@north-light/crouter 0.3.213 → 0.3.215

package/dist/daemon/api/handlers/messages.js

@@ -6,6 +6,7 @@ import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js'
 import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { deliverLive, interruptLive } from '../../../core/runtime/interactive-deliver.js';
 import { cancelPendingHumanMessages } from '../../../core/feed/inbox.js';
+import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { withFreshTerminalGuard } from '../../../core/canvas/canvas.js';
 import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../../../core/runtime/reopen.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
@@ -194,6 +195,12 @@ async function handleMessage(ctx) {
         throw notFound(`unknown node: ${id}`, { received: id });
     const req = parseSendBody(ctx.body);
     const tier = (req.tier ?? 'normal');
+    // A paused profile takes no new work through either delivery route: the
+    // interactive route hands the body to the live broker instead of queueing it,
+    // and a wake is a revive by another name. So a paused target always takes the
+    // durable path and its entry waits, at every tier, for `crtr profile resume`
+    // (the live broker's watcher holds it; a dormant one is not woken).
+    const paused = isProfilePaused(meta.profile_id);
     const from = req.from ?? null;
     const hasBody = req.body.trim() !== '';
     // One sidecar slot: the caller's rendered card, or prose rendered as one.
@@ -235,7 +242,7 @@ async function handleMessage(ctx) {
     //     ordering. A mid-revive race (liveness said live, connection refused)
     //     falls back to the durable path below; a genuinely dormant target skips
     //     straight there (append + revive, watcher delivers post-boot). ---
-    if (req.delivery === 'interactive' && isBrokerLive(meta)) {
+    if (req.delivery === 'interactive' && !paused && isBrokerLive(meta)) {
         try {
             if (hasSidecar)
                 appendSituationalContext(id, sidecar);
@@ -310,7 +317,7 @@ async function handleMessage(ctx) {
     // A wake-capable tier revives a dormant target so its inbox-watcher delivers
     // this; deferred never wakes — it rides the target's next natural cycle.
     let revived = false;
-    if (tier !== 'deferred' && !isBrokerLive(meta)) {
+    if (tier !== 'deferred' && !paused && !isBrokerLive(meta)) {
         try {
             const result = reviveNode(id, { resume: true });
             revived = result.launch !== undefined;

package/dist/daemon/api/handlers/nodes.d.ts

@@ -1,8 +1,10 @@
 import { type ModelRegistryLike } from '../../../core/model-routes.js';
+import { assertProfileActive } from '../../../core/profiles/manifest.js';
 import type { HandlerResult, RequestContext, RouteTable } from '../router.js';
 interface NodeHandlerDeps {
     modelRegistry?: ModelRegistryLike;
 }
+export declare function resolveCreateKind(kind: string | undefined, profile: ReturnType<typeof assertProfileActive>): string;
 export declare function handleCreate(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;
 export declare function handlePromote(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;
 export declare function handleYield(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;

package/dist/daemon/api/handlers/nodes.js

@@ -32,7 +32,7 @@ import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js'
 import { isBrokerLive, persistDormantModel, setModelLive } from '../../../core/runtime/model-swap.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { claimWarmNode, refillWarmPool, warmPoolEnabled } from '../../../core/runtime/warm-pool.js';
-import { profileHome } from '../../../core/profiles/manifest.js';
+import { assertProfileActive, profileHome } from '../../../core/profiles/manifest.js';
 import { fullName } from '../../../core/canvas/labels.js';
 import { getCron } from '../../../core/canvas/crons.js';
 import { cronWakeOrigin } from '../../../core/runtime/bearings.js';
@@ -81,11 +81,11 @@ function countFiles(id) {
 /** Validate + narrow the create body (spec §6.2). */
 function parseCreateBody(body) {
     if (typeof body !== 'object' || body === null) {
-        throw usage('a node create requires a JSON body { kind, ... }');
+        throw usage('a node create requires a JSON body');
     }
     const b = body;
-    if (typeof b['kind'] !== 'string' || b['kind'].trim() === '') {
-        throw usage('a node create requires a kind');
+    if (b['kind'] !== undefined && (typeof b['kind'] !== 'string' || b['kind'].trim() === '')) {
+        throw usage('kind must be a non-empty string when provided');
     }
     const rootLifecycle = b['root_lifecycle'];
     if (rootLifecycle !== undefined &&
@@ -184,6 +184,9 @@ function warmRequestFor(req, cwd, profileId) {
         name: req.name ?? null,
     };
 }
+export function resolveCreateKind(kind, profile) {
+    return kind ?? profile?.manifest.default_kind ?? 'general';
+}
 function requestFromLaunch(launch) {
     const intent = launch.modelIntent === undefined
         ? undefined
@@ -227,8 +230,12 @@ export async function handleCreate(ctx, deps = {}) {
     // to this daemon, never to the possibly-remote CLI caller.
     const contextCwd = req.cwd ?? process.cwd();
     const profileId = await resolveProfileId(req.profile, parent ?? null, contextCwd);
-    const cwd = resolveNodeCwd(req, parent, profileId, contextCwd);
-    const launch = buildLaunchSpec(req.kind, (req.mode ?? 'base'), {
+    const profile = assertProfileActive(profileId);
+    const kind = resolveCreateKind(req.kind, profile);
+    assertKindServer(kind);
+    const resolvedReq = { ...req, kind };
+    const cwd = resolveNodeCwd(resolvedReq, parent, profileId, contextCwd);
+    const launch = buildLaunchSpec(kind, (resolvedReq.mode ?? 'base'), {
         lifecycle: req.root === true ? (req.root_lifecycle ?? 'resident') : 'terminal',
         hasManager: req.root !== true,
         ...(req.model !== undefined ? { model: req.model } : {}),
@@ -239,7 +246,7 @@ export async function handleCreate(ctx, deps = {}) {
     // --- Warm path: hand out an already-booted spare instead of paying a full
     //     engine boot. A miss is not a failure — it falls through to the cold
     //     spawn below and mints the spare that serves the NEXT create. ---
-    const warm = warmRequestFor(req, cwd, profileId);
+    const warm = warmRequestFor(resolvedReq, cwd, profileId);
     if (warm !== null) {
         const claimed = await claimWarmNode(warm);
         refillWarmPool(warm);
@@ -249,7 +256,7 @@ export async function handleCreate(ctx, deps = {}) {
             return { status: 201, body: detailOf(claimed) };
         }
     }
-    const recipe = buildRecipe(req, parent, cwd);
+    const recipe = buildRecipe(resolvedReq, parent, cwd);
     recipe.readiness = req.root === true ? 'await' : 'launch';
     const result = await spawnChild(recipe);
     if (schema !== null)

package/dist/daemon/api/handlers/profiles.js

@@ -12,7 +12,9 @@ import { toProfileDTO } from '../map.js';
 const ROOT_PROFILE_NAME = 'root';
 /** `PUT /v1/profiles/:name` — idempotent ensure. `root` maps to the singleton
  *  root profile; any other name returns the existing same-named profile if one
- *  exists (so a re-PUT yields the same id), else creates it. */
+ *  exists (so a re-PUT yields the same id), else creates it. `default_kind`
+ *  and `metadata` apply only at create — an existing profile is returned
+ *  untouched; mutation stays on `crtr profile kind` / `crtr profile meta`. */
 function handleEnsure(ctx) {
     const name = ctx.params['name'];
     const req = (ctx.body ?? {});
@@ -23,7 +25,10 @@ function handleEnsure(ctx) {
     if (existing !== undefined) {
         return { status: 200, body: toProfileDTO(existing) };
     }
-    const created = createProfile(name, req.projects ?? []);
+    const created = createProfile(name, req.projects ?? [], {
+        defaultKind: req.default_kind,
+        metadata: req.metadata,
+    });
     return { status: 200, body: toProfileDTO(created) };
 }
 /** `GET /v1/profiles` — every profile with a readable manifest. */

package/dist/daemon/api/map.js

@@ -264,6 +264,9 @@ export function toProfileDTO(entry) {
         name: entry.manifest.name,
         projects: [...entry.manifest.projects],
         home: entry.manifest.home,
+        paused_at: entry.manifest.paused_at,
+        default_kind: entry.manifest.default_kind ?? 'general',
+        metadata: { ...(entry.manifest.metadata ?? {}) },
         default_dir: null,
     };
 }

package/dist/daemon/fleet.d.ts

@@ -20,10 +20,10 @@ export declare function surfaceBootFailure(meta: NodeMeta): Promise<void>;
  *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
  *  not throwing the conversation away. */
 export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null): boolean;
-export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'respawn-cycle' | 'respawn-resume' | 'boot-failure';
+export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'release-idle' | 'respawn-cycle' | 'respawn-resume' | 'boot-failure';
 /** The narrow durable state the policy table reads. Structural (a Pick, not
  *  NodeMeta itself) so tests fabricate table rows directly. */
-export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' | 'cycle_pending' | 'fork_from'>;
+export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' | 'cycle_pending' | 'fork_from' | 'lifecycle'>;
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
@@ -37,8 +37,12 @@ export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' |
  *  needs the turn re-driven, which is a continuation prompt on top of the
  *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
  *  only to route a node that died before session_start ever recorded a session
- *  to a fresh relaunch instead of terminalizing it as a boot failure. */
-export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean): DeadNodeAction;
+ *  to a fresh relaunch instead of terminalizing it as a boot failure.
+ *
+ *  `pendingWake` is the one non-row input (`hasPendingWake`): whether anything
+ *  would drive a turn if the engine came back. It selects row 4b and defaults
+ *  to `true`, so an uninformed caller keeps the conservative respawn. */
+export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean, pendingWake?: boolean): DeadNodeAction;
 /** An exit with uptime at or above this resets the consecutive-failure
  *  counter before classification; a shorter-lived exit increments it. */
 export declare const HEALTHY_UPTIME_MS = 60000;

package/dist/daemon/fleet.js

@@ -19,6 +19,7 @@ import { isSafeNodeId } from '../core/canvas/paths.js';
 import { transition } from '../core/runtime/lifecycle.js';
 import { fanDoctrineWake } from '../core/runtime/close.js';
 import { hasCleanAbort, isBusy } from '../core/runtime/busy.js';
+import { hasPendingWake } from './reconcilers/live-obligation.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { emitEvent } from '../core/events/emit.js';
@@ -76,8 +77,12 @@ export function retryResumeMode(meta) {
  *  needs the turn re-driven, which is a continuation prompt on top of the
  *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
  *  only to route a node that died before session_start ever recorded a session
- *  to a fresh relaunch instead of terminalizing it as a boot failure. */
-export function classifyDeadNode(row, busy) {
+ *  to a fresh relaunch instead of terminalizing it as a boot failure.
+ *
+ *  `pendingWake` is the one non-row input (`hasPendingWake`): whether anything
+ *  would drive a turn if the engine came back. It selects row 4b and defaults
+ *  to `true`, so an uninformed caller keeps the conservative respawn. */
+export function classifyDeadNode(row, busy, pendingWake = true) {
     if (row === null)
         return 'forget'; // row 1: row deleted
     if (row.status === 'done' || row.status === 'canceled' || row.status === 'dead')
@@ -86,6 +91,18 @@ export function classifyDeadNode(row, busy) {
         return 'respawn-fresh'; // row 3
     if (row.intent === 'idle-release')
         return 'dormant'; // row 4
+    // Row 4b — a RESIDENT node is interactable and is never forced to finish
+    // anything (stop-guard's `dormant`), so one that died between turns with
+    // nothing waiting for it has no turn to come back to. Resuming it would boot
+    // an engine that sits at an idle prompt until the park clock releases it 15
+    // minutes later, and a daemon restart classifies EVERY such node at once —
+    // which is how a canvas with a hundred parked conversations stampedes its
+    // host to death at boot. Release instead: the row stays revivable and its
+    // next message wakes it with the same session resume.
+    // A terminal node is deliberately excluded: with nothing live and no final
+    // pushed it has STALLED, and coming back to be reprompted is the point.
+    if (row.lifecycle === 'resident' && !busy && !pendingWake && row.pi_session_id != null)
+        return 'release-idle';
     if (row.pi_session_id != null)
         return retryResumeMode(row) ? 'respawn-resume' : 'respawn-cycle'; // row 5: any saved session
     if (busy)
@@ -263,7 +280,7 @@ export class DaemonFleet {
         // as the run settles, then writes the clean-abort certificate. Both need the
         // same recovery: resume the saved transcript and re-drive the stopped turn.
         const interruptedTurn = isBusy(nodeId) || hasCleanAbort(nodeId);
-        const action = classifyDeadNode(meta, interruptedTurn);
+        const action = classifyDeadNode(meta, interruptedTurn, hasPendingWake(nodeId));
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
@@ -275,6 +292,22 @@ export class DaemonFleet {
                 // tick's pass-2 cursor-keyed retry cap (D-11), not this throttle.
                 this.#clearThrottle(nodeId);
                 break;
+            case 'release-idle':
+                // Dormancy the daemon chose ON the node's behalf, and the same
+                // non-failure: the row lands exactly where a stophook idle-release
+                // would have left it, so pass-2 inbox wakes own its next revive.
+                this.#clearThrottle(nodeId);
+                transition(nodeId, 'release');
+                emitEvent({
+                    level: 'info',
+                    event: 'broker.recovery.released',
+                    ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
+                    fields: {
+                        ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
+                        origin,
+                    },
+                });
+                break;
             case 'boot-failure':
                 await this.#terminalize(nodeId, meta, {
                     event: 'broker.boot.failed',
@@ -392,11 +425,6 @@ export class DaemonFleet {
                 error: err,
             });
         }
-        try {
-            fanDoctrineWake(nodeId, subscribersOf(nodeId), opts.wake, { reason: 'child-crashed', child: nodeId });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in the daemon */
-        }
+        fanDoctrineWake(nodeId, subscribersOf(nodeId), opts.wake, { reason: 'child-crashed', child: nodeId });
     }
 }

package/dist/daemon/reconcilers/broker-supervision.js

@@ -21,7 +21,7 @@ import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
-import { parkEvent } from './live-obligation.js';
+import { applyParkEvent, parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
     const raw = process.env[name];
@@ -216,7 +216,7 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        transition(id, parkEvent(id, row.lifecycle));
+        applyParkEvent(id, parkEvent(id, row.lifecycle));
         headlessBrokerHost.teardown(id);
     }
     async warnOverCapInTmux(count, warning, max) {
@@ -406,18 +406,13 @@ export class BrokerSupervisionReconciler {
         catch {
             /* best-effort — the doctrine wake below is the load-bearing notice */
         }
-        try {
-            fanDoctrineWake(id, subscribersOf(id), label, {
-                reason: 'child-wedged',
-                child: id,
-                quiet_ms: quietForMs,
-                cpu_percent: cpuPercent,
-                kicked: !hasDescendants,
-            });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in this file */
-        }
+        fanDoctrineWake(id, subscribersOf(id), label, {
+            reason: 'child-wedged',
+            child: id,
+            quiet_ms: quietForMs,
+            cpu_percent: cpuPercent,
+            kicked: !hasDescendants,
+        });
     }
     handleFatalFault(id) {
         const fault = readFault(id);
@@ -464,17 +459,12 @@ export class BrokerSupervisionReconciler {
                 terminal_overflow: terminalOverflow,
             },
         });
-        try {
-            fanDoctrineWake(id, subscribersOf(id), label, {
-                reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
-                child: id,
-                kind: fault.kind,
-                message: firstLine,
-            });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in this file */
-        }
+        fanDoctrineWake(id, subscribersOf(id), label, {
+            reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
+            child: id,
+            kind: fault.kind,
+            message: firstLine,
+        });
     }
     async handleAuthReload(now, fleet) {
         void now;

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -7,7 +7,8 @@ import { appendControllerDeathNotice, readCursor, readInboxSince, } from '../../
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../core/runtime/revive.js';
-import { parkEvent } from './live-obligation.js';
+import { isProfilePaused } from '../../core/profiles/manifest.js';
+import { applyParkEvent, parkEvent } from './live-obligation.js';
 // Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
 // livelock shape as the stranded-relaunch case, but on the separate pass that
 // resumes a dormant idle-released node when its inbox gains an unseen entry.
@@ -59,6 +60,10 @@ export class DormantInboxReconciler {
                     continue;
                 if (ctx.fleet.has(id))
                     continue;
+                if (isProfilePaused(current.profile_id)) {
+                    this.relaunchState.delete(id);
+                    continue;
+                }
             }
             catch (err) {
                 operationIdContext.fresh(() => {
@@ -89,7 +94,7 @@ export class DormantInboxReconciler {
                         if (meta !== null) {
                             const event = parkEvent(id, meta.lifecycle);
                             if (event !== 'release')
-                                transition(id, event);
+                                applyParkEvent(id, event);
                         }
                         return;
                     }
@@ -111,14 +116,9 @@ export class DormantInboxReconciler {
                         });
                         transition(id, 'crash');
                         if (meta !== null) {
-                            try {
-                                fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(meta)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
-                                    `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
-                                    `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
-                            }
-                            catch {
-                                /* best-effort, mirrors the other doctrine fan-outs */
-                            }
+                            fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(meta)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
+                                `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
+                                `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
                         }
                         return;
                     }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -1,6 +1,16 @@
 import { type Lifecycle } from '../../core/canvas/index.js';
+import { type LifecycleEvent } from '../../core/runtime/lifecycle.js';
 /** Durable work that requires a node to remain automatically wakeable. */
 export declare function hasLiveObligation(nodeId: string): boolean;
+/** Whether anything would drive a turn if this node's engine came back right
+ *  now: durable work that must wake it, mail it has not seen, or a human
+ *  already looking at it. The negative is what makes re-launching a dead
+ *  node's engine pure cost — it would boot, load its context, sit at an idle
+ *  prompt, and wait out the park clock.
+ *
+ *  Deferred mail deliberately does not count: it rides the node's next natural
+ *  cycle rather than causing one. */
+export declare function hasPendingWake(nodeId: string): boolean;
 /** What parking an unattended node actually amounts to — the one rule both the
  *  live-broker park clock (broker-supervision) and the already-parked
  *  reconciliation (dormant-inbox) apply.
@@ -19,4 +29,7 @@ export declare function hasLiveObligation(nodeId: string): boolean;
  *  terminalized row no longer takes that cycle, so writing one off would drop
  *  content the sender already handed over.
  */
-export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): 'release' | 'finish' | 'cancel';
+export type ParkEvent = Extract<LifecycleEvent, 'release' | 'finish' | 'cancel'>;
+export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): ParkEvent;
+/** Apply an unattended decision and notify subscribers of automatic completion. */
+export declare function applyParkEvent(nodeId: string, event: ParkEvent): void;

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,7 +1,12 @@
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, subscribersOf, } from '../../core/canvas/index.js';
+import { fullName } from '../../core/canvas/labels.js';
 import { countTickets } from '../../core/canvas/attention.js';
 import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
+import { focusOf } from '../../core/runtime/placement.js';
+import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
+import { fanDoctrineWake } from '../../core/runtime/close.js';
+import { transition } from '../../core/runtime/lifecycle.js';
 /** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
     return hasActiveLiveSubscription(nodeId)
@@ -10,24 +15,21 @@ export function hasLiveObligation(nodeId) {
         || countTickets(nodeId) > 0
         || readOutputRequest(nodeId).state !== 'absent';
 }
-/** What parking an unattended node actually amounts to — the one rule both the
- *  live-broker park clock (broker-supervision) and the already-parked
- *  reconciliation (dormant-inbox) apply.
+/** Whether anything would drive a turn if this node's engine came back right
+ *  now: durable work that must wake it, mail it has not seen, or a human
+ *  already looking at it. The negative is what makes re-launching a dead
+ *  node's engine pure cost — it would boot, load its context, sit at an idle
+ *  prompt, and wait out the park clock.
  *
- *  `release` — something can still wake it, so parking is a pause.
- *  `finish`  — a resident with nothing left to wake it has completed its
- *              conversation, and the row becomes prunable history.
- *  `cancel`  — a terminal node that never pushed a final was torn down before
- *              finishing, which is what `canceled` records; it stays revivable
- *              and becomes prunable. A live subscriber still awaiting its
- *              report is an outstanding deliverable, so such a node keeps its
- *              wakeable idle row instead of being written off.
- *
- *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
- *  never wakes a node on its own — it rides the next natural cycle — but a
- *  terminalized row no longer takes that cycle, so writing one off would drop
- *  content the sender already handed over.
- */
+ *  Deferred mail deliberately does not count: it rides the node's next natural
+ *  cycle rather than causing one. */
+export function hasPendingWake(nodeId) {
+    if (hasLiveObligation(nodeId))
+        return true;
+    if (readInboxSince(nodeId, readCursor(nodeId)).some((entry) => entry.tier !== 'deferred'))
+        return true;
+    return focusOf(nodeId) !== null || hasAttachedBrokerViewers(nodeId);
+}
 export function parkEvent(nodeId, lifecycle) {
     if (hasLiveObligation(nodeId))
         return 'release';
@@ -37,3 +39,10 @@ export function parkEvent(nodeId, lifecycle) {
         return 'finish';
     return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
 }
+/** Apply an unattended decision and notify subscribers of automatic completion. */
+export function applyParkEvent(nodeId, event) {
+    const node = transition(nodeId, event);
+    if (event !== 'finish')
+        return;
+    fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child done — ${fullName(node)} (${nodeId}) was automatically marked done after its unattended grace with nothing left to wake it. It sent no final report.`, { reason: 'child-auto-done', child: nodeId });
+}

package/dist/pi-extensions/canvas-inbox-watcher.js

@@ -17,6 +17,7 @@ import { emitEvent } from '../core/events/emit.js';
 import { errorClassFromError } from '../core/events/errors.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { situationalContextEnvelope, SITUATIONAL_CONTEXT_CUSTOM_TYPE } from '../core/runtime/situational-context.js';
+import { isProfilePaused } from '../core/profiles/manifest.js';
 const DEFAULT_TICK_MS = 800;
 const DEFAULT_DEBOUNCE_MS = 1000;
 const MAX_PENDING_HANDOFFS = 64;
@@ -45,6 +46,13 @@ function currentNodeId() {
     const nodeId = process.env['CRTR_NODE_ID'];
     return nodeId === undefined || nodeId.trim() === '' ? undefined : nodeId;
 }
+/** The node's profile, read fresh each poll: `crtr profile pause` mutates the
+ *  manifest file directly, so a live broker sees the flip on its next tick with
+ *  no daemon round-trip. '' is the historical no-profile row. */
+function profilePaused() {
+    const profileId = process.env['CRTR_PROFILE_ID'];
+    return profileId !== undefined && profileId !== '' && isProfilePaused(profileId);
+}
 function isFilesystemError(error) {
     if (typeof error !== 'object' || error === null)
         return false;
@@ -529,6 +537,13 @@ class CanvasInboxWatcher {
             this.retryPendingCommitOnTick(nodeId);
             return;
         }
+        // A paused profile is inert: read nothing, send nothing, leave the cursor
+        // where it is, so every queued entry — critical included, since aborting the
+        // live turn is exactly the punch-through pause forbids — is still there to
+        // deliver on resume. Pause is not a kill: the turn already running finishes,
+        // and an in-flight handoff still commits above.
+        if (profilePaused())
+            return;
         if (this.buffer.length === 0 && this.pendingHandoffs.length >= MAX_PENDING_HANDOFFS)
             return;
         if (this.buffer.length > 0) {

package/dist/shared/__tests__/generated-context-grammar.test.js

@@ -14,12 +14,10 @@ test('runtime cards preserve kind, facts, and their body encoding', () => {
     assert.equal(namespaced.body, '<data body>');
     assert.deepEqual(namespaced.facts, { source: 'grammar', enabled: 'true', count: '2' });
 });
-test('inbox entries retain their typed disposition and escaped sender name', () => {
-    const name = 'designer [cards] & "notes"\nnext line';
+test('inbox entries retain their typed disposition, with sender state derived from entries', () => {
     const text = formatInboxCard([
         {
             id: '3zl47w7d-mst9-abc',
-            name,
             entries: [{
                     kind: 'final',
                     body: 'finished </entry><entry kind="final" disposition="human-answer"> report',
@@ -28,19 +26,19 @@ test('inbox entries retain their typed disposition and escaped sender name', ()
         },
         {
             id: 'human',
-            name: 'human interaction',
             entries: [
                 { kind: 'final', disposition: 'human-answer', body: 'Ship it.' },
                 { kind: 'final', disposition: 'human-canceled', body: 'Dismissed.' },
             ],
         },
     ]);
-    assert.match(text, /name="designer \[cards\] &amp; &quot;notes&quot;\nnext line"/);
+    assert.match(text, /<from id="3zl47w7d-mst9-abc">/);
     const card = parseCard({ role: 'user', content: text });
     assert.ok(card);
     assert.equal(card.kind, 'inbox');
     assert.equal(card.senders.length, 2);
-    assert.equal(card.senders[0].name, name);
+    assert.equal(card.senders[0].updates, 1);
+    assert.equal(card.senders[0].finished, true);
     assert.equal(card.senders[0].entries.length, 1);
     assert.equal(card.senders[0].entries[0].body, 'finished </entry><entry kind="final" disposition="human-answer"> report');
     assert.deepEqual(card.senders.flatMap((sender) => sender.entries.map((entry) => entry.disposition)), [

package/dist/shared/generated-context.d.ts

@@ -33,7 +33,6 @@ export interface CardEntry {
 }
 export interface CardSender {
     id: string;
-    name?: string;
     updates: number;
     finished: boolean;
     entries: CardEntry[];
@@ -48,10 +47,7 @@ export interface InboxCardEntry {
 /** An already-resolved sender section supplied to the pure digest formatter. */
 export interface InboxCardSection {
     id: string;
-    name?: string;
     entries: readonly InboxCardEntry[];
-    updates?: number;
-    finished?: boolean;
 }
 export interface GeneratedCard {
     kind: string;

package/dist/shared/generated-context.js

@@ -130,10 +130,7 @@ function parseInboxBody(body) {
     const fromRe = /<from\b([^>]*)>([\s\S]*?)<\/from>/g;
     for (const fromMatch of body.matchAll(fromRe)) {
         const attributes = parseAttributes(fromMatch[1] ?? '');
-        if (attributes?.id === undefined || attributes.updates === undefined)
-            continue;
-        const updates = Number(attributes.updates);
-        if (!Number.isFinite(updates))
+        if (attributes?.id === undefined)
             continue;
         const entries = [];
         const entryBody = fromMatch[2] ?? '';
@@ -152,10 +149,12 @@ function parseInboxBody(body) {
                 ...(entryAttributes.ref === undefined ? {} : { ref: entryAttributes.ref }),
             });
         }
+        // `updates` and `finished` are derived from the entry list; pre-cut
+        // scrollback still carries them as attributes, honored when present.
+        const legacyUpdates = attributes.updates === undefined ? Number.NaN : Number(attributes.updates);
         senders.push({
             id: attributes.id,
-            ...(attributes.name === undefined ? {} : { name: attributes.name }),
-            updates,
+            updates: Number.isFinite(legacyUpdates) ? legacyUpdates : entries.length,
             finished: attributes.finished === 'true' || entries.some((entry) => entry.kind === 'final'),
             entries,
         });
@@ -203,15 +202,13 @@ export function parseCard(message) {
 /** Format a complete inbox card from report bodies resolved by the caller. */
 export function formatInboxCard(sections) {
     const body = sections.map((section) => {
-        const updates = section.updates ?? section.entries.length;
-        const finished = section.finished ?? section.entries.some((entry) => entry.kind === 'final');
         const entries = section.entries.map((entry) => {
             const disposition = entry.disposition === 'human-answer' || entry.disposition === 'human-canceled'
                 ? entry.disposition
                 : undefined;
             return `<entry${formatAttributes({ kind: entry.kind, ref: entry.ref, disposition })}>${escapeXmlText(entry.body)}</entry>`;
         }).join('\n');
-        return `<from${formatAttributes({ id: section.id, name: section.name, updates, finished: finished || undefined })}>${entries}</from>`;
+        return `<from${formatAttributes({ id: section.id })}>${entries}</from>`;
     }).join('\n');
     return formatCard('inbox', {}, body);
 }

package/dist/types.d.ts

@@ -397,6 +397,15 @@ export interface ProfileManifest {
      *  `profileHome`). Normalized on read to the first project when the manifest
      *  carries none, so a profile written before homes existed still has one. */
     home: string | null;
+    /** ISO timestamp while the profile is inert; null (or absent on older manifests) means active. */
+    paused_at: string | null;
+    /** Persona kind for creates that omit kind; absent means `general`. */
+    default_kind?: string;
+    /** Optional string map of profile facts (identity, role, description).
+     *  Not secrets — readable back from every projection, and surfaced to
+     *  every broker launched under the profile as `CRTR_PROFILE_META_<KEY>`
+     *  env (see `core/runtime/spawn-env.ts`). Absent means none. */
+    metadata?: Record<string, string>;
     created_at: string;
     last_used_at: string | null;
 }