormant on this child hangs forever,
+                // never told it will not come back on its own. Mirrors closeNode's step-4
+                // fan-out (same subscribers table, same active/passive split).
+                fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child crashed — ${fullName(meta)} (${nodeId}) failed to relaunch and is now dead: ${error.message}\n\n` +
+                    `It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`, { reason: 'child-crashed', child: nodeId });
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+            clearPid(nodeId);
+            throw new Error(`[broker] refusing to revive ${nodeId}: ${error.message}`);
         }
-        clearPid(nodeId);
-        throw new Error(`[broker] refusing to revive ${nodeId}: ${error.message}`);
+        // Record the real broker pid immediately, still inside the lock — this is
+        // the write that makes the guard's next reader (a contender unblocked from
+        // its own BEGIN IMMEDIATE the instant this transaction commits) see an
+        // ALIVE pid instead of racing past the same stale one this call just
+        // relaunched from. session_start will re-record the same pid after
+        // extension bind, but the daemon must supervise the process during the
+        // cold-boot window too; otherwise a slow-but-alive broker reads as
+        // pid=null+session=null and can be falsely crashed by the boot-grace path.
+        if (launched.pid !== null)
+            recordPid(nodeId, launched.pid);
+        return { window: null, session: meta.tmux_session ?? null, resumed: resuming, launch: launched };
+    }
+    finally {
+        db.exec('COMMIT');
     }
-    // Record the real broker pid immediately. session_start will re-record the
-    // same pid after extension bind, but the daemon must supervise the process
-    // during the cold-boot window too; otherwise a slow-but-alive broker reads as
-    // pid=null+session=null and can be falsely crashed by the boot-grace path.
-    if (launched.pid !== null)
-        recordPid(nodeId, launched.pid);
-    return { window: null, session: meta.tmux_session ?? null, resumed: resuming, launch: launched };
 }

package/dist/core/runtime/tmux.js

@@ -67,7 +67,10 @@ function ensureBracketedPaste() {
     const current = tmux(['show-options', '-s', 'terminal-overrides']).stdout;
     if (current.includes('Enbp='))
         return;
-    tmux(['set-option', '-sga', 'terminal-overrides', '*:Enbp=\E[?2004h:Dsbp=\E[?2004l']);
+    // Emit a LITERAL backslash-E (`\\E`) so tmux's option parser resolves it to ESC.
+    // A single `\E` in this JS source collapses to the letter `E`, which stores a
+    // broken `Enbp=E[?2004h` (no ESC) and silently disables bracketed paste.
+    tmux(['set-option', '-sga', 'terminal-overrides', '*:Enbp=\\E[?2004h:Dsbp=\\E[?2004l']);
 }
 /** Create a detached session rooted at `cwd` if it doesn't exist. The session
  *  name is a root's tmux home; every node under that root is a window in it. */

package/dist/core/view/__tests__/transport-remote.test.js

@@ -25,8 +25,12 @@ function startStalledServer() {
         });
     });
 }
-test('a stalled endpoint returns a timeout failure within the configured bound instead of hanging forever', async () => {
+test('a stalled endpoint returns a timeout failure within the configured bound instead of hanging forever', async (t) => {
     const server = await startStalledServer();
+    // Register the close BEFORE any assertion runs — a listening server left
+    // open by a thrown assertion keeps this test file's process alive forever
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => server.close());
     const exec = createRemoteExec(server.url, 'tok', 100); // small timeout for the test
     const started = Date.now();
     // Race against a generous outer deadline: if the transport doesn't
@@ -40,9 +44,8 @@ test('a stalled endpoint returns a timeout failure within the configured bound i
     assert.equal(result.ok, false);
     assert.match(result.stderr, /timeout/i);
     assert.ok(elapsed < 1000, `expected the timeout to fire near the configured 100ms bound, took ${elapsed}ms`);
-    await server.close();
 });
-test('a normal fast response is unaffected by the timeout wiring', async () => {
+test('a normal fast response is unaffected by the timeout wiring', async (t) => {
     const server = createServer((req, res) => {
         const chunks = [];
         req.on('data', (c) => chunks.push(c));
@@ -51,6 +54,7 @@ test('a normal fast response is unaffected by the timeout wiring', async () => {
             res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
         });
     });
+    t.after(() => new Promise((r) => server.close(() => r())));
     await new Promise((r) => server.listen(0, '127.0.0.1', r));
     const addr = server.address();
     const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
@@ -58,7 +62,6 @@ test('a normal fast response is unaffected by the timeout wiring', async () => {
     const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
     assert.equal(result.ok, true);
     assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-    await new Promise((r) => server.close(() => r()));
 });
 // --- Phase 3 review Minor 1: no token bytes may ever reach returned stderr ---
 test('an unreachable endpoint returns a flat generic network-error message, never the raw exception text', async () => {
@@ -75,7 +78,7 @@ test('a malformed token (contains a newline) is rejected up front with a generic
     assert.ok(!result.stderr.includes('bad\ntoken'));
     assert.ok(!result.stderr.includes('bad'));
 });
-test('a valid token containing typical bearer-token punctuation (-, _, .) still round-trips against a real server', async () => {
+test('a valid token containing typical bearer-token punctuation (-, _, .) still round-trips against a real server', async (t) => {
     const server = createServer((req, res) => {
         const chunks = [];
         req.on('data', (c) => chunks.push(c));
@@ -84,6 +87,7 @@ test('a valid token containing typical bearer-token punctuation (-, _, .) still
             res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
         });
     });
+    t.after(() => new Promise((r) => server.close(() => r())));
     await new Promise((r) => server.listen(0, '127.0.0.1', r));
     const addr = server.address();
     const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
@@ -91,5 +95,4 @@ test('a valid token containing typical bearer-token punctuation (-, _, .) still
     const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
     assert.equal(result.ok, true);
     assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-    await new Promise((r) => server.close(() => r()));
 });

package/dist/core/view/transport-local.js

@@ -38,9 +38,18 @@ function sendExec(req, baseCwd) {
                 resolve({ ok: true, exitCode: code, stdout: stdout ?? '', stderr: stderr ?? '' });
                 return;
             }
-            if (err.signal) {
-                // Killed by signal: it ran; surface as a non-zero exit.
-                resolve({ ok: true, exitCode: 1, stdout: stdout ?? '', stderr: stderr ?? '' });
+            const signal = err.signal;
+            if (signal) {
+                // Killed by signal: it ran; surface as a non-zero exit. A SIGKILL with
+                // no stderr at all (the live-incident shape: a guest OOM killer takes
+                // out the child before it ever writes anything) used to come back as
+                // a bare `failed (1)` with nothing to explain it — the signal itself
+                // IS the useful diagnostic here, so surface it when stderr is empty
+                // rather than discarding it.
+                const detail = stderr && stderr.trim() !== ''
+                    ? stderr
+                    : `killed by signal ${signal}${signal === 'SIGKILL' ? ' (often out-of-memory)' : ''}`;
+                resolve({ ok: true, exitCode: 1, stdout: stdout ?? '', stderr: detail });
                 return;
             }
             // Spawn-level failure (ENOENT/EACCES/maxBuffer): transport failure.

package/dist/daemon/crtrd-cli.d.ts

@@ -1 +1 @@
-export {};
+import '../suppress-experimental-warnings.js';

package/dist/daemon/crtrd-cli.js

@@ -1,4 +1,5 @@
 // crtrd entry point — spawned detached by `crtr sys daemon start` and by bin/crtrd.
 // Calls runDaemon() and never returns (the loop drives via setTimeout).
+import '../suppress-experimental-warnings.js';
 import { runDaemon } from './crtrd.js';
 runDaemon();

package/dist/suppress-experimental-warnings.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/suppress-experimental-warnings.js

@@ -0,0 +1,15 @@
+const originalEmit = process.emit;
+process.emit = function (name, ...args) {
+    const [data] = args;
+    if (name === 'warning' &&
+        data instanceof Error &&
+        data.name === 'ExperimentalWarning' &&
+        data.message.includes('SQLite')) {
+        return false;
+    }
+    return originalEmit.apply(this, [
+        name,
+        ...args,
+    ]);
+};
+export {};

package/dist/types.js

@@ -57,12 +57,12 @@ export function defaultKindsConfig() {
         },
         explore: {
             whenToUse: 'Map unfamiliar code or architecture — read-only orientation and code-path research with concrete file:line evidence. Anything diagnostic — investigating a failure, why something is broken or misbehaving, or live/runtime behavior — is advisor, not explore.',
-            model: 'anthropic/light',
+            model: 'openai/light',
         },
         developer: {
             whenToUse: 'Implement a change — make the feature or fix genuinely work against its acceptance criteria, not merely compile.',
-            model: 'anthropic/medium',
-            orchestratorModel: 'anthropic/strong',
+            model: 'openai/medium',
+            orchestratorModel: 'openai/strong',
         },
         design: {
             whenToUse: 'Architect a solution — produce one design document an implementer can build from without re-deciding anything left open.',
@@ -150,15 +150,15 @@ export function defaultModelLaddersConfig() {
     return {
         anthropic: {
             ultra: 'anthropic/claude-fable-5:high',
-            strong: 'anthropic/claude-opus-4-8:high',
-            medium: 'anthropic/claude-sonnet-5:high',
-            light: 'anthropic/claude-haiku-4-5:high',
+            strong: 'anthropic/claude-fable-5:medium',
+            medium: 'anthropic/claude-opus-4-8:high',
+            light: 'anthropic/claude-sonnet-5:high',
         },
         openai: {
-            ultra: 'openai-codex/gpt-5.5:xhigh',
-            strong: 'openai-codex/gpt-5.5:high',
-            medium: 'openai-codex/gpt-5.5:medium',
-            light: 'openai-codex/gpt-5.3-codex-spark',
+            ultra: 'openai-codex/gpt-5.6-sol:max',
+            strong: 'openai-codex/gpt-5.6-sol:high',
+            medium: 'openai-codex/gpt-5.6-terra:medium',
+            light: 'openai-codex/gpt-5.6-luna:low',
         },
     };
 }