@north-light/crouter 0.3.198 → 0.3.199

package/dist/core/__tests__/human-node-not-supervised.test.js

@@ -1,7 +1,7 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/human-node-not-supervised.test.ts
 //
 // BUG REGRESSION (issue #2 — "Headless node can't reach human-ask: human-kind
-// TUI dies at boot"): a headless orchestrator's every `crtr human ask` node died
+// TUI dies at boot"): a headless orchestrator's every reply-bearing `crtr human send` bridge died
 // at boot with "pi vehicle exited before the session came up".
 //
 // ROOT CAUSE: a kind:'human' row is NOT a broker-hosted agent node — it is a

package/dist/core/__tests__/plugin-page-components.test.js

@@ -0,0 +1,157 @@
+// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/plugin-page-components.test.ts
+//
+// Wiring pins for plugin-contributed page components — the layer whose absence
+// is SILENT: every authoring, validation, daemon, inbox, and TUI consumer takes
+// the catalog as a parameter, so if `resolvePageComponents` stopped reading
+// installed plugins' manifest `page_components` blocks, every plugin-shipped
+// component would simply stop being authorable with all suites green.
+// Plus the archive path: `validatePluginBundle` must carry a valid bundle.json
+// `page_components` block into `ValidatedBundle.page_components` (what the
+// installer copies into the synthesized manifest) and reject an invalid one.
+import { test, before, beforeEach, afterEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import * as tar from 'tar';
+import { resetScopeCache } from '../scope.js';
+import { resolvePageComponents } from '../config.js';
+import { validatePluginBundle } from '../command-plugins/bundle.js';
+let isolatedHome;
+let isolatedCwd;
+let prevHome;
+let prevCwd;
+before(() => {
+    prevHome = process.env.HOME;
+    prevCwd = process.cwd();
+});
+beforeEach(() => {
+    isolatedHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-page-components-home-')));
+    isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-page-components-cwd-')));
+    process.env.HOME = isolatedHome;
+    process.chdir(isolatedCwd);
+    resetScopeCache();
+});
+afterEach(() => {
+    process.chdir(prevCwd);
+    rmSync(isolatedHome, { recursive: true, force: true });
+    rmSync(isolatedCwd, { recursive: true, force: true });
+});
+after(() => {
+    process.chdir(prevCwd);
+    process.env.HOME = prevHome;
+    resetScopeCache();
+});
+/** Plant a manifest-only plugin (page components need no commands or executable). */
+function plantPlugin(scopeRootPath, name, pageComponents) {
+    const root = join(scopeRootPath, 'plugins', name, '.crouter-plugin');
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'plugin.json'), JSON.stringify({ name, version: '0.1.0', page_components: pageComponents }));
+}
+function userRoot() {
+    const root = join(isolatedHome, '.crouter');
+    mkdirSync(root, { recursive: true });
+    return root;
+}
+test('an enabled user-scope plugin contributes its page components; a disabled one contributes nothing', () => {
+    const root = userRoot();
+    plantPlugin(root, 'northlight', [
+        { kind: 'connector', description: 'Connector decision', useWhen: 'Use for a connector decision.', doc: 'Product contract.' },
+        { kind: 'applet-card', display: true },
+    ]);
+    plantPlugin(root, 'zzz-disabled', ['ghost']);
+    writeFileSync(join(root, 'config.json'), JSON.stringify({ plugins: { 'zzz-disabled': { enabled: false } } }));
+    const components = resolvePageComponents();
+    assert.deepEqual(components, [
+        { kind: 'connector', description: 'Connector decision', useWhen: 'Use for a connector decision.', doc: 'Product contract.' },
+        { kind: 'applet-card', display: true },
+    ]);
+});
+test('user config entries and plugin contributions resolve together, and a colliding kind is rejected', () => {
+    const root = userRoot();
+    plantPlugin(root, 'northlight', ['connector']);
+    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['approval'] }));
+    assert.deepEqual(resolvePageComponents().map((component) => component.kind), ['approval', 'connector']);
+    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['connector'] }));
+    assert.throws(() => resolvePageComponents(), /page component kind "connector" is registered by both config.json and plugin "northlight"/);
+});
+test('two plugins whose kinds derive one JSX tag are rejected, naming both sources', () => {
+    const root = userRoot();
+    plantPlugin(root, 'alpha', ['foo-bar']);
+    plantPlugin(root, 'beta', ['foo--bar']);
+    assert.throws(() => resolvePageComponents(), /kind "foo--bar" \(plugin "beta"\) derives JSX tag "FooBar", which duplicates kind "foo-bar" from plugin "alpha"/);
+});
+// --- archive path -----------------------------------------------------------
+function minimalCommandsJson() {
+    return {
+        schemaVersion: 1,
+        mounts: [
+            {
+                parent: [],
+                node: {
+                    kind: 'branch',
+                    name: 'app',
+                    description: 'application lifecycle and inspection',
+                    whenToUse: 'you need to inspect an application',
+                    rootEntry: {
+                        concept: 'applications hosted by a crouter home',
+                        description: 'application lifecycle and inspection',
+                        whenToUse: 'you need to inspect an application',
+                    },
+                    summary: 'application lifecycle and inspection',
+                    model: 'Applications are product resources owned by the selected home.',
+                    children: [
+                        {
+                            kind: 'leaf',
+                            name: 'show',
+                            description: 'show one application',
+                            whenToUse: 'inspect a single application by id',
+                            tier: 'important',
+                            summary: 'show one application details',
+                            params: [{ kind: 'positional', name: 'app-id', required: true, constraint: 'the application id' }],
+                            output: [{ name: 'app_id', type: 'string', required: true, constraint: 'the echoed application id' }],
+                            effects: ['None. Read-only.'],
+                            rest: { method: 'GET', path: '/v1/apps/{app-id}', params: { 'app-id': { in: 'path' } } },
+                        },
+                    ],
+                },
+            },
+        ],
+    };
+}
+function makeArchive(bundleJson) {
+    const dir = mkdtempSync(join(tmpdir(), 'crtr-page-components-tar-'));
+    try {
+        writeFileSync(join(dir, 'bundle.json'), JSON.stringify(bundleJson));
+        writeFileSync(join(dir, 'commands.json'), JSON.stringify(minimalCommandsJson()));
+        const pack = tar.create({ sync: true, cwd: dir, portable: true }, ['bundle.json', 'commands.json']);
+        const chunks = [];
+        let chunk;
+        while ((chunk = pack.read()) !== null)
+            chunks.push(chunk);
+        return new Uint8Array(Buffer.concat(chunks));
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+test('validatePluginBundle carries a valid bundle.json page_components block into ValidatedBundle', async () => {
+    const archive = makeArchive({
+        bundleVersion: 1,
+        page_components: ['connector', { kind: 'applet-card', description: 'Applet card', display: true }],
+    });
+    const validated = await validatePluginBundle(archive, { reservedCoreNames: new Set(['node']) });
+    assert.deepEqual(validated.issues, []);
+    assert.deepEqual(validated.bundle?.page_components, [
+        { kind: 'connector' },
+        { kind: 'applet-card', description: 'Applet card', display: true },
+    ]);
+});
+test('validatePluginBundle rejects an invalid page_components block loudly', async () => {
+    const archive = makeArchive({ bundleVersion: 1, page_components: [{ kind: 'connector', use_when: 'typo field' }] });
+    const validated = await validatePluginBundle(archive, { reservedCoreNames: new Set(['node']) });
+    assert.equal(validated.bundle, undefined);
+    assert.equal(validated.issues.length, 1);
+    assert.match(validated.issues[0].message, /page_components block is invalid/);
+    assert.match(validated.issues[0].received, /use_when/);
+});

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -19,6 +19,8 @@
 // they belong to the compiled seam tier; neither needs tmux.
 import { after, before, test } from 'node:test';
 import assert from 'node:assert/strict';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { appendInbox, readCursor, readInboxSince } from '../../feed/inbox.js';
 import { registerWarmSpare, subscribe, updateNode } from '../../canvas/index.js';
 import { isPidAlive } from '../../canvas/pid.js';
@@ -176,6 +178,44 @@ test('an unattended resident with no live obligation completes on the daemon clo
             process.env['CRTR_TEST_UNATTENDED_PARK_MS'] = priorParkMs;
     }
 });
+test('a connected broker viewer keeps an obligation-free resident live', { timeout: 30_000 }, async () => {
+    const priorParkMs = process.env['CRTR_TEST_UNATTENDED_PARK_MS'];
+    process.env['CRTR_TEST_UNATTENDED_PARK_MS'] = '1500';
+    const nodeId = h.fabricateBrokerNode({
+        id: 'settled-with-viewer',
+        parent: root,
+        lifecycle: 'resident',
+        status: 'idle',
+        intent: 'idle-release',
+    });
+    updateNode(nodeId, {
+        launch: {
+            extensions: [],
+            tools: [],
+            systemPrompt: '',
+            env: {},
+        },
+    });
+    reviveNode(nodeId, { resume: true });
+    const boot = await h.awaitBoot(nodeId);
+    // This is the presence written by a helloed direct attach, which has no
+    // focuses-table row because it did not pass through the focus opener.
+    writeFileSync(join(h.home, 'nodes', nodeId, 'job', 'attach.json'), JSON.stringify({ viewers: 1 }));
+    try {
+        const seenAt = 15_000;
+        await h.tick(seenAt);
+        await h.tick(seenAt + 1500);
+        assert.equal(h.fleet.has(nodeId), true, 'an attached viewer keeps the broker fleet-owned');
+        assert.equal(isPidAlive(boot.pid), true, 'an attached viewer keeps the broker process alive');
+        assert.ok(['active', 'idle'].includes(h.node(nodeId)?.status ?? ''), 'an attached viewer keeps the node live');
+    }
+    finally {
+        if (priorParkMs === undefined)
+            delete process.env['CRTR_TEST_UNATTENDED_PARK_MS'];
+        else
+            process.env['CRTR_TEST_UNATTENDED_PARK_MS'] = priorParkMs;
+    }
+});
 test('an already idle terminal node with no live obligation reconciles into canceled', async () => {
     const nodeId = h.fabricateBrokerNode({
         id: 'idle-terminal-without-obligation',

package/dist/core/__tests__/serial/flagship-lifecycle.test.js

@@ -150,7 +150,7 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         //      ('natural stop while awaiting a live worker → idle-release …').
         // ===================================================================
         {
-            const stop = evaluateStop(B, { pushedFinal: false, askedHuman: false });
+            const stop = evaluateStop(B, { pushedFinal: false, requestedHumanReply: false });
             assert.equal(stop.action, 'allow', 'awaiting terminal B → allow (legit idle-release)');
             assert.equal(stop.reason, 'awaiting', "B classified awaiting on its ACTIVE live sub to C");
         }
@@ -225,7 +225,7 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
             assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
             assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator guidance');
-            const stop = evaluateStop(B, { pushedFinal: false, askedHuman: false });
+            const stop = evaluateStop(B, { pushedFinal: false, requestedHumanReply: false });
             assert.equal(stop.action, 'reprompt', 'orchestrator B with no live sub, no final → reprompt');
             assert.equal(stop.reason, 'stalled', 'classified stalled');
             assert.equal(stop.action === 'reprompt' ? stop.message : '', STALL_REPROMPT, 'the stall reprompt nudge');

package/dist/core/__tests__/serial/human-deliver-e2e.test.js

@@ -11,6 +11,7 @@ import { ApiError, CrtrClient } from '../../../api/index.js';
 import { createApiServer } from '../../../daemon/api/server.js';
 import { apiSocketPath } from '../../canvas/paths.js';
 import { claimTicket, readTicketClaim } from '../../human/claim.js';
+import { bindTicketReplyRoute } from '../../human/convention.js';
 import { ticketDir } from '../../human/root.js';
 import { submitPage, submitReview } from '../../human/tickets.js';
 import { spawnNode } from '../../runtime/nodes.js';
@@ -66,10 +67,14 @@ async function expectReviewSubmitGuidance(nodeId, body) {
 function submitBridgePage(bridge) {
     const dir = ticketDir(bridge);
     const sourceDir = mkdtempSync(join(tmpdir(), 'crtr-e2e-page-'));
-    const sourceFile = join(sourceDir, 'page.html');
-    writeFileSync(sourceFile, '<!doctype html><html><head><meta name="crtr-page-title" content="Ship it?"><meta name="crtr-page-subtitle" content="Decide whether to ship now so the release can proceed."></head><body><crtr-pages><crtr-page><crtr-text id="question"><script type="application/json">{"initialText":"","editable":true}</script></crtr-text></crtr-page></crtr-pages></body></html>');
+    const sourceFile = join(sourceDir, 'page.tsx');
+    writeFileSync(sourceFile, 'export default () => (\n  <Page title="Ship it?" subtitle="Decide whether to ship now so the release can proceed.">\n    <UserText id="question" initialText="" />\n  </Page>\n);\n');
     try {
-        submitPage({ dir, sourceFile, dialect: 'html' });
+        bindTicketReplyRoute(dir, bridge);
+        // The delivery `human send` derives for a terminal bridge page: a
+        // response-bearing slot gives it a reply route, and a terminal sender's page
+        // always projects to the inbox.
+        submitPage({ dir, sourceFile, delivery: { placement: 'inline', inbox: true, reply: true } });
     }
     finally {
         rmSync(sourceDir, { recursive: true, force: true });
@@ -100,6 +105,7 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
     const reviewDir = ticketDir(reviewBridge);
     const file = join(home, 'review.md');
     writeFileSync(file, '# Review\n');
+    bindTicketReplyRoute(reviewDir, reviewBridge);
     submitReview({ dir: reviewDir, review: { title: 'Review', subtitle: 'Review this file so implementation can proceed safely.', source: {}, file } });
     const reviewClaim = claimTicket(reviewDir);
     assert.ok(reviewClaim !== null);
@@ -108,10 +114,10 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
 });
 test('the ticket resolve route pushFinals the readable answer to the parent', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-ask', lifecycle: 'terminal' }).node_id;
+    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     const dir = submitBridgePage(bridge);
-    const result = await client.resolveHumanTicket(bridge, { responses: { question: { text: 'yes, ship', edited: true, comments: [] } } });
-    assert.deepEqual(result, { delivered: true, kind: 'page' });
+    const result = await client.resolveHumanTicket(bridge, { responses: { question: { text: 'yes, ship', edited: true } } });
+    assert.deepEqual(result, { completed: true, reply_delivered: true, kind: 'page' });
     assert.equal(getNode(bridge)?.status, 'done', 'bridge finalized by crtrd');
     const finals = readInboxSince(parent).filter((entry) => entry.from === bridge && entry.kind === 'final');
     assert.equal(finals.length, 1, 'exactly one pushFinal reached the parent');

package/dist/core/__tests__/serial/live-mutation.test.js

@@ -48,7 +48,7 @@ import { evaluateStop } from '../../runtime/stop-guard.js';
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
-const SIGNALS = { pushedFinal: false, askedHuman: false };
+const SIGNALS = { pushedFinal: false, requestedHumanReply: false };
 // ===========================================================================
 // (a) LIFECYCLE FLIP — `crtr node config --lifecycle` on a LIVE node, both directions,
 //     observing the idle-release DECISION change. A round-trip on ONE node

package/dist/core/__tests__/serial/tmux-surface.test.js

@@ -186,7 +186,7 @@ test('tmux installer remaps owned pairs and preserves occupied user bindings', (
         const defaultMenu = tmuxBinding(socket, 'root', 'M-c') ?? '';
         assert.match(defaultMenu, /display-menu/);
         // The inbox toggle installs at its default key (alt+i → M-i) in the same sweep.
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr surface inbox/);
         const remapped = installTmuxBindings(resolveKeybindings({
             'crtr.tmux.menu.open': ['alt+shift+z'],
             'crtr.tmux.menu.graph': ['shift+z'],
@@ -242,11 +242,13 @@ test('tmux installer reads pair-array manifests and replaces owned pairs', (t) =
     try {
         // Current-scope releases wrote the pair array before wrappers were added.
         isolatedTmux(socket, ['set-option', '-s', '@crtr_keybindings_manifest', JSON.stringify([{ table: 'root', key: 'M-i' }])]);
+        // Seeded with the pre-move command path, so the assertion below distinguishes a
+        // genuine replacement from a no-op.
         isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-i', 'run-shell', '-b', 'crtr human inbox toggle --quiet']);
         const result = installTmuxBindings(resolveKeybindings());
         assert.equal(result.ok, true, JSON.stringify(result.diagnostics));
         assert.ok(!result.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(result.diagnostics));
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr surface inbox/);
         assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /background running bash/);
     }
     finally {

package/dist/core/__tests__/serial/worktree.test.js

@@ -1,12 +1,11 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, existsSync, readdirSync, statSync, writeFileSync, chmodSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, existsSync, statSync, writeFileSync, chmodSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../../git.js';
-import { push } from '../../feed/feed.js';
-import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree, setWorktreeCleanupRunnerForTest } from '../../worktree.js';
+import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree } from '../../worktree.js';
 import { createNode, getNode } from '../../canvas/canvas.js';
 import { closeDb } from '../../canvas/db.js';
 let home;
@@ -60,14 +59,9 @@ after(() => {
     rmSync(sourceDir, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-// Regression for #120: `git worktree remove` deletes the checkout directory
-// that IS the calling node's own pi-process cwd. A process can never chdir
-// itself out of a directory that vanishes out from under it, so once that
-// dir is gone every subsequent bash in that node fails permanently and the
-// mandated post-close `crtr push final` can never run. closeManagedWorktree
-// must leave the path resolvable (as an empty tombstone dir) even though the
-// git worktree registration itself is gone.
-test('closeManagedWorktree recreates the worktree path as a tombstone dir so the node cwd still resolves', () => {
+// Regression for #710: close lands from a live caller, so it must preserve the
+// caller checkout rather than starting Git's recursive removal beneath it.
+test('closeManagedWorktree leaves the active caller checkout intact with named deferred cleanup', () => {
     const nodeId = 'wt-close-1';
     const wt = createManagedWorktree(sourceDir, nodeId);
     assert.equal(wt.base_ref, 'main', 'default base must remain backward-compatible with persisted main worktrees');
@@ -75,22 +69,16 @@ test('closeManagedWorktree recreates the worktree path as a tombstone dir so the
     assert.ok(existsSync(wt.path), 'worktree checkout should exist after create');
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
     const result = closeManagedWorktree(nodeId);
-    assert.equal(result.worktree_removed, true);
-    // The path must still resolve as a directory — this is the actual fix: a
-    // node whose cwd was wt.path can still chdir there / run bash / push final.
-    assert.ok(existsSync(wt.path), 'worktree path must still exist after close (tombstone)');
-    assert.ok(statSync(wt.path).isDirectory(), 'recreated path must be a directory');
-    assert.deepEqual(readdirSync(wt.path), [], 'tombstone dir should be empty — git already removed the real checkout');
-    // git itself no longer tracks it as a worktree.
+    assert.equal(result.worktree_removed, false);
+    assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
+    assert.ok(existsSync(join(wt.path, 'README.md')), 'the caller checkout keeps its tracked files');
+    assert.ok(statSync(wt.path).isDirectory(), 'the caller cwd remains a directory');
     const list = gitSync(['worktree', 'list', '--porcelain'], sourceDir);
-    assert.ok(!list.stdout.includes(wt.path), 'git should no longer register the removed worktree');
+    assert.ok(list.stdout.includes(wt.path), 'Git keeps the intact caller checkout registered');
     const meta = getNode(nodeId);
     assert.equal(meta?.managed_worktree?.state, 'closed');
-    // Regression for #519: a later park/revive must relaunch from the durable
-    // base checkout, not the torn-down worktree dir (best-effort tombstone —
-    // reapable by concurrent git GC, and not a real repo checkout even while
-    // it survives). closeManagedWorktree must repoint the persisted cwd.
-    assert.equal(meta?.cwd, wt.repo_root, 'closed node cwd must repoint to the repo root, not the removed worktree path');
+    assert.equal(meta?.managed_worktree?.cleanup, 'pending');
+    assert.equal(meta?.cwd, wt.repo_root, 'a later revive uses the durable base checkout');
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
     const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;
@@ -372,7 +360,8 @@ test('close ignores crtr\'s own untracked .crouter/config.json and state.json bo
     // reports a clean tree, not just that close happens not to notice.
     assert.equal(gitSync(['status', '--porcelain'], wt.path).stdout.trim(), '', 'git status must already be clean with only crtr bookkeeping present');
     const result = closeManagedWorktree(nodeId);
-    assert.equal(result.worktree_removed, true);
+    assert.equal(result.worktree_removed, false);
+    assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
 });
 // The exclude must be narrow: it must NEVER hide real, committable node work
 // that merely happens to live under `.crouter/` — this mirrors crouter's OWN
@@ -416,21 +405,15 @@ test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async (
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
     const result = autoDropCleanManagedWorktree(nodeId);
     assert.ok(result !== null, 'a worktree with zero commits and a clean tree must be droppable');
-    assert.equal(result?.worktree_removed, true);
+    assert.equal(result?.worktree_removed, false);
+    assert.match(result?.worktree_remove_error ?? '', /cleanup pending/);
     const meta = getNode(nodeId);
     assert.equal(meta?.managed_worktree?.state, 'closed');
-    assert.ok(!gitSync(['worktree', 'list', '--porcelain'], sourceDir).stdout.includes(wt.path), 'git must no longer register the dropped worktree');
-    // Regression for #519: auto-drop must persist the SAME closed-worktree
-    // transition explicit close does — repointing `cwd` to the durable base
-    // checkout, atomically with `state: 'closed'`. Before the fix, auto-drop
-    // left `cwd` at the removed worktree path; that path is recreated as an
-    // empty tombstone dir (see `bestEffortRemoveWorktreeCheckout`), so a later
-    // `--reopen` revive's `existsSync(meta.cwd)` preflight passed anyway and
-    // launched into a non-checkout instead of failing loud or landing somewhere
-    // real. `cwd` must be durable: a real git checkout, not a reapable stand-in.
-    assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd must repoint to the repo root, not the removed worktree path');
-    assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd must resolve to a real git checkout a reopen/revive can launch from');
-    assert.equal(existsSync(join(wt.path, '.git')), false, 'the tombstoned worktree path must NOT itself resolve as a git checkout');
+    assert.equal(meta?.managed_worktree?.cleanup, 'pending');
+    assert.ok(gitSync(['worktree', 'list', '--porcelain'], sourceDir).stdout.includes(wt.path), 'Git keeps the caller checkout registered until it exits');
+    assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd repoints to the durable base checkout');
+    assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd resolves to a real git checkout');
+    assert.ok(existsSync(join(wt.path, '.git')), 'the intact caller worktree remains a git checkout');
 });
 // The same real-commit case close already protects: a worktree with actual
 // unlanded work must NEVER be auto-dropped by push-final.
@@ -570,9 +553,10 @@ test('autoDropCleanManagedWorktree drops a branch with real commits already cont
     assert.equal(gitSync(['rev-parse', 'main'], repo).stdout.trim(), branchSha);
     const result = autoDropCleanManagedWorktree(nodeId);
     assert.ok(result !== null, 'a branch whose commits are already contained in a moved base has nothing left to land');
-    assert.equal(result?.branch_deleted, true);
+    assert.equal(result?.branch_deleted, false);
     assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 1, 'the now-redundant branch ref must actually be gone');
+    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'pending');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 0, 'the caller branch remains checked out until cleanup runs after exit');
     // The work itself is NOT lost — it stays reachable from main, which is the point.
     assert.equal(gitSync(['merge-base', '--is-ancestor', branchSha, 'main'], repo).status, 0, 'the landed commit must remain reachable from main after the drop');
     rmSync(repo, { recursive: true, force: true });
@@ -687,63 +671,6 @@ test('the re-verified base containment refuses when the base is rewritten betwee
 // for the branch-only race, and the same one the independent re-review used
 // to reproduce this exact Critical against `6de1c8d`.
 // ---------------------------------------------------------------------------
-test('auto-drop atomic delete refuses when the base is force-reset between the live ancestry check and the ref transaction', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-auto-drop-base-window-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const preMergeMainSha = gitSync(['rev-parse', 'main'], repo).stdout.trim();
-    const nodeId = 'wt-auto-drop-base-window';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'feature.txt'), 'landed elsewhere\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
-    const branchSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    // A manager fast-forwards main past this branch's own tip, exactly like
-    // the #327 positive case, so the branch proves clean-and-contained.
-    run(['merge', '--ff-only', branchSha], repo);
-    assert.equal(gitSync(['rev-parse', 'main'], repo).stdout.trim(), branchSha);
-    const proof = proveCleanEmptyManagedWorktree(wt);
-    assert.ok(proof !== null, 'the branch, now contained in the moved base, must prove droppable');
-    // Wrap `git worktree remove` — the call `autoDropCleanManagedWorktreeLocked`
-    // makes strictly AFTER its own live ancestry re-check and strictly BEFORE
-    // its ref-deletion transaction — to force-reset main back to its pre-merge
-    // tip right before the real removal runs. A sequential re-check placed
-    // anywhere before this point cannot see this rewrite; only binding the
-    // base's live value into the delete transaction itself can.
-    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
-    const wrapperPath = join(wrapperDir, 'git');
-    const originalPath = process.env['PATH'] ?? '';
-    writeFileSync(wrapperPath, `#!/bin/sh
-if [ "$1" = "worktree" ] && [ "$2" = "remove" ] && [ "$3" = "${wt.path}" ]; then
-  PATH="$CRTR_TEST_REAL_PATH" git -C "${repo}" update-ref refs/heads/main "${preMergeMainSha}"
-fi
-PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
-`);
-    chmodSync(wrapperPath, 0o755);
-    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
-    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
-    let result;
-    try {
-        result = autoDropCleanManagedWorktreeLocked(nodeId, wt, proof);
-    }
-    finally {
-        process.env['PATH'] = originalPath;
-        delete process.env['CRTR_TEST_REAL_PATH'];
-        rmSync(wrapperDir, { recursive: true, force: true });
-    }
-    assert.equal(result, null, 'a base rewritten strictly after the live ancestry check must still refuse the atomic delete');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'state must stay open — nothing may be marked safely dropped');
-    const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], repo);
-    assert.equal(refCheck.status, 0, 'the source branch must be preserved');
-    assert.equal(refCheck.stdout.trim(), branchSha, 'the branch must still name the proven commit — the source commit remains reachable from this head');
-    rmSync(repo, { recursive: true, force: true });
-});
 test('close-landed atomic delete refuses when the base is force-reset between landing and the cleanup delete', () => {
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-close-base-window-'));
     run(['init', '-b', 'main'], repo);
@@ -817,107 +744,6 @@ test('auto-drop refuses and preserves the branch and checkout when checkout remo
     assert.ok(list.stdout.includes(wt.path), 'the checkout must remain registered and recoverable');
     assert.ok(existsSync(join(wt.path, 'late-arrival.txt')), 'the live checkout, including its uncommitted file, must remain intact');
 });
-test('post-land cleanup timeout preserves the land and releases the repository lock', async () => {
-    const nodeId = 'wt-close-cleanup-timeout';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'cleanup-timeout-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'cleanup timeout work'], wt.path);
-    const baseBefore = gitSync(['rev-parse', 'main'], sourceDir).stdout.trim();
-    setWorktreeCleanupRunnerForTest((args, cwd, options) => {
-        if (args[0] === 'worktree' && args[1] === 'remove' && args[2] === wt.path) {
-            assert.equal(options.timeoutMs, 5_000, 'only post-land cleanup gets the finite deadline');
-            return { status: 1, stdout: '', stderr: '', timedOut: true };
-        }
-        if (args[0] === 'worktree' && args[1] === 'list') {
-            assert.equal(options.timeoutMs, 5_000, 'residual inspection gets the same finite deadline');
-            const inspection = gitSync(args, cwd, undefined, options);
-            return {
-                ...inspection,
-                // Branch identity is not checkout-validity: a switch/detach racing the
-                // timed-out remove still leaves a live registration that needs --force.
-                stdout: inspection.stdout.replace(`branch refs/heads/${wt.branch}`, 'branch refs/heads/externally-switched'),
-            };
-        }
-        return gitSync(args, cwd, undefined, options);
-    });
-    try {
-        const started = Date.now();
-        const result = closeManagedWorktree(nodeId);
-        const elapsed = Date.now() - started;
-        const cleanupDeadlineMs = 5_000;
-        const schedulingMarginMs = 500;
-        assert.ok(elapsed < cleanupDeadlineMs - schedulingMarginMs, `cleanup timeout must return promptly, took ${elapsed}ms`);
-        assert.notEqual(result.landed_sha, baseBefore, 'the land must contain a new commit');
-        assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), result.landed_sha, 'the base must contain the landed commit');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed', 'timeout must preserve the closed state');
-        assert.equal(result.worktree_removed, false);
-        assert.equal(result.branch_deleted, false);
-        assert.match(result.worktree_remove_error ?? '', /timed out/);
-        assert.match(result.worktree_remove_error ?? '', /git -C .* worktree remove --force/);
-        assert.doesNotMatch(result.worktree_remove_error ?? '', /worktree prune/, 'a valid registered checkout needs force-removal even if its branch changed');
-        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'the source branch must remain reachable');
-        // The node that timed out must still be able to complete its own finalization
-        // from the recreated cwd; a different-node lock check alone is insufficient.
-        await push(nodeId, { kind: 'final', body: 'timed-out cleanup node finalized' });
-        assert.equal(getNode(nodeId)?.status, 'done', 'the timed-out node must finalize itself successfully');
-        assert.ok(getNode(nodeId)?.final_report, 'the timed-out node must record its canonical final');
-        // A second close must acquire the same repository lock and complete, proving
-        // the timed-out cleanup did not strand the lock around the finished land.
-        const followupId = 'wt-close-after-cleanup-timeout';
-        const followup = createManagedWorktree(sourceDir, followupId);
-        createNode(node(followupId, { cwd: followup.path, managed_worktree: followup }));
-        writeFileSync(join(followup.path, 'followup-work.txt'), 'followup\n');
-        run(['add', '.'], followup.path);
-        run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'followup work'], followup.path);
-        const followupResult = closeManagedWorktree(followupId);
-        assert.equal(followupResult.worktree_removed, true, 'subsequent finalization must complete');
-        assert.equal(getNode(followupId)?.managed_worktree?.state, 'closed');
-    }
-    finally {
-        setWorktreeCleanupRunnerForTest();
-    }
-});
-test('post-land cleanup timeout gives prune guidance for a tombstone residual', () => {
-    const nodeId = 'wt-close-cleanup-timeout-tombstone';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'cleanup-tombstone-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'cleanup tombstone work'], wt.path);
-    setWorktreeCleanupRunnerForTest((args, cwd, options) => {
-        if (args[0] === 'worktree' && args[1] === 'remove' && args[2] === wt.path) {
-            assert.equal(options.timeoutMs, 5_000, 'the timed-out remove gets the finite deadline');
-            rmSync(wt.path, { recursive: true, force: true });
-            mkdirSync(wt.path, { recursive: true });
-            return { status: 1, stdout: '', stderr: '', timedOut: true };
-        }
-        if (args[0] === 'worktree' && args[1] === 'list') {
-            assert.equal(options.timeoutMs, 5_000, 'residual inspection gets the same finite deadline');
-            const branchSha = gitSync(['rev-parse', `refs/heads/${wt.branch}`], sourceDir).stdout.trim();
-            return {
-                status: 0,
-                stdout: `worktree ${wt.path}\nHEAD ${branchSha}\nbranch refs/heads/${wt.branch}\nprunable gitdir file points to non-existent location\n`,
-                stderr: '',
-            };
-        }
-        return gitSync(args, cwd, undefined, options);
-    });
-    try {
-        const result = closeManagedWorktree(nodeId);
-        const guidance = result.worktree_remove_error ?? '';
-        assert.equal(result.worktree_removed, false);
-        assert.equal(result.branch_deleted, false);
-        assert.match(guidance, /git -C .* worktree prune/);
-        assert.match(guidance, /rm -rf/);
-        assert.doesNotMatch(guidance, /worktree remove --force/);
-        assert.ok(existsSync(wt.path), 'the tombstone residual must remain available for guided cleanup');
-    }
-    finally {
-        setWorktreeCleanupRunnerForTest();
-    }
-});
 test('close-landed never low-level-deletes the source branch when checkout removal is refused', () => {
     const nodeId = 'wt-close-removal-refused';
     const wt = createManagedWorktree(sourceDir, nodeId);