@north-light/crouter 0.3.204 → 0.3.205

package/dist/core/runtime/session-visibility.d.ts

@@ -1,16 +1,11 @@
-import type { BrokerSnapshot, WireSessionTreeNode } from './broker-protocol.js';
-/** customType of the crtr-authored boundary marker that opens a review
- *  companion's visible transcript. Data payload: `{ reviewId, originNodeId,
- *  targetFile }` — per-review facts that complement the inheritance prefix.
- *
- *  The marker itself is a crtr-rendered divider shown to the person; everything
- *  above it in the inherited session is context they cannot see.
- */
-export declare const REVIEW_BOUNDARY_CUSTOM_TYPE = "crtr-review-boundary";
+import type { WireSessionTreeNode } from './broker-protocol.js';
+import type { IdentifiedMessage } from './session-cycles.js';
+import { REVIEW_BOUNDARY_CUSTOM_TYPE } from '../../shared/generated-context.js';
+export { REVIEW_BOUNDARY_CUSTOM_TYPE };
 /** True when an entry is a durable review boundary, optionally for one review. */
 export declare function isReviewBoundary(entry: unknown, reviewId?: string): boolean;
 /**
- * Project snapshot messages to the visible window for a review companion.
+ * Project identified snapshot messages to the visible window for a review companion.
  *
  * A companion passes its binding's review id so the slice starts at ITS OWN
  * boundary marker: a node forked from another companion inherits that
@@ -27,9 +22,9 @@ export declare function isReviewBoundary(entry: unknown, reviewId?: string): boo
  *    with a synthetic boundary while its retained tail remains visible. Every
  *    other markerless shape fails closed with the synthetic boundary alone.
  */
-export declare function visibleMessages(messages: BrokerSnapshot['messages'], opts: {
+export declare function visibleMessages(messages: IdentifiedMessage[], opts: {
     boundaryReviewId: string | undefined;
-}): BrokerSnapshot['messages'];
+}): IdentifiedMessage[];
 /**
  * Project a session tree to the review companion's visible transcript boundary.
  *

package/dist/core/runtime/session-visibility.js

@@ -9,14 +9,8 @@
 // Applied at the two BrokerSnapshot.messages producers (live broker and
 // dormant node read) so every presenter — attach, web node viewer, inspect — is
 // boundary-safe by construction with no presenter-side changes.
-/** customType of the crtr-authored boundary marker that opens a review
- *  companion's visible transcript. Data payload: `{ reviewId, originNodeId,
- *  targetFile }` — per-review facts that complement the inheritance prefix.
- *
- *  The marker itself is a crtr-rendered divider shown to the person; everything
- *  above it in the inherited session is context they cannot see.
- */
-export const REVIEW_BOUNDARY_CUSTOM_TYPE = 'crtr-review-boundary';
+import { REVIEW_BOUNDARY_CUSTOM_TYPE } from '../../shared/generated-context.js';
+export { REVIEW_BOUNDARY_CUSTOM_TYPE };
 /** True when an entry is a durable review boundary, optionally for one review. */
 export function isReviewBoundary(entry, reviewId) {
     if (entry === null || typeof entry !== 'object')
@@ -36,7 +30,7 @@ function syntheticBoundary(timestamp) {
     };
 }
 /**
- * Project snapshot messages to the visible window for a review companion.
+ * Project identified snapshot messages to the visible window for a review companion.
  *
  * A companion passes its binding's review id so the slice starts at ITS OWN
  * boundary marker: a node forked from another companion inherits that
@@ -54,16 +48,16 @@ function syntheticBoundary(timestamp) {
  *    other markerless shape fails closed with the synthetic boundary alone.
  */
 export function visibleMessages(messages, opts) {
-    const markerIndex = messages.findIndex((message) => isReviewBoundary(message, opts.boundaryReviewId));
+    const markerIndex = messages.findIndex(({ message }) => isReviewBoundary(message, opts.boundaryReviewId));
     if (markerIndex !== -1)
         return messages.slice(markerIndex);
     if (opts.boundaryReviewId === undefined)
         return messages;
     const [first, ...retainedTail] = messages;
-    if (first?.role === 'compactionSummary') {
-        return [syntheticBoundary(first.timestamp), ...retainedTail];
+    if (first?.message.role === 'compactionSummary') {
+        return [{ id: '~boundary', message: syntheticBoundary(first.message.timestamp) }, ...retainedTail];
     }
-    return [syntheticBoundary(first?.timestamp)];
+    return [{ id: '~boundary', message: syntheticBoundary(first?.message.timestamp) }];
 }
 /**
  * Project a session tree to the review companion's visible transcript boundary.

package/dist/core/runtime/situational-live.js

@@ -16,6 +16,7 @@
 // (`deliver-live.ts`), which the claim's bearings delivery also rides.
 import { getNode } from '../canvas/index.js';
 import { deliverCustomMessageLive } from './deliver-live.js';
+import { formatCard } from '../../shared/generated-context.js';
 import { appendSituationalContext, situationalContextBlock, SITUATIONAL_CONTEXT_CUSTOM_TYPE, } from './situational-context.js';
 /** Write `text` to the node's sidecar and, when its broker is live, deliver the
  *  rendered block into the running session for the NEXT turn.
@@ -34,7 +35,7 @@ export async function setSituationalContextLive(nodeId, text) {
         return; // blank text — appendSituationalContext no-ops, nothing to deliver
     await deliverCustomMessageLive(nodeId, {
         customType: SITUATIONAL_CONTEXT_CUSTOM_TYPE,
-        content: block,
+        content: formatCard('situational', {}, block),
         deliverAs: 'nextTurn',
     });
 }

package/dist/core/runtime/stop-guard.js

@@ -23,16 +23,16 @@
 //                      final pushed. Re-prompt it to finish or escalate.
 import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, getNode, contextDir } from '../canvas/index.js';
 import { activeBackgroundBashJobs } from '../bash-jobs.js';
-import { formatStructuredOutputReprompt, STALL_REPROMPT } from '../../shared/generated-context.js';
+import { formatCard, formatStructuredOutputReprompt, STALL_REPROMPT } from '../../shared/generated-context.js';
 import { readOutputRequest } from './structured-output.js';
 export { STALL_REPROMPT } from '../../shared/generated-context.js';
 /** Format the stop guard's reprompt for a valid structured-output request. */
 function formatValidStructuredOutputReprompt(schema) {
-    return formatStructuredOutputReprompt(JSON.stringify(schema, null, 2));
+    return formatCard('stop-guard', { reason: 'structured-output' }, formatStructuredOutputReprompt(JSON.stringify(schema, null, 2)));
 }
 /** Format the stop guard's reprompt for an invalid structured-output request file. */
 function formatInvalidStructuredOutputReprompt(error) {
-    return (`Structured-output request file is invalid and cannot be used: ${error}\n\n` +
+    return formatCard('stop-guard', { reason: 'structured-output' }, `Structured-output request file is invalid and cannot be used: ${error}\n\n` +
         `You have two options:\n` +
         `1. Remove the invalid file (the output-schema.json in your node directory has been corrupted)\n` +
         `2. Fix the corruption if you know the original request schema\n\n` +
@@ -96,5 +96,9 @@ export function evaluateStop(nodeId, signals, backgroundJobsRunning = activeBack
         || backgroundJobsRunning)
         return { action: 'allow', reason: 'awaiting' };
     // A terminal node with nothing live and no final pushed has stalled.
-    return { action: 'reprompt', reason: 'stalled', message: STALL_REPROMPT };
+    return {
+        action: 'reprompt',
+        reason: 'stalled',
+        message: formatCard('stop-guard', { reason: 'stalled' }, STALL_REPROMPT),
+    };
 }

package/dist/core/runtime/warm-pool.d.ts

@@ -17,7 +17,7 @@ export interface WarmRequest {
     kind: string;
     mode: Mode;
     /** Where the node runs — already resolved by the create handler (pin >
-     *  spawner > profile home), never a raw caller directory. */
+     *  spawner > launch cwd > profile home). */
     cwd: string;
     /** The RESOLVED profile id, or null for explicitly no profile. */
     profileId: string | null;

package/dist/core/runtime/warm-pool.js

@@ -47,10 +47,9 @@
 // and at daemon start for the most recently used profiles, so the FIRST node
 // after sitting down is warm too.
 //
-// The pool does not fan out per directory: a node runs in its profile's home
-// (`resolveNodeCwd` in the create handler), so the cwd a spare freezes is a
-// function of its profile, and "which spare serves this create" is in practice
-// a question about the profile alone.
+// A spare freezes the directory it was booted in, so a create launched from a
+// different directory than the last one simply misses and cold-spawns — the
+// pool serves the common case of returning to the same working directory.
 //
 // Nothing ever RESUMES a spare: the daemon's recovery sweep reads `listNodes`,
 // which hides the pool, so a spare whose broker dies (every daemon handover
@@ -63,7 +62,6 @@ import { claimWarmSpare, deleteNode, getNode, listNodes, listWarmSpares, registe
 import { recordedPidLiveness } from '../canvas/pid.js';
 import { nowIso } from '../fs-utils.js';
 import { spawnChildPrepared } from './spawn.js';
-import { profileHome } from '../profiles/manifest.js';
 import { buildLaunchSpec } from './launch.js';
 import { setModelLive } from './model-swap.js';
 import { setSituationalContextLive } from './situational-live.js';
@@ -335,10 +333,9 @@ export function prewarmRecentRecipes() {
             if (seen.has(profileId ?? ''))
                 continue;
             seen.add(profileId ?? '');
-            // The profile's home is where its next node will land. A profile without
-            // one (root, or a home since deleted) still gets a spare, keyed on the
-            // directory its last root actually ran in.
-            candidates.push({ cwd: profileHome(profileId) ?? row.cwd, profileId });
+            // A node lands in the directory its launch names, so the profile's last
+            // root predicts the next one better than the profile's home does.
+            candidates.push({ cwd: row.cwd, profileId });
             if (candidates.length >= PREWARM_PROFILES)
                 break;
         }

package/dist/daemon/api/handlers/nodes.js

@@ -98,14 +98,14 @@ function parseCreateBody(body) {
 }
 /** The directory a new node is pinned to. An explicit `pin_cwd` wins; else a
  *  managed child inherits its spawner's cwd (which is what keeps a worktree
- *  node's whole subtree inside that worktree); else the node runs in its
- *  profile's home. The request's own `cwd` — the caller's directory — is only
- *  the last resort, for a profile that has no home (notably root).
+ *  node's whole subtree inside that worktree); else the launch's own `cwd`, the
+ *  directory the create came from; else the profile's home.
  *
- *  This is the profile→cwd direction: `cwd` selected the profile a moment ago,
- *  and the profile now supplies where the node runs. Collapsing every create
- *  under a profile onto one directory is also what keeps the warm pool to one
- *  spare per profile instead of one per directory anyone happened to spawn from. */
+ *  The launch directory beating the profile home is what lets one profile cover
+ *  many working directories — a root started inside a planted instance runs in
+ *  that instance while still taking its identity, purview, and memory from the
+ *  profile covering it. The profile supplies a home only for a create that named
+ *  no directory at all. */
 function resolveNodeCwd(req, parent, profileId, contextCwd) {
     if (req.pin_cwd !== undefined && req.pin_cwd !== '')
         return resolve(req.pin_cwd);
@@ -114,6 +114,8 @@ function resolveNodeCwd(req, parent, profileId, contextCwd) {
         if (spawner !== null)
             return spawner.cwd;
     }
+    if (req.cwd !== undefined && req.cwd !== '')
+        return resolve(req.cwd);
     return profileHome(profileId) ?? contextCwd;
 }
 /** Build the immediate spawn recipe. */
@@ -328,6 +330,7 @@ async function handleMessages(ctx) {
     const body = {
         node_id: id,
         messages: read.messages,
+        ...(read.messageIds === undefined ? {} : { message_ids: read.messageIds }),
         next_cursor: read.nextCursor,
         captured_at: nowIso(),
     };

package/dist/daemon/human/finish.js

@@ -9,7 +9,7 @@ import { pagePath, readTicketReplyRoute, responsePath } from '../../core/human/c
 import { readPageFeedback } from '../../core/human/feedback.js';
 import { pageDocumentSha256 } from '../../core/human/feedback-companion.js';
 import { appendInbox } from '../../core/feed/inbox.js';
-import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
+import { FinalDeliveryError, pushFinal, pushUpdate } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { retireCompanion } from '../companion-retire.js';
@@ -80,15 +80,51 @@ function pageTitle(dir) {
         return undefined;
     }
 }
+/** Person-authored response values, derived from the structured answer rather
+ * than display prose. Empty values have no words to attribute. */
+function personWords(answer) {
+    if (answer.kind === 'acknowledgement')
+        return '';
+    const words = [];
+    for (const slot of answer.slots) {
+        if (slot.state !== 'answered')
+            continue;
+        if (slot.raw !== undefined) {
+            words.push(JSON.stringify(slot.raw));
+            continue;
+        }
+        if (slot.text !== undefined) {
+            if (slot.text.edited || slot.text.singleLine === true)
+                words.push(slot.text.value);
+            continue;
+        }
+        for (const group of slot.groups)
+            words.push(...group.picked.map((item) => item.label));
+        if (slot.freetext !== undefined)
+            words.push(slot.freetext);
+        words.push(...slot.comments.map((comment) => comment.text));
+    }
+    return words.filter((word) => word !== '').join('\n\n');
+}
+/** The answer push: the person's words alone when the page captured any, tagged
+ * so every reader attributes them to the person without re-deriving it from
+ * prose. A page that captured nothing stays an ordinary report carrying the
+ * full record, because there is nothing of the person's to attribute. */
 function renderPageAnswer(dir, result, resultPath) {
     let manifest;
     try {
         manifest = parsePage(dir);
     }
     catch {
-        return renderCorruptPageAnswer(result, resultPath);
+        return { body: renderCorruptPageAnswer(result, resultPath) };
     }
-    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt }), resultPath) + feedbackAddendum(dir);
+    const answer = describePageAnswer(manifest, result.responses, { completedAt: result.completedAt });
+    const rendered = renderAnswerText(answer, resultPath);
+    const addendum = feedbackAddendum(dir);
+    const words = personWords(answer);
+    return words === ''
+        ? { body: rendered + addendum }
+        : { body: words, disposition: 'human-answer', ...(addendum === '' ? {} : { feedback: addendum.trim() }) };
 }
 function deliveryFailed(error) {
     // A canonical final is committed inside its own write boundary and can never
@@ -198,6 +234,7 @@ export async function deliverTerminalResult(ticketId) {
                     kind: 'message',
                     label: subject,
                     data: { body },
+                    disposition: 'human-canceled',
                 });
             }
             catch {
@@ -210,7 +247,10 @@ export async function deliverTerminalResult(ticketId) {
         return true;
     }
     if (result.kind === 'page') {
-        await pushFinal(bridgeNodeId, renderPageAnswer(dir, result, responsePath(dir)));
+        const answer = renderPageAnswer(dir, result, responsePath(dir));
+        if (answer.feedback !== undefined)
+            await pushUpdate(bridgeNodeId, answer.feedback);
+        await pushFinal(bridgeNodeId, answer.body, answer.disposition === undefined ? undefined : { disposition: answer.disposition });
     }
     return true;
 }

package/dist/daemon/messaging/node-message.d.ts

@@ -4,6 +4,10 @@ export interface NodeMessageDelivery {
     via: 'engine' | 'inbox';
     revived: boolean;
 }
+export interface RuntimeMessageCard {
+    kind: string;
+    facts: Record<string, string | number | boolean | undefined>;
+}
 /**
  * Deliver one daemon-originated node message. Interactive messages use the live
  * broker when available; every other successful path is a durable inbox entry.
@@ -15,4 +19,5 @@ export declare function deliverNodeMessage(args: {
     from?: string | null;
     mode: NodeMessageMode;
     data?: Record<string, unknown>;
+    runtime?: RuntimeMessageCard;
 }): Promise<NodeMessageDelivery>;

package/dist/daemon/messaging/node-message.js

@@ -7,6 +7,7 @@ import { isBrokerLive } from '../../core/runtime/model-swap.js';
 import { reviveNode } from '../../core/runtime/revive.js';
 import { hasNoNaturalCycle } from '../../core/runtime/revive-all.js';
 import { ReviewOperationError } from '../../core/review/types.js';
+import { formatCard } from '../../shared/generated-context.js';
 function deliveryUnroutable(nodeId, reason) {
     throw new ReviewOperationError('delivery_unroutable', reason === 'origin_missing' ? 'message target was not found' : 'message target has no natural delivery cycle', { node_id: nodeId, reason });
 }
@@ -33,7 +34,11 @@ export async function deliverNodeMessage(args) {
         deliveryUnroutable(args.node_id, 'origin_missing');
     if (args.mode === 'interactive' && isBrokerLive(target)) {
         try {
-            await deliverLive(args.node_id, args.body);
+            // Inbox delivery supplies the raw body as an entry in its outer inbox
+            // card; only live delivery needs this message's own envelope.
+            await deliverLive(args.node_id, args.runtime === undefined
+                ? args.body
+                : formatCard(args.runtime.kind, args.runtime.facts, args.body));
             // The broker acknowledgement is asynchronous to the SQLite guard. Recheck
             // before reporting an engine receipt so a final that committed during the
             // request is not represented as a routable delivery.

package/dist/daemon/review/comment-notify.js

@@ -70,6 +70,14 @@ export async function notifyComment(args) {
                 comment_id: args.comment.comment_id,
                 verb: args.verb,
             },
+            runtime: {
+                kind: 'review-comment',
+                facts: {
+                    review_id: args.review.review_id,
+                    comment_id: args.comment.comment_id,
+                    verb: args.verb,
+                },
+            },
         });
     }
     catch (error) {

package/dist/daemon/review/deliver.js

@@ -1,5 +1,5 @@
 import { FinalizationError, pushFinal, redeliverFinalReport } from '../../core/feed/feed.js';
-import { formatReviewApproval } from '../../shared/generated-context.js';
+import { formatCard } from '../../shared/generated-context.js';
 import { deliverNodeMessage } from '../messaging/node-message.js';
 function approvalBody(review, resultPath) {
     const summary = review.changed
@@ -9,7 +9,7 @@ function approvalBody(review, resultPath) {
 }
 /** Render the immutable approval fact without replaying comment text. */
 export function renderApprovalMessage(review, resultPath) {
-    return formatReviewApproval(approvalBody(review, resultPath));
+    return formatCard('review-approval', { review: review.review_id, file: review.file }, approvalBody(review, resultPath));
 }
 function recordedFailedFanout(review, reportBasename) {
     const error = review.delivery_error;

package/dist/daemon/review/finish.js

@@ -164,6 +164,7 @@ async function noteSubmitQueued(review) {
             mode: 'quiet',
             label: 'human review submitted — result to follow',
             data: { review_id: review.review_id },
+            runtime: { kind: 'review-queued', facts: { review_id: review.review_id } },
             body: `The human submitted their review of \`${review.file}\`; the document is still being edited. `
                 + "You'll be notified with the result once the review completes. Nothing is needed from you now.",
         });

package/dist/pi-extensions/__tests__/canvas-goal-capture-envelope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pi-extensions/__tests__/canvas-goal-capture-envelope.test.js

@@ -0,0 +1,96 @@
+// Run with: node --conditions=crtr-src --import tsx/esm --test src/pi-extensions/__tests__/canvas-goal-capture-envelope.test.ts
+//
+// The revive-kickoff exclusion in canvas-goal-capture. A fresh revive's kickoff
+// arrives as a LAUNCH PROMPT — an ordinary interactive input event, not an
+// extension injection — so without an exclusion it looks exactly like a bare
+// root's first typed message: it would be written to context/initial-prompt.md
+// as the node's mandate and would name the node from the runtime's own words.
+//
+// The exclusion used to key on the kickoff's opening sentence. It now keys on
+// the <runtime kind="revive" …> envelope, and this file pins that the real
+// builder's real bytes are still excluded — the two changes are one unit
+// precisely because the envelope moves the bytes the old check read.
+//
+// The naming attempt is observed at the daemon socket: generateAndCommitInitialName
+// starts by asking crtrd for the node's projection, so a request for a node id is
+// proof that naming ran for it, and no request is proof that it did not.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import registerCanvasGoalCapture from '../canvas-goal-capture.js';
+import { createNode } from '../../core/canvas/canvas.js';
+import { closeDb } from '../../core/canvas/db.js';
+import { apiSocketPath } from '../../core/canvas/paths.js';
+import { buildReviveKickoff, drainBearings } from '../../core/runtime/kickoff.js';
+let home;
+let socket;
+/** Every request line the extension's naming path sent to the daemon socket. */
+const requests = [];
+function node(id) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    };
+}
+/** Register the extension and hand back its input handler. */
+function handler() {
+    let captured;
+    registerCanvasGoalCapture({ on: (_event, fn) => { captured = fn; } });
+    assert.ok(captured !== undefined, 'the extension registers an input handler');
+    return captured;
+}
+function initialPromptPath(id) {
+    return join(home, 'nodes', id, 'context', 'initial-prompt.md');
+}
+async function waitForRequestMentioning(id) {
+    for (let i = 0; i < 200; i++) {
+        if (requests.some((line) => line.includes(id)))
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    throw new Error(`no daemon request mentioning ${id} arrived`);
+}
+before(async () => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-goal-capture-'));
+    process.env['CRTR_HOME'] = home;
+    // A stub daemon: it records the request and hangs up, so the naming path fails
+    // fast (and silently, as it must) without any model call.
+    socket = createServer((connection) => {
+        connection.on('data', (chunk) => {
+            requests.push(chunk.toString('utf8'));
+            connection.destroy();
+        });
+    });
+    await new Promise((resolve) => socket.listen(apiSocketPath(), resolve));
+});
+after(async () => {
+    closeDb();
+    await new Promise((resolve) => socket.close(() => resolve()));
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+    delete process.env['CRTR_NODE_ID'];
+});
+test('a fresh-revive kickoff seeds no mandate and no name; a human first message seeds both', async () => {
+    const revived = createNode(node('revived-node'));
+    const kickoff = buildReviveKickoff(revived, drainBearings(revived));
+    process.env['CRTR_NODE_ID'] = revived.node_id;
+    handler()({ type: 'input', text: kickoff, source: 'interactive' });
+    const bare = createNode(node('bare-root'));
+    process.env['CRTR_NODE_ID'] = bare.node_id;
+    handler()({ type: 'input', text: 'build me a receipt tracker', source: 'interactive' });
+    // The human message's naming call is the clock: both inputs ran through the
+    // same handler, so once its request has landed the revive's would have too.
+    await waitForRequestMentioning(bare.node_id);
+    assert.equal(existsSync(initialPromptPath(revived.node_id)), false, 'a fresh revive never overwrites the node mandate with the runtime kickoff');
+    assert.equal(requests.some((line) => line.includes(revived.node_id)), false, 'a fresh revive never names the node from the runtime kickoff');
+    assert.equal(readFileSync(initialPromptPath(bare.node_id), 'utf8').trim(), 'build me a receipt tracker', "a bare root's first typed message is still captured as its mandate");
+});

package/dist/pi-extensions/__tests__/canvas-stophook-agentend.test.js

@@ -409,7 +409,7 @@ test('stalled leaf (nothing live to await, no final) is still reprompted', async
     let shutdown = false;
     await settle(pi, stopEvent('I think I am basically done here'), { shutdown: () => { shutdown = true; } });
     assert.equal(pi.injected.length, 1, 'the stall reprompt fired');
-    assert.equal(pi.injected[0].content, STALL_REPROMPT, 'reprompt carries the stall nudge to push final / ask');
+    assert.equal(pi.injected[0].content, `<runtime kind="stop-guard" reason="stalled">${STALL_REPROMPT}</runtime>`, 'reprompt carries the stall nudge to push final / ask');
     assert.equal(pi.injected[0].deliverAs, 'followUp', 'reprompt delivered as a followUp');
     assert.equal(shutdown, false, 'a stalled leaf is NOT shut down — it is re-prompted to finish');
     assert.notEqual(getNode('leaf')?.intent, 'idle-release', 'a stalled leaf does not idle-release');

package/dist/pi-extensions/__tests__/canvas-stophook-context-nudge.test.js

@@ -98,7 +98,7 @@ test('band crossing mid-run (tool calls present) → context nudge is a STEER',
     await pi.fire('turn_end', turnEnd([{ type: 'toolCall', id: 't1', name: 'bash', arguments: {} }], 'toolUse'), ctxAt(150_000));
     assert.equal(pi.steered.length, 1, 'exactly one steer delivered');
     assert.equal(pi.steered[0].deliverAs, 'steer');
-    assert.match(pi.steered[0].content, /^\[crtr\] Context ~150k/);
+    assert.match(pi.steered[0].content, /^<runtime kind="context-nudge">Context ~150k/);
     assert.equal(pi.held.length, 0, 'nothing held for nextTurn');
 });
 test('band crossing on the FINAL message (no tool calls) → nudge is HELD as nextTurn, never a steer', async () => {
@@ -111,7 +111,7 @@ test('band crossing on the FINAL message (no tool calls) → nudge is HELD as ne
     assert.equal(pi.held.length, 1, 'nudge held for the next user message');
     assert.equal(pi.held[0].deliverAs, 'nextTurn');
     assert.equal(pi.held[0].customType, 'crtr-context-nudge');
-    assert.match(pi.held[0].content, /^\[crtr\] Context ~150k/);
+    assert.match(pi.held[0].content, /^<runtime kind="context-nudge">Context ~150k/);
     assert.notEqual(pi.held[0].triggerTurn, true, 'must not trigger a turn');
 });
 test('a truncated tool-calling turn (stopReason length) still steers — the loop continues past failed calls', async () => {

package/dist/pi-extensions/broker-local.d.ts

@@ -1,5 +1,3 @@
-import { REVIVE_KICKOFF_SENTINEL } from '../shared/generated-context.js';
-export { REVIVE_KICKOFF_SENTINEL };
 /** Persist a bare root's first real interactive message without clobbering an
  * existing spawning mandate. This is broker-local file state, not canvas.db. */
 export declare function captureGoalIfAbsent(nodeId: string, text: string): boolean;

package/dist/pi-extensions/broker-local.js

@@ -7,11 +7,9 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { CRTR_DIR_NAME } from '../types.js';
-import { REVIVE_KICKOFF_SENTINEL } from '../shared/generated-context.js';
 import { brokerExtensionState, commitBrokerGeneratedName, } from '../core/runtime/broker/daemon-ops.js';
 import { publishNodeNamed } from '../core/runtime/broker/node-named.js';
 import { headlessName, headlessNameFromConversation, sanitizeSessionName, slugFromPrompt, } from '../core/runtime/naming.js';
-export { REVIVE_KICKOFF_SENTINEL };
 function contextDir(nodeId) {
     if (nodeId === '' || nodeId === '.' || nodeId === '..' || /[\\/\0]/u.test(nodeId)) {
         throw new TypeError('node_id must be a non-empty path segment');

package/dist/pi-extensions/canvas-context-intro.js

@@ -26,7 +26,7 @@
 //
 // Plain TS-with-types — no imports from @earendil-works/* so this compiles inside
 // crouter's own tsc build without a dep on the pi packages.
-import { CONTEXT_INTRO_CUSTOM_TYPE } from '../shared/generated-context.js';
+import { CONTEXT_INTRO_CUSTOM_TYPE, formatCard, parseCard } from '../shared/generated-context.js';
 import { brokerExtensionState } from '../core/runtime/broker/daemon-ops.js';
 import { buildContextBearingsFromState, buildForkBearingsFromState, buildProjectContextBlockForBroker } from '../core/runtime/broker-extension-render.js';
 import { situationalContextBlock } from '../core/runtime/situational-context.js';
@@ -112,7 +112,8 @@ export function renderContextMessage(message, options, theme) {
                 return [paint('dim', truncateToWidth(stub, w))];
             }
             const lines = [paint('customMessageLabel', truncateToWidth(`[${CONTEXT_INTRO_CUSTOM_TYPE}]`, w)), ''];
-            for (const raw of messageText(message).split('\n')) {
+            const body = parseCard({ role: 'custom', customType: message.customType, content: messageText(message) })?.body ?? messageText(message);
+            for (const raw of body.split('\n')) {
                 for (const wrapped of wrapLine(raw, w))
                     lines.push(paint('customMessageText', wrapped));
             }
@@ -172,7 +173,7 @@ export function registerCanvasContextIntro(pi) {
             : buildContextBearingsFromState(state, buildProjectContextBlockForBroker(state.node.cwd), situationalContextBlock(nodeId), seen);
         pi.sendMessage({
             customType: CONTEXT_INTRO_CUSTOM_TYPE,
-            content,
+            content: formatCard('bearings', {}, content),
             display: true,
             details: { nodeId },
         });

package/dist/pi-extensions/canvas-goal-capture.js

@@ -18,8 +18,9 @@
 //      live-update the editor label. The first message may be a human's line OR
 //      a delegated child's kickoff task — naming off the agent prompt is fine.
 //
-// Both skip extension-injected messages (inbox wakes, steering) and the
-// fresh-revive kickoff (its sentinel), so neither is mistaken for a first input.
+// Both skip extension-injected messages (inbox wakes, steering) and every
+// runtime-authored message (the fresh-revive kickoff and its siblings, each one
+// a <runtime kind="…"> card), so neither is mistaken for a first input.
 //
 // Pure observation — it writes the goal file as a side effect and always lets
 // the message through unchanged (returns nothing ⇒ continue). Registered before
@@ -28,7 +29,8 @@
 //
 // Plain TS-with-types — no imports from @earendil-works/* so this compiles inside
 // crouter's own tsc build without a dep on the pi packages.
-import { captureGoalIfAbsent, generateAndCommitInitialName, REVIVE_KICKOFF_SENTINEL, } from './broker-local.js';
+import { captureGoalIfAbsent, generateAndCommitInitialName, } from './broker-local.js';
+import { parseCard } from '../shared/generated-context.js';
 /**
  * Register the goal-capture handler on `pi`.
  *
@@ -46,11 +48,13 @@ export function registerCanvasGoalCapture(pi) {
             if (text === '')
                 return;
             // Never seed a mandate or a name from an extension-injected message (inbox
-            // wakes, steering nudges) or a fresh-revive kickoff (the node is already
-            // named). Both would otherwise masquerade as the node's first real input.
+            // wakes, steering nudges) or any runtime-authored message — a fresh-revive
+            // kickoff arrives as a launch prompt, not an injection, and would otherwise
+            // masquerade as the node's first real input: overwriting a bare root's
+            // mandate and renaming the node from the runtime's own words.
             if (event.source === 'extension')
                 return;
-            if (text.startsWith(REVIVE_KICKOFF_SENTINEL))
+            if (parseCard({ role: 'user', content: text }) !== null)
                 return;
             // Goal capture is bare-root only: a delegated child already had its goal
             // persisted at birth (writeGoal), so only a genuine human-typed prompt