@north-light/crouter 0.3.175 → 0.3.176

package/dist/core/profiles/manifest.d.ts

@@ -4,6 +4,15 @@ export declare function profilesRoot(): string;
 export declare function profileRoot(profileId: string): string;
 export declare function profileManifestPath(profileId: string): string;
 export declare function profileMemoryDir(profileId: string): string;
+/** The directory a node running under `profileId` is pinned to — the profile's
+ *  home, but only while it still exists on disk (a node pinned to a deleted dir
+ *  cannot boot). Null for the root profile, a profile with no projects, a home
+ *  that has since been deleted, and an unresolvable id.
+ *
+ *  This is the whole of the profile→cwd direction: cwd SELECTS a profile at the
+ *  front door, and the selected profile then SUPPLIES the node's cwd. Never
+ *  throws — it sits on the node-create path. */
+export declare function profileHome(profileId: string | null): string | null;
 export interface ProfileEntry {
     profileId: string;
     manifest: ProfileManifest;
@@ -30,6 +39,8 @@ export declare function ensureRootProfile(): ProfileEntry;
 export declare function createProfile(name: string, projects?: string[]): ProfileEntry;
 export declare function updateProfileLastUsed(profileId: string): ProfileEntry;
 export declare function renameProfile(profileId: string, name: string): ProfileEntry;
-export declare function addProfileProject(profileId: string, dir: string): ProfileEntry;
+export declare function addProfileProject(profileId: string, dir: string, opts?: {
+    home?: boolean;
+}): ProfileEntry;
 export declare function removeProfileProject(profileId: string, dir: string): ProfileEntry;
 export declare function deleteProfile(profileId: string): void;

package/dist/core/profiles/manifest.js

@@ -6,12 +6,13 @@
 // here, so no caller ever passes a raw CLI operand or `CRTR_PROFILE_ID`
 // straight into `join(profilesRoot(), value)`.
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { dirname, join, relative, resolve as resolvePath, sep } from 'node:path';
 import { SCHEMA_VERSION, PROFILE_DIR } from '../../types.js';
 import { userScopeRoot, resetScopeCache } from '../scope.js';
 import { ensureDir, nowIso } from '../fs-utils.js';
 import { usage, notFound, ambiguous, general } from '../errors.js';
+import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
 // ---------------------------------------------------------------------------
 // Path safety — the only code in the tree that builds a path under the
 // profiles root. Every other module reaches profile paths through this file.
@@ -73,11 +74,47 @@ export function profileMemoryDir(profileId) {
 // a profile id. Both walk immediate children of the canonical root; neither
 // ever joins an unvalidated operand into a path.
 // ---------------------------------------------------------------------------
-function readManifestFile(path) {
+/** A profile's `home` DEFAULTS to its first project dir. Normalizing here (the
+ *  single read path) rather than at write time means a manifest written before
+ *  homes existed, and one whose explicit home was later removed from purview,
+ *  both still answer with a usable home — no migration pass.
+ *
+ *  The root profile is the exception and never takes the default: it is the
+ *  identity a directory nothing covers falls back to, so its nodes belong where
+ *  the user started them, not in whatever dir was last added to its purview. */
+function normalizeHome(profileId, manifest) {
+    const stored = typeof manifest.home === 'string' && manifest.home !== '' ? manifest.home : null;
+    if (profileId === ROOT_PROFILE_ID)
+        return { ...manifest, home: stored };
+    return { ...manifest, home: stored ?? manifest.projects[0] ?? null };
+}
+function readManifestFile(path, profileId) {
     if (!existsSync(path))
         return null;
     try {
-        return JSON.parse(readFileSync(path, 'utf8'));
+        return normalizeHome(profileId, JSON.parse(readFileSync(path, 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+/** The directory a node running under `profileId` is pinned to — the profile's
+ *  home, but only while it still exists on disk (a node pinned to a deleted dir
+ *  cannot boot). Null for the root profile, a profile with no projects, a home
+ *  that has since been deleted, and an unresolvable id.
+ *
+ *  This is the whole of the profile→cwd direction: cwd SELECTS a profile at the
+ *  front door, and the selected profile then SUPPLIES the node's cwd. Never
+ *  throws — it sits on the node-create path. */
+export function profileHome(profileId) {
+    if (profileId === null || profileId === '')
+        return null;
+    try {
+        const { manifest } = loadProfileManifest(profileId);
+        const home = manifest.home;
+        if (home === null)
+            return null;
+        return existsSync(home) && statSync(home).isDirectory() ? home : null;
     }
     catch {
         return null;
@@ -99,7 +136,7 @@ export function listProfiles() {
         const profileId = dirent.name;
         if (!ID_SHAPE.test(profileId))
             continue;
-        const manifest = readManifestFile(join(root, profileId, 'profile.json'));
+        const manifest = readManifestFile(join(root, profileId, 'profile.json'), profileId);
         if (manifest === null)
             continue;
         out.push({ profileId, manifest });
@@ -142,55 +179,20 @@ export function loadProfileManifest(profileIdOrName) {
             : 'No profiles exist on this host yet — create one with `crtr profile new --name <name>`.',
     });
 }
-// ---------------------------------------------------------------------------
-// Locking — a plain mkdir-based mutex under `profilesRoot()/.locks/`. mkdir is
-// atomic (EEXIST when already held), so this needs no extra dependency. The
-// blocking wait uses Atomics.wait on a throwaway SharedArrayBuffer to stay
-// synchronous, matching every other sync fs call in this module.
-// ---------------------------------------------------------------------------
-const LOCK_TIMEOUT_MS = 5000;
-const LOCK_POLL_MS = 25;
 function locksDir() {
     return join(profilesRoot(), '.locks');
 }
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
 /** Hold the per-profile manifest lock for the duration of `fn`. ALL manifest
  *  mutations (create/rename/add-project/remove-project/delete/last-used)
  *  below run inside this. */
 export function withProfileManifestLock(profileId, fn) {
     assertSafeProfileId(profileId);
     ensureDir(locksDir());
-    const lockPath = join(locksDir(), `${profileId}.lock`);
-    const deadline = Date.now() + LOCK_TIMEOUT_MS;
-    for (;;) {
-        try {
-            mkdirSync(lockPath);
-            break;
-        }
-        catch (err) {
-            if (err.code !== 'EEXIST')
-                throw err;
-            if (Date.now() > deadline) {
-                throw general(`timed out waiting for the profile lock: ${profileId}`, {
-                    next: 'Retry — another `crtr profile` command may be running concurrently on this profile.',
-                });
-            }
-            sleepSync(LOCK_POLL_MS);
-        }
-    }
-    try {
-        return fn();
-    }
-    finally {
-        try {
-            rmSync(lockPath, { recursive: true, force: true });
-        }
-        catch {
-            /* best-effort release */
-        }
-    }
+    return withExclusiveDirectoryLock(join(locksDir(), `${profileId}.lock`), fn, {
+        timeoutError: () => general(`timed out waiting for the profile lock: ${profileId}`, {
+            next: 'Retry — another `crtr profile` command may be running concurrently on this profile.',
+        }),
+    });
 }
 function writeManifestAtomic(path, manifest) {
     ensureDir(dirname(path));
@@ -254,7 +256,7 @@ export function ensureRootProfile() {
     return withProfileManifestLock(ROOT_PROFILE_ID, () => {
         const manifestPath = profileManifestPath(ROOT_PROFILE_ID);
         const manifestExists = existsSync(manifestPath);
-        const manifest = manifestExists ? readManifestFile(manifestPath) : null;
+        const manifest = manifestExists ? readManifestFile(manifestPath, ROOT_PROFILE_ID) : null;
         if (manifestExists && manifest === null) {
             throw general(`root profile manifest is unreadable: ${manifestPath}`);
         }
@@ -267,6 +269,7 @@ export function ensureRootProfile() {
             schema_version: SCHEMA_VERSION,
             name: ROOT_PROFILE_NAME,
             projects: [],
+            home: null,
             created_at: nowIso(),
             last_used_at: nowIso(),
         };
@@ -286,6 +289,7 @@ export function createProfile(name, projects = []) {
             schema_version: SCHEMA_VERSION,
             name: trimmed,
             projects: resolvedProjects,
+            home: resolvedProjects[0] ?? null,
             created_at: nowIso(),
             last_used_at: null,
         };
@@ -307,7 +311,7 @@ function mutateManifest(profileId, mutate) {
     requireExistingProfile(profileId);
     return withProfileManifestLock(profileId, () => {
         const path = profileManifestPath(profileId);
-        const current = readManifestFile(path);
+        const current = readManifestFile(path, profileId);
         if (current === null) {
             throw notFound(`profile not found: ${profileId}`, { received: profileId });
         }
@@ -327,11 +331,12 @@ export function renameProfile(profileId, name) {
     resetScopeCache();
     return result;
 }
-export function addProfileProject(profileId, dir) {
+export function addProfileProject(profileId, dir, opts = {}) {
     const resolved = resolveExistingProjectDir(dir);
     const result = mutateManifest(profileId, (m) => ({
         ...m,
         projects: dedupeOrdered([...m.projects, resolved]),
+        ...(opts.home === true ? { home: resolved } : {}),
     }));
     resetScopeCache();
     return result;
@@ -351,13 +356,17 @@ export function removeProfileProject(profileId, dir) {
     }
     const result = mutateManifest(profileId, (m) => {
         const filtered = m.projects.filter((p) => p !== real && p !== abs);
+        // Dropping the home dir from purview falls the home back to the first
+        // remaining project, exactly as `normalizeHome` would for a manifest that
+        // never named one — never leaves the profile pointing outside its purview.
+        const home = m.home === real || m.home === abs ? filtered[0] ?? null : m.home;
         if (filtered.length === m.projects.length) {
             throw notFound(`project not found on profile: ${dir}`, {
                 received: dir,
                 next: `Current projects: ${m.projects.length > 0 ? m.projects.join(', ') : '(none)'}.`,
             });
         }
-        return { ...m, projects: filtered };
+        return { ...m, projects: filtered, home };
     });
     resetScopeCache();
     return result;

package/dist/core/review/store.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseSync } from 'node:sqlite';
-import type { NewReviewRow, ReviewRecord, ReviewState } from './types.js';
+import { type NewReviewRow, type ReviewRecord, type ReviewState } from './types.js';
 /** Fields written when an open review is conditionally approved. */
 export interface ApproveReviewArgs {
     review_id: string;
@@ -17,6 +17,9 @@ export declare function commitBindingReview(row: NewReviewRow): {
     won: boolean;
 };
 export declare function getReview(reviewId: string): ReviewRecord | null;
+/** The review `reviewId` names, for a caller that cannot proceed without one.
+ *  A `binding` row is still mid-creation and reads as absent. */
+export declare function requireVisibleReview(reviewId: string): ReviewRecord;
 export declare function getReviewByIdempotencyKey(key: string): ReviewRecord | null;
 export declare function getReviewByCompanion(nodeId: string): ReviewRecord | null;
 export declare function getReviewByBridge(nodeId: string): ReviewRecord | null;

package/dist/core/review/store.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { newNodeId } from '../runtime/nodes.js';
 import { openDb, withCanvasWrite } from '../canvas/db.js';
+import { ReviewOperationError, } from './types.js';
 function recordFromRow(raw) {
     return {
         review_id: raw['review_id'],
@@ -79,6 +80,15 @@ export function commitBindingReview(row) {
 export function getReview(reviewId) {
     return readRecord(openDb(), 'review_id = ?', reviewId);
 }
+/** The review `reviewId` names, for a caller that cannot proceed without one.
+ *  A `binding` row is still mid-creation and reads as absent. */
+export function requireVisibleReview(reviewId) {
+    const review = getReview(reviewId);
+    if (review === null || review.state === 'binding') {
+        throw new ReviewOperationError('unknown_review', 'review was not found', { received: reviewId });
+    }
+    return review;
+}
 export function getReviewByIdempotencyKey(key) {
     return readRecord(openDb(), 'idempotency_key = ?', key);
 }

package/dist/core/runtime/branded-host.js

@@ -21,12 +21,13 @@
 // (a `brew upgrade node` moves realpath(execPath) to a new Cellar version) or the
 // copy is missing. The drift check is a cheap marker compare — no subprocess, no
 // copy — on the happy path.
-import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, renameSync, realpathSync, unlinkSync, rmSync, statSync, linkSync, } from 'node:fs';
+import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, renameSync, realpathSync, unlinkSync, rmSync, linkSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { CRTR_DIR_NAME } from '../../types.js';
 import { emitEvent } from '../events/emit.js';
+import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
 /** The filename the FDA / TCC entry is shown under. */
 const BRANDED_BIN_NAME = 'crouter';
 /** Machine-global host dir. Deliberately NOT under `CRTR_HOME` (tests override
@@ -75,95 +76,16 @@ function readMarker(path = markerPath()) {
     }
 }
 const HOST_LOCK_TIMEOUT_MS = 30_000;
-const HOST_LOCK_POLL_MS = 25;
-const UNOWNED_LOCK_GRACE_MS = 1_000;
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === 'EPERM';
-    }
-}
-function reclaimDeadHostLock(lockPath) {
-    let reclaimable = false;
-    try {
-        const owner = JSON.parse(readFileSync(join(lockPath, 'owner.json'), 'utf8'));
-        reclaimable = typeof owner.pid === 'number' && !processIsAlive(owner.pid);
-    }
-    catch {
-        try {
-            reclaimable = Date.now() - statSync(lockPath).mtimeMs > UNOWNED_LOCK_GRACE_MS;
-        }
-        catch {
-            return true;
-        }
-    }
-    if (!reclaimable)
-        return false;
-    const stalePath = `${lockPath}.stale.${process.pid}.${Math.random().toString(36).slice(2)}`;
-    try {
-        renameSync(lockPath, stalePath);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return true;
-        return false;
-    }
-    rmSync(stalePath, { recursive: true, force: true });
-    return true;
-}
 /** Serialize reconciliation of the one machine-global host tuple. This lock is
  * deliberately separate from the immutable runtime-generation install lock. */
 function withBrandedHostLock(run) {
     const root = join(homedir(), CRTR_DIR_NAME);
     const lockPath = join(root, 'host.lock');
-    const token = `${process.pid}.${Math.random().toString(36).slice(2)}`;
-    const candidatePath = `${lockPath}.candidate.${token}`;
     mkdirSync(root, { recursive: true });
-    mkdirSync(candidatePath);
-    writeFileSync(join(candidatePath, 'owner.json'), JSON.stringify({ pid: process.pid, token }));
-    const deadline = Date.now() + HOST_LOCK_TIMEOUT_MS;
-    for (;;) {
-        try {
-            // The owner record and lock become visible together, so another process
-            // can never mistake an in-progress live acquisition for an abandoned lock.
-            renameSync(candidatePath, lockPath);
-            break;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== 'EEXIST' && code !== 'ENOTEMPTY') {
-                rmSync(candidatePath, { recursive: true, force: true });
-                throw error;
-            }
-            if (reclaimDeadHostLock(lockPath))
-                continue;
-            if (Date.now() > deadline) {
-                rmSync(candidatePath, { recursive: true, force: true });
-                throw new Error(`timed out waiting for branded host lock: ${lockPath}`);
-            }
-            sleepSync(HOST_LOCK_POLL_MS);
-        }
-    }
-    try {
-        return run();
-    }
-    finally {
-        try {
-            const owner = JSON.parse(readFileSync(join(lockPath, 'owner.json'), 'utf8'));
-            if (owner.token === token)
-                rmSync(lockPath, { recursive: true, force: true });
-        }
-        catch {
-            /* A reclaimed/replaced lock is not ours to remove. */
-        }
-        rmSync(candidatePath, { recursive: true, force: true });
-    }
+    return withExclusiveDirectoryLock(lockPath, run, {
+        timeoutMs: HOST_LOCK_TIMEOUT_MS,
+        timeoutError: () => new Error(`timed out waiting for branded host lock: ${lockPath}`),
+    });
 }
 /** macOS keys FDA grants on the Mach-O cdhash. A real developer identity
  *  keeps that hash stable across branded-host rebuilds; ad-hoc signing is the

package/dist/core/runtime/broker-extension-render.js

@@ -7,7 +7,7 @@ import { hostname } from 'node:os';
 import { interpolateNodePaths } from '../canvas/paths.js';
 import { fullName } from '../canvas/labels.js';
 import { renderKnowledgeForSubject, renderPreferencesForSubject } from '../substrate/render.js';
-import { renderWorkspaceOpenDocsForSubject } from '../substrate/on-read-pure.js';
+import { renderWorkspaceOpenDocsForSubject } from '../substrate/on-read.js';
 import { loadProfileManifest } from '../profiles/manifest.js';
 export function editorLabelForBrokerNode(node) {
     const icon = (node.icon ?? '').trim();

package/dist/core/runtime/canvas-extensions.d.ts

@@ -9,6 +9,7 @@ export declare const CANVAS_TOOL_GUIDE_PATH: string;
 export declare const CANVAS_DOC_SUBSTRATE_PATH: string;
 export declare const CANVAS_STRUCTURED_OUTPUT_PATH: string;
 export declare const CANVAS_BASH_VALVE_PATH: string;
+export declare const CANVAS_PREVIEW_RESULT_PATH: string;
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session

package/dist/core/runtime/canvas-extensions.js

@@ -21,6 +21,7 @@ export const CANVAS_TOOL_GUIDE_PATH = resolveExtension('canvas-tool-guide');
 export const CANVAS_DOC_SUBSTRATE_PATH = resolveExtension('canvas-doc-substrate');
 export const CANVAS_STRUCTURED_OUTPUT_PATH = resolveExtension('canvas-structured-output');
 export const CANVAS_BASH_VALVE_PATH = resolveExtension('canvas-bash-valve');
+export const CANVAS_PREVIEW_RESULT_PATH = resolveExtension('canvas-preview-result');
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session
@@ -37,6 +38,7 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_DOC_SUBSTRATE_PATH,
     CANVAS_STRUCTURED_OUTPUT_PATH,
     CANVAS_BASH_VALVE_PATH,
+    CANVAS_PREVIEW_RESULT_PATH,
 ];
 /** Preserve the invariant: mandatory extensions are always present exactly once.
  *

package/dist/core/runtime/tmux-bindings.js

@@ -7,7 +7,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { ATTACH_CONTROL_BINDINGS, BINDING_CATALOG, BINDING_IDS, encodeAttachControlInput, formatGesture, isAttachPaneBinding, resolveUserKeybindingSettings, } from '../keybindings/index.js';
 import { normalizeTmuxPassthrough } from '../config.js';
-import { withExclusiveDirectoryLock } from '../human/convention.js';
+import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
 import { surfaceTmuxStyleArgs } from './surface-bg.js';
 import { runTmux as tmux, shellQuote } from './tmux-driver.js';
 // ---------------------------------------------------------------------------

package/dist/core/runtime/warm-pool.d.ts

@@ -16,10 +16,11 @@ export declare function warmPoolEnabled(): boolean;
 export interface WarmRequest {
     kind: string;
     mode: Mode;
+    /** Where the node runs — already resolved by the create handler (pin >
+     *  spawner > profile home), never a raw caller directory. */
     cwd: string;
-    /** The RAW `--profile` operand: a string to pin, `null` for explicitly no
-     *  profile, `undefined` to let the daemon resolve one for the cwd. */
-    profile: string | null | undefined;
+    /** The RESOLVED profile id, or null for explicitly no profile. */
+    profileId: string | null;
     model: string | null;
     situationalContext: string | null;
     name: string | null;
@@ -43,9 +44,9 @@ export declare function reapStaleSpares(): string[];
  *  throws and never blocks a caller: a failed mint just means the next create
  *  for this key is cold again. */
 export declare function refillWarmPool(request: WarmRequest): void;
-/** Mint a spare for the most recently used project recipes so the FIRST create
- *  after crtrd boots is warm too, not only the second. The recipe is sourced
- *  from real recent roots — (cwd, profile) is the whole of it, since everything
- *  else a claim reshapes live. Fire-and-forget: returns as soon as the mints
- *  are scheduled, never blocking the daemon's work lane. */
+/** Mint a spare for the most recently used profiles so the FIRST create after
+ *  crtrd boots is warm too, not only the second. The profile is the whole
+ *  recipe: it supplies the cwd, and everything else a claim reshapes live.
+ *  Fire-and-forget — returns as soon as the mints are scheduled, never blocking
+ *  the daemon's work lane. */
 export declare function prewarmRecentRecipes(): void;

package/dist/core/runtime/warm-pool.js

@@ -44,8 +44,13 @@
 //
 // Pool depth is 1 per key. It is populated lazily (the first `prefer_warm`
 // create for a key falls back to a cold spawn and mints the spare behind it)
-// and at daemon start for the most recent live roots, so the FIRST node after
-// sitting down is warm too.
+// and at daemon start for the most recently used profiles, so the FIRST node
+// after sitting down is warm too.
+//
+// The pool no longer fans out per directory: a node runs in its profile's home
+// (`resolveNodeCwd` in the create handler), so the cwd a spare freezes is a
+// function of its profile, and "which spare serves this create" is in practice
+// a question about the profile alone.
 //
 // Nothing ever RESUMES a spare: the daemon's recovery sweep reads `listNodes`,
 // which hides the pool, so a spare whose broker dies (every daemon handover
@@ -57,7 +62,8 @@ import { createHash } from 'node:crypto';
 import { claimWarmSpare, deleteNode, getNode, listNodes, listWarmSpares, registerWarmSpare, unregisterWarmSpare, updateNode, warmSpareCount, } from '../canvas/index.js';
 import { recordedPidLiveness } from '../canvas/pid.js';
 import { nowIso } from '../fs-utils.js';
-import { resolveProfileId, spawnChildPrepared } from './spawn.js';
+import { spawnChildPrepared } from './spawn.js';
+import { profileHome } from '../profiles/manifest.js';
 import { buildLaunchSpec } from './launch.js';
 import { setModelLive } from './model-swap.js';
 import { setSituationalContextLive } from './situational-live.js';
@@ -94,31 +100,23 @@ function warmRecipeKey(cwd, profileId, launch) {
     ]);
     return createHash('sha256').update(canonical).digest('hex').slice(0, 32);
 }
-/** Resolve a request's frozen half. `resolveProfileId(explicit, null, cwd)` is
- *  the SAME call the cold create path makes for an API-created root (no spawner
- *  — a warm-eligible create is parentless by construction), so keying the
- *  resolved id costs nothing extra and keys what actually matters. */
-async function resolveRecipe(request) {
-    const profileId = await resolveProfileId(request.profile, null, request.cwd);
+/** Resolve a request's frozen half. Both cwd and profile arrive already
+ *  resolved from the create handler, so this is pure launch-spec construction. */
+function resolveRecipe(request) {
     const { launch } = buildLaunchSpec(request.kind, request.mode, {
         lifecycle: 'resident',
         hasManager: false,
         ...(request.model !== null ? { model: request.model } : {}),
         cwd: request.cwd,
-        profileId,
+        profileId: request.profileId,
     });
-    return {
-        key: warmRecipeKey(request.cwd, profileId, launch),
-        launch,
-        profileId,
-        request,
-    };
+    return { key: warmRecipeKey(request.cwd, request.profileId, launch), launch, request };
 }
 /** Claim a spare for `request`, reshaped onto its persona — or null when the
  *  pool cannot serve it. The caller falls back to a cold spawn; a claim never
  *  fails the create. */
 export async function claimWarmNode(request) {
-    const recipe = await resolveRecipe(request);
+    const recipe = resolveRecipe(request);
     const created = nowIso();
     // The row's stamp moves inside the claim transaction; meta.json (the identity
     // source of truth `rebuildIndex` re-derives the row from) follows with the
@@ -261,18 +259,15 @@ const minting = new Set();
 export function refillWarmPool(request) {
     if (!warmPoolEnabled())
         return;
-    void (async () => {
-        try {
-            // Mint at the kind's DEFAULT model and with NO situational context: both
-            // are claim-time properties, so baking either in would only narrow who
-            // the spare can serve.
-            const recipe = await resolveRecipe({ ...request, model: null, situationalContext: null });
-            mint(recipe);
-        }
-        catch (err) {
-            console.error(`[warm-pool] recipe resolution failed: ${err.message}`);
-        }
-    })();
+    try {
+        // Mint at the kind's DEFAULT model and with NO situational context: both
+        // are claim-time properties, so baking either in would only narrow who the
+        // spare can serve.
+        mint(resolveRecipe({ ...request, model: null, situationalContext: null }));
+    }
+    catch (err) {
+        console.error(`[warm-pool] recipe resolution failed: ${err.message}`);
+    }
 }
 /** Mint one spare for an already-resolved recipe, if the pool is short. */
 function mint(recipe) {
@@ -298,7 +293,7 @@ function mint(recipe) {
                 // Mint at the kind's DEFAULT model: `model_override` then stays unset on
                 // the spare, so a claim only ever SETS it (updateNode cannot clear a
                 // field) and a no-model claim gets a clean row.
-                ...(request.profile !== undefined ? { profile: request.profile } : {}),
+                profile: request.profileId,
                 // No situational context either: the claimant's is delivered live at
                 // claim time, so a spare that baked one in would serve nobody else.
                 // Mark it unclaimed the instant its row exists and BEFORE the broker
@@ -317,14 +312,14 @@ function mint(recipe) {
 // ---------------------------------------------------------------------------
 // Daemon-start pre-warm
 // ---------------------------------------------------------------------------
-/** How many distinct (cwd, profile) recipes get a spare at daemon start. Each
- *  spare is a resident broker at ~150-300 MB, so this is deliberately tiny. */
-const PREWARM_RECIPES = 2;
-/** Mint a spare for the most recently used project recipes so the FIRST create
- *  after crtrd boots is warm too, not only the second. The recipe is sourced
- *  from real recent roots — (cwd, profile) is the whole of it, since everything
- *  else a claim reshapes live. Fire-and-forget: returns as soon as the mints
- *  are scheduled, never blocking the daemon's work lane. */
+/** How many profiles get a spare at daemon start. Each spare is a resident
+ *  broker at ~150-300 MB, so this is deliberately tiny. */
+const PREWARM_PROFILES = 2;
+/** Mint a spare for the most recently used profiles so the FIRST create after
+ *  crtrd boots is warm too, not only the second. The profile is the whole
+ *  recipe: it supplies the cwd, and everything else a claim reshapes live.
+ *  Fire-and-forget — returns as soon as the mints are scheduled, never blocking
+ *  the daemon's work lane. */
 export function prewarmRecentRecipes() {
     if (!warmPoolEnabled())
         return;
@@ -336,12 +331,15 @@ export function prewarmRecentRecipes() {
         for (const row of listNodes({ status: ['active', 'idle'] }).reverse()) {
             if (row.parent !== null || row.kind === 'human')
                 continue;
-            const dedupe = `${row.cwd}\u0000${row.profile_id ?? ''}`;
-            if (seen.has(dedupe))
+            const profileId = row.profile_id ?? null;
+            if (seen.has(profileId ?? ''))
                 continue;
-            seen.add(dedupe);
-            candidates.push({ cwd: row.cwd, profileId: row.profile_id ?? null });
-            if (candidates.length >= PREWARM_RECIPES)
+            seen.add(profileId ?? '');
+            // The profile's home is where its next node will land. A profile without
+            // one (root, or a home since deleted) still gets a spare, keyed on the
+            // directory its last root actually ran in.
+            candidates.push({ cwd: profileHome(profileId) ?? row.cwd, profileId });
+            if (candidates.length >= PREWARM_PROFILES)
                 break;
         }
     }
@@ -350,24 +348,22 @@ export function prewarmRecentRecipes() {
         return;
     }
     for (const candidate of candidates) {
-        void (async () => {
-            try {
-                // `general`/`base` is only the shape the spare BOOTS as — the key it is
-                // filed under excludes everything a claim can reshape, so any kind can
-                // claim it.
-                mint(await resolveRecipe({
-                    kind: 'general',
-                    mode: 'base',
-                    cwd: candidate.cwd,
-                    profile: candidate.profileId,
-                    model: null,
-                    situationalContext: null,
-                    name: null,
-                }));
-            }
-            catch (err) {
-                console.error(`[warm-pool] prewarm failed for ${candidate.cwd}: ${err.message}`);
-            }
-        })();
+        try {
+            // `general`/`base` is only the shape the spare BOOTS as — the key it is
+            // filed under excludes everything a claim can reshape, so any kind can
+            // claim it.
+            mint(resolveRecipe({
+                kind: 'general',
+                mode: 'base',
+                cwd: candidate.cwd,
+                profileId: candidate.profileId,
+                model: null,
+                situationalContext: null,
+                name: null,
+            }));
+        }
+        catch (err) {
+            console.error(`[warm-pool] prewarm failed for ${candidate.cwd}: ${err.message}`);
+        }
     }
 }