@north-light/crouter 0.3.175 → 0.3.177

package/dist/core/runtime/warm-pool.js

@@ -44,8 +44,13 @@
 //
 // Pool depth is 1 per key. It is populated lazily (the first `prefer_warm`
 // create for a key falls back to a cold spawn and mints the spare behind it)
-// and at daemon start for the most recent live roots, so the FIRST node after
-// sitting down is warm too.
+// and at daemon start for the most recently used profiles, so the FIRST node
+// after sitting down is warm too.
+//
+// The pool does not fan out per directory: a node runs in its profile's home
+// (`resolveNodeCwd` in the create handler), so the cwd a spare freezes is a
+// function of its profile, and "which spare serves this create" is in practice
+// a question about the profile alone.
 //
 // Nothing ever RESUMES a spare: the daemon's recovery sweep reads `listNodes`,
 // which hides the pool, so a spare whose broker dies (every daemon handover
@@ -57,7 +62,8 @@ import { createHash } from 'node:crypto';
 import { claimWarmSpare, deleteNode, getNode, listNodes, listWarmSpares, registerWarmSpare, unregisterWarmSpare, updateNode, warmSpareCount, } from '../canvas/index.js';
 import { recordedPidLiveness } from '../canvas/pid.js';
 import { nowIso } from '../fs-utils.js';
-import { resolveProfileId, spawnChildPrepared } from './spawn.js';
+import { spawnChildPrepared } from './spawn.js';
+import { profileHome } from '../profiles/manifest.js';
 import { buildLaunchSpec } from './launch.js';
 import { setModelLive } from './model-swap.js';
 import { setSituationalContextLive } from './situational-live.js';
@@ -94,31 +100,23 @@ function warmRecipeKey(cwd, profileId, launch) {
     ]);
     return createHash('sha256').update(canonical).digest('hex').slice(0, 32);
 }
-/** Resolve a request's frozen half. `resolveProfileId(explicit, null, cwd)` is
- *  the SAME call the cold create path makes for an API-created root (no spawner
- *  — a warm-eligible create is parentless by construction), so keying the
- *  resolved id costs nothing extra and keys what actually matters. */
-async function resolveRecipe(request) {
-    const profileId = await resolveProfileId(request.profile, null, request.cwd);
+/** Resolve a request's frozen half. Both cwd and profile arrive already
+ *  resolved from the create handler, so this is pure launch-spec construction. */
+function resolveRecipe(request) {
     const { launch } = buildLaunchSpec(request.kind, request.mode, {
         lifecycle: 'resident',
         hasManager: false,
         ...(request.model !== null ? { model: request.model } : {}),
         cwd: request.cwd,
-        profileId,
+        profileId: request.profileId,
     });
-    return {
-        key: warmRecipeKey(request.cwd, profileId, launch),
-        launch,
-        profileId,
-        request,
-    };
+    return { key: warmRecipeKey(request.cwd, request.profileId, launch), launch, request };
 }
 /** Claim a spare for `request`, reshaped onto its persona — or null when the
  *  pool cannot serve it. The caller falls back to a cold spawn; a claim never
  *  fails the create. */
 export async function claimWarmNode(request) {
-    const recipe = await resolveRecipe(request);
+    const recipe = resolveRecipe(request);
     const created = nowIso();
     // The row's stamp moves inside the claim transaction; meta.json (the identity
     // source of truth `rebuildIndex` re-derives the row from) follows with the
@@ -261,18 +259,15 @@ const minting = new Set();
 export function refillWarmPool(request) {
     if (!warmPoolEnabled())
         return;
-    void (async () => {
-        try {
-            // Mint at the kind's DEFAULT model and with NO situational context: both
-            // are claim-time properties, so baking either in would only narrow who
-            // the spare can serve.
-            const recipe = await resolveRecipe({ ...request, model: null, situationalContext: null });
-            mint(recipe);
-        }
-        catch (err) {
-            console.error(`[warm-pool] recipe resolution failed: ${err.message}`);
-        }
-    })();
+    try {
+        // Mint at the kind's DEFAULT model and with NO situational context: both
+        // are claim-time properties, so baking either in would only narrow who the
+        // spare can serve.
+        mint(resolveRecipe({ ...request, model: null, situationalContext: null }));
+    }
+    catch (err) {
+        console.error(`[warm-pool] recipe resolution failed: ${err.message}`);
+    }
 }
 /** Mint one spare for an already-resolved recipe, if the pool is short. */
 function mint(recipe) {
@@ -298,7 +293,7 @@ function mint(recipe) {
                 // Mint at the kind's DEFAULT model: `model_override` then stays unset on
                 // the spare, so a claim only ever SETS it (updateNode cannot clear a
                 // field) and a no-model claim gets a clean row.
-                ...(request.profile !== undefined ? { profile: request.profile } : {}),
+                profile: request.profileId,
                 // No situational context either: the claimant's is delivered live at
                 // claim time, so a spare that baked one in would serve nobody else.
                 // Mark it unclaimed the instant its row exists and BEFORE the broker
@@ -317,14 +312,14 @@ function mint(recipe) {
 // ---------------------------------------------------------------------------
 // Daemon-start pre-warm
 // ---------------------------------------------------------------------------
-/** How many distinct (cwd, profile) recipes get a spare at daemon start. Each
- *  spare is a resident broker at ~150-300 MB, so this is deliberately tiny. */
-const PREWARM_RECIPES = 2;
-/** Mint a spare for the most recently used project recipes so the FIRST create
- *  after crtrd boots is warm too, not only the second. The recipe is sourced
- *  from real recent roots — (cwd, profile) is the whole of it, since everything
- *  else a claim reshapes live. Fire-and-forget: returns as soon as the mints
- *  are scheduled, never blocking the daemon's work lane. */
+/** How many profiles get a spare at daemon start. Each spare is a resident
+ *  broker at ~150-300 MB, so this is deliberately tiny. */
+const PREWARM_PROFILES = 2;
+/** Mint a spare for the most recently used profiles so the FIRST create after
+ *  crtrd boots is warm too, not only the second. The profile is the whole
+ *  recipe: it supplies the cwd, and everything else a claim reshapes live.
+ *  Fire-and-forget — returns as soon as the mints are scheduled, never blocking
+ *  the daemon's work lane. */
 export function prewarmRecentRecipes() {
     if (!warmPoolEnabled())
         return;
@@ -336,12 +331,15 @@ export function prewarmRecentRecipes() {
         for (const row of listNodes({ status: ['active', 'idle'] }).reverse()) {
             if (row.parent !== null || row.kind === 'human')
                 continue;
-            const dedupe = `${row.cwd}\u0000${row.profile_id ?? ''}`;
-            if (seen.has(dedupe))
+            const profileId = row.profile_id ?? null;
+            if (seen.has(profileId ?? ''))
                 continue;
-            seen.add(dedupe);
-            candidates.push({ cwd: row.cwd, profileId: row.profile_id ?? null });
-            if (candidates.length >= PREWARM_RECIPES)
+            seen.add(profileId ?? '');
+            // The profile's home is where its next node will land. A profile without
+            // one (root, or a home since deleted) still gets a spare, keyed on the
+            // directory its last root actually ran in.
+            candidates.push({ cwd: profileHome(profileId) ?? row.cwd, profileId });
+            if (candidates.length >= PREWARM_PROFILES)
                 break;
         }
     }
@@ -350,24 +348,22 @@ export function prewarmRecentRecipes() {
         return;
     }
     for (const candidate of candidates) {
-        void (async () => {
-            try {
-                // `general`/`base` is only the shape the spare BOOTS as — the key it is
-                // filed under excludes everything a claim can reshape, so any kind can
-                // claim it.
-                mint(await resolveRecipe({
-                    kind: 'general',
-                    mode: 'base',
-                    cwd: candidate.cwd,
-                    profile: candidate.profileId,
-                    model: null,
-                    situationalContext: null,
-                    name: null,
-                }));
-            }
-            catch (err) {
-                console.error(`[warm-pool] prewarm failed for ${candidate.cwd}: ${err.message}`);
-            }
-        })();
+        try {
+            // `general`/`base` is only the shape the spare BOOTS as — the key it is
+            // filed under excludes everything a claim can reshape, so any kind can
+            // claim it.
+            mint(resolveRecipe({
+                kind: 'general',
+                mode: 'base',
+                cwd: candidate.cwd,
+                profileId: candidate.profileId,
+                model: null,
+                situationalContext: null,
+                name: null,
+            }));
+        }
+        catch (err) {
+            console.error(`[warm-pool] prewarm failed for ${candidate.cwd}: ${err.message}`);
+        }
     }
 }

package/dist/core/scope.js

@@ -1,10 +1,11 @@
 import { homedir } from 'node:os';
-import { existsSync, statSync, realpathSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
 import { CRTR_DIR_NAME } from '../types.js';
 import { assetRoot } from './asset-root.js';
 import { usage } from './errors.js';
 import { loadProfileManifest } from './profiles/manifest.js';
+import { realpathOrSelf } from './fs-utils.js';
 // Cache of resolved project-scope-root STACKS, keyed by (resolved cwd, profile
 // id). A profile widens the pointer set beyond the bare cwd (see
 // findProjectScopeRoots below), so the cache key must carry both — the same
@@ -31,14 +32,6 @@ export function builtinPiPackageDir(name) {
 export function userScopeRoot() {
     return join(homedir(), CRTR_DIR_NAME);
 }
-function realpathOrSelf(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 function isProjectScopeDir(candidate, userRoot) {
     if (!existsSync(candidate))
         return false;

package/dist/core/self-update.js

@@ -1,6 +1,6 @@
-// Self-update and content-check primitives extracted from commands/update.ts.
-// Moved here to break the core→commands import inversion: auto-update.ts
-// (core) previously imported from commands/update.ts (commands layer).
+// Self-update and content-check primitives. They live in core/ so auto-update.ts
+// (core) reaches them without importing commands/update.ts, which would invert
+// the core→commands layering.
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';

package/dist/core/spawn.d.ts

@@ -13,4 +13,3 @@ export declare function isInTmux(): boolean;
  *  no server is running — the true "no tmux to surface into" case that should
  *  degrade to the inbox-drain follow-up. */
 export declare function tmuxServerReachable(): boolean;
-export declare function shellQuote(s: string): string;

package/dist/core/spawn.js

@@ -1,4 +1,4 @@
-// Tmux reachability + quoting helpers for the `human` command tree.
+// Tmux reachability for the `human` command tree.
 //
 // The human surface gates on whether the canvas tmux server is reachable
 // (tmuxServerReachable) so it can decide whether to surface a prompt or degrade
@@ -25,6 +25,3 @@ export function tmuxServerReachable() {
     const r = spawnSync('tmux', ['list-clients', '-F', '#{client_name}'], { encoding: 'utf8' });
     return r.status === 0;
 }
-export function shellQuote(s) {
-    return `'${s.replace(/'/g, "'\\''")}'`;
-}

package/dist/core/substrate/index.d.ts

@@ -7,4 +7,5 @@ export { gatePasses } from './gate.js';
 export { INDEX_NAME, isIndexName, indexDirOf, displayName, buildCeilingIndex, effectiveSystemPromptRung, } from './ceiling.js';
 export { renderPreferencesForSubject, renderKnowledgeForSubject } from './render.js';
 export { renderPreferencesSection, renderKnowledgeBlock } from './render-node.js';
-export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read.js';
+export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject } from './on-read.js';
+export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read-node.js';

package/dist/core/substrate/index.js

@@ -22,4 +22,5 @@ export { gatePasses } from './gate.js';
 export { INDEX_NAME, isIndexName, indexDirOf, displayName, buildCeilingIndex, effectiveSystemPromptRung, } from './ceiling.js';
 export { renderPreferencesForSubject, renderKnowledgeForSubject } from './render.js';
 export { renderPreferencesSection, renderKnowledgeBlock } from './render-node.js';
-export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read.js';
+export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject } from './on-read.js';
+export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read-node.js';

package/dist/core/substrate/on-read-node.d.ts

@@ -0,0 +1,7 @@
+/** Surface docs matched by a successful read tool call. An unknown node id or
+ *  an unreadable canvas renders nothing. */
+export declare function renderOnReadDocs(nodeId: string, readFilePath: string, seen?: Set<string>): string;
+/** Surface workspace-wide docs during first-message assembly, using the node's
+ *  recorded cwd and selected profile. `.` is a reserved applies-to target
+ *  meaning “when this project store is mounted by cwd/profile”. */
+export declare function renderWorkspaceOpenDocs(nodeId: string): string;

package/dist/core/substrate/on-read-node.js

@@ -0,0 +1,37 @@
+// on-read-node.ts — the CANVAS-DB wrappers over the pure on-read functions.
+// Both take a node id, assemble its subject from the canvas-db, then delegate
+// to on-read.ts. Split out for the same reason as render-node.ts: a consumer
+// that already holds a subject imports on-read.js without subject.js's
+// canvas-db reach.
+import { getNode } from '../canvas/index.js';
+import { assembleNodeSubject } from './subject.js';
+import { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject } from './on-read.js';
+/** Surface docs matched by a successful read tool call. An unknown node id or
+ *  an unreadable canvas renders nothing. */
+export function renderOnReadDocs(nodeId, readFilePath, seen = new Set()) {
+    let subject;
+    try {
+        subject = assembleNodeSubject(nodeId);
+    }
+    catch {
+        return '';
+    }
+    if (subject === null)
+        return '';
+    return renderOnReadDocsForSubject(subject, readFilePath, seen);
+}
+/** Surface workspace-wide docs during first-message assembly, using the node's
+ *  recorded cwd and selected profile. `.` is a reserved applies-to target
+ *  meaning “when this project store is mounted by cwd/profile”. */
+export function renderWorkspaceOpenDocs(nodeId) {
+    try {
+        const subject = assembleNodeSubject(nodeId);
+        const node = getNode(nodeId);
+        if (subject === null || node === null)
+            return '';
+        return renderWorkspaceOpenDocsForSubject(subject, node.cwd, node.profile_id ?? null);
+    }
+    catch {
+        return '';
+    }
+}

package/dist/core/substrate/on-read.d.ts

@@ -1,5 +1,7 @@
-/** Surface docs matched by a successful read tool call. */
-export declare function renderOnReadDocs(nodeId: string, readFilePath: string, seen?: Set<string>): string;
-/** Surface workspace-wide docs during first-message assembly. `.` is a reserved
- * applies-to target meaning “when this project store is mounted by cwd/profile”. */
-export declare function renderWorkspaceOpenDocs(nodeId: string): string;
+import type { NodeConfigSubject } from './subject-fields.js';
+/** Surface docs matched by a successful read tool call using the caller-supplied
+ * daemon snapshot subject. */
+export declare function renderOnReadDocsForSubject(subject: NodeConfigSubject, readFilePath: string, seen?: Set<string>): string;
+/** Workspace boot docs using the snapshot's cwd/profile instead of a canvas
+ * lookup. */
+export declare function renderWorkspaceOpenDocsForSubject(subject: NodeConfigSubject, cwd: string, profileId: string | null): string;

package/dist/core/substrate/on-read.js

@@ -1,4 +1,8 @@
-// on-read.ts — file-context delivery for the document substrate.
+// on-read.ts — the pure file-context delivery functions for the document
+// substrate. Both take a caller-supplied subject; the canvas-db wrappers that
+// resolve one from a node id live in on-read-node.ts, so a consumer that
+// already holds a subject imports this module WITHOUT pulling subject.js's
+// canvas-db reach (the same split as render.ts / render-node.ts).
 //
 // A memory with file-read visibility participates only through an explicit
 // `applies-to` path glob (authoring lint requires one). Two events use that one
@@ -20,7 +24,6 @@
 // Every candidate renders at its own fileReadVisibility rung. Explicit routing
 // is the whole on-read model, so directory INDEX ceilings remain a boot-catalog
 // concern and do not cap a deliberately matched document.
-import { realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, matchesGlob, parse, relative, sep } from 'node:path';
 import { CRTR_DIR_NAME } from '../../types.js';
@@ -28,19 +31,13 @@ import { pathExists, readText, walkFiles } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 import { evalCondition } from '../predicate.js';
 import { listAllMemoryDocs, listProjectMemoryDocs } from '../memory-resolver.js';
-import { getNode } from '../canvas/index.js';
 import { userScopeRoot } from '../scope.js';
-import { assembleNodeSubject, displayName, gatePasses, normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName, } from './index.js';
+import { displayName } from './ceiling.js';
+import { gatePasses } from './gate.js';
+import { normalizeDocName, parseSubstrateDoc, parseSubstrateFrontmatter, previewLine, resolveDocName } from './schema.js';
 import { cachedSubstrateDocs } from './session-cache.js';
+import { realpathOrSelf } from '../fs-utils.js';
 const JUNK_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '.cache', '.yalc']);
-function realpathOrSelf(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 function attr(s) {
     return s
         .replace(/&/g, '&')
@@ -237,17 +234,9 @@ function renderCandidates(subject, docs, seen) {
         ? ''
         : `<auto-loaded-context>\n${rendered.join('\n')}\n</auto-loaded-context>`;
 }
-/** Surface docs matched by a successful read tool call. */
-export function renderOnReadDocs(nodeId, readFilePath, seen = new Set()) {
-    let subject;
-    try {
-        subject = assembleNodeSubject(nodeId);
-    }
-    catch {
-        return '';
-    }
-    if (subject === null)
-        return '';
+/** Surface docs matched by a successful read tool call using the caller-supplied
+ * daemon snapshot subject. */
+export function renderOnReadDocsForSubject(subject, readFilePath, seen = new Set()) {
     const absReadFile = realpathOrSelf(readFilePath);
     const readFrontmatter = readFileFrontmatter(absReadFile);
     const docs = dedupeByPhysicalPath([...enclosingProjectDocs(absReadFile), ...resolvedDocs()])
@@ -255,17 +244,12 @@ export function renderOnReadDocs(nodeId, readFilePath, seen = new Set()) {
         .filter((doc) => matchesReadEvent(doc, absReadFile, readFrontmatter));
     return renderCandidates(subject, docs, seen);
 }
-/** Surface workspace-wide docs during first-message assembly. `.` is a reserved
- * applies-to target meaning “when this project store is mounted by cwd/profile”. */
-export function renderWorkspaceOpenDocs(nodeId) {
-    let subject;
+/** Workspace boot docs using the snapshot's cwd/profile instead of a canvas
+ * lookup. */
+export function renderWorkspaceOpenDocsForSubject(subject, cwd, profileId) {
     let docs;
     try {
-        subject = assembleNodeSubject(nodeId);
-        const node = getNode(nodeId);
-        if (subject === null || node === null)
-            return '';
-        docs = listProjectMemoryDocs(node.cwd, node.profile_id ?? null)
+        docs = listProjectMemoryDocs(cwd, profileId)
             .map(parseSubstrateDoc)
             .filter((doc) => doc !== null);
     }

package/dist/core/termrender/termrender.js

@@ -1,8 +1,9 @@
 import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync, statSync, mkdirSync, openSync, closeSync, unlinkSync, renameSync, accessSync, realpathSync, constants, } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, statSync, mkdirSync, unlinkSync, renameSync, accessSync, realpathSync, constants, } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import stringWidth from 'string-width';
+import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
 import { TERMRENDER_VERSION } from './version.js';
 // ── The sole org-wide termrender binding ─────────────────────────────────────
 //
@@ -31,15 +32,11 @@ const VENV_STAMP = join(VENV_DIR, '.crtr-termrender-stamp.json');
 // in a read-only runtime image, and serializes venv mutation + stamp publication
 // across processes: a stamp can never certify a concurrently-changing venv.
 const VENV_LOCK = join(RENDERER_CACHE_DIR, '.crtr-termrender.lock');
-// A lock older than this is from a crashed process and may be stolen. Set
-// comfortably above the worst-case held path (uv probe 5s + venv 60s + install
-// 120s + re-verify ~10s ≈ 195s) so a slow-but-alive holder is never judged
-// stale while it still holds.
-const LOCK_STALE_MS = 300_000;
 // Absolute cap on how long a waiter spins before giving up to plaintext for
 // this session (the next launch retries) — a safety valve so a wedged holder
-// can never hang a process, WITHOUT ever stealing a lock we can't prove stale.
-const LOCK_GIVE_UP_MS = LOCK_STALE_MS + 60_000;
+// can never hang a process. Set comfortably above the worst-case held path
+// (uv probe 5s + venv 60s + install 120s + re-verify ~10s ≈ 195s).
+const LOCK_GIVE_UP_MS = 360_000;
 let rendererState = 'unchecked';
 function isFp(x) {
     const e = x;
@@ -167,46 +164,12 @@ function stampValid() {
     }
     return true;
 }
-function sleepSync(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function lockIsStale() {
-    try {
-        const at = JSON.parse(readFileSync(VENV_LOCK, 'utf8')).at;
-        if (typeof at === 'number')
-            return Date.now() - at > LOCK_STALE_MS;
-    }
-    catch {
-        // Unreadable/malformed lock — fall through to mtime.
-    }
-    try {
-        return Date.now() - statSync(VENV_LOCK).mtimeMs > LOCK_STALE_MS;
-    }
-    catch {
-        return true; // vanished — the retry loop re-acquires
-    }
-}
-// Run `provision` while holding the exclusive provisioning lock. If another
-// live process holds it, wait for that process to publish (re-checking the
-// stamp) rather than mutating the venv concurrently. Stale locks are stolen.
-// Steal a lock judged stale by renaming it to a unique name first: rename is
-// atomic, so if two waiters race only the one whose rename succeeds owns (and
-// deletes) it — the loser gets ENOENT and re-loops. This can never delete a
-// lock a peer has freshly re-acquired (that peer holds a DIFFERENT inode at the
-// same path; our rename of the old name either already happened or fails).
-function stealStaleLock() {
-    const tmp = `${VENV_LOCK}.steal.${process.pid}.${Date.now()}`;
-    try {
-        renameSync(VENV_LOCK, tmp);
-    }
-    catch {
-        return; // lost the steal race or already gone — caller re-loops
-    }
-    try {
-        unlinkSync(tmp);
-    }
-    catch { /* best effort */ }
-}
+// Run `provision` holding the exclusive provisioning lock, so no two processes
+// mutate the venv (or certify it) at once. A crashed holder is reclaimed at
+// once; a live one is waited on, and if it outlasts the give-up window this
+// process falls back to plaintext for the session rather than break mutual
+// exclusion. `provision` re-checks the stamp first, so a waiter that finally
+// acquires adopts the peer's published result instead of reinstalling.
 function withProvisionLock(provision) {
     try {
         mkdirSync(RENDERER_CACHE_DIR, { recursive: true });
@@ -216,54 +179,11 @@ function withProvisionLock(provision) {
         process.stderr.write(`[crtr] termrender unavailable — renderer cache cannot be created (${err instanceof Error ? err.message : String(err)}); using plaintext fallback\n`);
         return;
     }
-    const giveUpAt = Date.now() + LOCK_GIVE_UP_MS;
-    for (;;) {
-        let fd;
-        try {
-            fd = openSync(VENV_LOCK, 'wx'); // O_CREAT | O_EXCL — atomic acquire
-        }
-        catch (err) {
-            if (err.code !== 'EEXIST') {
-                rendererState = 'unavailable';
-                process.stderr.write(`[crtr] termrender unavailable — renderer cache cannot be locked (${err instanceof Error ? err.message : String(err)}); using plaintext fallback\n`);
-                return;
-            }
-            if (lockIsStale()) {
-                stealStaleLock();
-                continue;
-            }
-            // A live process is provisioning — give it a chance, then adopt its result.
-            // Never steal a lock we can't prove stale; if we wait too long, give up to
-            // plaintext this session rather than break mutual exclusion.
-            if (Date.now() > giveUpAt) {
-                rendererState = 'unavailable';
-                return;
-            }
-            sleepSync(200);
-            if (stampValid()) {
-                rendererState = 'ready';
-                return;
-            }
-            continue;
-        }
-        try {
-            writeFileSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
-        }
-        catch { /* lock held regardless of whether the marker body wrote */ }
-        try {
-            provision();
-        }
-        finally {
-            try {
-                closeSync(fd);
-            }
-            catch { /* already closed */ }
-            try {
-                unlinkSync(VENV_LOCK);
-            }
-            catch { /* stolen as stale by another process */ }
-        }
-        return;
+    try {
+        withExclusiveDirectoryLock(VENV_LOCK, provision, { timeoutMs: LOCK_GIVE_UP_MS });
+    }
+    catch {
+        rendererState = 'unavailable';
     }
 }
 function binaryOk() {

package/dist/core/wake.js

@@ -3,8 +3,8 @@
 // This is the ONE place that owns cron time logic. Both the CLI surface and the
 // daemon's firing pass import from here, so there is no duplicated cron usage
 // and no surface<->daemon inverted dependency:
-//   - parseWhen / parseCadence  — arm-time grammar (surface, T7)
-//   - nextSlotAfter             — per-tick advance / coalescing (daemon, T4)
+//   - parseWhen / parseCadence  — arm-time grammar (surface)
+//   - nextSlotAfter             — per-tick advance / coalescing (daemon)
 //
 // Design refs: surface-design §4 (grammar), §5 (timezone/DST ruling),
 // design §5.3 + D7 (engine evaluates UTC; the surface bakes the IANA zone

package/dist/core/worktree.d.ts

@@ -95,11 +95,11 @@ export interface AutoDroppedWorktree {
  *  branch and the live checkout stay fully recoverable and the caller's
  *  `open_managed_worktree` guard fires. */
 export declare function autoDropCleanManagedWorktreeLocked(nodeId: string, wt: ManagedWorktree, proof: CleanEmptyProof): AutoDroppedWorktree | null;
-/** `push final`'s escape hatch (#327, #333): a managed worktree that has
+/** `push final`'s escape hatch: a managed worktree that has
  *  nothing to land is auto-dropped instead of blocking on an explicit
  *  `node worktree close` — one the caller may have been told NOT to run
- *  because a manager already landed the same change another way (#327), or
- *  that never had anything to close in the first place (#333, a read-only
+ *  because a manager already landed the same change another way, or
+ *  that never had anything to close in the first place (a read-only
  *  review node). Returns null and changes nothing when the worktree is not
  *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
  *  concurrent mutation invalidates that proof before the destructive delete