@north-light/crouter 0.3.172 → 0.3.174

package/dist/core/__tests__/serial/subscription-delivery.test.js

@@ -0,0 +1,126 @@
+// Run with: npm run test:serial
+//
+// THE DAEMON WAKE HALF of delivery-vs-wake, on a graph >=2 levels deep. Routing
+// itself (active → inbox.jsonl, passive → passive.jsonl) is owned by
+// passive-subscription.test.ts; what this file owns is the decision ONE real
+// `superviseTick` makes on that routing: the ACTIVE subscriber of a finished
+// target is revived, the PASSIVE subscriber on the same target is not.
+//
+// HEADLESS / FABRICATED DRIVE (foundation-spec §C.15 + §E). All nodes are
+// broker-hosted (paneless), so the topology and dormant states are fabricated
+// directly rather than booted — a released broker's dormancy is an EXITED
+// process (status=idle, intent=idle-release, pi_pid dead). A daemon revive is
+// observed via getNode().cycles, which reviveNode bumps together with
+// transition('revive') BEFORE it spawns, so the model effect is instant.
+//
+// HOW IT FAILS IF THE SPLIT REGRESSES: after T's pushFinal, one h.tick() must
+// revive the ACTIVE subscriber B (cycles bumps, status→active) while the PASSIVE
+// subscriber P stays idle with cycles==0. If routing breaks, either B's entry
+// never reaches its inbox (the 2nd-pass gate finds nothing → B not revived) or P
+// gets an inbox entry and IS woken — both go red here.
+//
+// Graph (T is two hops under A):
+//        A  (resident root — the user's virtual front door)
+//        └── B  (terminal)         A→B active seed  ── ACTIVE subscriber of T
+//            ├── T  (terminal)     B→T active seed  ── THE TARGET (level 2)
+//            ├── K  (terminal)     B→K active seed  ── keepalive (stays active)
+//            └── P  (terminal)     B→P active seed  ── PASSIVE subscriber of T
+//                  P→T passive  (wired via subscribe(P,T,false))
+//                  P→K active   (the tie that legitimizes P's own release)
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { createHarness } from '../helpers/harness.js';
+import { closeDb } from '../../canvas/db.js';
+import { subscribe } from '../../canvas/canvas.js';
+import { pushFinal } from '../../feed/feed.js';
+import { passivePath } from '../../canvas/paths.js';
+// A pid reaped (dead) by the time spawnSync returns — a released broker's exited
+// process (the headless analog of a closed pane).
+function deadPid() {
+    const r = spawnSync('true', [], { stdio: 'ignore' });
+    return r.pid ?? 0x7ffffffe;
+}
+// LOCAL helper: read a node's PASSIVE accumulator (passive.jsonl) straight off
+// the data layer, mirroring the harness's own `inbox()` reader. The harness
+// exposes inbox() but NOT passive() — this fills that gap.
+function passive(nodeId) {
+    closeDb();
+    const path = passivePath(nodeId);
+    if (!existsSync(path))
+        return [];
+    return readFileSync(path, 'utf8').split('\n').filter(Boolean).map((line) => JSON.parse(line));
+}
+// `{node_id, active}` arrays → a stable comparable set of `id:active|passive`.
+function edgeSet(arr) {
+    return new Set(arr.map((e) => `${e.node_id}:${e.active ? 'active' : 'passive'}`));
+}
+test('one daemon tick revives the active subscriber of a finished target and leaves the passive one dormant', { timeout: 30_000 }, async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-subdeliv' });
+    try {
+        // ===================================================================
+        // Build the graph by FABRICATION (no boots). A is a resident root
+        // (inline, daemon-untouched); B/T/K/P are broker nodes whose liveness
+        // fields are set directly. Each parent→child spine edge is wired ACTIVE.
+        // ===================================================================
+        const A = h.spawnRoot('front door'); // resident root, active, no placement
+        // T (the target) and K (keepalive) are LIVE-active workers; B and P start
+        // already DORMANT (idle-released, broker exited = dead pid) — exactly the
+        // post-stop state the delivery split is judged against.
+        const T = h.fabricateBrokerNode({ status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-T' });
+        const K = h.fabricateBrokerNode({ status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-K' });
+        const B = h.fabricateBrokerNode({ status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: 'sess-B' });
+        const P = h.fabricateBrokerNode({ status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: 'sess-P' });
+        // Spine seeds: A→B, B→T, B→K, B→P all ACTIVE (subscriber, publisher).
+        subscribe(A, B, true);
+        subscribe(B, T, true);
+        subscribe(B, K, true);
+        subscribe(B, P, true);
+        // PASSIVE axis under test: P passively subscribes to T; P actively to K
+        // (the only tie that legitimizes P's own idle-release).
+        subscribe(P, T, false);
+        subscribe(P, K, true);
+        assert.deepEqual(edgeSet(h.subscribers(T)), new Set([`${B}:active`, `${P}:passive`]), 'T has B(active) + P(passive) as subscribers — the same-target split');
+        // Pre-push baseline: keepalive up, nothing delivered, nothing revived.
+        assert.equal(h.status(K), 'active', 'K active (keepalive holds P legitimately dormant)');
+        assert.equal(h.inbox(B).length, 0, 'B inbox empty before the push');
+        assert.equal(passive(P).length, 0, 'P passive accumulator empty before the push');
+        assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
+        assert.equal(h.node(P).cycles ?? 0, 0, 'P not yet revived');
+        // ===================================================================
+        // T FINISHES via the model layer — the precondition the daemon decides on:
+        // B's pointer lands in inbox.jsonl (the wake channel), P's in passive.jsonl.
+        // ===================================================================
+        await pushFinal(T, 'TARGET-FINAL-BODY: the worker completed');
+        closeDb();
+        assert.ok(h.inbox(B).find((e) => e.from === T && e.kind === 'final'), 'ACTIVE subscriber B: T-final pointer delivered to inbox.jsonl');
+        assert.equal(h.inbox(P).length, 0, 'PASSIVE subscriber P: inbox.jsonl stays empty (no wake channel)');
+        assert.equal(passive(P).length, 1, 'PASSIVE subscriber P: exactly one passive entry');
+        // ===================================================================
+        // The DAEMON decision pass. Its 2nd pass revives an idle-released node
+        // ONLY on an unseen INBOX entry. B has one (active) → REVIVED. P has none
+        // (its entry went to passive.jsonl) → stays idle. Decided in ONE tick.
+        // ===================================================================
+        await h.tick();
+        // ACTIVE subscriber: WOKEN — reviveNode bumped cycles + transition(revive).
+        {
+            const b = h.node(B);
+            assert.equal(b.cycles ?? 0, 1, 'ACTIVE subscriber B: daemon pass-2 REVIVED (cycles bumped to 1)');
+            assert.equal(b.status, 'active', 'B revive → active');
+            assert.equal(b.intent ?? null, null, 'B intent cleared by revive');
+        }
+        // PASSIVE subscriber: NOT WOKEN — the same tick did NOT revive P.
+        {
+            const p = h.node(P);
+            assert.equal(p.cycles ?? 0, 0, 'PASSIVE subscriber P: NOT revived (cycles still 0)');
+            assert.equal(p.status, 'idle', 'P STILL idle — daemon did NOT wake it');
+            assert.equal(p.intent, 'idle-release', 'P still intent=idle-release (untouched)');
+        }
+        assert.equal(passive(P).length, 1, "P's passive entry is still pending (drained only on its next message)");
+        assert.equal(h.inbox(P).length, 0, "P's inbox still empty");
+    }
+    finally {
+        await h.dispose();
+    }
+});

package/dist/core/__tests__/serial/tmux-surface.test.js

@@ -0,0 +1,256 @@
+// Run with: npm run test:serial
+//
+// STEP 2 of the placement/focus migration: guards on the tmux Surface (driver).
+//
+//   1. The §2.2 HARD DRIVER INVARIANT (GREEN now): every create/placement verb
+//      in the driver — after the broker-host cut gutted the engine-in-pane
+//      relocate verbs (U9 deleted swap-pane/break-pane/join-pane/move-pane),
+//      the survivors are new-window / split-window / respawn-pane — MUST pass an
+//      explicit `-t` target.
+//      Omitting `-t` lets tmux resolve against its GLOBAL current session, which
+//      can leak a pane into a user session — the exact unbidden-window bug this
+//      redesign kills. This guards the bug's blast radius and should pass today.
+//
+//   2. The §5.1 driver-import lint guard (ENFORCED as of Step 8): every other
+//      module reaches the driver through placement's re-exports or the
+//      tmux-chrome seam, so the only direct importers are placement.ts,
+//      placement-tmux.ts, tmux-chrome.ts, and tmux-bindings.ts.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, basename } from 'node:path';
+import { ensureSession } from '../../runtime/placement.js';
+import { installTmuxBindings } from '../../runtime/tmux-chrome.js';
+import { resolveKeybindings } from '../../keybindings/index.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SRC_ROOT = join(__dirname, '..', '..', '..'); // .../src
+const TMUX_DRIVER_TS = join(SRC_ROOT, 'core', 'runtime', 'tmux-driver.ts');
+/** The placement verbs the §2.2 invariant governs. (swap-pane/break-pane/
+ *  join-pane/move-pane were deleted with the engine-in-pane host in the broker
+ *  cut; kept in the match set so a regression that re-introduces an untargeted
+ *  one is still caught.) */
+const PLACEMENT_VERBS = [
+    'new-window',
+    'split-window',
+    'swap-pane',
+    'break-pane',
+    'join-pane',
+    'move-pane',
+    'respawn-pane',
+];
+/** The smallest `[ … ]` array literal that encloses `matchIdx`: scan back to the
+ *  nearest `[` (the array open — the verb is always its first element), then
+ *  forward with bracket-depth counting to the matching `]` (handles nested
+ *  arrays like splitWindow's `? [] : ['-h']`). Returns the array source slice. */
+function enclosingArray(src, matchIdx) {
+    let open = matchIdx;
+    while (open >= 0 && src[open] !== '[')
+        open--;
+    assert.ok(open >= 0, `no enclosing [ for the verb at index ${matchIdx}`);
+    let depth = 0;
+    for (let i = open; i < src.length; i++) {
+        if (src[i] === '[')
+            depth++;
+        else if (src[i] === ']') {
+            depth--;
+            if (depth === 0)
+                return src.slice(open, i + 1);
+        }
+    }
+    throw new Error('unbalanced [ ] while bracket-matching the verb array');
+}
+test('§2.2 driver invariant: every placement verb in tmux-driver.ts passes an explicit -t target', () => {
+    const src = readFileSync(TMUX_DRIVER_TS, 'utf8');
+    // Match only the QUOTED JS string forms (`'new-window'`, …) — these are real
+    // args-array elements; the jsdoc prose mentions the verbs unquoted / in
+    // backticks, so this never trips on a comment.
+    const re = new RegExp(`'(${PLACEMENT_VERBS.join('|')})'`, 'g');
+    let found = 0;
+    for (let m = re.exec(src); m !== null; m = re.exec(src)) {
+        found++;
+        const verb = m[1];
+        const arr = enclosingArray(src, m.index);
+        // The invariant is "name a specific tmux object, never fall back to the
+        // GLOBAL current one". `-t` targets a destination; `break-pane` (and the
+        // deleted swap/join/move-pane) instead name their SOURCE with `-s` — which
+        // satisfies the invariant identically. Accept either explicit target flag.
+        assert.ok(arr.includes(`'-t'`) || arr.includes(`'-s'`), `tmux verb '${verb}' is invoked WITHOUT an explicit -t/-s target — a latent ` +
+            `instance of the unbidden-window bug (§2.2). Offending args array:\n${arr}`);
+    }
+    // Sanity: the driver really does contain placement verbs (so a refactor that
+    // renames them can't make this assertion vacuously pass). The broker cut left
+    // three (new-window / split-window / respawn-pane).
+    assert.ok(found >= 3, `expected to scan ≥3 placement verbs, saw ${found}`);
+});
+// ---------------------------------------------------------------------------
+// Lint guard — §5.1, ENFORCED. The driver (tmux-driver.ts) is imported only by
+// placement.ts, placement-tmux.ts, tmux-chrome.ts, and tmux-bindings.ts. Every
+// other module — runtime, daemon, commands, stophook, and tests — must route
+// through those sanctioned seams.
+// ---------------------------------------------------------------------------
+/** Every `.ts` file under `src` (recursively), excluding nothing. */
+function allTsFiles(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const p = join(dir, entry);
+        if (statSync(p).isDirectory())
+            out.push(...allTsFiles(p));
+        else if (entry.endsWith('.ts'))
+            out.push(p);
+    }
+    return out;
+}
+/** Files (basename) sanctioned to import the driver, per §2.1. */
+const ALLOWED_IMPORTERS = new Set(['placement.ts', 'placement-tmux.ts', 'tmux-chrome.ts', 'tmux-bindings.ts']);
+function importsDriver(file) {
+    const src = readFileSync(file, 'utf8');
+    // A specifier whose basename is exactly `tmux-driver.js` (so
+    // `tmux-bindings.js` is not matched). Covers `from '...'` and `import('...')`.
+    return [...src.matchAll(/(?:from|import\s*\()\s*'([^']+)'/g)].some((m) => basename(m[1]) === 'tmux-driver.js');
+}
+test('§5.1 lint: only sanctioned seams import the tmux driver', () => {
+    const offenders = allTsFiles(SRC_ROOT)
+        .filter((f) => !ALLOWED_IMPORTERS.has(basename(f)))
+        .filter(importsDriver)
+        .map((f) => f.slice(SRC_ROOT.length + 1));
+    assert.deepEqual(offenders, [], `modules importing tmux-driver.ts directly: ${offenders.join(', ')}`);
+});
+function isolatedTmux(socket, args) {
+    const result = spawnSync('tmux', ['-S', socket, ...args], { encoding: 'utf8' });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+function tmuxBinding(socket, table, key) {
+    const result = isolatedTmux(socket, ['list-keys', '-T', table]);
+    if (result.status !== 0)
+        return null;
+    return result.stdout.split('\n').find((line) => {
+        const match = line.match(/^bind-key\s+(?:-r\s+)?-T\s+\S+\s+(\S+)\s+/);
+        return match?.[1] === key;
+    }) ?? null;
+}
+test('tmux repairs corrupt bracketed-paste caps without replacing user overrides', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-bracketed-paste-${process.pid}-${Date.now()}`;
+    // `-f /dev/null`: boot a config-less isolated server so these binding tests are
+    // hermetic. Without it the server sources the developer's ~/.tmux.conf, whose
+    // own root-table bindings (e.g. M-j) pre-occupy keys these tests rebind onto —
+    // the installer then correctly refuses to clobber the foreign binding and the
+    // assertion fails on the dev's machine but not on a config-less CI runner.
+    const boot = spawnSync('tmux', ['-L', name, '-f', '/dev/null', 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socket = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' }).stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    process.env['TMUX'] = `${socket},1,0`;
+    try {
+        assert.equal(isolatedTmux(socket, ['set-option', '-s', 'terminal-overrides', 'xterm*:Tc']).status, 0);
+        assert.equal(isolatedTmux(socket, ['set-option', '-sga', 'terminal-overrides', '*:Enbp=E[?2004h:Dsbp=E[?2004l']).status, 0);
+        ensureSession('test', process.cwd());
+        const repaired = isolatedTmux(socket, ['show-options', '-s', 'terminal-overrides']);
+        assert.equal(repaired.status, 0, repaired.stderr);
+        assert.match(repaired.stdout, /xterm\*:Tc/, 'unrelated user override must remain');
+        assert.match(repaired.stdout, /Enbp=\\+E\[\?2004h/, 'a valid Enbp override must be appended');
+        ensureSession('test', process.cwd());
+        assert.equal(isolatedTmux(socket, ['show-options', '-s', 'terminal-overrides']).stdout, repaired.stdout, 'valid Enbp must make the repair idempotent');
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});
+test('tmux installer remaps owned pairs and preserves occupied user bindings', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-keybindings-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, '-f', '/dev/null', 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socketResult = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' });
+    const socket = socketResult.stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    process.env['TMUX'] = `${socket},1,0`;
+    try {
+        const first = installTmuxBindings(resolveKeybindings());
+        assert.equal(first.ok, true, JSON.stringify(first.diagnostics));
+        assert.ok(first.installed.some((pair) => pair.table === 'root' && pair.key === 'M-]'));
+        const defaultMenu = tmuxBinding(socket, 'root', 'M-c') ?? '';
+        assert.match(defaultMenu, /display-menu/);
+        // The inbox toggle installs at its default key (alt+i → M-i) in the same sweep.
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
+        const remapped = installTmuxBindings(resolveKeybindings({
+            'crtr.tmux.menu.open': ['alt+shift+z'],
+            'crtr.tmux.menu.graph': ['shift+z'],
+            'crtr.tmux.menu-global.fold-tools': ['alt+shift+f'],
+            'crtr.tmux.node.next': [],
+        }));
+        assert.equal(remapped.ok, true, JSON.stringify(remapped.diagnostics));
+        assert.equal(tmuxBinding(socket, 'root', 'M-c'), null);
+        assert.equal(tmuxBinding(socket, 'root', 'M-]'), null);
+        assert.equal(tmuxBinding(socket, 'root', 'M-F'), null);
+        assert.equal(tmuxBinding(socket, 'root', 'M-S-f'), null);
+        const foldTools = tmuxBinding(socket, 'root', 'M-S-F') ?? '';
+        assert.match(foldTools, /fold-tools/);
+        assert.doesNotMatch(foldTools, /#\{pane_id\}/);
+        const menu = tmuxBinding(socket, 'root', 'M-S-Z') ?? '';
+        assert.match(menu, /canvas graph/);
+        assert.match(menu, /Z/);
+        assert.match(menu, /"Alt\+Shift\+Z to close" M-S-Z refresh-client/);
+        const again = installTmuxBindings(resolveKeybindings({
+            'crtr.tmux.menu.open': ['alt+shift+y'],
+            'crtr.tmux.node.next': [],
+        }));
+        assert.equal(again.ok, true, JSON.stringify(again.diagnostics));
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-S-Z', 'display-message', 'user-owned']);
+        const occupied = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.menu.open': ['alt+shift+z'] }));
+        assert.equal(occupied.ok, true);
+        assert.ok(occupied.diagnostics.some((diagnostic) => diagnostic.code === 'occupied' && diagnostic.bindingId === 'crtr.tmux.menu.open'));
+        assert.match(tmuxBinding(socket, 'root', 'M-S-Z') ?? '', /user-owned/);
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});
+test('tmux installer reads pair-array manifests and replaces owned pairs', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-pair-manifest-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, '-f', '/dev/null', 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socket = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' }).stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    process.env['TMUX'] = `${socket},1,0`;
+    try {
+        // Current-scope releases wrote the pair array before wrappers were added.
+        isolatedTmux(socket, ['set-option', '-s', '@crtr_keybindings_manifest', JSON.stringify([{ table: 'root', key: 'M-i' }])]);
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-i', 'run-shell', '-b', 'crtr human inbox toggle --quiet']);
+        const result = installTmuxBindings(resolveKeybindings());
+        assert.equal(result.ok, true, JSON.stringify(result.diagnostics));
+        assert.ok(!result.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(result.diagnostics));
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /background running bash/);
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});

package/dist/core/__tests__/{worktree.test.js → serial/worktree.test.js}

@@ -4,11 +4,11 @@ import { mkdtempSync, mkdirSync, rmSync, existsSync, readdirSync, statSync, writ
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { gitSync } from '../git.js';
-import { push } from '../feed/feed.js';
-import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree, setWorktreeCleanupRunnerForTest } from '../worktree.js';
-import { createNode, getNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { gitSync } from '../../git.js';
+import { push } from '../../feed/feed.js';
+import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree, setWorktreeCleanupRunnerForTest } from '../../worktree.js';
+import { createNode, getNode } from '../../canvas/canvas.js';
+import { closeDb } from '../../canvas/db.js';
 let home;
 let remoteDir;
 let sourceDir;
@@ -93,7 +93,7 @@ test('closeManagedWorktree recreates the worktree path as a tombstone dir so the
     assert.equal(meta?.cwd, wt.repo_root, 'closed node cwd must repoint to the repo root, not the removed worktree path');
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
-    const worktreeModule = new URL('../worktree.ts', import.meta.url).href;
+    const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;
     const createFrom = (cwd, nodeId) => new Promise((resolve, reject) => {
         const script = `import { createManagedWorktree } from ${JSON.stringify(worktreeModule)}; createManagedWorktree(${JSON.stringify(cwd)}, ${JSON.stringify(nodeId)});`;
         const child = spawn(process.execPath, ['--import', 'tsx/esm', '--input-type=module', '--eval', script], { env: { ...process.env, CRTR_HOME: home }, stdio: 'pipe' });
@@ -410,7 +410,7 @@ test('close still blocks on real .crouter/memory/ work — a tracked-file edit a
 // (autoDropCleanManagedWorktree) must close it without requiring an explicit
 // `node worktree close`.
 test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../worktree.js');
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const nodeId = 'wt-auto-drop-empty';
     const wt = createManagedWorktree(sourceDir, nodeId);
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
@@ -435,7 +435,7 @@ test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async (
 // The same real-commit case close already protects: a worktree with actual
 // unlanded work must NEVER be auto-dropped by push-final.
 test('autoDropCleanManagedWorktree refuses a worktree with a real commit ahead of base', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../worktree.js');
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const nodeId = 'wt-auto-drop-real-work';
     const wt = createManagedWorktree(sourceDir, nodeId);
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
@@ -450,7 +450,7 @@ test('autoDropCleanManagedWorktree refuses a worktree with a real commit ahead o
 // Real uncommitted (non-crtr-bookkeeping) changes must also refuse auto-drop,
 // even with zero commits.
 test('autoDropCleanManagedWorktree refuses a worktree with real uncommitted changes', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../worktree.js');
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const nodeId = 'wt-auto-drop-dirty';
     const wt = createManagedWorktree(sourceDir, nodeId);
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
@@ -465,7 +465,7 @@ test('autoDropCleanManagedWorktree refuses a worktree with real uncommitted chan
 // ever going through crtr's own close path). This must auto-drop and, above
 // all, must never lose the work — it stays reachable from the moved base.
 test('autoDropCleanManagedWorktree drops a branch with real commits already contained in a moved base (#327)', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../worktree.js');
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-327-'));
     run(['init', '-b', 'main'], repo);
     run(['config', 'user.email', 'test@example.com'], repo);
@@ -498,7 +498,7 @@ test('autoDropCleanManagedWorktree drops a branch with real commits already cont
 // auto-drop rather than guess — the SAME guard `resolveLandableBase` already
 // gives the explicit close path.
 test('autoDropCleanManagedWorktree refuses when the recorded base branch no longer resolves', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../worktree.js');
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-missingbase-'));
     run(['init', '-b', 'main'], repo);
     run(['config', 'user.email', 'test@example.com'], repo);
@@ -531,7 +531,7 @@ test('autoDropCleanManagedWorktree refuses when the recorded base branch no long
 // compare-and-delete must refuse, leaving the branch (and the new commit)
 // fully intact.
 test('the atomic delete refuses when a commit lands on the branch between the predicate and cleanup', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../worktree.js');
+    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
     const nodeId = 'wt-race-branch-commit';
     const wt = createManagedWorktree(sourceDir, nodeId);
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
@@ -561,7 +561,7 @@ test('the atomic delete refuses when a commit lands on the branch between the pr
 // before the delete must catch this even though the branch itself never
 // moved.
 test('the re-verified base containment refuses when the base is rewritten between the predicate and cleanup', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../worktree.js');
+    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-race-base-'));
     run(['init', '-b', 'main'], repo);
     run(['config', 'user.email', 'test@example.com'], repo);
@@ -605,7 +605,7 @@ test('the re-verified base containment refuses when the base is rewritten betwee
 // to reproduce this exact Critical against `6de1c8d`.
 // ---------------------------------------------------------------------------
 test('auto-drop atomic delete refuses when the base is force-reset between the live ancestry check and the ref transaction', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../worktree.js');
+    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-auto-drop-base-window-'));
     run(['init', '-b', 'main'], repo);
     run(['config', 'user.email', 'test@example.com'], repo);
@@ -717,7 +717,7 @@ PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
 // transaction, which bypasses Git's own checked-out-branch protection.
 // ---------------------------------------------------------------------------
 test('auto-drop refuses and preserves the branch and checkout when checkout removal is refused after the clean predicate', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../worktree.js');
+    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
     const nodeId = 'wt-auto-drop-removal-refused';
     const wt = createManagedWorktree(sourceDir, nodeId);
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));

package/dist/core/__tests__/session-model.test.js

@@ -94,24 +94,6 @@ test('a notify is never a dialog, and never disturbs one that is pending', () =>
     assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'other' }), asked);
     assert.equal(reduce(asked, { type: 'extension_ui_dismiss', id: 'ask-1' }).dialog, null);
 });
-test('frames that carry no session state return the SAME state reference', () => {
-    const s0 = reduce(initialSessionState(), welcome());
-    const inert = [
-        { type: 'error', code: 'read_only', message: 'read-only' },
-        { type: 'ack', for: 'get_commands', ok: true, detail: '[]' },
-        { type: 'bash_start', command: 'ls' },
-        { type: 'bash_output', chunk: 'a\n' },
-        { type: 'bash_end', exitCode: 0, cancelled: false, truncated: false },
-    ];
-    for (const f of inert) {
-        assert.equal(reduce(s0, f), s0, `${f.type} must not allocate a new state`);
-    }
-    // Slice identity is what viewers repaint off: an engine-only change must leave
-    // the display slice untouched by reference.
-    const started = reduce(s0, { type: 'agent_start' });
-    assert.notEqual(started, s0);
-    assert.equal(started.display, s0.display, 'an engine change must not dirty the display slice');
-});
 test('a welcome is a COMPLETE catch-up: a re-welcome drops a dead broker s levels and queue', () => {
     const s0 = fold(initialSessionState(), [
         welcome(),

package/dist/core/__tests__/spawn-worktree-id-conflict.test.js

@@ -57,3 +57,12 @@ test('a --worktree spawn at an already-existing node id throws and leaves NO wor
     assert.equal(getNode(nodeId).kind, 'general');
     assert.equal(getNode(nodeId).managed_worktree, undefined);
 });
+test('spawnNode({ nodeId }): a hyphen-less opaque id spawns at the exact given id', () => {
+    // Regression for the reviewed opaque-id-contract violation: the old validator
+    // required >=2 hyphen segments and rejected a hyphen-less id outright,
+    // contradicting the design's "opaque, never parsed for structure" ID scheme
+    // that remote and cloud spawns depend on.
+    const meta = spawnNode({ kind: 'general', cwd: '/tmp/work', nodeId: 'remote42' });
+    assert.equal(meta.node_id, 'remote42');
+    assert.notEqual(getNode('remote42'), null);
+});

package/dist/core/__tests__/watchdog-abort-arms-retry.test.js

@@ -0,0 +1,50 @@
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { FaultRetry } from '../runtime/broker/fault-retry.js';
+import { readFault } from '../runtime/fault.js';
+let home;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-watchdog-abort-retry-'));
+    process.env['CRTR_HOME'] = home;
+});
+after(() => {
+    rmSync(home, { recursive: true, force: true });
+});
+test('only a watchdog-stamped aborted settlement records an automatic connection fault', () => {
+    const settleAbort = (nodeId, stagedWatchdogAbort) => {
+        const session = {
+            sessionManager: { getLeafId: () => 'leaf-entry' },
+            model: undefined,
+        };
+        const generation = {
+            id: 1,
+            session,
+            fallback: { blocked: false },
+            stagedProviderAgentEnd: {
+                messages: [{ role: 'assistant', stopReason: 'aborted', errorMessage: 'Request was aborted' }],
+            },
+            stagedWatchdogAbort,
+            stagedOverflowFailure: null,
+            executingTools: new Set(),
+        };
+        const retry = new FaultRetry({
+            nodeId,
+            currentSession: () => session,
+            installedGeneration: () => generation,
+        });
+        retry.publishSettledProviderFault(generation);
+        return { retry, generation };
+    };
+    const watchdog = settleAbort('watchdog-node', true);
+    const fault = readFault('watchdog-node');
+    assert.equal(fault?.link, 'pi→provider');
+    assert.equal(fault?.kind, 'connection');
+    assert.deepEqual(fault?.retry, { disposition: 'auto', by: 'daemon' });
+    assert.equal(watchdog.retry.isActiveAutoFault(fault), true);
+    assert.equal(watchdog.generation.stagedWatchdogAbort, false, 'settlement consumes the one-shot provenance');
+    settleAbort('human-node', false);
+    assert.equal(readFault('human-node'), null, 'an otherwise-identical human abort must not arm recovery');
+});