@crouton-kit/crouter 0.3.68 → 0.3.70

package/dist/core/__tests__/helpers/harness.js

@@ -45,12 +45,28 @@ const TSX_ESM = createRequire(import.meta.url).resolve('tsx/esm');
 // A multi-word launcher, baked verbatim ahead of the (shell-quoted) argv by the
 // seam. Absolute paths so it works regardless of the spawned window's cwd.
 const FAKE_PI_BINARY = `${process.execPath} --import ${TSX_ESM} ${FAKE_PI_HOST}`;
+// Every raw `tmux` call the harness/full-tier tests make against the shared
+// DEFAULT server is synchronous (spawnSync). Node's spawnSync blocks the WHOLE
+// worker (no event loop, no `node --test` timeout can preempt it) until the
+// child exits — with no `timeout` option it can wait FOREVER. A wedged/CPU-
+// starved tmux server (the acknowledged "intermittent Linux-only crash-revive
+// wedge", CI-only) has been observed to hang one of these calls indefinitely,
+// which permanently consumes one of the `--test-concurrency` slots; as more
+// full-tier files each hit the SAME wedged server, every slot eventually gets
+// consumed the same way and the whole suite flatlines with zero further TAP
+// output (confirmed 3/3 in CI, see ci-full-suite-hang-blocker.md). TMUX_TIMEOUT_MS
+// bounds every raw tmux spawnSync call so a wedge fails that ONE call (and the
+// test it belongs to) fast instead of hanging the run.
+export const TMUX_TIMEOUT_MS = 10_000;
 /** True when a usable tmux is on PATH — tests gate on this and SKIP otherwise. */
 export function hasTmux() {
-    return spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0;
+    return spawnSync('tmux', ['-V'], { stdio: 'ignore', timeout: TMUX_TIMEOUT_MS }).status === 0;
 }
 function tmuxSessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+    return (spawnSync('tmux', ['has-session', '-t', session], {
+        stdio: 'ignore',
+        timeout: TMUX_TIMEOUT_MS,
+    }).status === 0);
 }
 // Every canvas/tmux var the harness itself runs under — scrubbed from each child
 // env so a spawned CLI cannot leak the REAL canvas into the isolated test.
@@ -172,14 +188,19 @@ export async function createHarness(opts = {}) {
     if (!headless) {
         spawnSync('tmux', ['new-session', '-d', '-s', session, '-c', CROUTER, 'sleep 100000'], {
             stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
         });
         // Put CRTR_PI_BINARY in the SESSION environment so EVERY pane/process spawned
         // in this session inherits it — so any pi the runtime launches (boot, revive)
         // resolves to the fake-pi vehicle, not a real pi.
         spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_PI_BINARY', FAKE_PI_BINARY], {
             stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
+        });
+        spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_HOME', home], {
+            stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
         });
-        spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_HOME', home], { stdio: 'ignore' });
     }
     const pidsToKill = new Set();
     let nextRootSeq = 0;
@@ -517,7 +538,10 @@ export async function createHarness(opts = {}) {
             return subscriptionsOf(nodeId).map((s) => ({ node_id: s.node_id, active: s.active }));
         },
         async dispose() {
-            spawnSync('tmux', ['kill-session', '-t', session], { stdio: 'ignore' });
+            spawnSync('tmux', ['kill-session', '-t', session], {
+                stdio: 'ignore',
+                timeout: TMUX_TIMEOUT_MS,
+            });
             // Best-effort: a superviseTick-triggered revive of a fabricated node fires
             // a DETACHED throwaway broker (it loads the real SDK; the rmSync of home
             // below makes a mid-boot one self-terminate when its files vanish). Kill

package/dist/core/__tests__/live-mutation-verbs.test.js

@@ -47,6 +47,7 @@ import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
+const FULL_CLI_TEST_TIMEOUT_MS = 180_000;
 // ===========================================================================
 // (b) THE demote / recycle SPLIT — two DISTINCT verbs:
 //   • `node lifecycle demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
@@ -60,9 +61,9 @@ function persona(m) {
 // ===========================================================================
 test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle recycle is FINISH+RECYCLE', 
 // Drives several full-CLI subprocess spawns (each a cold tsx compile of the
-// whole CLI) + recycleNode; a 20s budget blew on the slower, concurrency-
-// oversubscribed CI runner though it passes in ~8s locally. 60s = safe margin.
-{ timeout: 60_000 }, async () => {
+// whole CLI) + recycleNode; this is a subprocess-heavy regression and gets a
+// CI-safe per-test budget while the npm script isolates it at file concurrency 1.
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-demote' });
     try {
         const A = h.spawnRoot('resident root');
@@ -136,7 +137,7 @@ test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle
 // ===========================================================================
 test('A4: a base→orchestrator yield auto-promotes + sets refresh but leaves persona_ack PENDING (the steer is never delivered)', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
-{ timeout: 60_000 }, async () => {
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-a4' });
     try {
         const A = h.spawnRoot('resident root');

package/dist/core/__tests__/review-model-floor.test.js

@@ -27,7 +27,7 @@ test('review still permits equal-or-stronger explicit models', () => {
     assert.equal(spec('review', 'ultra'), normalizeModel('ultra'));
 });
 test('explore remains cheap by default and may explicitly run light', () => {
-    assert.equal(spec('explore'), normalizeModel('anthropic/light'));
+    assert.equal(spec('explore'), normalizeModel('openai/light'));
     assert.equal(spec('explore', 'light'), normalizeModel('light'));
 });
 // `node new --model` widened to the full spec grammar (provider/tier, exact

package/dist/core/canvas/__tests__/remote-event-stream.test.js

@@ -45,7 +45,7 @@ async function waitFor(predicate, timeoutMs = 2000, intervalMs = 5) {
         await new Promise((r) => setTimeout(r, intervalMs));
     }
 }
-test('a listener fires once per known-kind SSE event, and never for a ping or an unknown kind', async () => {
+test('a listener fires once per known-kind SSE event, and never for a ping or an unknown kind', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(200, { 'content-type': 'text/event-stream' });
         res.write(': connected\n\n');
@@ -55,15 +55,18 @@ test('a listener fires once per known-kind SSE event, and never for a ping or an
         res.end();
     });
     const stream = new RemoteEventStream(server.url, 'tok');
+    // Register cleanup BEFORE any assertion runs — a thrown assertion must not
+    // leave the client's reconnect loop or the server's listening socket alive
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => { stream.stop(); return server.close(); });
     const seen = [];
     stream.subscribe((kind) => seen.push(kind));
     stream.start();
     await waitFor(() => seen.length > 0);
     stream.stop();
     assert.deepEqual(seen, ['nodes']);
-    await server.close();
 });
-test('the SSE connection carries the token ONLY in the Authorization header — not in the URL or any other header', async () => {
+test('the SSE connection carries the token ONLY in the Authorization header — not in the URL or any other header', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(200, { 'content-type': 'text/event-stream' });
         res.end();
@@ -73,6 +76,7 @@ test('the SSE connection carries the token ONLY in the Authorization header —
     // no header, including Host, is permitted to carry it.
     const token = 'secret-sse-token-value';
     const stream = new RemoteEventStream(server.url, token);
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     await waitFor(() => server.requests.length > 0);
     stream.stop();
@@ -87,9 +91,8 @@ test('the SSE connection carries the token ONLY in the Authorization header —
         assert.ok(!String(v).includes(token), `header ${k} must not carry the token`);
     }
     assert.ok(!req.url.includes(token));
-    await server.close();
 });
-test('stop() cancels a pending reconnect timer — no zombie loop survives a stop()+start() cycle', async () => {
+test('stop() cancels a pending reconnect timer — no zombie loop survives a stop()+start() cycle', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(500);
         res.end();
@@ -101,6 +104,7 @@ test('stop() cancels a pending reconnect timer — no zombie loop survives a sto
     // wide enough that ordinary event-loop/scheduler jitter can't flip it.
     const BACKOFF = 200;
     const stream = new RemoteEventStream(server.url, 'tok', { initialBackoffMs: BACKOFF });
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     // t≈0: first request fires+fails, backoff(BACKOFF) scheduled → stale deadline ≈ BACKOFF.
     await waitFor(() => server.hitCount() >= 1);
@@ -119,10 +123,8 @@ test('stop() cancels a pending reconnect timer — no zombie loop survives a sto
     // this window; a cleared one (fixed) leaves it at 2.
     await new Promise((r) => setTimeout(r, BACKOFF * 0.7));
     assert.equal(server.hitCount(), 2, "no zombie request from the stopped loop's dangling timer");
-    stream.stop();
-    await server.close();
 });
-test('stop() halts the reconnect loop — no further requests after it is called', async () => {
+test('stop() halts the reconnect loop — no further requests after it is called', async (t) => {
     const server = await startSseServer((res) => {
         // Every connection is refused immediately (no SSE headers, just a close)
         // so the client's loop falls into its backoff-and-retry path.
@@ -131,6 +133,7 @@ test('stop() halts the reconnect loop — no further requests after it is called
     });
     const BACKOFF = 20;
     const stream = new RemoteEventStream(server.url, 'tok', { initialBackoffMs: BACKOFF });
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     await waitFor(() => server.hitCount() >= 1);
     const hitsAtStop = server.hitCount();
@@ -140,5 +143,4 @@ test('stop() halts the reconnect loop — no further requests after it is called
     // continuing to retry in the background after stop() returned.
     await new Promise((r) => setTimeout(r, BACKOFF * 5));
     assert.equal(server.hitCount(), hitsAtStop);
-    await server.close();
 });

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -140,7 +140,7 @@ function seedPoisonedLocalState() {
     ].join('\n'));
     return sf;
 }
-test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource suppress every local-read field to its safe default for a RemoteCanvasSource, even with conflicting local state for the same node id', async () => {
+test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource suppress every local-read field to its safe default for a RemoteCanvasSource, even with conflicting local state for the same node id', async (t) => {
     sessionFile = seedPoisonedLocalState();
     const server = await startMockCrtrServer((args) => {
         if (args[1] === 'node' && args[2] === 'inspect' && args[3] === 'list') {
@@ -164,6 +164,10 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
         }
         return { status: 500, body: {} };
     });
+    // Register the close BEFORE any assertion runs — a listening server left
+    // open by a thrown assertion keeps this test file's process alive forever
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => server.close());
     const source = new RemoteCanvasSource(server.url, 'tok');
     const rows = await dashboardRowsAllFromSource(source);
     assert.equal(rows.length, 1);
@@ -180,7 +184,6 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
     assert.equal(previewed.prompts, undefined, 'a local session transcript must not leak into a remote preview');
     assert.equal(previewed.lastAssistant, undefined, 'a local session transcript must not leak into a remote preview');
     assert.equal(previewed.previewLoaded, true);
-    await server.close();
 });
 // The non-TTY `canvas browse` path (browse/app.ts's `if (!process.stdin.isTTY)`
 // branch) calls `renderForestFromSource(source)` directly — a SEPARATE code
@@ -190,7 +193,7 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
 // test above never exercises it, so a regression that reintroduced local
 // telemetry/ask/fault reads into the static forest renderer specifically would
 // pass that test while still leaking poisoned local state here.
-test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) for a RemoteCanvasSource, even with conflicting local state for the same node id', async () => {
+test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) for a RemoteCanvasSource, even with conflicting local state for the same node id', async (t) => {
     const sf = seedPoisonedLocalState();
     const server = await startMockCrtrServer((args) => {
         if (args[1] === 'node' && args[2] === 'inspect' && args[3] === 'list') {
@@ -211,11 +214,11 @@ test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) f
         }
         return { status: 500, body: {} };
     });
+    t.after(() => server.close());
     const source = new RemoteCanvasSource(server.url, 'tok');
     const out = await renderForestFromSource(source);
     assert.match(out, /ctx 0k/, 'the remote node must render with the suppressed ctx default, not a real token read');
     assert.doesNotMatch(out, /⚑/, 'no ask badge — local asks must not leak into the static forest render');
     assert.doesNotMatch(out, /POISON FAULT/, 'a local active fault must not leak into the static forest render');
     assert.doesNotMatch(out, /POISON/, 'no poisoned local telemetry/goal/session text may appear anywhere in the output');
-    await server.close();
 });

package/dist/core/canvas/browse/__tests__/rebuild-coalescer.test.js

@@ -71,19 +71,36 @@ test('a burst of SSE-style triggers produces ONE round of remote requests, not N
             res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
         });
     });
-    await new Promise((r) => server.listen(0, '127.0.0.1', r));
-    const addr = server.address();
-    const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
-    const source = new RemoteCanvasSource(`http://127.0.0.1:${port}`, 'tok');
-    const rebuilder = createCoalescedRebuilder(async () => {
-        source.invalidate();
-        await source.listNodes(); // one round of remote requests, mirroring app.ts's rebuildSnapshot
-    }, 20);
-    for (let i = 0; i < 6; i++)
-        rebuilder.trigger();
-    await new Promise((r) => setTimeout(r, 80));
-    assert.equal(hits, 1, 'a burst of 6 SSE events must produce ONE round of remote requests, not 6');
-    await new Promise((r) => server.close(() => r()));
+    // The server MUST close in a `finally` — a listening TCP server keeps its
+    // process's event loop non-empty forever. Under `node --test`, every test
+    // file is its own child process; if an assertion in this test throws before
+    // the old inline `server.close()` at the end of the function ran, the
+    // server (and the process) never exited, wedging one `--test-concurrency`
+    // slot permanently and hanging the whole suite (see the CI-hang postmortem).
+    try {
+        await new Promise((r) => server.listen(0, '127.0.0.1', r));
+        const addr = server.address();
+        const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
+        const source = new RemoteCanvasSource(`http://127.0.0.1:${port}`, 'tok');
+        const rebuilder = createCoalescedRebuilder(async () => {
+            source.invalidate();
+            await source.listNodes(); // one round of remote requests, mirroring app.ts's rebuildSnapshot
+        }, 20);
+        for (let i = 0; i < 6; i++)
+            rebuilder.trigger();
+        // Poll for the request to land instead of sleeping a fixed duration —
+        // deterministic under CI's variable CPU load, and doesn't slow down the
+        // common case (returns as soon as the debounce + request round trip land).
+        const deadline = Date.now() + 2000;
+        while (hits < 1 && Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, 10));
+        }
+        assert.equal(hits, 1, 'a burst of 6 SSE events must produce ONE round of remote requests, not 6');
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise((r) => server.close(() => r()));
+    }
 });
 // Integration proof for browse/app.ts's ACTUAL wiring — not the coalescer
 // helper in isolation. Every test above instantiates `createCoalescedRebuilder`

package/dist/core/canvas/pid.d.ts

@@ -74,16 +74,20 @@ export declare function identitiesMatch(a: string, b: string): boolean;
  *      `identitiesMatch` says so, else `'dead'` (positively reused). */
 export type RecordedPidLiveness = 'alive' | 'dead' | 'indeterminate';
 export declare function recordedPidLiveness(pid: number | null | undefined, expectedIdentity: string | null | undefined): RecordedPidLiveness;
-/** Boolean teardown-direction adapter over `recordedPidLiveness`, kept so
- *  every pre-existing signalling caller stays behavior-identical: `dead` is
- *  the ONLY thing that reads false. `indeterminate` (can't confirm either
- *  way) reads true alongside `alive` — never signal a maybe-ours pid on mere
- *  uncertainty, matching this module's universal discipline (a POSITIVE
- *  mismatch is the only thing that changes behavior, never an absence of
- *  evidence). Callers that need to distinguish "confirmed alive" from
- *  "can't confirm" (e.g. a double-launch guard, where treating uncertainty as
- *  alive risks silently skipping a needed relaunch) must call
- *  `recordedPidLiveness` directly instead of this adapter. */
+/** Boolean confirmed-dead-direction adapter over `recordedPidLiveness`:
+ *  `dead` is the ONLY thing that reads false. `indeterminate` (can't confirm
+ *  either way) reads true alongside `alive` — never act on a maybe-ours pid
+ *  on mere uncertainty, matching this module's universal discipline (a
+ *  POSITIVE verdict is the only thing that changes behavior, never an
+ *  absence of evidence). This is the correct read for BOTH signalling
+ *  callers (never signal on uncertainty) and the double-launch guard in
+ *  `reviveNode` (never RELAUNCH on uncertainty — the identity probe is a
+ *  fork+exec that fails precisely under the OOM pressure where an extra
+ *  broker is most destructive, while a truly dead pid always reads `dead`
+ *  via the fork-free signal-0 path; see the guard's comment for the live
+ *  incident this closed). Callers that need "confirmed alive" three-valued
+ *  precision (e.g. the daemon's grace-clock bookkeeping) call
+ *  `recordedPidLiveness` directly. */
 export declare function isRecordedPidAlive(pid: number | null | undefined, expectedIdentity: string | null | undefined): boolean;
 /** SIGTERM a process GROUP by pid (the negative-pid convention) — best-effort,
  *  swallowing ESRCH (already gone). Shared by triggers.ts (cancel-time reap of

package/dist/core/canvas/pid.js

@@ -132,16 +132,20 @@ export function recordedPidLiveness(pid, expectedIdentity) {
         logPidLivenessDecision(pid, alive, expectedIdentity, 'value', matches ? 'identity matches expected → alive' : 'identity differs from expected → REUSED → dead', matches ? 'alive' : 'dead', actual);
     return matches ? 'alive' : 'dead';
 }
-/** Boolean teardown-direction adapter over `recordedPidLiveness`, kept so
- *  every pre-existing signalling caller stays behavior-identical: `dead` is
- *  the ONLY thing that reads false. `indeterminate` (can't confirm either
- *  way) reads true alongside `alive` — never signal a maybe-ours pid on mere
- *  uncertainty, matching this module's universal discipline (a POSITIVE
- *  mismatch is the only thing that changes behavior, never an absence of
- *  evidence). Callers that need to distinguish "confirmed alive" from
- *  "can't confirm" (e.g. a double-launch guard, where treating uncertainty as
- *  alive risks silently skipping a needed relaunch) must call
- *  `recordedPidLiveness` directly instead of this adapter. */
+/** Boolean confirmed-dead-direction adapter over `recordedPidLiveness`:
+ *  `dead` is the ONLY thing that reads false. `indeterminate` (can't confirm
+ *  either way) reads true alongside `alive` — never act on a maybe-ours pid
+ *  on mere uncertainty, matching this module's universal discipline (a
+ *  POSITIVE verdict is the only thing that changes behavior, never an
+ *  absence of evidence). This is the correct read for BOTH signalling
+ *  callers (never signal on uncertainty) and the double-launch guard in
+ *  `reviveNode` (never RELAUNCH on uncertainty — the identity probe is a
+ *  fork+exec that fails precisely under the OOM pressure where an extra
+ *  broker is most destructive, while a truly dead pid always reads `dead`
+ *  via the fork-free signal-0 path; see the guard's comment for the live
+ *  incident this closed). Callers that need "confirmed alive" three-valued
+ *  precision (e.g. the daemon's grace-clock bookkeeping) call
+ *  `recordedPidLiveness` directly. */
 export function isRecordedPidAlive(pid, expectedIdentity) {
     return recordedPidLiveness(pid, expectedIdentity) !== 'dead';
 }

package/dist/core/runtime/broker.js

@@ -1086,6 +1086,8 @@ export async function runBroker(nodeId) {
             showTerminalProgress: sm.getShowTerminalProgress(),
             warnings: sm.getWarnings(),
             defaultProjectTrust: sm.getDefaultProjectTrust(),
+            showCacheMissNotices: sm.getShowCacheMissNotices(),
+            outputPad: sm.getOutputPad(),
             autoRetry: session.autoRetryEnabled,
             model: toModelRef(session.model),
         };

package/dist/core/runtime/launch.js

@@ -111,7 +111,7 @@ const STRENGTH_ALIASES = {
 const MODEL_PROVIDER_KEYS = ['anthropic', 'openai'];
 const MODEL_STRENGTHS = ['ultra', 'strong', 'medium', 'light'];
 const MODEL_STRENGTH_RANK = { light: 0, medium: 1, strong: 2, ultra: 3 };
-const THINKING_SUFFIXES = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+const THINKING_SUFFIXES = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
 function stripThinkingSuffix(spec) {
     const i = spec.lastIndexOf(':');
     if (i <= 0)

package/dist/core/runtime/revive.js

@@ -29,7 +29,7 @@ import { fanDoctrineWake } from './close.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { headlessBrokerHost } from './host.js';
-import { recordedPidLiveness } from '../canvas/pid.js';
+import { isRecordedPidAlive } from '../canvas/pid.js';
 import { reconcileBootLiveness } from '../canvas/boot.js';
 import { clearFault } from './fault.js';
 import { clearInjectedDocs } from '../substrate/injected-store.js';
@@ -118,24 +118,34 @@ export function reviveNode(nodeId, opts) {
     const db = openDb();
     db.exec('BEGIN IMMEDIATE');
     try {
-        // Double-revive guard: identity-aware liveness on pi_pid, requiring
-        // CONFIRMED alive — not the fail-open-to-alive boolean adapter. A node
-        // whose broker pid is CONFIRMED still running as that same broker (not a
-        // reused pid) was already revived by another path — re-launching would put
-        // a SECOND broker on the same session file. No-op. A bare isPidAlive would
-        // misread a reused pid (heavy forking, esp. Linux) as "still alive" and
-        // skip the relaunch forever; conversely, treating an INDETERMINATE read
-        // (can't confirm either way, e.g. a transient `ps` probe failure) as
-        // "alive" here would risk the opposite failure — silently skipping a
-        // needed relaunch and stranding the node with no engine. So this guard
-        // blocks ONLY on a positively confirmed-alive read; `dead` AND
-        // `indeterminate` both proceed to relaunch. We accept that tradeoff: an
-        // `indeterminate` read CAN come from a genuinely live broker whose identity
-        // `ps` probe transiently failed, so proceeding risks a rare double-launch —
-        // but stranding a truly-dead node with no engine is the worse failure, and
-        // recovering from it is far harder, so we bias toward relaunching.
+        // Double-revive guard: identity-aware liveness on pi_pid. Only a
+        // CONFIRMED-dead read proceeds to relaunch; `alive` AND `indeterminate`
+        // both no-op. A node whose broker pid is still running as that same broker
+        // was already revived by another path — re-launching would put a SECOND
+        // broker on the same session file.
+        //
+        // Why `indeterminate` must NOT relaunch (live incident, 2026-07-10, 4GB
+        // Hearth home): the `dead` verdict comes from the fork-free signal-0
+        // syscall (`isPidAlive`), which cannot fail under resource pressure — a
+        // truly dead broker ALWAYS reads `dead`. `indeterminate` therefore means
+        // "the pid EXISTS but the `ps` identity probe failed" — and the probe is a
+        // fork+exec, so it fails exactly when the host is out of memory (ENOMEM)
+        // or thrashing (>2s timeout). Those failures are CORRELATED and
+        // persistent, not transient: under sustained OOM every guard read went
+        // `indeterminate`, every daemon grace window relaunched a broker whose
+        // predecessor was still alive, and `recordPid` below overwrote the row's
+        // pid — leaking each older broker untracked. That compounded to 7 live
+        // engines on one node (35 total on the home), which itself sustained the
+        // OOM that kept the probes failing. Relaunching on uncertainty is
+        // self-amplifying in precisely the regime where uncertainty occurs.
+        //
+        // The cost of no-opping on `indeterminate` is bounded and small: the only
+        // dead-but-indeterminate cases are a zombie or a reused pid whose `ps`
+        // probe failed — both re-read next daemon tick, and read `dead` the
+        // moment a probe succeeds. `isRecordedPidAlive` is the exact adapter for
+        // this direction (false ONLY on confirmed `dead`).
         const live = getNode(nodeId) ?? meta;
-        if (recordedPidLiveness(live.pi_pid, live.pi_pid_identity) === 'alive') {
+        if (isRecordedPidAlive(live.pi_pid, live.pi_pid_identity)) {
             return {
                 window: null,
                 session: live.tmux_session ?? null,

package/dist/core/view/__tests__/transport-remote.test.js

@@ -25,8 +25,12 @@ function startStalledServer() {
         });
     });
 }
-test('a stalled endpoint returns a timeout failure within the configured bound instead of hanging forever', async () => {
+test('a stalled endpoint returns a timeout failure within the configured bound instead of hanging forever', async (t) => {
     const server = await startStalledServer();
+    // Register the close BEFORE any assertion runs — a listening server left
+    // open by a thrown assertion keeps this test file's process alive forever
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => server.close());
     const exec = createRemoteExec(server.url, 'tok', 100); // small timeout for the test
     const started = Date.now();
     // Race against a generous outer deadline: if the transport doesn't
@@ -40,9 +44,8 @@ test('a stalled endpoint returns a timeout failure within the configured bound i
     assert.equal(result.ok, false);
     assert.match(result.stderr, /timeout/i);
     assert.ok(elapsed < 1000, `expected the timeout to fire near the configured 100ms bound, took ${elapsed}ms`);
-    await server.close();
 });
-test('a normal fast response is unaffected by the timeout wiring', async () => {
+test('a normal fast response is unaffected by the timeout wiring', async (t) => {
     const server = createServer((req, res) => {
         const chunks = [];
         req.on('data', (c) => chunks.push(c));
@@ -51,6 +54,7 @@ test('a normal fast response is unaffected by the timeout wiring', async () => {
             res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
         });
     });
+    t.after(() => new Promise((r) => server.close(() => r())));
     await new Promise((r) => server.listen(0, '127.0.0.1', r));
     const addr = server.address();
     const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
@@ -58,7 +62,6 @@ test('a normal fast response is unaffected by the timeout wiring', async () => {
     const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
     assert.equal(result.ok, true);
     assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-    await new Promise((r) => server.close(() => r()));
 });
 // --- Phase 3 review Minor 1: no token bytes may ever reach returned stderr ---
 test('an unreachable endpoint returns a flat generic network-error message, never the raw exception text', async () => {
@@ -75,7 +78,7 @@ test('a malformed token (contains a newline) is rejected up front with a generic
     assert.ok(!result.stderr.includes('bad\ntoken'));
     assert.ok(!result.stderr.includes('bad'));
 });
-test('a valid token containing typical bearer-token punctuation (-, _, .) still round-trips against a real server', async () => {
+test('a valid token containing typical bearer-token punctuation (-, _, .) still round-trips against a real server', async (t) => {
     const server = createServer((req, res) => {
         const chunks = [];
         req.on('data', (c) => chunks.push(c));
@@ -84,6 +87,7 @@ test('a valid token containing typical bearer-token punctuation (-, _, .) still
             res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
         });
     });
+    t.after(() => new Promise((r) => server.close(() => r())));
     await new Promise((r) => server.listen(0, '127.0.0.1', r));
     const addr = server.address();
     const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
@@ -91,5 +95,4 @@ test('a valid token containing typical bearer-token punctuation (-, _, .) still
     const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
     assert.equal(result.ok, true);
     assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-    await new Promise((r) => server.close(() => r()));
 });

package/dist/daemon/crtrd-cli.d.ts

@@ -1 +1 @@
-export {};
+import '../suppress-experimental-warnings.js';

package/dist/daemon/crtrd-cli.js

@@ -1,4 +1,5 @@
 // crtrd entry point — spawned detached by `crtr sys daemon start` and by bin/crtrd.
 // Calls runDaemon() and never returns (the loop drives via setTimeout).
+import '../suppress-experimental-warnings.js';
 import { runDaemon } from './crtrd.js';
 runDaemon();

package/dist/suppress-experimental-warnings.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/suppress-experimental-warnings.js

@@ -0,0 +1,15 @@
+const originalEmit = process.emit;
+process.emit = function (name, ...args) {
+    const [data] = args;
+    if (name === 'warning' &&
+        data instanceof Error &&
+        data.name === 'ExperimentalWarning' &&
+        data.message.includes('SQLite')) {
+        return false;
+    }
+    return originalEmit.apply(this, [
+        name,
+        ...args,
+    ]);
+};
+export {};

package/dist/types.js

@@ -57,12 +57,12 @@ export function defaultKindsConfig() {
         },
         explore: {
             whenToUse: 'Map unfamiliar code or architecture — read-only orientation and code-path research with concrete file:line evidence. Anything diagnostic — investigating a failure, why something is broken or misbehaving, or live/runtime behavior — is advisor, not explore.',
-            model: 'anthropic/light',
+            model: 'openai/light',
         },
         developer: {
             whenToUse: 'Implement a change — make the feature or fix genuinely work against its acceptance criteria, not merely compile.',
-            model: 'anthropic/medium',
-            orchestratorModel: 'anthropic/strong',
+            model: 'openai/medium',
+            orchestratorModel: 'openai/strong',
         },
         design: {
             whenToUse: 'Architect a solution — produce one design document an implementer can build from without re-deciding anything left open.',
@@ -150,15 +150,15 @@ export function defaultModelLaddersConfig() {
     return {
         anthropic: {
             ultra: 'anthropic/claude-fable-5:high',
-            strong: 'anthropic/claude-opus-4-8:high',
-            medium: 'anthropic/claude-sonnet-5:high',
-            light: 'anthropic/claude-haiku-4-5:high',
+            strong: 'anthropic/claude-fable-5:medium',
+            medium: 'anthropic/claude-opus-4-8:high',
+            light: 'anthropic/claude-sonnet-5:high',
         },
         openai: {
-            ultra: 'openai-codex/gpt-5.5:xhigh',
-            strong: 'openai-codex/gpt-5.5:high',
-            medium: 'openai-codex/gpt-5.5:medium',
-            light: 'openai-codex/gpt-5.3-codex-spark',
+            ultra: 'openai-codex/gpt-5.6-sol:max',
+            strong: 'openai-codex/gpt-5.6-sol:high',
+            medium: 'openai-codex/gpt-5.6-terra:medium',
+            light: 'openai-codex/gpt-5.6-luna:low',
         },
     };
 }