@north-light/crouter 0.3.198 → 0.3.200

package/dist/core/__tests__/serial/worktree.test.js

@@ -1,12 +1,11 @@
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, existsSync, readdirSync, statSync, writeFileSync, chmodSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, existsSync, statSync, writeFileSync, chmodSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../../git.js';
-import { push } from '../../feed/feed.js';
-import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree, setWorktreeCleanupRunnerForTest } from '../../worktree.js';
+import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree } from '../../worktree.js';
 import { createNode, getNode } from '../../canvas/canvas.js';
 import { closeDb } from '../../canvas/db.js';
 let home;
@@ -60,14 +59,9 @@ after(() => {
     rmSync(sourceDir, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-// Regression for #120: `git worktree remove` deletes the checkout directory
-// that IS the calling node's own pi-process cwd. A process can never chdir
-// itself out of a directory that vanishes out from under it, so once that
-// dir is gone every subsequent bash in that node fails permanently and the
-// mandated post-close `crtr push final` can never run. closeManagedWorktree
-// must leave the path resolvable (as an empty tombstone dir) even though the
-// git worktree registration itself is gone.
-test('closeManagedWorktree recreates the worktree path as a tombstone dir so the node cwd still resolves', () => {
+// Regression for #710: close lands from a live caller, so it must preserve the
+// caller checkout rather than starting Git's recursive removal beneath it.
+test('closeManagedWorktree leaves the active caller checkout intact with named deferred cleanup', () => {
     const nodeId = 'wt-close-1';
     const wt = createManagedWorktree(sourceDir, nodeId);
     assert.equal(wt.base_ref, 'main', 'default base must remain backward-compatible with persisted main worktrees');
@@ -75,22 +69,16 @@ test('closeManagedWorktree recreates the worktree path as a tombstone dir so the
     assert.ok(existsSync(wt.path), 'worktree checkout should exist after create');
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
     const result = closeManagedWorktree(nodeId);
-    assert.equal(result.worktree_removed, true);
-    // The path must still resolve as a directory — this is the actual fix: a
-    // node whose cwd was wt.path can still chdir there / run bash / push final.
-    assert.ok(existsSync(wt.path), 'worktree path must still exist after close (tombstone)');
-    assert.ok(statSync(wt.path).isDirectory(), 'recreated path must be a directory');
-    assert.deepEqual(readdirSync(wt.path), [], 'tombstone dir should be empty — git already removed the real checkout');
-    // git itself no longer tracks it as a worktree.
+    assert.equal(result.worktree_removed, false);
+    assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
+    assert.ok(existsSync(join(wt.path, 'README.md')), 'the caller checkout keeps its tracked files');
+    assert.ok(statSync(wt.path).isDirectory(), 'the caller cwd remains a directory');
     const list = gitSync(['worktree', 'list', '--porcelain'], sourceDir);
-    assert.ok(!list.stdout.includes(wt.path), 'git should no longer register the removed worktree');
+    assert.ok(list.stdout.includes(wt.path), 'Git keeps the intact caller checkout registered');
     const meta = getNode(nodeId);
     assert.equal(meta?.managed_worktree?.state, 'closed');
-    // Regression for #519: a later park/revive must relaunch from the durable
-    // base checkout, not the torn-down worktree dir (best-effort tombstone —
-    // reapable by concurrent git GC, and not a real repo checkout even while
-    // it survives). closeManagedWorktree must repoint the persisted cwd.
-    assert.equal(meta?.cwd, wt.repo_root, 'closed node cwd must repoint to the repo root, not the removed worktree path');
+    assert.equal(meta?.managed_worktree?.cleanup, 'pending');
+    assert.equal(meta?.cwd, wt.repo_root, 'a later revive uses the durable base checkout');
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
     const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;
@@ -372,7 +360,8 @@ test('close ignores crtr\'s own untracked .crouter/config.json and state.json bo
     // reports a clean tree, not just that close happens not to notice.
     assert.equal(gitSync(['status', '--porcelain'], wt.path).stdout.trim(), '', 'git status must already be clean with only crtr bookkeeping present');
     const result = closeManagedWorktree(nodeId);
-    assert.equal(result.worktree_removed, true);
+    assert.equal(result.worktree_removed, false);
+    assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
 });
 // The exclude must be narrow: it must NEVER hide real, committable node work
 // that merely happens to live under `.crouter/` — this mirrors crouter's OWN
@@ -416,21 +405,15 @@ test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async (
     createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
     const result = autoDropCleanManagedWorktree(nodeId);
     assert.ok(result !== null, 'a worktree with zero commits and a clean tree must be droppable');
-    assert.equal(result?.worktree_removed, true);
+    assert.equal(result?.worktree_removed, false);
+    assert.match(result?.worktree_remove_error ?? '', /cleanup pending/);
     const meta = getNode(nodeId);
     assert.equal(meta?.managed_worktree?.state, 'closed');
-    assert.ok(!gitSync(['worktree', 'list', '--porcelain'], sourceDir).stdout.includes(wt.path), 'git must no longer register the dropped worktree');
-    // Regression for #519: auto-drop must persist the SAME closed-worktree
-    // transition explicit close does — repointing `cwd` to the durable base
-    // checkout, atomically with `state: 'closed'`. Before the fix, auto-drop
-    // left `cwd` at the removed worktree path; that path is recreated as an
-    // empty tombstone dir (see `bestEffortRemoveWorktreeCheckout`), so a later
-    // `--reopen` revive's `existsSync(meta.cwd)` preflight passed anyway and
-    // launched into a non-checkout instead of failing loud or landing somewhere
-    // real. `cwd` must be durable: a real git checkout, not a reapable stand-in.
-    assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd must repoint to the repo root, not the removed worktree path');
-    assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd must resolve to a real git checkout a reopen/revive can launch from');
-    assert.equal(existsSync(join(wt.path, '.git')), false, 'the tombstoned worktree path must NOT itself resolve as a git checkout');
+    assert.equal(meta?.managed_worktree?.cleanup, 'pending');
+    assert.ok(gitSync(['worktree', 'list', '--porcelain'], sourceDir).stdout.includes(wt.path), 'Git keeps the caller checkout registered until it exits');
+    assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd repoints to the durable base checkout');
+    assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd resolves to a real git checkout');
+    assert.ok(existsSync(join(wt.path, '.git')), 'the intact caller worktree remains a git checkout');
 });
 // The same real-commit case close already protects: a worktree with actual
 // unlanded work must NEVER be auto-dropped by push-final.
@@ -570,9 +553,10 @@ test('autoDropCleanManagedWorktree drops a branch with real commits already cont
     assert.equal(gitSync(['rev-parse', 'main'], repo).stdout.trim(), branchSha);
     const result = autoDropCleanManagedWorktree(nodeId);
     assert.ok(result !== null, 'a branch whose commits are already contained in a moved base has nothing left to land');
-    assert.equal(result?.branch_deleted, true);
+    assert.equal(result?.branch_deleted, false);
     assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 1, 'the now-redundant branch ref must actually be gone');
+    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'pending');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 0, 'the caller branch remains checked out until cleanup runs after exit');
     // The work itself is NOT lost — it stays reachable from main, which is the point.
     assert.equal(gitSync(['merge-base', '--is-ancestor', branchSha, 'main'], repo).status, 0, 'the landed commit must remain reachable from main after the drop');
     rmSync(repo, { recursive: true, force: true });
@@ -687,63 +671,6 @@ test('the re-verified base containment refuses when the base is rewritten betwee
 // for the branch-only race, and the same one the independent re-review used
 // to reproduce this exact Critical against `6de1c8d`.
 // ---------------------------------------------------------------------------
-test('auto-drop atomic delete refuses when the base is force-reset between the live ancestry check and the ref transaction', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-auto-drop-base-window-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const preMergeMainSha = gitSync(['rev-parse', 'main'], repo).stdout.trim();
-    const nodeId = 'wt-auto-drop-base-window';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'feature.txt'), 'landed elsewhere\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
-    const branchSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    // A manager fast-forwards main past this branch's own tip, exactly like
-    // the #327 positive case, so the branch proves clean-and-contained.
-    run(['merge', '--ff-only', branchSha], repo);
-    assert.equal(gitSync(['rev-parse', 'main'], repo).stdout.trim(), branchSha);
-    const proof = proveCleanEmptyManagedWorktree(wt);
-    assert.ok(proof !== null, 'the branch, now contained in the moved base, must prove droppable');
-    // Wrap `git worktree remove` — the call `autoDropCleanManagedWorktreeLocked`
-    // makes strictly AFTER its own live ancestry re-check and strictly BEFORE
-    // its ref-deletion transaction — to force-reset main back to its pre-merge
-    // tip right before the real removal runs. A sequential re-check placed
-    // anywhere before this point cannot see this rewrite; only binding the
-    // base's live value into the delete transaction itself can.
-    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
-    const wrapperPath = join(wrapperDir, 'git');
-    const originalPath = process.env['PATH'] ?? '';
-    writeFileSync(wrapperPath, `#!/bin/sh
-if [ "$1" = "worktree" ] && [ "$2" = "remove" ] && [ "$3" = "${wt.path}" ]; then
-  PATH="$CRTR_TEST_REAL_PATH" git -C "${repo}" update-ref refs/heads/main "${preMergeMainSha}"
-fi
-PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
-`);
-    chmodSync(wrapperPath, 0o755);
-    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
-    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
-    let result;
-    try {
-        result = autoDropCleanManagedWorktreeLocked(nodeId, wt, proof);
-    }
-    finally {
-        process.env['PATH'] = originalPath;
-        delete process.env['CRTR_TEST_REAL_PATH'];
-        rmSync(wrapperDir, { recursive: true, force: true });
-    }
-    assert.equal(result, null, 'a base rewritten strictly after the live ancestry check must still refuse the atomic delete');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'state must stay open — nothing may be marked safely dropped');
-    const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], repo);
-    assert.equal(refCheck.status, 0, 'the source branch must be preserved');
-    assert.equal(refCheck.stdout.trim(), branchSha, 'the branch must still name the proven commit — the source commit remains reachable from this head');
-    rmSync(repo, { recursive: true, force: true });
-});
 test('close-landed atomic delete refuses when the base is force-reset between landing and the cleanup delete', () => {
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-close-base-window-'));
     run(['init', '-b', 'main'], repo);
@@ -817,107 +744,6 @@ test('auto-drop refuses and preserves the branch and checkout when checkout remo
     assert.ok(list.stdout.includes(wt.path), 'the checkout must remain registered and recoverable');
     assert.ok(existsSync(join(wt.path, 'late-arrival.txt')), 'the live checkout, including its uncommitted file, must remain intact');
 });
-test('post-land cleanup timeout preserves the land and releases the repository lock', async () => {
-    const nodeId = 'wt-close-cleanup-timeout';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'cleanup-timeout-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'cleanup timeout work'], wt.path);
-    const baseBefore = gitSync(['rev-parse', 'main'], sourceDir).stdout.trim();
-    setWorktreeCleanupRunnerForTest((args, cwd, options) => {
-        if (args[0] === 'worktree' && args[1] === 'remove' && args[2] === wt.path) {
-            assert.equal(options.timeoutMs, 5_000, 'only post-land cleanup gets the finite deadline');
-            return { status: 1, stdout: '', stderr: '', timedOut: true };
-        }
-        if (args[0] === 'worktree' && args[1] === 'list') {
-            assert.equal(options.timeoutMs, 5_000, 'residual inspection gets the same finite deadline');
-            const inspection = gitSync(args, cwd, undefined, options);
-            return {
-                ...inspection,
-                // Branch identity is not checkout-validity: a switch/detach racing the
-                // timed-out remove still leaves a live registration that needs --force.
-                stdout: inspection.stdout.replace(`branch refs/heads/${wt.branch}`, 'branch refs/heads/externally-switched'),
-            };
-        }
-        return gitSync(args, cwd, undefined, options);
-    });
-    try {
-        const started = Date.now();
-        const result = closeManagedWorktree(nodeId);
-        const elapsed = Date.now() - started;
-        const cleanupDeadlineMs = 5_000;
-        const schedulingMarginMs = 500;
-        assert.ok(elapsed < cleanupDeadlineMs - schedulingMarginMs, `cleanup timeout must return promptly, took ${elapsed}ms`);
-        assert.notEqual(result.landed_sha, baseBefore, 'the land must contain a new commit');
-        assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), result.landed_sha, 'the base must contain the landed commit');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed', 'timeout must preserve the closed state');
-        assert.equal(result.worktree_removed, false);
-        assert.equal(result.branch_deleted, false);
-        assert.match(result.worktree_remove_error ?? '', /timed out/);
-        assert.match(result.worktree_remove_error ?? '', /git -C .* worktree remove --force/);
-        assert.doesNotMatch(result.worktree_remove_error ?? '', /worktree prune/, 'a valid registered checkout needs force-removal even if its branch changed');
-        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'the source branch must remain reachable');
-        // The node that timed out must still be able to complete its own finalization
-        // from the recreated cwd; a different-node lock check alone is insufficient.
-        await push(nodeId, { kind: 'final', body: 'timed-out cleanup node finalized' });
-        assert.equal(getNode(nodeId)?.status, 'done', 'the timed-out node must finalize itself successfully');
-        assert.ok(getNode(nodeId)?.final_report, 'the timed-out node must record its canonical final');
-        // A second close must acquire the same repository lock and complete, proving
-        // the timed-out cleanup did not strand the lock around the finished land.
-        const followupId = 'wt-close-after-cleanup-timeout';
-        const followup = createManagedWorktree(sourceDir, followupId);
-        createNode(node(followupId, { cwd: followup.path, managed_worktree: followup }));
-        writeFileSync(join(followup.path, 'followup-work.txt'), 'followup\n');
-        run(['add', '.'], followup.path);
-        run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'followup work'], followup.path);
-        const followupResult = closeManagedWorktree(followupId);
-        assert.equal(followupResult.worktree_removed, true, 'subsequent finalization must complete');
-        assert.equal(getNode(followupId)?.managed_worktree?.state, 'closed');
-    }
-    finally {
-        setWorktreeCleanupRunnerForTest();
-    }
-});
-test('post-land cleanup timeout gives prune guidance for a tombstone residual', () => {
-    const nodeId = 'wt-close-cleanup-timeout-tombstone';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'cleanup-tombstone-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'cleanup tombstone work'], wt.path);
-    setWorktreeCleanupRunnerForTest((args, cwd, options) => {
-        if (args[0] === 'worktree' && args[1] === 'remove' && args[2] === wt.path) {
-            assert.equal(options.timeoutMs, 5_000, 'the timed-out remove gets the finite deadline');
-            rmSync(wt.path, { recursive: true, force: true });
-            mkdirSync(wt.path, { recursive: true });
-            return { status: 1, stdout: '', stderr: '', timedOut: true };
-        }
-        if (args[0] === 'worktree' && args[1] === 'list') {
-            assert.equal(options.timeoutMs, 5_000, 'residual inspection gets the same finite deadline');
-            const branchSha = gitSync(['rev-parse', `refs/heads/${wt.branch}`], sourceDir).stdout.trim();
-            return {
-                status: 0,
-                stdout: `worktree ${wt.path}\nHEAD ${branchSha}\nbranch refs/heads/${wt.branch}\nprunable gitdir file points to non-existent location\n`,
-                stderr: '',
-            };
-        }
-        return gitSync(args, cwd, undefined, options);
-    });
-    try {
-        const result = closeManagedWorktree(nodeId);
-        const guidance = result.worktree_remove_error ?? '';
-        assert.equal(result.worktree_removed, false);
-        assert.equal(result.branch_deleted, false);
-        assert.match(guidance, /git -C .* worktree prune/);
-        assert.match(guidance, /rm -rf/);
-        assert.doesNotMatch(guidance, /worktree remove --force/);
-        assert.ok(existsSync(wt.path), 'the tombstone residual must remain available for guided cleanup');
-    }
-    finally {
-        setWorktreeCleanupRunnerForTest();
-    }
-});
 test('close-landed never low-level-deletes the source branch when checkout removal is refused', () => {
     const nodeId = 'wt-close-removal-refused';
     const wt = createManagedWorktree(sourceDir, nodeId);

package/dist/core/__tests__/session-cycles.test.js

@@ -105,3 +105,25 @@ test('cycleAwareMessages: a yielded cycle keeps terminal assistant content witho
     assert.equal(yieldedAssistant.errorMessage, undefined, 'the provider abort text is omitted with the yield boundary');
     assert.equal(out.filter((message) => message.customType === 'crtr-cycle-divider').length, 1);
 });
+// Observed shape: the yield's self-abort landed as the NEXT request was
+// starting, so the provider caught a bare AbortError instead of seeing its own
+// signal and stamped `stopReason: 'error'` on an empty turn. Pi's assistant
+// component reserves a red `Error: …` line for exactly that stopReason, so the
+// annotation must come off here too — a yield is not a failure.
+test('cycleAwareMessages: a yield abort recorded as a provider error is still not a failed turn', () => {
+    const m1 = userMsg('m1', null, 'yield after this turn');
+    const m2 = assistantMsg('m2', 'm1', [], 'error', 'This operation was aborted');
+    const cy1 = {
+        type: 'custom',
+        id: 'cy1',
+        parentId: null,
+        timestamp: new Date(1).toISOString(),
+        customType: CRTR_CYCLE_CUSTOM_TYPE,
+        data: { cycle: 2, fromLeaf: 'm2' },
+    };
+    const m3 = userMsg('m3', 'cy1', 'fresh cycle');
+    const out = cycleAwareMessages(cycleManager([m1, m2, cy1, m3], 'm3'));
+    const yieldedAssistant = out.find((message) => message.role === 'assistant');
+    assert.equal(yieldedAssistant.stopReason, undefined, 'yield is not presented as a failed assistant turn');
+    assert.equal(yieldedAssistant.errorMessage, undefined, 'the aborted-request text is omitted with the yield boundary');
+});

package/dist/core/__tests__/stop-guard.test.js

@@ -28,7 +28,7 @@ function node(id, over = {}) {
         ...over,
     };
 }
-const noSignals = { pushedFinal: false, askedHuman: false };
+const noSignals = { pushedFinal: false, requestedHumanReply: false };
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-stopguard-'));
     process.env['CRTR_HOME'] = home;
@@ -132,10 +132,10 @@ test('a TERMINAL node whose only worker is dead is stalled (no LIVE subscription
     assert.equal(d.action, 'reprompt');
     assert.equal(d.reason, 'stalled');
 });
-test('pushedFinal → finished; askedHuman → escalated (both short-circuit before lifecycle)', () => {
+test('pushedFinal → finished; requestedHumanReply → escalated (both short-circuit before lifecycle)', () => {
     createNode(node('t', { parent: 'mgr', lifecycle: 'terminal' }));
-    assert.deepEqual(evaluateStop('t', { pushedFinal: true, askedHuman: false }), { action: 'allow', reason: 'finished' });
-    assert.deepEqual(evaluateStop('t', { pushedFinal: false, askedHuman: true }), { action: 'allow', reason: 'escalated' });
+    assert.deepEqual(evaluateStop('t', { pushedFinal: true, requestedHumanReply: false }), { action: 'allow', reason: 'finished' });
+    assert.deepEqual(evaluateStop('t', { pushedFinal: false, requestedHumanReply: true }), { action: 'allow', reason: 'escalated' });
 });
 test('an active follow-up cycle with a canonical final is allowed without another final', () => {
     createNode(node('followUp', {

package/dist/core/__tests__/watchdog-abort-arms-retry.test.js

@@ -14,7 +14,7 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
 });
 test('only a watchdog-stamped aborted settlement records an automatic connection fault', () => {
-    const settleAbort = (nodeId, stagedWatchdogAbort) => {
+    const settleAbort = (nodeId, stagedWatchdogAbort, stagedRefreshAbort, stopReason = 'aborted') => {
         const session = {
             sessionManager: { getLeafId: () => 'leaf-entry' },
             model: undefined,
@@ -24,9 +24,14 @@ test('only a watchdog-stamped aborted settlement records an automatic connection
             session,
             fallback: { blocked: false },
             stagedProviderAgentEnd: {
-                messages: [{ role: 'assistant', stopReason: 'aborted', errorMessage: 'Request was aborted' }],
+                messages: [{
+                        role: 'assistant',
+                        stopReason,
+                        errorMessage: stopReason === 'error' ? 'This operation was aborted' : 'Request was aborted',
+                    }],
             },
             stagedWatchdogAbort,
+            stagedRefreshAbort,
             stagedOverflowFailure: null,
             executingTools: new Set(),
         };
@@ -38,15 +43,24 @@ test('only a watchdog-stamped aborted settlement records an automatic connection
         retry.publishSettledProviderFault(generation);
         return { retry, generation };
     };
-    const watchdog = settleAbort('watchdog-node', true);
+    const watchdog = settleAbort('watchdog-node', true, false);
     const fault = readFault('watchdog-node');
     assert.equal(fault?.link, 'pi→provider');
     assert.equal(fault?.kind, 'connection');
     assert.deepEqual(fault?.retry, { disposition: 'auto', by: 'daemon' });
     assert.equal(watchdog.retry.isActiveAutoFault(fault), true);
     assert.equal(watchdog.generation.stagedWatchdogAbort, false, 'settlement consumes the one-shot provenance');
-    settleAbort('human-node', false);
+    settleAbort('human-node', false, false);
     assert.equal(readFault('human-node'), null, 'an otherwise-identical human abort must not arm recovery');
+    // Pi 0.84 currently serializes a host abort from `node yield` as an `error`
+    // settlement. Only the refresh-abort provenance suppresses that provider-looking error.
+    const refresh = settleAbort('refresh-node', false, true, 'error');
+    assert.equal(readFault('refresh-node'), null, 'a refresh-aborted error settlement must not enter provider fault recovery');
+    assert.equal(refresh.generation.stagedRefreshAbort, false, 'settlement consumes the one-shot refresh provenance');
+    settleAbort('provider-node', false, false, 'error');
+    const providerFault = readFault('provider-node');
+    assert.equal(providerFault?.kind, 'other', 'the same provider error without refresh provenance still classifies');
+    assert.deepEqual(providerFault?.retry, { disposition: 'fatal' }, 'the same provider error without refresh provenance still records its fault');
 });
 test('a failed retry settlement carries the episode forward instead of restarting it', () => {
     // The episode marker a daemon retry records before re-prompting: original
@@ -68,6 +82,7 @@ test('a failed retry settlement carries the episode forward instead of restartin
             messages: [{ role: 'assistant', stopReason: 'error', errorMessage: 'fetch failed' }],
         },
         stagedWatchdogAbort: false,
+        stagedRefreshAbort: false,
         stagedOverflowFailure: null,
         executingTools: new Set(),
     };

package/dist/core/bash-jobs.d.ts

@@ -77,6 +77,12 @@ export declare function jobStartedAtMs(jobId: string): number | undefined;
  * notice, the `node bash background` result/toast, and the attach cockpit)
  * shows it: `<60s -> "12s"`; `60s-59m -> "3m 40s"`; `>=60m -> "1h 04m"`. */
 export declare function formatBashElapsed(ms: number): string;
+/** The command line worth SHOWING for a job. `cmd.sh` opens with the harness's
+ * injected environment preamble (`export CRTR_PREVIEW_RESULT_PATH=…`), so its
+ * literal first line names no command at all: skip leading assignment lines and
+ * return the first real one, whitespace-collapsed to a single line. A job whose
+ * command is nothing but assignments falls back to its first non-empty line. */
+export declare function bashJobCommandLine(command: string): string;
 export interface BashJobStatus {
     jobId: string;
     /** Full text of cmd.sh. */

package/dist/core/bash-jobs.js

@@ -189,6 +189,16 @@ export function formatBashElapsed(ms) {
     const minutes = totalMinutes % 60;
     return `${hours}h ${String(minutes).padStart(2, '0')}m`;
 }
+/** The command line worth SHOWING for a job. `cmd.sh` opens with the harness's
+ * injected environment preamble (`export CRTR_PREVIEW_RESULT_PATH=…`), so its
+ * literal first line names no command at all: skip leading assignment lines and
+ * return the first real one, whitespace-collapsed to a single line. A job whose
+ * command is nothing but assignments falls back to its first non-empty line. */
+export function bashJobCommandLine(command) {
+    const lines = command.split('\n').map((line) => line.trim()).filter((line) => line !== '');
+    const real = lines.find((line) => !/^(export\s+)?[A-Za-z_][A-Za-z0-9_]*=/.test(line));
+    return (real ?? lines[0] ?? '').replace(/\s+/g, ' ');
+}
 /** Every live backgrounded bash job for this node — job.bg present, job.exit
  * absent — whether handed off by the menu, the valve deadline, or broker
  * termination. Read-only; never mutates. Skips malformed/partially-written

package/dist/core/canvas/__tests__/attention.test.js

@@ -4,7 +4,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { atomicWriteJson, pageManifestPath } from '../../human/convention.js';
+import { atomicWriteJson, bindTicketReplyRoute, pageManifestPath } from '../../human/convention.js';
 import { createNode } from '../canvas.js';
 import { closeDb } from '../db.js';
 import { nodeDir } from '../paths.js';
@@ -22,16 +22,19 @@ function meta(id, cwd, extra) {
         ...extra,
     };
 }
+// A ticket only counts as attention when it routes a reply back, so the fixture binds
+// the reply route the same way `human send` does before writing the page manifest.
 function seedPage(bridgeId) {
     const dir = nodeDir(bridgeId);
     mkdirSync(dir, { recursive: true });
+    bindTicketReplyRoute(dir, bridgeId);
     atomicWriteJson(pageManifestPath(dir), {
-        schema: 'crtr.page/v1',
-        dialect: 'html',
+        schema: 'crtr.page/v2',
+        dialect: 'jsx',
         title: bridgeId,
         subtitle: 'Acknowledge this ticket so the request can proceed.',
-        placement: 'inline',
-        document: 'page.html',
+        delivery: { placement: 'inline', inbox: true, reply: true },
+        document: 'page.tsx',
         steps: 1,
         slots: [],
     });

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -8,7 +8,7 @@
 // This is adversarial, not merely a clean-machine assertion: BEFORE calling
 // the render functions, the test seeds real, CONFLICTING local state for the
 // same node id `a` (a local focus, an active fault, telemetry, a goal file, a
-// session transcript, and a pending human ask) — every historically-broken
+// session transcript, and a pending human reply) — every historically-broken
 // local read this suppression covers. If the production suppression ever
 // regressed back to consulting local disk/SQLite for a remote source, the
 // assertions below would observe the poisoned values instead of the safe
@@ -114,12 +114,12 @@ function seedPoisonedLocalState() {
     const askDir = nodeDir('poison-ask');
     mkdirSync(askDir, { recursive: true });
     atomicWriteJson(pageManifestPath(askDir), {
-        schema: 'crtr.page/v1',
-        dialect: 'html',
+        schema: 'crtr.page/v2',
+        dialect: 'jsx',
         title: 'poison',
         subtitle: 'This local ticket must not affect the remote rendering.',
-        placement: 'inline',
-        document: 'page.html',
+        delivery: { placement: 'inline', inbox: true, reply: true },
+        document: 'page.tsx',
         steps: 1,
         slots: [],
     });

package/dist/core/canvas/attention.js

@@ -1,15 +1,17 @@
 // attention.ts — pending human-ticket counters across the canvas.
 //
-// Every ticket is a direct child of the single registered `<canvas>/nodes` root,
-// named for its terminal human bridge node. The bridge's parent is the asking
-// node, so storage identity and attribution come from the canvas graph rather
-// than duplicated attribution fields in page/review data.
-import { basename } from 'node:path';
+// Reply-bearing tickets carry an explicit bridge route. The bridge's parent is
+// the asking node; standalone pages have no bridge and do not contribute to a
+// node's pending-reply count.
 import { scanInbox } from '../human/scan.js';
 import { filterTerminalReviewTickets } from '../review/ticket-filter.js';
+import { readTicketReplyRoute } from '../human/convention.js';
 import { getNode, listNodes, view } from './canvas.js';
 function askingNodeId(ticketDir) {
-    const bridge = getNode(basename(ticketDir));
+    const replyRoute = readTicketReplyRoute(ticketDir);
+    if (replyRoute === null)
+        return null;
+    const bridge = getNode(replyRoute.bridge_node_id);
     if (bridge === null)
         return null;
     return bridge.parent ?? bridge.node_id;

package/dist/core/canvas/browse/model.d.ts

@@ -11,8 +11,14 @@ export type SortMode = 'tree' | 'attention' | 'relevance' | 'recency';
 export declare const SORTS: readonly SortMode[];
 /** Does a node belong to this tab's slice?
  *    All       — every node.
- *    Live      — active | idle.
- *    Dormant   — done | dead | canceled.
+ *    Live      — what you can pick up right now: active | idle, PLUS a resident
+ *                agent that stopped without finishing (its broker exited, but
+ *                Enter resumes the conversation in place — see `isFinishedWork`).
+ *                Finished work never appears here.
+ *    Dormant   — done | dead | canceled: literally "no engine running". A stopped
+ *                resident agent is deliberately on BOTH tabs — it is resumable
+ *                (Live) and it is not running (Dormant); both are true and each
+ *                tab is the one a different search starts from.
  *    Attention — needs a human: has pending asks OR is parked on a fault.
  *    Pinned    — user-starred (a local, view-only preference; `isPinned`). */
 export declare function tabPredicate(tab: Tab, row: DashboardRow, isPinned?: boolean): boolean;

package/dist/core/canvas/browse/model.js

@@ -4,19 +4,26 @@
 // it is exhaustively unit-testable. The app layer (app.ts) wires the canvas data
 // access (dashboardRowsAll / listNodes / subscriptionsOf) into buildTree, then
 // drives flatten() on each keystroke.
-import { statusRank } from '../node-order.js';
+import { isFinishedWork, isLiveStatus, statusRank } from '../node-order.js';
 export const TABS = ['All', 'Live', 'Dormant', 'Attention', 'Pinned'];
 export const SORTS = ['tree', 'attention', 'relevance', 'recency'];
 /** Does a node belong to this tab's slice?
  *    All       — every node.
- *    Live      — active | idle.
- *    Dormant   — done | dead | canceled.
+ *    Live      — what you can pick up right now: active | idle, PLUS a resident
+ *                agent that stopped without finishing (its broker exited, but
+ *                Enter resumes the conversation in place — see `isFinishedWork`).
+ *                Finished work never appears here.
+ *    Dormant   — done | dead | canceled: literally "no engine running". A stopped
+ *                resident agent is deliberately on BOTH tabs — it is resumable
+ *                (Live) and it is not running (Dormant); both are true and each
+ *                tab is the one a different search starts from.
  *    Attention — needs a human: has pending asks OR is parked on a fault.
  *    Pinned    — user-starred (a local, view-only preference; `isPinned`). */
 export function tabPredicate(tab, row, isPinned = false) {
     switch (tab) {
         case 'All': return true;
-        case 'Live': return row.status === 'active' || row.status === 'idle';
+        case 'Live': return isLiveStatus(row.status)
+            || !isFinishedWork({ lifecycle: row.lifecycle, finalized: row.finalized === true });
         case 'Dormant': return row.status === 'done' || row.status === 'dead' || row.status === 'canceled';
         case 'Attention': return row.asks > 0 || row.hanging != null;
         case 'Pinned': return isPinned;

package/dist/core/canvas/canvas.d.ts

@@ -90,6 +90,10 @@ export declare function clearPid(nodeId: string): void;
 export declare function migrateLegacyPidIdentities(captureIdentity?: (pid: number) => string | undefined): {
     migrated: string[];
 };
+/** Every hydrated node whose durable profile identity equals `profileId`.
+ *  Unlike `listNodes`, this includes unclaimed warm-pool spares: profile
+ *  deletion owns every matching row, whether or not it is user-visible. */
+export declare function listNodesByProfile(profileId: string): NodeMeta[];
 /** All rows, optionally filtered by status. Unclaimed warm spares are excluded. */
 export declare function listNodes(filter?: {
     status?: NodeStatus | NodeStatus[];
@@ -306,6 +310,9 @@ export interface DeleteNodeResult {
  *  state are removed in one canvas write boundary. Best-effort dir removal
  *  follows the commit. */
 export declare function deleteNode(nodeId: string): DeleteNodeResult;
+/** Hard-delete a validated set of nodes in one row transaction, then remove
+ *  their directories. The caller must tear down engines and viewers first. */
+export declare function deleteNodes(nodeIds: readonly string[]): string[];
 /** Retention sweep: remove TERMINAL nodes (status dead | done | canceled) whose
  *  `created` is older than `ttlDays`, bounding the otherwise-unbounded growth of
  *  node rows + dirs. Open managed-worktree nodes are retained so their checkout