@north-light/crouter 0.3.154

package/dist/core/__tests__/live-lifecycle-prompt.test.js

@@ -0,0 +1,51 @@
+// Regression for #244: the document corpus is session-cached, but the gate
+// subject must follow a live node lifecycle change in that same session.
+import { after, before, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, updateNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { renderPreferencesSection } from '../substrate/render-node.js';
+import { clearSessionCache } from '../substrate/session-cache.js';
+let home;
+function node(id) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: process.cwd(),
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'resident',
+        status: 'active',
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-live-lifecycle-prompt-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    clearSessionCache();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    clearSessionCache();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('a cached resident prompt becomes terminal after a live lifecycle change', () => {
+    createNode(node('live'));
+    const resident = renderPreferencesSection('live');
+    assert.match(resident, /You are \*\*resident\*\* and interactable/);
+    assert.match(resident, /Do \*\*not\*\* `crtr push final`/);
+    updateNode('live', { lifecycle: 'terminal' });
+    const terminal = renderPreferencesSection('live');
+    assert.match(terminal, /You are \*\*terminal\*\*: you owe a final result/);
+    assert.match(terminal, /crtr push final/);
+    assert.doesNotMatch(terminal, /You are \*\*resident\*\* and interactable/);
+    assert.doesNotMatch(terminal, /Do \*\*not\*\* `crtr push final`/);
+});

package/dist/core/__tests__/live-mutation-verbs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/live-mutation-verbs.test.js

@@ -0,0 +1,195 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/live-mutation-verbs.test.ts
+//
+// HEADLESS RETARGET (foundation-spec §C.11 + §E). AXIS: LIVE MUTATION, part 2 —
+// the demote/recycle verb split and the A4 yield-mode boundary, driven
+// against FABRICATED broker-hosted (paneless) nodes — no real tmux session, no
+// pane chrome, and NO real broker boot. Split out of live-mutation.test.ts for
+// node:test file-level parallelism; each test holds its OWN isolated harness.
+//
+// THREE-PART LOCK HEADER ──────────────────────────────────────────────────
+// (1) BUG LOCKED — the demote/recycle SPLIT and the A4 yield-mode boundary:
+//     • `node lifecycle demote` flips lifecycle→TERMINAL IN PLACE — keeps MODE, parentage,
+//       and a live (active) status; NOT finalized. It is NOT a mode flip.
+//     • `node lifecycle recycle` is FINISH+RECYCLE — pushes a final → done (mode KEPT), and
+//       mints a DIFFERENT fresh general/base/resident root.
+//     • A4: a PLAIN `node yield` on a base node is MODE-PRESERVING — no auto-
+//       promote, no roadmap seeded, no persona_ack drift — it just sets
+//       intent=refresh. `node yield --promote` is the explicit opt-in that
+//       rides the promote() path (mode→orchestrator + roadmap seeded), and
+//       because its agent_end goes straight to the refresh-revive with NO
+//       preceding turn_end, the persona-drift steer that promotion would have
+//       queued is never delivered (ack left PENDING).
+// (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — demote writes lifecycle on the row
+//     (setLifecycle→updateNode); recycle's FINISH+MINT half is pushFinal +
+//     spawnNode (pure model) — only its pane-respawn is tmux (a deliberately-
+//     skipped artifact here, recycled:false). yield's mode flip (or lack of
+//     one) + intent set are row writes; persona_ack/personaDrift are pure. No
+//     pane is read for any assertion.
+// (3) HOW THE HEADLESS DRIVE STILL FAILS IF THE FIX REGRESSES — if demote also
+//     flipped MODE, the 'mode stays orchestrator' assert goes RED; if recycle
+//     re-roled instead of finishing, 'recycled node → done' / 'fresh root born
+//     base×resident' go RED; if a plain yield auto-promoted, the A4 'plain
+//     yield preserves mode' assert goes RED; if `--promote` failed to flip mode
+//     or seed a roadmap, or if it committed the ack itself, the A4 'yield
+//     --promote' asserts go RED.
+//
+// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi so the
+// REAL stophook enacted recycle's viewer teardown and A4's refresh-revive ack-drain
+// at agent_end. Fabrication cannot run those hooks. So: recycle is driven through
+// the real recycleNode (its FINISH+MINT model half runs fully; the pane respawn
+// is the only tmux artifact, intentionally skipped → recycled:false). For A4 the
+// PURE pre-stop facts are asserted (mode preserved on a plain yield; mode flip +
+// roadmap seeded + ack PENDING on `--promote`); the ack-commit-at-refresh-drain
+// is locked by persona.test.ts ('… then clears on commit'), and the steer-bypass
+// follows because no turn_end ever fires on the yield path.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from './helpers/harness.js';
+import { subscribe } from '../canvas/canvas.js';
+import { recycleNode } from '../runtime/recycle.js';
+import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
+import { hasRoadmap } from '../runtime/roadmap.js';
+/** Normalize the two persona axes off a NodeMeta for deepEqual. */
+function persona(m) {
+    return { mode: m.mode, lifecycle: m.lifecycle };
+}
+const FULL_CLI_TEST_TIMEOUT_MS = 180_000;
+// ===========================================================================
+// (b) THE demote / recycle SPLIT — two DISTINCT verbs:
+//   • `node lifecycle demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
+//     its MODE and parentage, keeps running (active), is NOT finalized; it now
+//     merely owes a final up the spine (vision F5). MODE is untouched.
+//   • `node lifecycle recycle` is FINISH+RECYCLE — push final → done, then recycle the pane
+//     into a FRESH general/base/resident root (a DIFFERENT node). The recycled
+//     node keeps mode=orchestrator (it is merely `done`).
+// This test drives demote via the real CLI verb and recycle via the real
+// recycleNode, pinning each behavior at the model layer.
+// ===========================================================================
+test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle recycle is FINISH+RECYCLE', 
+// Drives several full-CLI subprocess spawns (each a cold tsx compile of the
+// whole CLI) + recycleNode; this is a subprocess-heavy regression and gets a
+// CI-safe per-test budget while the npm script isolates it at file concurrency 1.
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-demote' });
+    try {
+        const A = h.spawnRoot('resident root');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        // Make B resident + orchestrator so the demote's flip→terminal is visible
+        // and we can prove MODE/parentage survive it.
+        assert.equal(h.cli(B, ['node', 'config', '--lifecycle', 'resident', '--node', B]).code, 0, 'B → resident');
+        assert.equal(h.cli(B, ['node', 'promote', '--kind', 'developer']).code, 0, 'promote B');
+        {
+            const b = h.node(B);
+            assert.equal(b.lifecycle, 'resident', 'B resident before demote');
+            assert.equal(b.mode, 'orchestrator', 'B orchestrator before demote');
+        }
+        const bParent = h.node(B).parent;
+        // --- node lifecycle demote: flip-to-terminal IN PLACE. Keeps B alive, MODE/parentage
+        //     untouched, NOT finalized.
+        const dem = h.cli(B, ['node', 'lifecycle', 'demote', '--node', B]);
+        assert.equal(dem.code, 0, `node lifecycle demote exit 0\n${dem.stderr}`);
+        assert.match(dem.stdout, /^Demoted /, `demote rendered\n${dem.stdout}`);
+        {
+            const b = h.node(B);
+            assert.equal(b.lifecycle, 'terminal', 'demote flips lifecycle→terminal IN PLACE');
+            assert.equal(b.mode, 'orchestrator', 'demote leaves MODE untouched (not an orchestrator→base flip)');
+            assert.equal(b.parent, bParent, 'demote leaves parentage unchanged');
+            assert.equal(b.status, 'active', 'demote does NOT finish B — it keeps running in place');
+            assert.notEqual(b.intent ?? null, 'done', 'demote does NOT finalize B');
+        }
+        // --- node lifecycle recycle: FINISH + RECYCLE. Driven through the real recycleNode.
+        //     Its FINISH+MINT model half runs fully; the pane respawn is the only
+        //     tmux artifact (no pane for a broker node), so recycled:false while
+        //     finalized:true and a fresh root IS minted — the bug-lock (recycle ≠
+        //     demote) is entirely in that model half.
+        const res = await recycleNode(B, '%recycle-headless');
+        assert.equal(res.finalized, true, 'recycle pushed a final for the node (FINISH half ran)');
+        assert.ok(typeof res.newRoot === 'string' && res.newRoot !== B, 'a fresh root (≠ B) was minted');
+        // The recycled node is FINISHED, not mode-flipped.
+        {
+            const b = h.node(B);
+            assert.equal(b.status, 'done', 'recycled node → done (finished), NOT re-roled');
+            assert.equal(b.intent, 'done', 'intent=done (finalize), per the push-final path');
+            assert.equal(b.mode, 'orchestrator', 'recycled node KEEPS mode=orchestrator — recycle is NOT a mode flip');
+        }
+        // The fresh root is a DIFFERENT, BASE×RESIDENT node.
+        {
+            const fresh = h.node(res.newRoot);
+            assert.deepEqual(persona(fresh), { mode: 'base', lifecycle: 'resident' }, 'recycled root is born base×resident (general)');
+            assert.deepEqual(fresh.persona_ack, { mode: 'base', lifecycle: 'resident' }, 'fresh root born acked base×resident');
+            assert.equal(fresh.parent ?? null, null, 'the fresh root is a root (no parent)');
+        }
+    }
+    finally {
+        await h.dispose();
+    }
+});
+// ===========================================================================
+// (b) A4 BOUNDARY — plain yield is mode-preserving; `yield --promote` is the
+//     explicit one-step promotion + refresh. A plain yield sets intent=refresh
+//     only, leaves the base persona acknowledged, and does NOT seed a roadmap.
+//     With `--promote`, the mode flips and a roadmap is seeded; that promotion
+//     still leaves its persona drift pending, because agent_end goes STRAIGHT to
+//     refresh-revive with no preceding turn_end to deliver the steer.
+// ===========================================================================
+test('A4: a plain yield preserves base mode and does not seed a roadmap', 
+// Full-CLI subprocess spawn under load — see the sibling test's budget note.
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-a4-plain' });
+    try {
+        const A = h.spawnRoot('resident root');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        assert.equal(hasRoadmap(B), false, 'B has no roadmap before a plain yield');
+        const y = h.cli(B, ['node', 'yield', 'refresh against the original goal']);
+        assert.equal(y.code, 0, `node yield exit 0\n${y.stderr}`);
+        {
+            const b = h.node(B);
+            assert.equal(b.mode, 'base', 'plain yield preserves base mode');
+            assert.equal(b.intent, 'refresh', 'intent=refresh set by the yield');
+            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'plain yield leaves the acknowledged base persona unchanged');
+        }
+        assert.equal(hasRoadmap(B), false, 'plain yield does not seed a roadmap');
+        assert.equal(personaDrift(B), null, 'plain yield leaves no persona drift to steer');
+    }
+    finally {
+        await h.dispose();
+    }
+});
+test('A4: yield --promote flips base→orchestrator, seeds a roadmap, and leaves persona_ack pending', 
+// Full-CLI subprocess spawn under load — see the sibling test's budget note.
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-a4-promote' });
+    try {
+        const A = h.spawnRoot('resident root');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        assert.equal(hasRoadmap(B), false, 'B has no roadmap before yield --promote');
+        const y = h.cli(B, ['node', 'yield', '--promote', 'refresh as an orchestrator']);
+        assert.equal(y.code, 0, `node yield --promote exit 0\n${y.stderr}`);
+        {
+            const b = h.node(B);
+            assert.equal(b.mode, 'orchestrator', 'yield --promote flips base→orchestrator');
+            assert.equal(b.intent, 'refresh', 'intent=refresh set by the yield');
+            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'ack STILL base — promote/yield never commits it; only an injector or the refresh drain does');
+        }
+        assert.equal(hasRoadmap(B), true, 'yield --promote seeds a roadmap');
+        // THE A4 PENDING-DRIFT LOCK — the base→orchestrator guidance is left
+        // PENDING (personaDrift reports it) and is the ONLY thing the (bypassed)
+        // turn_end injector would have delivered as a steer. The ack's silent
+        // advance at the refresh drain — NOT via a steer — is locked by
+        // persona.test.ts; the steer is lost because no turn_end fires on this path.
+        {
+            const drift = personaDrift(B);
+            assert.ok(drift !== null, 'the orchestration guidance is PENDING after yield --promote (drift detected)');
+            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'pending drift → orchestrator×terminal');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the pending (lost) steer carries the orchestration guidance');
+        }
+    }
+    finally {
+        await h.dispose();
+    }
+});

package/dist/core/__tests__/live-mutation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/live-mutation.test.js

@@ -0,0 +1,197 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/live-mutation.test.ts
+//
+// HEADLESS RETARGET (foundation-spec §C.12 + §E). AXIS: LIVE MUTATION of the
+// 2×2 state vector (mode {base,orchestrator} × lifecycle {terminal,resident})
+// driven through the REAL `node config --lifecycle` / `node promote` CLI verbs against
+// FABRICATED broker-hosted (paneless) nodes — no real tmux session, no pane
+// chrome, and NO real broker boot. The mutation verbs and the decisions they
+// gate are host-independent model logic, so the file never pays the ~5s SDK-boot
+// cost. Every assertion reads the canvas data layer / a PURE decision function.
+//
+// THREE-PART LOCK HEADER ──────────────────────────────────────────────────
+// (1) BUG LOCKED — (a) a live lifecycle flip changes the idle-release decision:
+//     a resident node is NEVER forced dormant (suppressed), a terminal one with
+//     an active live sub IS legitimately awaiting (restored). (b) a live promote
+//     flips mode but leaves persona_ack PENDING for the injector — it never
+//     commits the ack itself.
+// (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — the flip writes lifecycle/mode on the
+//     row (updateNode) and the idle-release call is decided by the PURE
+//     evaluateStop (stop-guard.ts), which keys on lifecycle + active live subs,
+//     never on a pane. persona_ack lives in meta.json; personaDrift is pure. No
+//     pane/window is read anywhere.
+// (3) HOW THE HEADLESS DRIVE STILL FAILS IF THE FIX REGRESSES — (a) after the
+//     terminal→resident flip, evaluateStop(B) must read 'dormant' NOT 'awaiting';
+//     if the resident-suppression branch in stop-guard regresses (lifecycle
+//     ignored), B still has its active live sub to C so evaluateStop returns
+//     'awaiting' → the 'dormant' assert goes RED (verified by bug-injection
+//     below). (b) after promote, personaDrift(B) must still report base→
+//     orchestrator PENDING; if promote wrongly committed the ack, drift reads
+//     null → the pending-drift assert goes RED.
+//
+// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi turn so
+// the REAL stophook enacted the idle-release at agent_end and committed
+// persona_ack at turn_end. Fabrication cannot run those hooks. So this test
+// asserts the PURE decisions the hooks enact (evaluateStop / personaDrift) and
+// leaves the hook-commit proof to the already-pure siblings:
+//   • idle-release / resident-suppression commit at agent_end → canvas-stophook-
+//     agentend.test.ts ('natural stop while awaiting a live worker → idle-release'
+//     and '§5.1.7 resident attended … nothing happens').
+//   • persona_ack recompose at turn_end → persona.test.ts ('personaDrift detects
+//     base→orchestrator after promote, then clears on commit').
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createHeadlessHarness } from './helpers/harness.js';
+import { subscribe } from '../canvas/canvas.js';
+import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
+import { evaluateStop } from '../runtime/stop-guard.js';
+/** Normalize the two persona axes off a NodeMeta for deepEqual. */
+function persona(m) {
+    return { mode: m.mode, lifecycle: m.lifecycle };
+}
+const SIGNALS = { pushedFinal: false, askedHuman: false };
+// ===========================================================================
+// (a) LIFECYCLE FLIP — `crtr node config --lifecycle` on a LIVE node, both directions,
+//     observing the idle-release DECISION change. A round-trip on ONE node
+//     (terminal→resident→terminal) proves both directions: a flipped-resident
+//     node no longer idle-releases (evaluateStop → dormant); flipped-terminal it
+//     idle-releases again (evaluateStop → awaiting, on its active live sub).
+// ===========================================================================
+test('live lifecycle flip: terminal→resident suppresses idle-release; resident→terminal restores it', 
+// Full-CLI subprocess spawns under load — 20s blew on the slower CI runner
+// (passes fast locally); 60s = safe margin. Same class as live-mutation-verbs.
+{ timeout: 60_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-life' });
+    try {
+        // A (resident root) ─ B (base/terminal) ─ C (base/terminal). B holds an
+        // ACTIVE live sub to C → a TERMINAL B that stops is legitimately 'awaiting'
+        // and would idle-release. That live sub is the precondition that makes the
+        // resident-vs-terminal flip the ONLY variable in the stop decision.
+        const A = h.spawnRoot('resident root');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        const C = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        subscribe(B, C, true);
+        {
+            const b = h.node(B);
+            assert.deepEqual(persona(b), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
+            assert.equal(b.status, 'active', 'B active');
+            assert.equal(b.intent ?? null, null, 'B no intent');
+            assert.equal(h.status(C), 'active', 'C active — B holds a live sub to it');
+            assert.ok(h.subscriptions(B).some((s) => s.node_id === C && s.active), 'B subscribes_to C (active) — the awaiting precondition');
+        }
+        // BASELINE — as a TERMINAL node with the active live sub, B's stop is
+        // 'awaiting' (it would idle-release).
+        {
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'terminal B → allow');
+            assert.equal(stop.reason, 'awaiting', 'terminal B with an active live sub → awaiting (would idle-release)');
+        }
+        // --- FLIP 1: terminal → RESIDENT (live). Oracle §4: sets lifecycle + the
+        //     launch spec, status/intent UNTOUCHED. ---
+        {
+            const res = h.cli(B, ['node', 'config', '--lifecycle', 'resident', '--node', B]);
+            assert.equal(res.code, 0, `config --lifecycle resident exit 0\n${res.stderr}`);
+            const b = h.node(B);
+            assert.equal(b.lifecycle, 'resident', 'B → resident');
+            assert.equal(b.mode, 'base', 'mode UNCHANGED by a lifecycle flip (orthogonal axis)');
+            assert.equal(b.status, 'active', 'status UNTOUCHED by node config --lifecycle (oracle §4)');
+            assert.equal(b.intent ?? null, null, 'intent UNTOUCHED by node config --lifecycle (oracle §4)');
+        }
+        // THE SUPPRESSION LOCK — as RESIDENT, B's stop is 'dormant' (NOT awaiting):
+        // a resident node is never forced to submit a final, so it does NOT idle-
+        // release even though it still holds the SAME active live sub to C that
+        // would release a terminal node. evaluateStop is the PURE decision the
+        // stophook enacts (the actual no-release commit is locked by canvas-
+        // stophook-agentend §5.1.7). NON-VACUOUS: revert the resident branch in
+        // stop-guard and B reads 'awaiting' → this goes RED (see bug-injection).
+        {
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'resident B → allow');
+            assert.equal(stop.reason, 'dormant', 'resident B → dormant, NOT awaiting — idle-release SUPPRESSED by the live flip');
+        }
+        // --- FLIP 2: resident → TERMINAL (live), on the now-resident node. ---
+        {
+            const res = h.cli(B, ['node', 'config', '--lifecycle', 'terminal', '--node', B]);
+            assert.equal(res.code, 0, `config --lifecycle terminal exit 0\n${res.stderr}`);
+            const b = h.node(B);
+            assert.equal(b.lifecycle, 'terminal', 'B → terminal');
+            assert.equal(b.status, 'active', 'status still UNTOUCHED by the flip');
+            assert.equal(b.intent ?? null, null, 'intent still UNTOUCHED by the flip');
+        }
+        // THE RESTORE LOCK — terminal again, B's stop is 'awaiting' once more: the
+        // exact idle-release behavior the resident flip had suppressed.
+        {
+            const stop = evaluateStop(B, SIGNALS);
+            assert.equal(stop.action, 'allow', 'terminal B → allow');
+            assert.equal(stop.reason, 'awaiting', 'terminal B with the active live sub → awaiting AGAIN (idle-release RESTORED)');
+        }
+        assert.equal(h.status(C), 'active', 'C untouched throughout the round-trip');
+    }
+    finally {
+        await h.dispose();
+    }
+});
+// ===========================================================================
+// (b) MODE FLIP — promote: base → orchestrator on a LIVE node. The flip itself
+//     does NOT commit the persona ack; the turn_end injector recomposes (commits
+//     the ack + delivers the steer) on the next turn. The NEW assertions here
+//     are that promote leaves the ack PENDING (not committed) and personaDrift
+//     reports the exact base→orchestrator transition the injector would deliver —
+//     the model precondition of the recompose (whose commit is locked by
+//     persona.test.ts).
+// ===========================================================================
+test('live mode flip: promote base→orchestrator leaves persona_ack PENDING for the turn_end injector', 
+// Full-CLI subprocess spawn under load — see the sibling test's budget note.
+{ timeout: 60_000 }, async () => {
+    const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-mode' });
+    try {
+        const A = h.spawnRoot('resident root');
+        const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
+        subscribe(A, B, true);
+        // Born acked to its own persona (mirroring a real birth) → no spurious
+        // drift before the promote (invariant 11).
+        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        {
+            const b = h.node(B);
+            assert.deepEqual(persona(b), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
+            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'persona_ack born equal to the initial persona (invariant 11)');
+            assert.equal(personaDrift(B), null, 'no drift before the promote');
+        }
+        // PROMOTE (live): mode→orchestrator, lifecycle UNCHANGED, status/intent
+        // untouched (no transition). Crucially promote does NOT commit the ack —
+        // the drift is left PENDING for the injector.
+        {
+            const res = h.cli(B, ['node', 'promote', '--kind', 'developer']);
+            assert.equal(res.code, 0, `promote exit 0\n${res.stderr}`);
+            const b = h.node(B);
+            assert.equal(b.mode, 'orchestrator', 'B → orchestrator');
+            assert.equal(b.lifecycle, 'terminal', 'lifecycle UNCHANGED (promote is mode-only)');
+            assert.equal(b.status, 'active', 'status untouched by promote');
+            assert.equal(b.intent ?? null, null, 'intent untouched by promote');
+            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'promote does NOT commit the ack — drift left PENDING for the injector');
+        }
+        // THE PENDING-DRIFT LOCK — personaDrift(B) reports the exact base→
+        // orchestrator transition the turn_end injector would deliver as a steer
+        // (and then commit). NON-VACUOUS: if promote wrongly committed the ack,
+        // personaDrift reads null and the asserts below go RED. The actual delivery
+        // + commit (and its idempotence on a second turn) is locked by
+        // persona.test.ts ('… then clears on commit').
+        {
+            const drift = personaDrift(B);
+            assert.ok(drift !== null, 'a recompose is pending after the live promote');
+            assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
+            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator orchestration guidance');
+        }
+        // And the recompose IS the injector's job, committed at turn_end — modeled
+        // here by commitPersonaAck (what the injector calls), proving drift then
+        // clears (idempotent). The firing of that commit inside the live stophook
+        // is locked by persona.test.ts.
+        commitPersonaAck(B, { mode: 'orchestrator', lifecycle: 'terminal' });
+        assert.deepEqual(h.node(B).persona_ack, { mode: 'orchestrator', lifecycle: 'terminal' }, 'persona_ack recomposed to the new persona');
+        assert.equal(personaDrift(B), null, 'no fresh drift after the ack commit (idempotent recompose)');
+    }
+    finally {
+        await h.dispose();
+    }
+});

package/dist/core/__tests__/memory-index-render.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/memory-index-render.test.js

@@ -0,0 +1,60 @@
+// Regression: a directory INDEX is addressed through its extensionless resolver
+// identity, so the assembled memory tree must never display physical INDEX.md.
+// Run: node --import tsx/esm --test src/core/__tests__/memory-index-render.test.ts
+import { afterEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveMemoryDoc } from '../memory-resolver.js';
+import { resetScopeCache } from '../scope.js';
+import { renderPreferencesForSubject } from '../substrate/render.js';
+import { clearSessionCache } from '../substrate/session-cache.js';
+const tempDirs = [];
+function subject(cwd) {
+    return {
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        hasManager: false,
+        cwd,
+        scope: 'user',
+        orchestration: { depth: 0 },
+        profile: null,
+    };
+}
+afterEach(() => {
+    for (const dir of tempDirs.splice(0))
+        rmSync(dir, { recursive: true, force: true });
+    resetScopeCache();
+    clearSessionCache();
+});
+test('a nested plugin INDEX renders as the extensionless identifier memory read accepts', () => {
+    const previousHome = process.env.HOME;
+    const home = mkdtempSync(join(tmpdir(), 'crtr-memory-index-render-'));
+    tempDirs.push(home);
+    const pluginRoot = join(home, '.crouter', 'plugins', 'fixture');
+    const indexPath = join(pluginRoot, 'memory', 'nested', 'INDEX.md');
+    mkdirSync(join(pluginRoot, '.crouter-plugin'), { recursive: true });
+    mkdirSync(join(pluginRoot, 'memory', 'nested'), { recursive: true });
+    writeFileSync(join(pluginRoot, '.crouter-plugin', 'plugin.json'), JSON.stringify({ name: 'fixture', version: '0.1.0', description: 'fixture' }));
+    writeFileSync(indexPath, '---\nkind: preference\nsystem-prompt-visibility: name\nfile-read-visibility: none\n---\n');
+    process.env.HOME = home;
+    resetScopeCache();
+    clearSessionCache();
+    try {
+        const rendered = renderPreferencesForSubject(subject(home)).tree;
+        const identifier = 'fixture/nested/INDEX';
+        assert.match(rendered, /└─ INDEX$/m);
+        assert.doesNotMatch(rendered, /INDEX\.md/);
+        const read = resolveMemoryDoc(identifier);
+        assert.equal(read.path, indexPath);
+        assert.equal(read.name, identifier);
+    }
+    finally {
+        if (previousHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = previousHome;
+    }
+});

package/dist/core/__tests__/memory-resolver-precedence.test.d.ts

@@ -0,0 +1 @@
+export {};