@north-light/crouter 0.3.175 → 0.3.177

package/dist/commands/sys/setup-core.js

@@ -14,6 +14,7 @@ import { detectNerdFont, nerdFontInstallCommand, NERD_FONT_SELECT_HINT } from '.
 import { ensureRenderer, isRendererReady } from '../../core/termrender/termrender.js';
 import { installFromMarketplace } from '../pkg/plugin-manage.js';
 import { findPluginByName } from '../../core/resolver.js';
+import { expandTilde } from '../../core/fs-utils.js';
 function isKeybindingsObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
@@ -214,13 +215,6 @@ export function buildSetupManifest(resolveBuiltinPackageDir = builtinPiPackageDi
         };
     });
 }
-function expandTilde(pathValue, homeDir) {
-    if (pathValue === '~')
-        return homeDir;
-    if (pathValue.startsWith('~/'))
-        return join(homeDir, pathValue.slice(2));
-    return pathValue;
-}
 function npmPackageName(source) {
     if (!source.startsWith('npm:'))
         return null;

package/dist/commands/sys/sync-deps.js

@@ -32,13 +32,11 @@ import { parseFrontmatterGeneric } from '../../core/frontmatter.js';
 import { pathExists, readJsonIfExists, readText, walkFiles, writeText } from '../../core/fs-utils.js';
 import { serializeMemoryDoc } from '../memory/shared.js';
 import { routeFromDescription, scalarString } from './sync-shared.js';
+import { isRecord } from '../../shared/predicates.js';
 /** Marker value written to the generated top INDEX's `generated-by` field —
  *  the wipe guard: `deps` only ever deletes a deps/ dir whose INDEX carries
  *  this marker. */
 export const DEPS_GENERATED_MARKER = 'crtr sys sync deps';
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
 function invalidDepsConfig(message) {
     throw usage(`--deps: invalid package.json crtr.sync.deps.exclude: ${message}`);
 }

package/dist/commands/sys/sync-project-guidance.js

@@ -3,7 +3,7 @@
 // `.crouter/memory/`. Each project guide becomes the root INDEX front door;
 // rules retain their explicit path routes, or use the workspace-open `.` route
 // when they are pathless.
-import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { defineLeaf } from '../../core/command.js';
 import { parseFrontmatterGeneric } from '../../core/frontmatter.js';
@@ -13,6 +13,7 @@ import { loadProfileManifest } from '../../core/profiles/manifest.js';
 import { CRTR_DIR_NAME } from '../../types.js';
 import { memoryFilePath, serializeMemoryDoc } from '../memory/shared.js';
 import { normalizedName, routeFromDescription, scalarString } from './sync-shared.js';
+import { realpathOrSelf } from '../../core/fs-utils.js';
 // Directories a project-doc walk never descends into — build/dependency trees
 // plus crouter's own state dir.
 const PROJECT_DOC_JUNK_DIRS = new Set([
@@ -136,16 +137,6 @@ function gitWorktreeRoot(dir) {
     const top = res.stdout.trim();
     return top === '' ? undefined : resolve(top);
 }
-/** `realpathSync`, tolerant of a path that doesn't exist or can't be resolved
- *  (falls back to the path as given). */
-function realpathOrSelf(p) {
-    try {
-        return realpathSync(p);
-    }
-    catch {
-        return p;
-    }
-}
 /** First Markdown H1 heading in the doc body, heading marker stripped. */
 function h1Title(body) {
     for (const raw of body.split('\n')) {

package/dist/commands/sys/sysprompt.js

@@ -7,9 +7,7 @@ import { jobDir } from '../../core/canvas/paths.js';
 import { openNodeWindow } from '../../core/runtime/placement-tmux.js';
 import { ApiError } from '../../api/index.js';
 import { cliClient } from '../api-client.js';
-function shellQuote(s) {
-    return `'${s.replace(/'/g, `'\\''`)}'`;
-}
+import { shellQuote } from '../../shared/shell-quote.js';
 export const sysSyspromptLeaf = defineLeaf({
     name: 'sysprompt',
     description: 'print a node\'s assembled system prompt',

package/dist/core/__tests__/branded-host-concurrency.test.js

@@ -35,7 +35,7 @@ test('concurrent processes reconcile one coherent branded host tuple', async ()
     assert.ok(deadOwner !== undefined);
     const abandonedLock = join(home, '.crouter', 'host.lock');
     mkdirSync(abandonedLock);
-    writeFileSync(join(abandonedLock, 'owner.json'), JSON.stringify({ pid: deadOwner, token: 'abandoned' }));
+    writeFileSync(join(abandonedLock, `owner.${deadOwner}.abandoned`), '');
     try {
         const moduleUrl = pathToFileURL(join(process.cwd(), 'src/core/runtime/branded-host.ts')).href;
         const results = await Promise.all(Array.from({ length: 4 }, () => reconcileInChild(home, moduleUrl)));

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -139,7 +139,7 @@ export class SessionManager {
     }
 }
 // ---------------------------------------------------------------------------
-// AgentSessionEvent stream synthesis (T8 / G1, G3, G4, G8). The fake emits a
+// AgentSessionEvent stream synthesis. The fake emits a
 // REALISTIC streaming assistant turn through session.subscribe — the SAME channel
 // the real pi engine feeds the broker's fan-out — so the frames a `crtr surface attach`
 // client receives are byte-for-byte real AgentSessionEvents. The EMITTED event

package/dist/core/__tests__/helpers/harness.d.ts

@@ -37,7 +37,7 @@ export interface HarnessOpts {
      *  harness does NOT gate on tmux, does NOT eagerly create the isolated tmux
      *  session, and skips the per-pane `set-environment` seeding — nothing in a
      *  headless run opens a window. CRTR_NODE_SESSION/CRTR_ROOT_SESSION are still
-     *  scrubbed/restored for env hygiene, but no longer route placement: a managed
+     *  scrubbed/restored for env hygiene, but do not route placement: a managed
      *  child opens NO viewer (it boots a detached broker, supervised by pid), and a
      *  --root opens one viewer in the caller's current session. Headless tests must
      *  use `spawnHeadlessChild`, never `spawnChild`. See createHeadlessHarness(). */

package/dist/core/__tests__/helpers/harness.js

@@ -312,7 +312,7 @@ export async function createHarness(opts = {}) {
     }
     // Pre-create the isolated session on the DEFAULT server so teardown always
     // has a kill-sessions target.
-    // ISOLATION ASSUMPTION (see header + MINOR-6): isolation is by SESSION NAME on
+    // ISOLATION ASSUMPTION (see header): isolation is by SESSION NAME on
     // the DEFAULT tmux server only. The runtime CLI shells `tmux` with no `-L`, so
     // a custom-socket server (`tmux -L foo`) would be invisible to it; this harness
     // therefore assumes the default socket and only ever kill-sessions, never the

package/dist/core/__tests__/on-read-crouter-home-fence.test.js

@@ -13,7 +13,7 @@ import { join } from 'node:path';
 import { closeDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
-import { renderOnReadDocs } from '../substrate/on-read.js';
+import { renderOnReadDocs } from '../substrate/on-read-node.js';
 let canvasHome;
 let fakeHome;
 let prevHomeEnv;

package/dist/core/__tests__/on-read-dedup-resume.test.js

@@ -13,7 +13,7 @@ import { join } from 'node:path';
 import { closeDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
-import { renderOnReadDocs } from '../substrate/on-read.js';
+import { renderOnReadDocs } from '../substrate/on-read-node.js';
 import { loadInjectedDocs, saveInjectedDocs, clearInjectedDocs, } from '../substrate/injected-store.js';
 const FIXTURE_BODY = 'Fixture body that must surface exactly once.';
 let home;

package/dist/core/canvas/boot.js

@@ -148,7 +148,7 @@ export function reconcileBootLiveness(current = currentBootIdentity()) {
         const rows = db
             .prepare('SELECT node_id FROM nodes WHERE pi_pid IS NOT NULL')
             .all();
-        // Clear the launch-time identity baseline (crouter#98 review finding 1)
+        // Clear the launch-time identity baseline
         // alongside `pi_pid` — a boot resets the OS process table, so any recorded
         // identity is as meaningless as the pid it was captured for; leaving it
         // behind would let a coincidentally-reused pid on the NEW boot compare

package/dist/core/canvas/browse/app.js

@@ -358,8 +358,8 @@ export async function runBrowse(opts) {
     // Coalesced search repaint. The expensive work per keystroke is recompute()
     // (a fuzzyMatch flatten over the whole corpus) + a full renderFrame. Doing it
     // synchronously on every key blocks the event loop, so fast typing batches into
-    // the stdin reads — and batched chunks used to be dropped (see onKeySearch).
-    // Instead, each key only mutates state.query (cheap) and marks the view dirty;
+    // the stdin reads, where a naive per-key handler drops batched chunks (see
+    // onKeySearch). Instead, each key only mutates state.query (cheap) and marks the view dirty;
     // a single setImmediate drains AFTER every queued stdin 'data' callback (poll
     // phase) has appended its chars, so N rapid keys collapse to ONE recompute+paint
     // and no keystroke is ignored. The sort may still take a moment — that's fine.

package/dist/core/canvas/canvas.d.ts

@@ -33,7 +33,7 @@ export declare function setPresence(nodeId: string, presence: {
     pane?: string | null;
 }): void;
 /** Record the live pi pid (daemon liveness signal) PLUS its launch-time
- *  identity fingerprint, in one atomic write (crouter#98 review finding 1):
+ *  identity fingerprint, in one atomic write:
  *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
  *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
  *  therefore definitely still exists — this is the LAUNCH-time baseline
@@ -242,7 +242,7 @@ export type TerminalGuardResult<T> = {
 } | {
     kind: 'missing';
 };
-/** #343: close the TOCTOU between checking a target has a natural cycle ahead
+/** Close the TOCTOU between checking a target has a natural cycle ahead
  *  of it and the write that depends on that (for example, a deferred inbox
  *  append). Fresh-reads `nodeId`'s
  *  (status, final_report) and either runs `body` (a write) or short-circuits
@@ -254,7 +254,7 @@ export type TerminalGuardResult<T> = {
  *  write left open. Pass the shared `hasNoNaturalCycle` predicate rather than
  *  a bespoke one so the two never drift.
  *
- *  #343 review (Major): a dangling `nodeId` — the row deleted after the
+ *  A dangling `nodeId` — the row deleted after the
  *  caller's own selection but before this guard's fresh read — MUST NEVER run
  *  `body`. Reporting `'missing'` distinctly from `'terminal'` (rather than
  *  folding it into either the terminal branch or a fabricated "safe" empty

package/dist/core/canvas/canvas.js

@@ -243,7 +243,7 @@ export function setPresence(nodeId, presence) {
         .run(presence.tmux_session ?? null, presence.window ?? null, presence.pane ?? null, nodeId);
 }
 /** Record the live pi pid (daemon liveness signal) PLUS its launch-time
- *  identity fingerprint, in one atomic write (crouter#98 review finding 1):
+ *  identity fingerprint, in one atomic write:
  *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
  *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
  *  therefore definitely still exists — this is the LAUNCH-time baseline
@@ -633,7 +633,7 @@ export function settleDeadMessageWait(nodeId, controller, deliver) {
         return result;
     });
 }
-/** #343: close the TOCTOU between checking a target has a natural cycle ahead
+/** Close the TOCTOU between checking a target has a natural cycle ahead
  *  of it and the write that depends on that (for example, a deferred inbox
  *  append). Fresh-reads `nodeId`'s
  *  (status, final_report) and either runs `body` (a write) or short-circuits
@@ -645,7 +645,7 @@ export function settleDeadMessageWait(nodeId, controller, deliver) {
  *  write left open. Pass the shared `hasNoNaturalCycle` predicate rather than
  *  a bespoke one so the two never drift.
  *
- *  #343 review (Major): a dangling `nodeId` — the row deleted after the
+ *  A dangling `nodeId` — the row deleted after the
  *  caller's own selection but before this guard's fresh read — MUST NEVER run
  *  `body`. Reporting `'missing'` distinctly from `'terminal'` (rather than
  *  folding it into either the terminal branch or a fabricated "safe" empty

package/dist/core/canvas/daemon-owner.js

@@ -1,5 +1,4 @@
-// daemon-owner.ts — the canvas-layer authoritative daemon ownership primitive
-// (Phase 1 runtime-boundary, task D0).
+// daemon-owner.ts — the canvas-layer authoritative daemon ownership primitive.
 //
 // A pidfile check followed by a later write is not singleton ownership: two
 // `crtrd` invocations racing a cold start can both read "no pidfile", both

package/dist/core/canvas/db.js

@@ -58,10 +58,9 @@ function addNodeColumnIfMissing(db, columns, name, ddl) {
     db.exec(ddl);
     columns.add(name);
 }
-/** v2 — additive runtime columns the keystone (Phase 2) will make
- *  authoritative: `intent, pi_pid, window, tmux_session`. `status` already
- *  lives in the baseline row, so it is NOT re-added here. All four default to
- *  NULL, so nothing observes a behavior change until a later phase reads them. */
+/** v2 — the additive runtime columns: `intent, pi_pid, window, tmux_session`.
+ *  `status` already lives in the baseline row, so it is NOT re-added here. All
+ *  four default to NULL; v3 backfills them. */
 function addRuntimeColumns(db) {
     const columns = nodeColumns(db);
     addNodeColumnIfMissing(db, columns, 'intent', `ALTER TABLE nodes ADD COLUMN intent TEXT;`);
@@ -69,14 +68,14 @@ function addRuntimeColumns(db) {
     addNodeColumnIfMissing(db, columns, 'window', `ALTER TABLE nodes ADD COLUMN window TEXT;`);
     addNodeColumnIfMissing(db, columns, 'tmux_session', `ALTER TABLE nodes ADD COLUMN tmux_session TEXT;`);
 }
-/** v3 — DATA backfill (keystone, Phase 2). The runtime fields
+/** v3 — DATA backfill. The runtime fields
  *  (`intent, pi_pid, window, tmux_session`) become authoritative in the row;
  *  copy each existing node's values out of its meta.json into the row columns
  *  once, so the version boundary loses no live state. `status` already mirrors
  *  the row, so it is not re-copied.
  *
- *  LAYERING NOTE (explicitly sanctioned by the runtime-fix plan): a *data*
- *  migration must read meta.json, which db.ts normally would not. Reading it
+ *  LAYERING NOTE — a sanctioned exception: a *data* migration must read
+ *  meta.json, which db.ts normally would not. Reading it
  *  directly here — via paths.ts, a one-time, clearly-labeled boot-time data
  *  migration — is the deliberate choice over splitting the `user_version`
  *  counter across two modules. Idempotent and gated: it runs exactly once at the
@@ -367,7 +366,7 @@ function addProfileIdColumn(db) {
  *  identity fingerprint (`pid.ts`'s `composeIdentity`) recorded alongside
  *  `pi_pid` (v2) by `recordPid`, so `headlessBrokerHost.teardown()` can refuse
  *  to signal a `pi_pid` the OS has since recycled for an unrelated process
- *  (crouter#98 final review, Fix 1 — see `NodeRuntime.pi_pid_identity`).
+ *  (see `NodeRuntime.pi_pid_identity`).
  *  Defaults NULL ⇒ no baseline ⇒ the guard fails open, exactly like a node
  *  booted before this column existed. No data backfill: an existing `pi_pid`
  *  with no recorded identity simply has no launch-time baseline to compare

package/dist/core/canvas/extensions.d.ts

@@ -1,4 +1,4 @@
-export declare const CANVAS_EXTENSION_NAMES: readonly ["canvas-inbox-watcher", "canvas-review-boundary", "canvas-stophook", "canvas-recap", "canvas-goal-capture", "canvas-passive-context", "canvas-context-intro", "canvas-tool-guide", "canvas-doc-substrate", "canvas-structured-output", "canvas-bash-valve"];
+export declare const CANVAS_EXTENSION_NAMES: readonly ["canvas-inbox-watcher", "canvas-review-boundary", "canvas-stophook", "canvas-recap", "canvas-goal-capture", "canvas-passive-context", "canvas-context-intro", "canvas-tool-guide", "canvas-doc-substrate", "canvas-structured-output", "canvas-bash-valve", "canvas-preview-result"];
 /** Structural shipped-hook identity: a canvas-hook stem directly under a
  * `pi-extensions` directory. A user's own extension elsewhere may share the
  * stem and is not shipped. */

package/dist/core/canvas/extensions.js

@@ -7,9 +7,15 @@ export const CANVAS_EXTENSION_NAMES = [
     'canvas-inbox-watcher', 'canvas-review-boundary', 'canvas-stophook', 'canvas-recap',
     'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',
     'canvas-tool-guide', 'canvas-doc-substrate', 'canvas-structured-output',
-    'canvas-bash-valve',
+    'canvas-bash-valve', 'canvas-preview-result',
 ];
 const HISTORICAL_CANVAS_EXTENSION_PREFIXES = [
+    [
+        'canvas-inbox-watcher', 'canvas-review-boundary', 'canvas-stophook', 'canvas-recap',
+        'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',
+        'canvas-tool-guide', 'canvas-doc-substrate', 'canvas-structured-output',
+        'canvas-bash-valve',
+    ],
     [
         'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
         'canvas-goal-capture', 'canvas-passive-context', 'canvas-review-boundary',

package/dist/core/canvas/index.js

@@ -1,5 +1,5 @@
-// The canvas: one global graph of nodes + edges. Phase 0 of the pi-native
-// agent runtime. Topology in sqlite (WAL), node flesh on disk.
+// The canvas: one global graph of nodes + edges.
+// Topology in sqlite (WAL), node flesh on disk.
 export * from './types.js';
 export * from './labels.js';
 export * from './paths.js';

package/dist/core/canvas/pid.d.ts

@@ -8,8 +8,7 @@ export declare function isPidAlive(pid: number | null | undefined): boolean;
  *  `composeIdentity` fingerprints are compared (this module's own
  *  `recordedPidLiveness`, `captureTeardownSnapshot`'s reuse check, and
  *  `killProcessTreePids`'s reuse check) — centralized so no call site can
- *  drift from this rule (review Major #1, Round 2 of the pid-reuse-liveness
- *  fix).
+ *  drift from this rule.
  *
  *  Two hazards this closes, both in the false-DEAD direction (the dangerous
  *  one — a false DEAD lets `reviveNode`'s double-launch guard relaunch a
@@ -94,7 +93,7 @@ export declare function recordedPidLiveness(pid: number | null | undefined, expe
  *  swallowing ESRCH (already gone). Used by cron cancellation, timeout, and
  *  stale-lease recovery. Lives beside isPidAlive: canvas/ is
  *  the lowest shared layer every process-liveness/-teardown primitive sits at.
- *  Guards `pid` before signaling (review nit, crouter#98): never hit pid 0
+ *  Guards `pid` before signaling: never hit pid 0
  *  (which means "my own group") or a negative/non-integer value. */
 export declare function killProcessGroup(pid: number, signal?: NodeJS.Signals): void;
 /** The kernel `boot_id` (`/proc/sys/kernel/random/boot_id`) is stable for the
@@ -155,8 +154,8 @@ export interface PsLivenessSnapshot {
 }
 export declare function captureLivenessSnapshot(): PsLivenessSnapshot | null;
 /** Every transitive descendant of `rootPid`, discovered by walking `ps`'s
- *  pid/ppid table (BFS) — NOT process-GROUP membership. This is the fix for
- *  crouton-labs/crouter#98: the pi SDK's bash tool spawns its shell child with
+ *  pid/ppid table (BFS) — NOT process-GROUP membership. The pi SDK's bash tool
+ *  spawns its shell child with
  *  `detached: true` (verified in `@earendil-works/pi-agent-core`'s
  *  `harness/env/nodejs.js`), which calls `setsid()` and puts that child in a
  *  brand-new process GROUP of its own — so `kill(-rootPid)` never reaches it.
@@ -173,7 +172,7 @@ export declare function descendantPids(rootPid: number): number[];
  *  batched `ps -p <list>` call. `lstart` is a standard format keyword on BOTH
  *  BSD ps (macOS) and procps-ng (Linux), so this needs no `/proc` parsing or
  *  other Linux-only machinery. Used to guard against PID REUSE during the
- *  multi-second teardown escalation ladder (crouter#98 review finding 3): a
+ *  multi-second teardown escalation ladder: a
  *  captured pid can exit and the OS can recycle it for an unrelated process
  *  before the SIGKILL rung fires, and a bare `kill(pid, 0)` / `kill(pid, sig)`
  *  cannot tell the difference.
@@ -182,9 +181,9 @@ export declare function descendantPids(rootPid: number): number[];
  *  could not be spawned, or was killed by the timeout): a probe failure means
  *  we have NO information, which is a fundamentally different outcome from a
  *  probe that SUCCEEDED and simply found no row for a given pid (that pid is
- *  genuinely gone). Collapsing these two into the same empty map was the
- *  final-review bug (crouter#98 signal-safety finding): `killProcessTreePids`
- *  cannot tell "pid confirmed gone" from "we don't know" without this
+ *  genuinely gone). Collapsing these two into the same empty map is unsafe:
+ *  `killProcessTreePids` cannot tell "pid confirmed gone" from "we don't know"
+ *  without this
  *  distinction, and misreading a failed probe as positive proof of
  *  absence/reuse either signals a reused stranger or — worse — silently skips
  *  reaping a real live orphan. A successful call may still return a map with
@@ -210,7 +209,7 @@ export declare function capturePidIdentities(pids: readonly number[]): Map<numbe
  *  signal. */
 export declare function capturePidCommand(pid: number): string | null;
 /** The full pre-signal snapshot `teardown()` needs, taken ONCE, from ONE `ps`
- *  table (crouter#98 final review, Fix 1): the process TREE rooted at `rootPid`
+ *  table: the process TREE rooted at `rootPid`
  *  (itself + every transitive descendant) alongside each member's identity
  *  fingerprint — PLUS, load-bearing, a launch-time-identity REUSE check on
  *  `rootPid` itself before the tree is even walked.
@@ -259,21 +258,20 @@ export declare function captureTeardownSnapshot(rootPid: number, expectedIdentit
  *  caller before sending any signal — see the doc on `isProcessTreeAlive` for
  *  why re-deriving via `ps` after signaling starts is unsafe). Signals EACH
  *  pid's OWN process group (a detached SDK-spawned descendant is its own
- *  group leader — the pi bash tool's shell child, crouton-labs/crouter#98)
+ *  group leader — the pi bash tool's shell child)
  *  PLUS a plain `kill(pid)` on each (belt-and-suspenders for a pid that is
  *  NOT its own group leader). Every signal is best-effort — `killProcessGroup`
  *  swallows ESRCH and the plain `kill` here does too — so firing this against
  *  an already-fully-dead snapshot is a harmless no-op.
  *
- *  `identities`, when supplied (crouter#98 review finding 3), is a
+ *  `identities`, when supplied, is a
  *  `capturePidIdentities` snapshot taken alongside the pid list at the SAME
  *  moment — `null` if that INITIAL capture's `ps` probe itself failed (see
  *  `capturePidIdentities`'s doc). Before signaling EITHER the group or the
  *  plain kill for a pid, this re-derives CURRENT identities in one fresh
  *  batched call and compares — but ONLY skips on POSITIVE proof of reuse; any
  *  failure or absence of evidence falls through to the normal signal path
- *  (fail-open, matching this module's pre-guard behavior — final review,
- *  crouter#98 signal-safety finding):
+ *  (fail-open, matching this module's unguarded behavior):
  *
  *    - baseline identity present AND the current probe SUCCEEDED AND the
  *      current identity for this pid is present AND DIFFERENT — the OS has

package/dist/core/canvas/pid.js

@@ -4,9 +4,8 @@
 // LOWEST shared layer — so canvas/, runtime/, AND daemon/ can all import it
 // "down" without a reverse-layer violation (runtime/ sits above canvas/, daemon/
 // above runtime/). It is a pure process-existence utility, NOT data-model access,
-// so it is exempt from the "only canvas.ts touches the db" rule. Collapses the
-// four near-identical copies that used to live in canvas.ts, revive.ts,
-// placement.ts, and crtrd.ts into one (Phase 3 review reuse MINOR-1).
+// so it is exempt from the "only canvas.ts touches the db" rule. canvas.ts,
+// revive.ts, placement.ts, and crtrd.ts all probe liveness through it.
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readKernelBootId } from './boot-id.js';
@@ -62,8 +61,7 @@ const BOOT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12
  *  purely-numeric suffix counts as ticks (the shape `procStartTicks` and
  *  `composeIdentity` guarantee); a malformed or empty suffix (`A#`, `A#bad`,
  *  `A#1#2`) is treated as ABSENT ticks, so the base compare then applies — a
- *  garbage suffix must never be trusted as a fine discriminator (review
- *  Minor). */
+ *  garbage suffix must never be trusted as a fine discriminator. */
 function splitIdentity(identity) {
     const i = identity.indexOf('#');
     if (i === -1)
@@ -75,8 +73,7 @@ function splitIdentity(identity) {
  *  `composeIdentity` fingerprints are compared (this module's own
  *  `recordedPidLiveness`, `captureTeardownSnapshot`'s reuse check, and
  *  `killProcessTreePids`'s reuse check) — centralized so no call site can
- *  drift from this rule (review Major #1, Round 2 of the pid-reuse-liveness
- *  fix).
+ *  drift from this rule.
  *
  *  Two hazards this closes, both in the false-DEAD direction (the dangerous
  *  one — a false DEAD lets `reviveNode`'s double-launch guard relaunch a
@@ -208,7 +205,7 @@ function logPidLivenessDecision(pid, isPidAliveResult, expectedIdentity, probeOu
  *  swallowing ESRCH (already gone). Used by cron cancellation, timeout, and
  *  stale-lease recovery. Lives beside isPidAlive: canvas/ is
  *  the lowest shared layer every process-liveness/-teardown primitive sits at.
- *  Guards `pid` before signaling (review nit, crouter#98): never hit pid 0
+ *  Guards `pid` before signaling: never hit pid 0
  *  (which means "my own group") or a negative/non-integer value. */
 export function killProcessGroup(pid, signal = 'SIGTERM') {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -220,8 +217,8 @@ export function killProcessGroup(pid, signal = 'SIGTERM') {
         /* already gone */
     }
 }
-/** Linux-only higher-resolution discriminator layered onto `lstart` (crouter#98
- *  review finding, minor): `ps lstart` is only second-granular, so a PID reused
+/** Linux-only higher-resolution discriminator layered onto `lstart`:
+ *  `ps lstart` is only second-granular, so a PID reused
  *  within the same wall-clock second compares equal and slips past the reuse
  *  guard. `/proc/<pid>/stat`'s `starttime` field is the kernel's own jiffies-
  *  since-boot counter for that process — effectively unique per pid even for
@@ -395,8 +392,8 @@ function descendantPidsFrom(rootPid, childrenOf) {
     return out;
 }
 /** Every transitive descendant of `rootPid`, discovered by walking `ps`'s
- *  pid/ppid table (BFS) — NOT process-GROUP membership. This is the fix for
- *  crouton-labs/crouter#98: the pi SDK's bash tool spawns its shell child with
+ *  pid/ppid table (BFS) — NOT process-GROUP membership. The pi SDK's bash tool
+ *  spawns its shell child with
  *  `detached: true` (verified in `@earendil-works/pi-agent-core`'s
  *  `harness/env/nodejs.js`), which calls `setsid()` and puts that child in a
  *  brand-new process GROUP of its own — so `kill(-rootPid)` never reaches it.
@@ -420,7 +417,7 @@ export function descendantPids(rootPid) {
  *  batched `ps -p <list>` call. `lstart` is a standard format keyword on BOTH
  *  BSD ps (macOS) and procps-ng (Linux), so this needs no `/proc` parsing or
  *  other Linux-only machinery. Used to guard against PID REUSE during the
- *  multi-second teardown escalation ladder (crouter#98 review finding 3): a
+ *  multi-second teardown escalation ladder: a
  *  captured pid can exit and the OS can recycle it for an unrelated process
  *  before the SIGKILL rung fires, and a bare `kill(pid, 0)` / `kill(pid, sig)`
  *  cannot tell the difference.
@@ -429,9 +426,9 @@ export function descendantPids(rootPid) {
  *  could not be spawned, or was killed by the timeout): a probe failure means
  *  we have NO information, which is a fundamentally different outcome from a
  *  probe that SUCCEEDED and simply found no row for a given pid (that pid is
- *  genuinely gone). Collapsing these two into the same empty map was the
- *  final-review bug (crouter#98 signal-safety finding): `killProcessTreePids`
- *  cannot tell "pid confirmed gone" from "we don't know" without this
+ *  genuinely gone). Collapsing these two into the same empty map is unsafe:
+ *  `killProcessTreePids` cannot tell "pid confirmed gone" from "we don't know"
+ *  without this
  *  distinction, and misreading a failed probe as positive proof of
  *  absence/reuse either signals a reused stranger or — worse — silently skips
  *  reaping a real live orphan. A successful call may still return a map with
@@ -529,21 +526,20 @@ export function captureTeardownSnapshot(rootPid, expectedIdentity) {
  *  caller before sending any signal — see the doc on `isProcessTreeAlive` for
  *  why re-deriving via `ps` after signaling starts is unsafe). Signals EACH
  *  pid's OWN process group (a detached SDK-spawned descendant is its own
- *  group leader — the pi bash tool's shell child, crouton-labs/crouter#98)
+ *  group leader — the pi bash tool's shell child)
  *  PLUS a plain `kill(pid)` on each (belt-and-suspenders for a pid that is
  *  NOT its own group leader). Every signal is best-effort — `killProcessGroup`
  *  swallows ESRCH and the plain `kill` here does too — so firing this against
  *  an already-fully-dead snapshot is a harmless no-op.
  *
- *  `identities`, when supplied (crouter#98 review finding 3), is a
+ *  `identities`, when supplied, is a
  *  `capturePidIdentities` snapshot taken alongside the pid list at the SAME
  *  moment — `null` if that INITIAL capture's `ps` probe itself failed (see
  *  `capturePidIdentities`'s doc). Before signaling EITHER the group or the
  *  plain kill for a pid, this re-derives CURRENT identities in one fresh
  *  batched call and compares — but ONLY skips on POSITIVE proof of reuse; any
  *  failure or absence of evidence falls through to the normal signal path
- *  (fail-open, matching this module's pre-guard behavior — final review,
- *  crouter#98 signal-safety finding):
+ *  (fail-open, matching this module's unguarded behavior):
  *
  *    - baseline identity present AND the current probe SUCCEEDED AND the
  *      current identity for this pid is present AND DIFFERENT — the OS has

package/dist/core/canvas/remote-transport.js

@@ -21,8 +21,8 @@ export function createRemoteExec(previewEndpoint, relayToken, timeoutMs = DEFAUL
     // A malformed stored token (control chars / non-Latin1 bytes) would throw
     // from the Headers constructor with the invalid value IN the thrown
     // message — validate up front so that never happens, and fail with a
-    // GENERIC message instead (Phase 3 review Minor 1: no token bytes may ever
-    // reach returned stderr). HTTP header values are ISO-8859-1; reject
+    // GENERIC message instead: no token bytes may ever reach returned stderr.
+    // HTTP header values are ISO-8859-1; reject
     // anything outside `/^[\x20-\x7e]+$/` (printable ASCII, no CR/LF/control).
     const tokenValid = /^[\x20-\x7e]+$/.test(relayToken);
     return async function exec(bin, args) {

package/dist/core/canvas/status-glyph.d.ts

@@ -28,7 +28,7 @@ export declare function resolveNodeVisual(status: NodeStatus, opts: {
  *  dashboard flags the node for the human. Exported so a recovery verb (e.g.
  *  `node lifecycle revive --now`, src/commands/node-lifecycle-revive.ts) can gate on the SAME
  *  predicate the dashboard advertises instead of drifting out of sync with it
- *  (issue #115 — `--now` used to reject exactly the nodes shown as "needs you"). */
+ *  and rejecting exactly the nodes shown as "needs you". */
 export declare function faultNeedsYou(fault: Pick<Fault, 'retry'>): boolean;
 /** Human-friendly active-fault disposition text. `auto` faults show the current
  *  retry attempt plus the next scheduled retry; client-owned redials say

package/dist/core/canvas/status-glyph.js

@@ -69,7 +69,7 @@ function retryCountdown(iso, now) {
  *  dashboard flags the node for the human. Exported so a recovery verb (e.g.
  *  `node lifecycle revive --now`, src/commands/node-lifecycle-revive.ts) can gate on the SAME
  *  predicate the dashboard advertises instead of drifting out of sync with it
- *  (issue #115 — `--now` used to reject exactly the nodes shown as "needs you"). */
+ *  and rejecting exactly the nodes shown as "needs you". */
 export function faultNeedsYou(fault) {
     return fault.retry.disposition !== 'auto';
 }

package/dist/core/canvas/types.d.ts

@@ -191,7 +191,7 @@ export interface NodeRuntime {
     /** Stable process-identity fingerprint (`pid.ts`'s `composeIdentity`) captured
      *  at the SAME moment `pi_pid` is recorded (`recordPid`) — the LAUNCH-time
      *  baseline `headlessBrokerHost.teardown()` compares `pi_pid`'s CURRENT
-     *  identity against before signaling anything (crouter#98 review finding 1):
+     *  identity against before signaling anything:
      *  a mismatch proves the OS has already recycled `pi_pid` for an unrelated
      *  process since this node launched it, and teardown must refuse to signal
      *  that stranger. `null` for a node booted before this field existed, or if

package/dist/core/command-manifests/manifest.js

@@ -8,14 +8,12 @@
 // This is pure validation: no fetch, no registration lookup, no file I/O beyond
 // the raw manifest bytes passed in.
 import { validateCommandNode } from './schema.js';
+import { isRecord } from '../../shared/predicates.js';
 // ---------------------------------------------------------------------------
 // Validation helpers
 // ---------------------------------------------------------------------------
 const KEBAB = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REST_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
-function isObject(v) {
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
 function typeName(v) {
     if (v === null)
         return 'null';
@@ -38,7 +36,7 @@ export function validateCommandManifest(raw, options) {
         issues.push({ code, message, received, expected, next, ...(path ? { path } : {}) });
     };
     // Top-level structure check
-    if (!isObject(raw)) {
+    if (!isRecord(raw)) {
         issue('command_manifest_invalid', 'manifest must be an object', typeName(raw), options.transport === 'http' ? '{ schemaVersion, baseUrl?, timeouts?, mounts }' : '{ schemaVersion, mounts }', 'Provide a valid JSON manifest object.');
         return { issues };
     }
@@ -126,7 +124,7 @@ export function validateCommandManifest(raw, options) {
 // Timeouts validation
 // ---------------------------------------------------------------------------
 function validateTimeouts(raw, issue) {
-    if (!isObject(raw)) {
+    if (!isRecord(raw)) {
         issue('command_manifest_invalid', 'timeouts must be an object', typeName(raw), '{ connectMs?, requestMs?, streamIdleMs? }', 'Fix timeouts.', 'timeouts');
         return null;
     }
@@ -150,7 +148,7 @@ function validateTimeouts(raw, issue) {
 }
 function validateMount(raw, index, transport, issue) {
     const path = `mounts[${index}]`;
-    if (!isObject(raw)) {
+    if (!isRecord(raw)) {
         issue('command_manifest_invalid', 'mount must be an object', typeName(raw), '{ parent, node }', 'Fix the mount.', path);
         return null;
     }