@north-light/crouter 0.3.213 → 0.3.215

package/dist/core/profiles/manifest.js

@@ -84,9 +84,9 @@ export function profileMemoryDir(profileId) {
  *  the user started them, not in whatever dir was last added to its purview. */
 function normalizeHome(profileId, manifest) {
     const stored = typeof manifest.home === 'string' && manifest.home !== '' ? manifest.home : null;
-    if (profileId === ROOT_PROFILE_ID)
-        return { ...manifest, home: stored };
-    return { ...manifest, home: stored ?? manifest.projects[0] ?? null };
+    const home = profileId === ROOT_PROFILE_ID ? stored : stored ?? manifest.projects[0] ?? null;
+    const pausedAt = typeof manifest.paused_at === 'string' && manifest.paused_at !== '' ? manifest.paused_at : null;
+    return { ...manifest, home, paused_at: pausedAt };
 }
 function readManifestFile(path, profileId) {
     if (!existsSync(path))
@@ -282,6 +282,7 @@ export function ensureRootProfile() {
             name: ROOT_PROFILE_NAME,
             projects: [],
             home: null,
+            paused_at: null,
             created_at: nowIso(),
             last_used_at: nowIso(),
         };
@@ -290,10 +291,33 @@ export function ensureRootProfile() {
         return { profileId: ROOT_PROFILE_ID, manifest: next };
     });
 }
-export function createProfile(name, projects = []) {
+/** Key shape every stored metadata entry must satisfy — kept env-mappable
+ *  (`CRTR_PROFILE_META_<KEY>`, see `core/runtime/spawn-env.ts`) by
+ *  construction. */
+const METADATA_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+export function assertProfileMetadata(entries) {
+    for (const [key, value] of Object.entries(entries)) {
+        if (!METADATA_KEY_SHAPE.test(key)) {
+            throw usage(`invalid metadata key: ${JSON.stringify(key)}`, {
+                received: key,
+                field: 'metadata',
+                next: 'Keys start with a letter or digit, followed by letters, digits, `_`, or `-`.',
+            });
+        }
+        if (value.includes('\0')) {
+            throw usage(`metadata value for ${key} contains a NUL byte, which no OS accepts in an environment variable`, {
+                field: 'metadata',
+                next: 'Remove NUL bytes from the value and retry.',
+            });
+        }
+    }
+}
+export function createProfile(name, projects = [], opts = {}) {
     const trimmed = name.trim();
     if (trimmed === '')
         throw usage('profile name must not be empty');
+    if (opts.metadata !== undefined)
+        assertProfileMetadata(opts.metadata);
     const resolvedProjects = dedupeOrdered(projects.map(resolveExistingProjectDir));
     const profileId = generateProfileId(trimmed);
     return withProfileManifestLock(profileId, () => {
@@ -302,6 +326,9 @@ export function createProfile(name, projects = []) {
             name: trimmed,
             projects: resolvedProjects,
             home: resolvedProjects[0] ?? null,
+            paused_at: null,
+            ...(opts.defaultKind !== undefined ? { default_kind: opts.defaultKind } : {}),
+            ...(opts.metadata !== undefined && Object.keys(opts.metadata).length > 0 ? { metadata: { ...opts.metadata } } : {}),
             created_at: nowIso(),
             last_used_at: null,
         };
@@ -335,6 +362,97 @@ function mutateManifest(profileId, mutate) {
 export function updateProfileLastUsed(profileId) {
     return mutateManifest(profileId, (m) => ({ ...m, last_used_at: nowIso() }));
 }
+/** Resolve an existing profile for a launch gate without making stale durable
+ * profile ids a new failure mode on a hot path. */
+function loadProfileManifestOrNull(profileId) {
+    if (profileId === null || profileId === undefined || profileId === '')
+        return null;
+    try {
+        return loadProfileManifest(profileId);
+    }
+    catch {
+        return null;
+    }
+}
+/** Paused check for an ALREADY-RESOLVED durable id (a canvas row's `profile_id`,
+ * `CRTR_PROFILE_ID`) — exact-id only, no name matching, so it costs one small
+ * read on the hot delivery paths that call it every poll. Fails OPEN: an id
+ * whose manifest is missing or corrupt is not paused, because treating it as
+ * paused would strand that node's queued inbox forever. */
+export function isProfilePaused(profileId) {
+    if (profileId === null || profileId === undefined || profileId === '')
+        return false;
+    try {
+        return loadExactProfileManifest(profileId).manifest.paused_at !== null;
+    }
+    catch {
+        return false;
+    }
+}
+/** Refuse a launch under a paused profile, naming the resume command. Shared by
+ * every gate that already holds a loaded manifest. */
+export function assertProfileEntryActive(entry) {
+    if (entry.manifest.paused_at === null)
+        return;
+    throw usage(`profile "${entry.manifest.name}" is paused and cannot start nodes`, {
+        received: entry.profileId,
+        next: `Resume it with \`crtr profile resume ${entry.profileId}\`.`,
+    });
+}
+export function assertProfileActive(profileId) {
+    const entry = loadProfileManifestOrNull(profileId);
+    if (entry === null)
+        return null;
+    assertProfileEntryActive(entry);
+    return entry;
+}
+export function pauseProfile(profileId) {
+    return mutateManifest(profileId, (m) => ({ ...m, paused_at: m.paused_at ?? nowIso() }));
+}
+export function resumeProfile(profileId) {
+    return mutateManifest(profileId, (m) => ({ ...m, paused_at: null }));
+}
+export function setProfileDefaultKind(profileId, defaultKind) {
+    return mutateManifest(profileId, (m) => ({ ...m, default_kind: defaultKind }));
+}
+/** Merge `set` entries over the stored map and drop `unset` keys; the
+ *  `metadata` field is omitted entirely when the result is empty. */
+export function updateProfileMetadata(profileId, set, unset = []) {
+    assertProfileMetadata(set);
+    return mutateManifest(profileId, (m) => {
+        const next = { ...(m.metadata ?? {}), ...set };
+        for (const key of unset)
+            delete next[key];
+        const { metadata: _dropped, ...rest } = m;
+        return { ...rest, ...(Object.keys(next).length > 0 ? { metadata: next } : {}) };
+    });
+}
+/** A profile's stored metadata for broker-env injection — sanitized entry by
+ *  entry (a manifest is hand-editable, so a bad key/value is dropped rather
+ *  than trusted) and never throwing: a stale/invalid/absent profile id is a
+ *  hot-path no-op, because broker-env resolution must never fail a launch
+ *  over a bad profile id (mirrors `readProfileEnvVars`). */
+export function readProfileMetadata(profileId) {
+    if (profileId === null || profileId === '')
+        return {};
+    try {
+        const stored = loadExactProfileManifest(profileId).manifest.metadata ?? {};
+        const out = {};
+        for (const [key, value] of Object.entries(stored)) {
+            if (typeof value !== 'string')
+                continue;
+            if (!METADATA_KEY_SHAPE.test(key))
+                continue;
+            if (value.includes('\0'))
+                continue;
+            out[key] = value;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 export function renameProfile(profileId, name) {
     const trimmed = name.trim();
     if (trimmed === '')

package/dist/core/runtime/boot-root.js

@@ -30,7 +30,7 @@ export async function bootRoot(opts) {
     if (!inTmux()) {
         throw new Error('crtr must be started from inside a tmux session — start tmux first (e.g. `tmux new -s work`), then run `crtr` there.');
     }
-    const kind = opts.kind ?? 'general';
+    const kind = opts.kind;
     // The front door's only source of profile identity — a root has no spawner to
     // inherit from. Runs BEFORE the create call: explicit --profile > MRU profile
     // covering cwd > a synchronous create-or-root-profile prompt (the stable root
@@ -47,12 +47,12 @@ export async function bootRoot(opts) {
     // viewer paints the crouton banner the instant the engine attaches (~1s),
     // which is the real "we're up" signal.
     const detail = await cliClient().createNode({
-        kind,
+        ...(kind !== undefined ? { kind } : {}),
         mode: 'base',
         prompt: opts.prompt,
         profile: profileId,
         cwd: opts.cwd,
-        name: opts.name ?? kind,
+        ...(opts.name !== undefined ? { name: opts.name } : kind !== undefined ? { name: kind } : {}),
         root: true,
         // The front door is exactly the wait a warm spare exists to remove: a bare
         // resident root with no kickoff. A miss costs nothing (cold spawn) and

package/dist/core/runtime/broker/inbox.js

@@ -198,11 +198,7 @@ export function coalesceBrokerInbox(entries, reportNodes) {
             cardSlot = deliveries.length;
             deliveries.push({ kind: 'card', text: '', cards: [], entries: [] });
         }
-        // The fallback to a CURRENT projected name is correct only for legacy
-        // entries, which predate the producer's own `from_name` snapshot.
-        const name = items.map((item) => item.from_name).filter((value) => value !== undefined && value !== '').at(-1)
-            ?? reportNodes.get(sender)?.name;
-        sections.push({ id: sender, ...(name === undefined ? {} : { name }), entries: items.map((entry) => cardEntry(entry, reportNodes)) });
+        sections.push({ id: sender, entries: items.map((entry) => cardEntry(entry, reportNodes)) });
     }
     if (cardSlot >= 0) {
         // Card sections group by sender, so its entry list comes from the input

package/dist/core/runtime/close.js

@@ -46,11 +46,16 @@ import { appendPassive } from '../feed/passive.js';
  *  crash path (revive.ts). */
 export function fanDoctrineWake(fromId, subscribers, label, data) {
     for (const sub of subscribers) {
-        const notice = { from: fromId, tier: 'normal', kind: 'message', label, data };
-        if (sub.active)
-            appendInbox(sub.node_id, notice);
-        else
-            appendPassive(sub.node_id, notice);
+        try {
+            const notice = { from: fromId, tier: 'normal', kind: 'message', label, data };
+            if (sub.active)
+                appendInbox(sub.node_id, notice);
+            else
+                appendPassive(sub.node_id, notice);
+        }
+        catch {
+            /* one unavailable subscriber never blocks the rest */
+        }
     }
 }
 /** The set of nodes to close: the root plus every descendant reachable down the

package/dist/core/runtime/revive.js

@@ -36,6 +36,7 @@ import { clearFault, beginBootFaultAttempt } from './fault.js';
 import { clearInjectedDocs } from '../substrate/injected-store.js';
 import { rootOfSpine } from './nodes.js';
 import { isReviewCompanionBound } from '../review/companion.js';
+import { assertProfileActive } from '../profiles/manifest.js';
 // ---------------------------------------------------------------------------
 // resumeArgs — which session source a revive resumes from
 // ---------------------------------------------------------------------------
@@ -108,6 +109,7 @@ export function reviveNode(nodeId, opts) {
     if (meta.final_report !== null) {
         throw new Error(`reviveNode: refusing to revive ${nodeId} — its finalization latch is set (final_report=${meta.final_report}). A final landed between the caller's reopen-gate check and this revive; re-run with --reopen if this retask is still wanted.`);
     }
+    assertProfileActive(meta.profile_id);
     // Double-launch guard: a fleet entry IS liveness (design D-1). reviveNode
     // runs fully SYNCHRONOUSLY on the daemon thread — this check, the launch,
     // and the fleet registration inside `headlessBrokerHost.launch` complete

package/dist/core/runtime/spawn-env.d.ts

@@ -22,6 +22,12 @@ export declare function buildOperationalEnvBase(opts: {
     targetProfileId: string | null;
     host?: NodeJS.ProcessEnv;
 }): NodeJS.ProcessEnv;
+/** Source F — the TARGET profile's manifest `metadata`, each entry surfaced
+ *  as `CRTR_PROFILE_META_<KEY>` (key uppercased, every non-alphanumeric run
+ *  → `_`). Identity facts rather than secrets — unlike the env store these
+ *  are readable back (`profile show`, ProfileDTO). Read straight off the
+ *  manifest at every launch; never throws (a bad profile id yields `{}`). */
+export declare function profileMetadataEnv(profileId: string | null): NodeJS.ProcessEnv;
 /** The one authoritative broker child env: sources A–C (the operational
  *  base, resolved from the TARGET node's own cwd/profile — `inv.env`'s
  *  `CRTR_NODE_CWD`/`CRTR_PROFILE_ID`, never this process's ambient
@@ -30,7 +36,9 @@ export declare function buildOperationalEnvBase(opts: {
  *  own `profile env` store (`readProfileEnvVars`, `core/profiles/env-store.ts`)
  *  read directly off disk and injected regardless of the host env or any
  *  `spawnEnv.allow` entry (setting a value there IS the consent to cross this
- *  boundary), plus D — the trusted, crtr-constructed `inv.env` overlay and the
+ *  boundary), F — the TARGET profile's manifest metadata as
+ *  `CRTR_PROFILE_META_*` (`profileMetadataEnv` above), plus D — the trusted,
+ *  crtr-constructed `inv.env` overlay and the
  *  fork-bomb recursion guard `FRONT_DOOR_ENV=1`. D is layered last so crtr's
  *  own constructed env always wins a name collision with a stored profile
  *  value. Every broker launch (front-door root, managed child, `--root`,

package/dist/core/runtime/spawn-env.js

@@ -33,6 +33,7 @@ import { statSync } from 'node:fs';
 import { delimiter, resolve } from 'node:path';
 import { readMergedLaunchConfig } from '../config.js';
 import { readProfileEnvVars } from '../profiles/env-store.js';
+import { readProfileMetadata } from '../profiles/manifest.js';
 import { binShimDirFor } from './bin-contributions.js';
 import { FRONT_DOOR_ENV } from './front-door-env.js';
 /** A1 — literal env-var names copied verbatim (no value inspection): a login
@@ -211,6 +212,18 @@ export function buildOperationalEnvBase(opts) {
     }
     return out;
 }
+/** Source F — the TARGET profile's manifest `metadata`, each entry surfaced
+ *  as `CRTR_PROFILE_META_<KEY>` (key uppercased, every non-alphanumeric run
+ *  → `_`). Identity facts rather than secrets — unlike the env store these
+ *  are readable back (`profile show`, ProfileDTO). Read straight off the
+ *  manifest at every launch; never throws (a bad profile id yields `{}`). */
+export function profileMetadataEnv(profileId) {
+    const out = {};
+    for (const [key, value] of Object.entries(readProfileMetadata(profileId))) {
+        out[`CRTR_PROFILE_META_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`] = value;
+    }
+    return out;
+}
 /** The one authoritative broker child env: sources A–C (the operational
  *  base, resolved from the TARGET node's own cwd/profile — `inv.env`'s
  *  `CRTR_NODE_CWD`/`CRTR_PROFILE_ID`, never this process's ambient
@@ -219,7 +232,9 @@ export function buildOperationalEnvBase(opts) {
  *  own `profile env` store (`readProfileEnvVars`, `core/profiles/env-store.ts`)
  *  read directly off disk and injected regardless of the host env or any
  *  `spawnEnv.allow` entry (setting a value there IS the consent to cross this
- *  boundary), plus D — the trusted, crtr-constructed `inv.env` overlay and the
+ *  boundary), F — the TARGET profile's manifest metadata as
+ *  `CRTR_PROFILE_META_*` (`profileMetadataEnv` above), plus D — the trusted,
+ *  crtr-constructed `inv.env` overlay and the
  *  fork-bomb recursion guard `FRONT_DOOR_ENV=1`. D is layered last so crtr's
  *  own constructed env always wins a name collision with a stored profile
  *  value. Every broker launch (front-door root, managed child, `--root`,
@@ -231,6 +246,7 @@ export function buildBrokerEnv(inv) {
     const operational = buildOperationalEnvBase({ targetCwd, targetProfileId });
     return {
         ...operational,
+        ...profileMetadataEnv(targetProfileId),
         ...readProfileEnvVars(targetProfileId),
         ...inv.env,
         [ADMITTED_HOST_PATH_ENV]: operational[ADMITTED_HOST_PATH_ENV],

package/dist/core/substrate/on-read.js

@@ -26,6 +26,7 @@
 // so a doc delivered by one never re-delivers at the same or lower rung
 // through another. Each candidate renders at its matched rung — the highest
 // `at` over its matching entries for the event.
+import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, parse, relative, sep } from 'node:path';
 import { CRTR_DIR_NAME } from '../../types.js';
@@ -172,6 +173,14 @@ function readFileFrontmatter(absReadFile) {
         return {};
     }
 }
+/** Content-identity dedup key, or null for an empty body (name-only docs
+ *  must not collide with each other). */
+function docContentKey(doc) {
+    const body = doc.body.trim();
+    if (body === '')
+        return null;
+    return `content-sha256:${createHash('sha256').update(body).digest('hex')}`;
+}
 function renderDocEnvelope(doc, rung) {
     if (rung === 'none')
         return null;
@@ -191,8 +200,13 @@ export function renderCandidateBlocks(subject, candidates, seen) {
     const rendered = [];
     for (const { doc, rung } of candidates) {
         const real = realpathOrSelf(doc.path);
+        // Byte-identical bodies at different paths (a cloned repo's store) inform
+        // once; the content key shares the realpath map and its rung semantics.
+        const contentKey = docContentKey(doc);
         if (deliveredAtOrAbove(seen, real, rung))
             continue;
+        if (contentKey !== null && deliveredAtOrAbove(seen, contentKey, rung))
+            continue;
         try {
             if (subject === null ? doc.gate !== undefined : !gatePasses(doc, subject))
                 continue;
@@ -200,6 +214,8 @@ export function renderCandidateBlocks(subject, candidates, seen) {
             if (block === null)
                 continue;
             recordDelivery(seen, real, rung);
+            if (contentKey !== null)
+                recordDelivery(seen, contentKey, rung);
             rendered.push(block);
         }
         catch {

package/dist/core/termrender/termrender.d.ts

@@ -15,7 +15,9 @@
 export declare function ensureRenderer(): void;
 /** Cheap predicate — true when the pinned managed binary is verified ready. Does not install or spawn. */
 export declare function isRendererReady(): boolean;
-/** Render markdown to terminal lines via the pinned binary; plaintext fallback. */
+/** Render markdown to terminal lines via the pinned binary; plaintext fallback.
+ *  Callers own the returned array — every return is a fresh copy, so a caller
+ *  that appends to it cannot grow the cached render on the next hit. */
 export declare function renderMarkdown(md: string, width: number): string[];
 export interface RenderedDoc {
     /** Rendered ANSI rows — byte-identical to the plain `doc render` output. */
@@ -50,7 +52,10 @@ export declare function renderMarkdownWithMap(md: string, width: number): Render
  * unchanged.
  */
 export declare function renderMarkdownBlockAware(md: string, proseWidth: number, paneWidth: number): RenderedDoc;
-/** Block-aware render as plain rows, for surfaces that do not anchor. */
+/** Block-aware render as plain rows, for surfaces that do not anchor. The rows
+ *  are the caller's own array: the block-aware render can pass the mapped
+ *  cache's line array straight through, and a caller appending to it would
+ *  otherwise poison every later render of the same document. */
 export declare function renderMarkdownBlockAwareLines(md: string, proseWidth: number, paneWidth: number): string[];
 /** Validate markdown via `termrender doc check`. */
 export declare function checkMarkdown(md: string): {

package/dist/core/termrender/termrender.js

@@ -410,12 +410,14 @@ class BoundedLRUCache {
     }
 }
 const _bodyCache = new BoundedLRUCache(20);
-/** Render markdown to terminal lines via the pinned binary; plaintext fallback. */
+/** Render markdown to terminal lines via the pinned binary; plaintext fallback.
+ *  Callers own the returned array — every return is a fresh copy, so a caller
+ *  that appends to it cannot grow the cached render on the next hit. */
 export function renderMarkdown(md, width) {
     const key = `${md}\0${width}`;
     const cached = _bodyCache.get(key);
     if (cached)
-        return cached;
+        return [...cached];
     ensureRenderer();
     if (rendererState === 'ready') {
         try {
@@ -429,7 +431,7 @@ export function renderMarkdown(md, width) {
             if (lines.length > 0 && lines[lines.length - 1] === '')
                 lines.pop();
             _bodyCache.set(key, lines);
-            return lines;
+            return [...lines];
         }
         catch (err) {
             // `doc render` is best-effort, so a non-timeout failure implicates the
@@ -441,7 +443,7 @@ export function renderMarkdown(md, width) {
     }
     const fallback = wrap(sanitize(md), width);
     _bodyCache.set(key, fallback);
-    return fallback;
+    return [...fallback];
 }
 /** Block types allowed to use the full pane width instead of the prose cap:
  *  a diagram is a picture, not prose, so a readability column limit only
@@ -657,9 +659,12 @@ export function renderMarkdownBlockAware(md, proseWidth, paneWidth) {
     }
     return { lines, rows, spans, blocks: base.blocks };
 }
-/** Block-aware render as plain rows, for surfaces that do not anchor. */
+/** Block-aware render as plain rows, for surfaces that do not anchor. The rows
+ *  are the caller's own array: the block-aware render can pass the mapped
+ *  cache's line array straight through, and a caller appending to it would
+ *  otherwise poison every later render of the same document. */
 export function renderMarkdownBlockAwareLines(md, proseWidth, paneWidth) {
-    return renderMarkdownBlockAware(md, proseWidth, paneWidth).lines;
+    return [...renderMarkdownBlockAware(md, proseWidth, paneWidth).lines];
 }
 /** Validate markdown via `termrender doc check`. */
 export function checkMarkdown(md) {

package/dist/core/termrender/version.d.ts

@@ -1 +1 @@
-export declare const TERMRENDER_VERSION = "4.12.7";
+export declare const TERMRENDER_VERSION = "4.12.8";

package/dist/core/termrender/version.js

@@ -1 +1 @@
-export const TERMRENDER_VERSION = '4.12.7';
+export const TERMRENDER_VERSION = '4.12.8';

package/dist/daemon/api/__tests__/profile-launch-gates.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/api/__tests__/profile-launch-gates.test.js

@@ -0,0 +1,111 @@
+import { after, afterEach, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getNode, listNodes } from '../../../core/canvas/canvas.js';
+import { closeDb } from '../../../core/canvas/db.js';
+import { CrtrError } from '../../../core/errors.js';
+import { createProfile, loadProfileManifest, pauseProfile, setProfileDefaultKind } from '../../../core/profiles/manifest.js';
+import { resetScopeCache } from '../../../core/scope.js';
+import { reviveNode } from '../../../core/runtime/revive.js';
+import { spawnNode } from '../../../core/runtime/nodes.js';
+import { handleCreate, resolveCreateKind } from '../handlers/nodes.js';
+const previousCrtrHome = process.env['CRTR_HOME'];
+const previousHome = process.env.HOME;
+let home = '';
+let cwd = '';
+beforeEach(() => {
+    closeDb();
+    home = mkdtempSync(join(tmpdir(), 'crtr-profile-launch-home-'));
+    cwd = mkdtempSync(join(tmpdir(), 'crtr-profile-launch-cwd-'));
+    process.env.HOME = home;
+    process.env['CRTR_HOME'] = join(home, 'canvas');
+    mkdirSync(process.env['CRTR_HOME'], { recursive: true });
+    resetScopeCache();
+});
+afterEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(cwd, { recursive: true, force: true });
+    resetScopeCache();
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = previousHome;
+    if (previousCrtrHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = previousCrtrHome;
+    resetScopeCache();
+});
+test('create rejects a paused profile before a node exists', async () => {
+    const profile = createProfile('paused profile', [cwd]);
+    pauseProfile(profile.profileId);
+    const ctx = {
+        method: 'POST',
+        path: '/v1/nodes',
+        params: {},
+        query: new URLSearchParams(),
+        body: { root: true, profile: profile.profileId, cwd, prompt: 'must not launch' },
+    };
+    const beforeRows = listNodes().length;
+    await assert.rejects(() => handleCreate(ctx), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.message, /paused profile/);
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(listNodes().length, beforeRows);
+});
+test('revive refuses a paused profile before launching a broker', () => {
+    const profile = createProfile('paused revive', [cwd]);
+    pauseProfile(profile.profileId);
+    const nodeId = 'paused-revive-node';
+    createNode({
+        node_id: nodeId,
+        name: nodeId,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'resident',
+        status: 'active',
+        parent: null,
+        profile_id: profile.profileId,
+    });
+    assert.throws(() => reviveNode(nodeId, { resume: true }), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(getNode(nodeId)?.status, 'active');
+});
+// The API create gate phrases the refusal; this one is what every OTHER birth
+// (fork, cron spawn, warm-pool mint, `/new` relaunch, recycle) actually hits,
+// because they all reach the canvas through spawnNode and none of them call
+// handleCreate.
+test('the birth gate refuses a paused profile for a daemon-side spawn', () => {
+    const profile = createProfile('paused spawn', [cwd]);
+    pauseProfile(profile.profileId);
+    const beforeRows = listNodes().length;
+    assert.throws(() => spawnNode({ kind: 'general', cwd, parent: null, profile_id: profile.profileId }), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(listNodes().length, beforeRows);
+});
+test('create kind resolves from the profile default when omitted', () => {
+    const profile = createProfile('default kind', [cwd]);
+    setProfileDefaultKind(profile.profileId, 'developer');
+    const entry = loadProfileManifest(profile.profileId);
+    assert.equal(resolveCreateKind(undefined, entry), 'developer');
+    assert.equal(resolveCreateKind('general', entry), 'general');
+    assert.equal(resolveCreateKind(undefined, null), 'general');
+});

package/dist/daemon/api/handlers/inbox.js

@@ -169,33 +169,44 @@ function isSlotValidationError(err) {
 // ===========================================================================
 // GET /v1/human/inbox — enumerate
 // ===========================================================================
+/** The one page-summary projection: the pending list and the per-node history differ only in which tickets they walk. */
+function pageSummaryToDTO(item, canonicalRoot) {
+    const dto = {
+        ticket_id: createHash('sha256').update(`${canonicalRoot}\0${item.id}`, 'utf8').digest('hex'),
+        kind: 'page',
+        title: item.title,
+        placement: item.placement,
+        dialect: item.dialect,
+        steps: item.steps,
+        emitted_at: item.emittedAt,
+        source: item.source,
+        slot_kinds: item.slotKinds,
+        inbox: item.inbox,
+        awaits_response: item.awaitsResponse,
+        state: item.state,
+    };
+    if (item.subtitle !== '')
+        dto.subtitle = item.subtitle;
+    if (item.answerDigest !== undefined)
+        dto.answer_digest = item.answerDigest;
+    if (item.recommendedOptions.length > 0) {
+        dto.recommended_options = item.recommendedOptions.map((option) => ({ slot_id: option.slotId, option_id: option.optionId, label: option.label }));
+    }
+    if (item.fastAction !== undefined)
+        dto.fast_action = { kind: item.fastAction.kind, responses: item.fastAction.responses };
+    return dto;
+}
 function handleList() {
     const allItems = scanInbox();
     const filtered = filterTerminalReviewTickets(allItems);
+    const canonicalRoot = realpathSync(ticketsRoot());
     const tickets = filtered.map((item) => {
         if (item.kind === 'page') {
-            const ticketId = createHash('sha256').update(`${realpathSync(ticketsRoot())}\0${item.id}`, 'utf8').digest('hex');
-            const dto = {
-                ticket_id: ticketId,
-                kind: 'page',
-                title: item.title,
-                placement: item.placement,
-                dialect: item.dialect,
-                steps: item.steps,
-                emitted_at: item.emittedAt,
-                source: item.source,
-                slot_kinds: item.slotKinds,
-                inbox: item.inbox,
-                awaits_response: item.awaitsResponse,
-                state: item.state,
-            };
-            if (item.subtitle !== '')
-                dto.subtitle = item.subtitle;
-            return dto;
+            return pageSummaryToDTO(item, canonicalRoot);
         }
         else if (item.kind === 'review') {
             return {
-                ticket_id: createHash('sha256').update(`${realpathSync(ticketsRoot())}\0${item.id}`, 'utf8').digest('hex'),
+                ticket_id: createHash('sha256').update(`${canonicalRoot}\0${item.id}`, 'utf8').digest('hex'),
                 kind: 'review',
                 title: item.title,
                 subtitle: item.subtitle,
@@ -221,28 +232,7 @@ function handleHistory(ctx) {
     }
     const history = scanPageHistory(nodeId);
     const canonicalRoot = realpathSync(ticketsRoot());
-    const tickets = history.map((item) => {
-        const ticketId = createHash('sha256').update(`${canonicalRoot}\0${item.id}`, 'utf8').digest('hex');
-        const dto = {
-            ticket_id: ticketId,
-            kind: 'page',
-            title: item.title,
-            placement: item.placement,
-            dialect: item.dialect,
-            steps: item.steps,
-            emitted_at: item.emittedAt,
-            source: item.source,
-            slot_kinds: item.slotKinds,
-            inbox: item.inbox,
-            awaits_response: item.awaitsResponse,
-            state: item.state,
-        };
-        if (item.subtitle !== '')
-            dto.subtitle = item.subtitle;
-        if (item.answerDigest !== undefined)
-            dto.answer_digest = item.answerDigest;
-        return dto;
-    });
+    const tickets = history.map((item) => pageSummaryToDTO(item, canonicalRoot));
     return { status: 200, body: { tickets } };
 }
 // ===========================================================================