@north-light/crouter 0.3.213 → 0.3.215

package/dist/core/__tests__/canvas-inbox-watcher-hold.test.js

@@ -14,6 +14,7 @@ import { appendInbox, readCursor } from '../feed/inbox.js';
 import { drainBearings } from '../runtime/kickoff.js';
 import { appendSituationalContext } from '../runtime/situational-context.js';
 import { createNode, getNode, recordPid, setIntent } from '../canvas/canvas.js';
+import { createProfile, pauseProfile, resumeProfile } from '../profiles/manifest.js';
 import { closeDb } from '../canvas/db.js';
 import { createApiServer } from '../../daemon/api/server.js';
 import { CrtrClient } from '../../api/client.js';
@@ -257,6 +258,45 @@ describe('canvas inbox watcher — hold + idle delivery', () => {
         assert.equal(pi.injected.length, 1);
         assert.equal(pi.injected[0].deliverAs, undefined, 'idle → sendUserMessage triggers a turn, no deliverAs');
     });
+    // Pause makes the profile inert while its broker is still alive: the entry
+    // must be RETAINED, not consumed. A critical entry is the sharpest case —
+    // its route aborts the live turn, exactly the punch-through pause forbids.
+    test('a paused profile holds queued entries in a live broker until resume', async () => {
+        freshNode('node-paused-profile');
+        closeDb();
+        const origUserHome = process.env.HOME;
+        const origProfile = process.env['CRTR_PROFILE_ID'];
+        const userHome = join(tmpdir(), `crtr-w-home-${Math.random().toString(36).slice(2, 8)}`);
+        mkdirSync(userHome, { recursive: true });
+        homes.push(userHome);
+        process.env.HOME = userHome;
+        try {
+            const profile = createProfile('paused watcher', ['/tmp']);
+            pauseProfile(profile.profileId);
+            process.env['CRTR_PROFILE_ID'] = profile.profileId;
+            const pi = makeFakePi();
+            disposers.push(registerWatcher(pi));
+            await wait(TICK_MS + 100);
+            appendInbox('node-paused-profile', { from: 'child-1', tier: 'critical', kind: 'update', label: 'sent while paused' });
+            await wait(SETTLE_MS);
+            assert.equal(pi.injected.length, 0, 'a paused profile delivers nothing to its live broker');
+            assert.equal(readCursor('node-paused-profile'), undefined, 'the held entry stays unconsumed');
+            resumeProfile(profile.profileId);
+            await wait(SETTLE_MS);
+            assert.equal(pi.injected.length, 1, 'resume delivers the entry that waited');
+            assert.match(pi.injected[0].content, /sent while paused/);
+        }
+        finally {
+            if (origUserHome === undefined)
+                delete process.env.HOME;
+            else
+                process.env.HOME = origUserHome;
+            if (origProfile === undefined)
+                delete process.env['CRTR_PROFILE_ID'];
+            else
+                process.env['CRTR_PROFILE_ID'] = origProfile;
+        }
+    });
 });
 // Lifecycle-ordering regression (the live inbox-delivery startup loop): pi
 // deliberately makes action methods (sendUserMessage/sendMessage) throw until

package/dist/core/__tests__/canvas-inbox-watcher.test.js

@@ -149,7 +149,7 @@ test('a human message coalesces verbatim — a conversation turn, not a digest',
         finalizeInboxEntry({ from: 'mqifzplr-0753bde3', tier: 'normal', kind: 'message', label: 'go', data: { body: 'go' } }),
     ]));
     assert.equal(agent.startsWith('<runtime kind="inbox"'), true);
-    assert.match(agent, /<from id="mqifzplr-0753bde3" updates="1">/);
+    assert.match(agent, /<from id="mqifzplr-0753bde3">/);
 });
 test('a mixed batch splits: human words verbatim, node reports in one card, order preserved', () => {
     // Concatenating the two into one message left `parseCard` unable to see the

package/dist/core/__tests__/dead-node-policy-table.test.js

@@ -16,6 +16,7 @@ function row(over = {}) {
         pi_session_id: null,
         cycle_pending: null,
         fork_from: null,
+        lifecycle: 'terminal',
         ...over,
     };
 }
@@ -40,6 +41,18 @@ test('row 4: intent=idle-release (chosen dormancy) takes no action — pass-2 in
     assert.equal(classifyDeadNode(row({ intent: 'idle-release' }), false), 'dormant');
     assert.equal(classifyDeadNode(row({ intent: 'idle-release', pi_session_id: 'sess' }), false), 'dormant', 'a saved session does not turn chosen dormancy into a crash');
 });
+// Row 4b is why a canvas of parked conversations does not stampede its host at
+// boot: a daemon restart classifies every one of them at once, and resuming an
+// engine that has nothing to come back to is pure cost.
+test('row 4b: a resident that died between turns with nothing to wake it is released, not resumed', () => {
+    const resident = row({ lifecycle: 'resident', pi_session_id: 'sess' });
+    assert.equal(classifyDeadNode(resident, false, false), 'release-idle');
+    assert.equal(classifyDeadNode(resident, false), 'respawn-resume', 'an uninformed caller keeps the conservative respawn');
+    assert.equal(classifyDeadNode(resident, false, true), 'respawn-resume', 'unseen mail, a live obligation, or an attached human brings it back');
+    assert.equal(classifyDeadNode(resident, true, false), 'respawn-resume', 'an interrupted turn outranks it — the continuation still owes that turn');
+    assert.equal(classifyDeadNode(row({ lifecycle: 'terminal', pi_session_id: 'sess' }), false, false), 'respawn-resume', 'a terminal node with nothing live has STALLED; coming back to be reprompted is the point');
+    assert.equal(classifyDeadNode(row({ lifecycle: 'resident' }), false, false), 'boot-failure', 'no saved session means it never booted — releasing would hide a boot failure');
+});
 test('row 5: every saved session resumes strictly unless its own pending cycle must be retried', () => {
     assert.equal(classifyDeadNode(row({ pi_session_id: 'sess' }), false), 'respawn-resume');
     assert.equal(classifyDeadNode(row({ pi_session_id: 'sess' }), true), 'respawn-resume', 'a dirty interrupted turn resumes in place; the respawn continuation re-drives it');

package/dist/core/__tests__/parse-argv-stdin-secret.test.js

@@ -9,11 +9,39 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { parseArgv } from '../command.js';
+// Companion lock: `crtr node yield "note"`, `crtr push "done"` and 11 sibling
+// leaves declare a `stdin` body and NO positional param, and take that body as
+// one bare token. A parser refactor dropped the branch that accepts it while
+// leaving the resolution code below it intact, so every one of them exited 2
+// with empty stderr — caught only indirectly, two suites away.
+const YIELD_SHAPED_PARAMS = [
+    { kind: 'flag', name: 'promote', type: 'bool', required: false, constraint: 'promote too' },
+    { kind: 'stdin', name: 'message', required: true, constraint: 'note to your future self' },
+];
 const PROFILE_SET_SHAPED_PARAMS = [
     { kind: 'positional', name: 'profile', required: true, constraint: 'profile id' },
     { kind: 'flag', name: 'name', type: 'string', required: true, constraint: 'var name' },
     { kind: 'stdin', name: 'value', required: true, constraint: 'value piped on stdin' },
 ];
+test('a lone positional supplies the stdin body on a leaf declaring no positional param', async () => {
+    const result = await parseArgv(YIELD_SHAPED_PARAMS, ['refresh against the original goal']);
+    assert.equal(result['message'], 'refresh against the original goal');
+});
+test('flags parse alongside the positional that supplies the stdin body', async () => {
+    const result = await parseArgv(YIELD_SHAPED_PARAMS, ['--promote', 'coordinate the fan-out']);
+    assert.equal(result['message'], 'coordinate the fan-out');
+    assert.equal(result['promote'], true);
+});
+test('allowPositional:false keeps a stdin-only leaf rejecting positionals by arity', async () => {
+    const params = [
+        { kind: 'stdin', name: 'document', required: false, allowPositional: false, constraint: 'page source on stdin' },
+    ];
+    await assert.rejects(() => parseArgv(params, ['page.tsx']), (err) => {
+        assert.equal(err.code, 'bad_invocation');
+        assert.match(err.message, /takes no positional arguments/);
+        return true;
+    });
+});
 test('an extra positional on a stdin-bearing leaf is rejected without echoing it', async () => {
     const secret = 'SUPERSECRET_ARGV';
     await assert.rejects(() => parseArgv(PROFILE_SET_SHAPED_PARAMS, ['some-profile', secret, '--name', 'REVIEW_TOKEN']), (err) => {

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -127,9 +127,12 @@ test('an already idle resident with no live obligation reconciles into completed
         intent: 'idle-release',
         pi_session_id: 'parked-session',
     });
+    subscribe(root, nodeId, true);
     await h.tick();
     assert.equal(h.node(nodeId)?.status, 'done', 'an older idle row becomes pruning-eligible without needing a broker revive');
     assert.equal(h.node(nodeId)?.intent, 'done', 'the reconciled row records clean completion');
+    const wake = readInboxSince(root).find((entry) => entry.from === nodeId && entry.data?.['reason'] === 'child-auto-done');
+    assert.ok(wake, 'the subscribing root learns that the parked resident completed without a final report');
 });
 test('an unattended resident with no live obligation completes on the daemon clock', { timeout: 30_000 }, async () => {
     // The park clock is read per supervision pass (unattendedParkMsForDaemon), so
@@ -153,6 +156,7 @@ test('an unattended resident with no live obligation completes on the daemon clo
                 env: {},
             },
         });
+        subscribe(root, nodeId, true);
         reviveNode(nodeId, { resume: true });
         const boot = await h.awaitBoot(nodeId);
         assert.equal(h.fleet.has(nodeId), true, 'the revived broker is fleet-owned');
@@ -170,6 +174,9 @@ test('an unattended resident with no live obligation completes on the daemon clo
         await h.awaitFleetExit(nodeId);
         assert.equal(h.fleet.has(nodeId), false, 'exit policy forgets the completed broker');
         assert.equal(h.node(nodeId)?.status, 'done', 'the row is terminal and eligible for history pruning');
+        const wake = readInboxSince(root).find((entry) => entry.from === nodeId && entry.data?.['reason'] === 'child-auto-done');
+        assert.ok(wake, 'the subscribing root is woken when the unattended clock completes the resident');
+        assert.match(wake.label, /sent no final report/, 'the wake distinguishes automatic completion from a final report');
         await h.tick();
         assert.equal(h.fleet.has(nodeId), false, 'a supervision tick does not revive completed history');
     }

package/dist/core/command.js

@@ -301,7 +301,7 @@ export async function parseArgv(params, tokens, options) {
     const provided = new Set(); // Track explicitly-provided parameter names
     const contextFilePaths = new Map();
     // Index params by kind for quick lookup
-    const positionalParam = params.find((p) => p.kind === 'positional');
+    const positionalParams = params.filter((p) => p.kind === 'positional');
     const stdinParam = params.find((p) => p.kind === 'stdin');
     const contextFileParam = params.find((p) => p.kind === 'context-file');
     const flagParams = params.filter((p) => p.kind === 'flag');
@@ -316,7 +316,7 @@ export async function parseArgv(params, tokens, options) {
         }
     }
     const positionalValues = [];
-    const repeatablePositional = positionalParam?.repeatable === true;
+    let positionalIndex = 0;
     let positionalWasSupplied = false; // Track if positional came from argv (not stdin)
     let forcedPositional = false; // true after bare --
     let i = 0;
@@ -419,46 +419,50 @@ export async function parseArgv(params, tokens, options) {
             continue;
         }
         // Positional (or token after --)
-        if (repeatablePositional && positionalParam !== undefined) {
+        const positionalParam = positionalParams[positionalIndex];
+        if (positionalParam !== undefined) {
+            const key = flagNameToKey(positionalParam.name);
+            if (positionalParam.repeatable === true) {
+                const values = result[key] ?? [];
+                values.push(token);
+                result[key] = values;
+            }
+            else {
+                result[key] = token;
+                positionalIndex++;
+            }
             positionalValues.push(token);
             positionalWasSupplied = true;
+            provided.add(key);
             i++;
             continue;
         }
         if (positionalValues.length > 0) {
             // A leaf that also declares a `stdin` param treats its stdin value as
             // write-only/sensitive by convention (`profile env set`'s value, etc.).
-            // An unexpected extra positional here is the single most likely misuse
-            // of that contract — a caller typing the secret as an argv token instead
-            // of piping it — so never echo the token or the full argv back; a
-            // sensitive value must not be disclosed by the very error that rejects
-            // the mistake.
+            // An unexpected extra positional is the likely secret-as-argv mistake, so
+            // never echo it back in the rejection.
             if (stdinParam !== undefined) {
                 throw parseArgvError('bad_invocation', `unexpected extra positional argument (value withheld: this leaf reads "${stdinParam.name}" from stdin, never argv)`, undefined, undefined, `Pipe it on stdin instead of passing it as a positional argument.`);
             }
-            throw parseArgvError('bad_invocation', `unexpected extra positional argument: ${token}`, tokens.join(' '), undefined, 'Use --flag for parameters; only one positional allowed.');
+            throw parseArgvError('bad_invocation', `unexpected extra positional argument: ${token}`, tokens.join(' '), undefined, 'Use declared flags or positional parameters. Run -h for the schema.');
         }
-        // A bare positional is accepted when the leaf declares a positional param,
-        // or when its stdin parameter explicitly permits a positional body.
-        if (positionalParam === undefined && (stdinParam === undefined || stdinParam.allowPositional === false)) {
+        // A leaf declaring no positional param may still take one bare token as its
+        // stdin body (`crtr node yield "note"`); the resolution below turns it into
+        // the stdin value. `allowPositional: false` opts out.
+        if (positionalParams.length === 0 && (stdinParam === undefined || stdinParam.allowPositional === false)) {
             throw parseArgvError('bad_invocation', `this leaf takes no positional arguments: ${token}`, token, undefined, 'Use --flag for parameters. Run -h for the schema.');
         }
         positionalValues.push(token);
         positionalWasSupplied = true;
         i++;
     }
-    // Assign positional (already tracked in provided set above)
-    if (positionalValues.length > 0 && positionalParam !== undefined) {
-        result[flagNameToKey(positionalParam.name)] = repeatablePositional
-            ? positionalValues
-            : positionalValues[0];
-    }
     // Resolve stdin if declared. Some leaves permit one positional token to
     // supply the stdin body; `-` then means read stdin. A positional alongside
     // genuinely piped, non-empty stdin is ambiguous and errors loudly.
     let stdinWasSupplied = false;
     if (stdinParam !== undefined) {
-        if (positionalValues.length > 0 && positionalParam === undefined && stdinParam.allowPositional !== false) {
+        if (positionalValues.length > 0 && positionalParams.length === 0 && stdinParam.allowPositional !== false) {
             const positionalValue = positionalValues[0];
             if (positionalValue === '-') {
                 const raw = await readStdinRaw();
@@ -505,10 +509,6 @@ export async function parseArgv(params, tokens, options) {
             stdinWasSupplied = !stdinIsTTY || positionalWasSupplied;
         }
     }
-    // Track provided positional param
-    if (positionalWasSupplied && positionalParam !== undefined) {
-        provided.add(flagNameToKey(positionalParam.name));
-    }
     // Track provided stdin param
     if (stdinWasSupplied && stdinParam !== undefined) {
         provided.add(flagNameToKey(stdinParam.name));

package/dist/core/feed/inbox.js

@@ -356,10 +356,6 @@ function cardEntry(e) {
         ...(e.disposition === undefined ? {} : { disposition: e.disposition }),
     };
 }
-/** The sender's display name as its last entry snapshotted it. */
-function sectionName(items) {
-    return items.map((item) => item.from_name).filter((name) => name !== undefined && name !== '').at(-1);
-}
 /** Split unread inbox pointers into ordered deliveries: each human entry
  *  verbatim, and every other sender in one `<runtime kind="inbox">` card. */
 export function coalesce(entries) {
@@ -395,8 +391,7 @@ export function coalesce(entries) {
             cardSlot = deliveries.length;
             deliveries.push({ kind: 'card', text: '', entries: [] });
         }
-        const name = sectionName(items);
-        sections.push({ id: sender, ...(name === undefined ? {} : { name }), entries: items.map(cardEntry) });
+        sections.push({ id: sender, entries: items.map(cardEntry) });
     }
     if (cardSlot >= 0) {
         // Card sections group by sender, so its entry list comes from the input

package/dist/core/help.d.ts

@@ -6,7 +6,7 @@ export interface Field {
      *  token caps. Lives here, never in a separate Preconditions section. */
     constraint: string;
 }
-/** Positional argument — at most one parameter per leaf; optionally repeatable. */
+/** Positional argument. A repeatable positional consumes every remaining positional token. */
 export interface PositionalParam {
     kind: 'positional';
     name: string;

package/dist/core/human/component-docs.js

@@ -76,7 +76,8 @@ ${SLOT_RULES}
 
 Props
 - \`id\` — required component id.
-- \`options\` — required nonempty array of \`{id:string (nonempty, unique), label:string (nonempty), description?:string}\`.
+- \`options\` — required nonempty array of \`{id:string (nonempty, unique), label:string (nonempty), description?:string, recommended?:boolean}\`.
+- \`recommended\` on one option marks it the suggested answer. At most one option per question may set it. The inbox shows it on the row, and when this question is the page's only response-bearing component the user can accept it from the list with one keystroke, without opening the page. Recommend when you have a view worth acting on; leave it off when the choice is genuinely theirs.
 - \`mode\` — required: \`single\` or \`multi\`.
 - \`label\` — required nonempty string: the question itself, drawn as the bold first line.
 - \`body\` — required nonempty string: markdown rendered above the choices — the context under the question a label cannot carry. Display-only; contributes nothing to the response.
@@ -92,7 +93,7 @@ Example
 <UserQuestion id="lane" label="Release lane" body="The audit closes tomorrow." mode="single" allowFreetext
   freetextLabel="Something else"
   options={[
-    { id: 'now', label: 'Ship now', description: 'Both gates are green.' },
+    { id: 'now', label: 'Ship now', description: 'Both gates are green.', recommended: true },
     { id: 'hold', label: 'Hold for the audit' },
   ]} />
 \`\`\``,

package/dist/core/human/page-schema.d.ts

@@ -26,6 +26,7 @@ export declare const optionSchema: z.ZodObject<{
     id: z.ZodString;
     label: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
+    recommended: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export declare const optionsConfigSchema: z.ZodObject<{
     label: z.ZodOptional<z.ZodString>;
@@ -34,6 +35,7 @@ export declare const optionsConfigSchema: z.ZodObject<{
         id: z.ZodString;
         label: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
+        recommended: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     mode: z.ZodEnum<{
         single: "single";
@@ -229,6 +231,32 @@ export interface PageManifest {
 export declare const BUILTIN_PAGE_CONFIG_SCHEMAS: Record<(typeof BUILTIN_PAGE_KINDS)[number], z.ZodType>;
 export declare const BUILTIN_PAGE_RESPONSE_SCHEMAS: Partial<Record<(typeof BUILTIN_PAGE_KINDS)[number], z.ZodType>>;
 export declare function issueText(error: z.ZodError): string;
+/** One question's recommended option, named well enough for a list row to draw it without reading the page. */
+export interface RecommendedOption {
+    slotId: string;
+    optionId: string;
+    label: string;
+}
+/**
+ * What one keypress on an inbox row publishes. `responses` is a complete, already-valid
+ * final response map, so the surface that sends it never assembles or interprets one.
+ * `kind` carries the semantic only — the words shown to a person belong to the surface.
+ */
+export interface PageFastAction {
+    kind: 'answer' | 'acknowledge';
+    responses: PageResponses;
+}
+/**
+ * The two independent overview facts: what a row displays, and what it can publish.
+ * A page can recommend without being fast-settleable — a recommendation beside a sibling
+ * input is still worth showing, but only the page itself can answer the rest of it.
+ */
+export interface PageOverviewActions {
+    recommendedOptions: RecommendedOption[];
+    fastAction?: PageFastAction;
+}
+/** Derive both overview facts from a manifest alone. Pure: no ticket state, no second read. */
+export declare function pageOverviewActions(manifest: PageManifest): PageOverviewActions;
 /** The canonical response-bearing predicate used by every page consumer. */
 export declare function isResponseBearingSlot(slot: PageSlot): boolean;
 /** Validate a persisted manifest. Publish-time validation made its slots authoritative, so reads do not resolve a component catalog. */

package/dist/core/human/page-schema.js

@@ -22,7 +22,7 @@ export const commentAnchorSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('row'), rowId: itemIdSchema }).strict(),
 ]);
 export const commentSchema = z.object({ id: z.string().min(1), anchor: commentAnchorSchema, text: z.string() }).strict();
-export const optionSchema = z.object({ id: itemIdSchema, label: z.string().min(1), description: z.string().optional() }).strict();
+export const optionSchema = z.object({ id: itemIdSchema, label: z.string().min(1), description: z.string().optional(), recommended: z.boolean().optional() }).strict();
 export const optionsConfigSchema = z.object({
     label: z.string().optional(),
     body: z.string().optional(),
@@ -31,7 +31,11 @@ export const optionsConfigSchema = z.object({
     allowFreetext: z.boolean().optional(),
     freetextLabel: z.string().optional(),
     freetextPlaceholder: z.string().optional(),
-}).strict();
+}).strict().superRefine((config, ctx) => {
+    const recommended = config.options.filter((option) => option.recommended === true);
+    if (recommended.length > 1)
+        ctx.addIssue({ code: 'custom', path: ['options'], message: `at most one option may be recommended, but ${recommended.length} are` });
+});
 export const optionsResponseSchema = z.object({ selectedOptionIds: z.array(itemIdSchema), comments: z.array(commentSchema), freetext: z.string().optional() }).strict();
 // Text is a writing surface, always: its whole point is the string the user hands back, so
 // there is no read-only mode. `singleLine` only swaps the multi-line surface for one compact
@@ -111,6 +115,35 @@ export const BUILTIN_PAGE_RESPONSE_SCHEMAS = {
 export function issueText(error) {
     return error.issues.map((issue) => `${issue.path.length === 0 ? 'value' : issue.path.join('.')}: ${issue.message}`).join('; ');
 }
+/** Derive both overview facts from a manifest alone. Pure: no ticket state, no second read. */
+export function pageOverviewActions(manifest) {
+    const recommendedOptions = [];
+    for (const slot of manifest.slots) {
+        if (slot.kind !== 'options' || slot.id === undefined)
+            continue;
+        // Persisted manifests predate the one-recommendation rule, so take the first rather than assuming.
+        const option = slot.config.options.find((candidate) => candidate.recommended === true);
+        if (option !== undefined)
+            recommendedOptions.push({ slotId: slot.id, optionId: option.id, label: option.label });
+    }
+    // An inline page lives in the transcript, where there is no row to press.
+    if (manifest.delivery.placement !== 'panel')
+        return { recommendedOptions };
+    const answerable = manifest.slots.filter(isResponseBearingSlot);
+    // A notice settles on the empty map, which is exactly what Acknowledge publishes from the page.
+    if (answerable.length === 0)
+        return { recommendedOptions, fastAction: { kind: 'acknowledge', responses: {} } };
+    if (answerable.length > 1)
+        return { recommendedOptions };
+    const slot = answerable[0];
+    const recommendation = recommendedOptions.find((candidate) => candidate.slotId === slot.id);
+    if (slot.kind !== 'options' || recommendation === undefined)
+        return { recommendedOptions };
+    return {
+        recommendedOptions,
+        fastAction: { kind: 'answer', responses: { [slot.id]: { selectedOptionIds: [recommendation.optionId], comments: [] } } },
+    };
+}
 /** The canonical response-bearing predicate used by every page consumer. */
 export function isResponseBearingSlot(slot) {
     if (slot.display === true)

package/dist/core/human/scan.js

@@ -3,6 +3,7 @@ import { basename, join } from 'node:path';
 import { claimPath, isResolved, pageManifestPath, reviewPath } from './convention.js';
 import { readJsonOrNull } from '../fs-utils.js';
 import { validateReviewDescriptor } from './review-schema.js';
+import { pageOverviewActions } from './page-schema.js';
 import { parsePage } from './page.js';
 import { pageTicketState, readTicketResult } from './tickets.js';
 import { ticketsRoot } from './root.js';
@@ -42,6 +43,8 @@ function pageSummary(dir, id) {
             return null;
         }
     }
+    const state = pageTicketState(dir);
+    const { recommendedOptions, fastAction } = pageOverviewActions(manifest);
     return {
         dir,
         id,
@@ -56,7 +59,10 @@ function pageSummary(dir, id) {
         awaitsResponse: manifest.delivery.reply,
         source: manifest.source ?? {},
         emittedAt,
-        state: pageTicketState(dir),
+        state,
+        recommendedOptions,
+        // A settled ticket has nothing left to publish, so only a pending one offers the keypress.
+        ...(fastAction !== undefined && state === 'pending' ? { fastAction } : {}),
         claim: claimSummary(dir),
     };
 }

package/dist/core/human/types.d.ts

@@ -65,6 +65,10 @@ export interface PageTicketSummary {
     steps: number;
     slotKinds: string[];
     awaitsResponse: boolean;
+    /** Every question's recommended option, for a row that says what is suggested without opening the page. */
+    recommendedOptions: import('./page-schema.js').RecommendedOption[];
+    /** Present when this ticket can be settled straight from a list row; absent when only the page can answer it. */
+    fastAction?: import('./page-schema.js').PageFastAction;
     state: 'pending' | 'resolved' | 'canceled' | 'passive';
 }
 /** The only pending-ticket shape scanners expose. */

package/dist/core/keybindings/attach-control.d.ts

@@ -13,6 +13,9 @@ export declare const ATTACH_CONTROL_BINDINGS: readonly [{
 }, {
     readonly menuId: "crtr.tmux.menu.attach.inbox.toggle";
     readonly actionId: "crtr.attach.inbox.toggle";
+}, {
+    readonly menuId: "crtr.tmux.menu.attach.inbox-strip";
+    readonly actionId: "crtr.attach.inbox-strip";
 }, {
     readonly menuId: "crtr.tmux.menu.attach.model-ladder.next";
     readonly actionId: "crtr.attach.model-ladder.next";

package/dist/core/keybindings/attach-control.js

@@ -4,6 +4,7 @@ export const ATTACH_CONTROL_BINDINGS = [
     { menuId: 'crtr.tmux.menu.attach.graph.toggle', actionId: 'crtr.attach.graph.toggle' },
     { menuId: 'crtr.tmux.menu.attach.help.toggle', actionId: 'crtr.attach.help.toggle' },
     { menuId: 'crtr.tmux.menu.attach.inbox.toggle', actionId: 'crtr.attach.inbox.toggle' },
+    { menuId: 'crtr.tmux.menu.attach.inbox-strip', actionId: 'crtr.attach.inbox-strip' },
     { menuId: 'crtr.tmux.menu.attach.model-ladder.next', actionId: 'crtr.attach.model-ladder.next' },
     { menuId: 'crtr.tmux.menu.attach.model-ladder.previous', actionId: 'crtr.attach.model-ladder.previous' },
     { menuId: 'crtr.tmux.menu.attach.command.inspect', actionId: 'crtr.attach.command.inspect' },

package/dist/core/keybindings/catalog.js

@@ -72,6 +72,7 @@ export const BINDING_CATALOG = Object.freeze([
     ...attachEntry('crtr.tmux.menu.attach.graph.toggle', 'crtr.attach.graph.toggle', 'Toggle graph', 'Open or close the graph overlay.', ['g'], ['alt+g']),
     ...attachEntry('crtr.tmux.menu.attach.help.toggle', 'crtr.attach.help.toggle', 'Help', 'Open the attach help overlay.', ['k'], ['alt+shift+k']),
     ...attachEntry('crtr.tmux.menu.attach.inbox.toggle', 'crtr.attach.inbox.toggle', 'Toggle inbox', 'Open or close the human inbox surface in this viewer.', ['i'], []),
+    ...attachEntry('crtr.tmux.menu.attach.inbox-strip', 'crtr.attach.inbox-strip', 'Pending requests', 'Jump to the pending human-request strip at the top of the pane.', ['u'], ['alt+u']),
     ...attachEntry('crtr.tmux.menu.attach.model-ladder.next', 'crtr.attach.model-ladder.next', 'Next model', 'Move to the next model ladder rung.', [']'], ['alt+m']),
     ...attachEntry('crtr.tmux.menu.attach.model-ladder.previous', 'crtr.attach.model-ladder.previous', 'Previous model', 'Move to the previous model ladder rung.', ['['], ['alt+shift+m']),
     ...attachEntry('crtr.tmux.menu.attach.command.inspect', 'crtr.attach.command.inspect', 'Inspect loaded command', 'Open the loaded slash command’s expanded prompt.', ['h'], ['alt+shift+h']),

package/dist/core/profiles/deletion-reservation.d.ts

@@ -2,7 +2,11 @@
  * The caller must release the returned lease after completion or failure. */
 export declare function reserveProfileDeletion(profileId: string): () => void;
 /** The synchronous birth gate. spawnNode calls this immediately before the
- * canvas row is persisted. A reservation rejects a birth that reaches the gate
- * during deletion; the exact manifest read rejects one whose async preflight
- * started before a fast hard deletion and resumed after its lease was released. */
+ * canvas row is persisted, so EVERY birth passes here — the API create, forks,
+ * cron spawns, warm-pool mints, `/new` relaunch, and recycle alike. A
+ * reservation rejects a birth that reaches the gate during deletion; the exact
+ * manifest read rejects one whose async preflight started before a fast hard
+ * deletion and resumed after its lease was released; a paused profile is inert
+ * and creates nothing. `POST /v1/nodes` gates earlier only to phrase the paused
+ * refusal against the operand the caller actually typed. */
 export declare function assertProfileAvailableForBirth(profileId: string | null): void;

package/dist/core/profiles/deletion-reservation.js

@@ -1,5 +1,5 @@
 import { usage } from '../errors.js';
-import { loadExactProfileManifest } from './manifest.js';
+import { assertProfileEntryActive, loadExactProfileManifest } from './manifest.js';
 const deletingProfileIds = new Set();
 /** Reserve one profile identity for its complete daemon-owned deletion lifecycle.
  * The caller must release the returned lease after completion or failure. */
@@ -21,9 +21,13 @@ export function reserveProfileDeletion(profileId) {
     };
 }
 /** The synchronous birth gate. spawnNode calls this immediately before the
- * canvas row is persisted. A reservation rejects a birth that reaches the gate
- * during deletion; the exact manifest read rejects one whose async preflight
- * started before a fast hard deletion and resumed after its lease was released. */
+ * canvas row is persisted, so EVERY birth passes here — the API create, forks,
+ * cron spawns, warm-pool mints, `/new` relaunch, and recycle alike. A
+ * reservation rejects a birth that reaches the gate during deletion; the exact
+ * manifest read rejects one whose async preflight started before a fast hard
+ * deletion and resumed after its lease was released; a paused profile is inert
+ * and creates nothing. `POST /v1/nodes` gates earlier only to phrase the paused
+ * refusal against the operand the caller actually typed. */
 export function assertProfileAvailableForBirth(profileId) {
     if (profileId === null)
         return;
@@ -34,5 +38,5 @@ export function assertProfileAvailableForBirth(profileId) {
             next: 'Choose another profile or wait for this deletion to finish.',
         });
     }
-    loadExactProfileManifest(profileId);
+    assertProfileEntryActive(loadExactProfileManifest(profileId));
 }

package/dist/core/profiles/manifest.d.ts

@@ -39,8 +39,34 @@ export declare function loadProfileManifest(profileIdOrName: string): ProfileEnt
  *  below run inside this. */
 export declare function withProfileManifestLock<T>(profileId: string, fn: () => T): T;
 export declare function ensureRootProfile(): ProfileEntry;
-export declare function createProfile(name: string, projects?: string[]): ProfileEntry;
+export declare function assertProfileMetadata(entries: Record<string, string>): void;
+export declare function createProfile(name: string, projects?: string[], opts?: {
+    defaultKind?: string;
+    metadata?: Record<string, string>;
+}): ProfileEntry;
 export declare function updateProfileLastUsed(profileId: string): ProfileEntry;
+/** Paused check for an ALREADY-RESOLVED durable id (a canvas row's `profile_id`,
+ * `CRTR_PROFILE_ID`) — exact-id only, no name matching, so it costs one small
+ * read on the hot delivery paths that call it every poll. Fails OPEN: an id
+ * whose manifest is missing or corrupt is not paused, because treating it as
+ * paused would strand that node's queued inbox forever. */
+export declare function isProfilePaused(profileId: string | null | undefined): boolean;
+/** Refuse a launch under a paused profile, naming the resume command. Shared by
+ * every gate that already holds a loaded manifest. */
+export declare function assertProfileEntryActive(entry: ProfileEntry): void;
+export declare function assertProfileActive(profileId: string | null | undefined): ProfileEntry | null;
+export declare function pauseProfile(profileId: string): ProfileEntry;
+export declare function resumeProfile(profileId: string): ProfileEntry;
+export declare function setProfileDefaultKind(profileId: string, defaultKind: string): ProfileEntry;
+/** Merge `set` entries over the stored map and drop `unset` keys; the
+ *  `metadata` field is omitted entirely when the result is empty. */
+export declare function updateProfileMetadata(profileId: string, set: Record<string, string>, unset?: string[]): ProfileEntry;
+/** A profile's stored metadata for broker-env injection — sanitized entry by
+ *  entry (a manifest is hand-editable, so a bad key/value is dropped rather
+ *  than trusted) and never throwing: a stale/invalid/absent profile id is a
+ *  hot-path no-op, because broker-env resolution must never fail a launch
+ *  over a bad profile id (mirrors `readProfileEnvVars`). */
+export declare function readProfileMetadata(profileId: string | null): Record<string, string>;
 export declare function renameProfile(profileId: string, name: string): ProfileEntry;
 export declare function addProfileProject(profileId: string, dir: string, opts?: {
     home?: boolean;