@north-light/crouter 0.3.214 → 0.3.215

package/dist/core/runtime/spawn-env.js

@@ -33,6 +33,7 @@ import { statSync } from 'node:fs';
 import { delimiter, resolve } from 'node:path';
 import { readMergedLaunchConfig } from '../config.js';
 import { readProfileEnvVars } from '../profiles/env-store.js';
+import { readProfileMetadata } from '../profiles/manifest.js';
 import { binShimDirFor } from './bin-contributions.js';
 import { FRONT_DOOR_ENV } from './front-door-env.js';
 /** A1 — literal env-var names copied verbatim (no value inspection): a login
@@ -211,6 +212,18 @@ export function buildOperationalEnvBase(opts) {
     }
     return out;
 }
+/** Source F — the TARGET profile's manifest `metadata`, each entry surfaced
+ *  as `CRTR_PROFILE_META_<KEY>` (key uppercased, every non-alphanumeric run
+ *  → `_`). Identity facts rather than secrets — unlike the env store these
+ *  are readable back (`profile show`, ProfileDTO). Read straight off the
+ *  manifest at every launch; never throws (a bad profile id yields `{}`). */
+export function profileMetadataEnv(profileId) {
+    const out = {};
+    for (const [key, value] of Object.entries(readProfileMetadata(profileId))) {
+        out[`CRTR_PROFILE_META_${key.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}`] = value;
+    }
+    return out;
+}
 /** The one authoritative broker child env: sources A–C (the operational
  *  base, resolved from the TARGET node's own cwd/profile — `inv.env`'s
  *  `CRTR_NODE_CWD`/`CRTR_PROFILE_ID`, never this process's ambient
@@ -219,7 +232,9 @@ export function buildOperationalEnvBase(opts) {
  *  own `profile env` store (`readProfileEnvVars`, `core/profiles/env-store.ts`)
  *  read directly off disk and injected regardless of the host env or any
  *  `spawnEnv.allow` entry (setting a value there IS the consent to cross this
- *  boundary), plus D — the trusted, crtr-constructed `inv.env` overlay and the
+ *  boundary), F — the TARGET profile's manifest metadata as
+ *  `CRTR_PROFILE_META_*` (`profileMetadataEnv` above), plus D — the trusted,
+ *  crtr-constructed `inv.env` overlay and the
  *  fork-bomb recursion guard `FRONT_DOOR_ENV=1`. D is layered last so crtr's
  *  own constructed env always wins a name collision with a stored profile
  *  value. Every broker launch (front-door root, managed child, `--root`,
@@ -231,6 +246,7 @@ export function buildBrokerEnv(inv) {
     const operational = buildOperationalEnvBase({ targetCwd, targetProfileId });
     return {
         ...operational,
+        ...profileMetadataEnv(targetProfileId),
         ...readProfileEnvVars(targetProfileId),
         ...inv.env,
         [ADMITTED_HOST_PATH_ENV]: operational[ADMITTED_HOST_PATH_ENV],

package/dist/core/termrender/termrender.d.ts

@@ -15,7 +15,9 @@
 export declare function ensureRenderer(): void;
 /** Cheap predicate — true when the pinned managed binary is verified ready. Does not install or spawn. */
 export declare function isRendererReady(): boolean;
-/** Render markdown to terminal lines via the pinned binary; plaintext fallback. */
+/** Render markdown to terminal lines via the pinned binary; plaintext fallback.
+ *  Callers own the returned array — every return is a fresh copy, so a caller
+ *  that appends to it cannot grow the cached render on the next hit. */
 export declare function renderMarkdown(md: string, width: number): string[];
 export interface RenderedDoc {
     /** Rendered ANSI rows — byte-identical to the plain `doc render` output. */
@@ -50,7 +52,10 @@ export declare function renderMarkdownWithMap(md: string, width: number): Render
  * unchanged.
  */
 export declare function renderMarkdownBlockAware(md: string, proseWidth: number, paneWidth: number): RenderedDoc;
-/** Block-aware render as plain rows, for surfaces that do not anchor. */
+/** Block-aware render as plain rows, for surfaces that do not anchor. The rows
+ *  are the caller's own array: the block-aware render can pass the mapped
+ *  cache's line array straight through, and a caller appending to it would
+ *  otherwise poison every later render of the same document. */
 export declare function renderMarkdownBlockAwareLines(md: string, proseWidth: number, paneWidth: number): string[];
 /** Validate markdown via `termrender doc check`. */
 export declare function checkMarkdown(md: string): {

package/dist/core/termrender/termrender.js

@@ -410,12 +410,14 @@ class BoundedLRUCache {
     }
 }
 const _bodyCache = new BoundedLRUCache(20);
-/** Render markdown to terminal lines via the pinned binary; plaintext fallback. */
+/** Render markdown to terminal lines via the pinned binary; plaintext fallback.
+ *  Callers own the returned array — every return is a fresh copy, so a caller
+ *  that appends to it cannot grow the cached render on the next hit. */
 export function renderMarkdown(md, width) {
     const key = `${md}\0${width}`;
     const cached = _bodyCache.get(key);
     if (cached)
-        return cached;
+        return [...cached];
     ensureRenderer();
     if (rendererState === 'ready') {
         try {
@@ -429,7 +431,7 @@ export function renderMarkdown(md, width) {
             if (lines.length > 0 && lines[lines.length - 1] === '')
                 lines.pop();
             _bodyCache.set(key, lines);
-            return lines;
+            return [...lines];
         }
         catch (err) {
             // `doc render` is best-effort, so a non-timeout failure implicates the
@@ -441,7 +443,7 @@ export function renderMarkdown(md, width) {
     }
     const fallback = wrap(sanitize(md), width);
     _bodyCache.set(key, fallback);
-    return fallback;
+    return [...fallback];
 }
 /** Block types allowed to use the full pane width instead of the prose cap:
  *  a diagram is a picture, not prose, so a readability column limit only
@@ -657,9 +659,12 @@ export function renderMarkdownBlockAware(md, proseWidth, paneWidth) {
     }
     return { lines, rows, spans, blocks: base.blocks };
 }
-/** Block-aware render as plain rows, for surfaces that do not anchor. */
+/** Block-aware render as plain rows, for surfaces that do not anchor. The rows
+ *  are the caller's own array: the block-aware render can pass the mapped
+ *  cache's line array straight through, and a caller appending to it would
+ *  otherwise poison every later render of the same document. */
 export function renderMarkdownBlockAwareLines(md, proseWidth, paneWidth) {
-    return renderMarkdownBlockAware(md, proseWidth, paneWidth).lines;
+    return [...renderMarkdownBlockAware(md, proseWidth, paneWidth).lines];
 }
 /** Validate markdown via `termrender doc check`. */
 export function checkMarkdown(md) {

package/dist/core/termrender/version.d.ts

@@ -1 +1 @@
-export declare const TERMRENDER_VERSION = "4.12.7";
+export declare const TERMRENDER_VERSION = "4.12.8";

package/dist/core/termrender/version.js

@@ -1 +1 @@
-export const TERMRENDER_VERSION = '4.12.7';
+export const TERMRENDER_VERSION = '4.12.8';

package/dist/daemon/api/__tests__/profile-launch-gates.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/api/__tests__/profile-launch-gates.test.js

@@ -0,0 +1,111 @@
+import { after, afterEach, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, getNode, listNodes } from '../../../core/canvas/canvas.js';
+import { closeDb } from '../../../core/canvas/db.js';
+import { CrtrError } from '../../../core/errors.js';
+import { createProfile, loadProfileManifest, pauseProfile, setProfileDefaultKind } from '../../../core/profiles/manifest.js';
+import { resetScopeCache } from '../../../core/scope.js';
+import { reviveNode } from '../../../core/runtime/revive.js';
+import { spawnNode } from '../../../core/runtime/nodes.js';
+import { handleCreate, resolveCreateKind } from '../handlers/nodes.js';
+const previousCrtrHome = process.env['CRTR_HOME'];
+const previousHome = process.env.HOME;
+let home = '';
+let cwd = '';
+beforeEach(() => {
+    closeDb();
+    home = mkdtempSync(join(tmpdir(), 'crtr-profile-launch-home-'));
+    cwd = mkdtempSync(join(tmpdir(), 'crtr-profile-launch-cwd-'));
+    process.env.HOME = home;
+    process.env['CRTR_HOME'] = join(home, 'canvas');
+    mkdirSync(process.env['CRTR_HOME'], { recursive: true });
+    resetScopeCache();
+});
+afterEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(cwd, { recursive: true, force: true });
+    resetScopeCache();
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = previousHome;
+    if (previousCrtrHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = previousCrtrHome;
+    resetScopeCache();
+});
+test('create rejects a paused profile before a node exists', async () => {
+    const profile = createProfile('paused profile', [cwd]);
+    pauseProfile(profile.profileId);
+    const ctx = {
+        method: 'POST',
+        path: '/v1/nodes',
+        params: {},
+        query: new URLSearchParams(),
+        body: { root: true, profile: profile.profileId, cwd, prompt: 'must not launch' },
+    };
+    const beforeRows = listNodes().length;
+    await assert.rejects(() => handleCreate(ctx), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.message, /paused profile/);
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(listNodes().length, beforeRows);
+});
+test('revive refuses a paused profile before launching a broker', () => {
+    const profile = createProfile('paused revive', [cwd]);
+    pauseProfile(profile.profileId);
+    const nodeId = 'paused-revive-node';
+    createNode({
+        node_id: nodeId,
+        name: nodeId,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'developer',
+        mode: 'base',
+        lifecycle: 'resident',
+        status: 'active',
+        parent: null,
+        profile_id: profile.profileId,
+    });
+    assert.throws(() => reviveNode(nodeId, { resume: true }), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(getNode(nodeId)?.status, 'active');
+});
+// The API create gate phrases the refusal; this one is what every OTHER birth
+// (fork, cron spawn, warm-pool mint, `/new` relaunch, recycle) actually hits,
+// because they all reach the canvas through spawnNode and none of them call
+// handleCreate.
+test('the birth gate refuses a paused profile for a daemon-side spawn', () => {
+    const profile = createProfile('paused spawn', [cwd]);
+    pauseProfile(profile.profileId);
+    const beforeRows = listNodes().length;
+    assert.throws(() => spawnNode({ kind: 'general', cwd, parent: null, profile_id: profile.profileId }), (error) => {
+        assert.ok(error instanceof CrtrError);
+        assert.equal(error.code, 'usage');
+        assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));
+        return true;
+    });
+    assert.equal(listNodes().length, beforeRows);
+});
+test('create kind resolves from the profile default when omitted', () => {
+    const profile = createProfile('default kind', [cwd]);
+    setProfileDefaultKind(profile.profileId, 'developer');
+    const entry = loadProfileManifest(profile.profileId);
+    assert.equal(resolveCreateKind(undefined, entry), 'developer');
+    assert.equal(resolveCreateKind('general', entry), 'general');
+    assert.equal(resolveCreateKind(undefined, null), 'general');
+});

package/dist/daemon/api/handlers/messages.js

@@ -6,6 +6,7 @@ import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js'
 import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { deliverLive, interruptLive } from '../../../core/runtime/interactive-deliver.js';
 import { cancelPendingHumanMessages } from '../../../core/feed/inbox.js';
+import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { withFreshTerminalGuard } from '../../../core/canvas/canvas.js';
 import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../../../core/runtime/reopen.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
@@ -194,6 +195,12 @@ async function handleMessage(ctx) {
         throw notFound(`unknown node: ${id}`, { received: id });
     const req = parseSendBody(ctx.body);
     const tier = (req.tier ?? 'normal');
+    // A paused profile takes no new work through either delivery route: the
+    // interactive route hands the body to the live broker instead of queueing it,
+    // and a wake is a revive by another name. So a paused target always takes the
+    // durable path and its entry waits, at every tier, for `crtr profile resume`
+    // (the live broker's watcher holds it; a dormant one is not woken).
+    const paused = isProfilePaused(meta.profile_id);
     const from = req.from ?? null;
     const hasBody = req.body.trim() !== '';
     // One sidecar slot: the caller's rendered card, or prose rendered as one.
@@ -235,7 +242,7 @@ async function handleMessage(ctx) {
     //     ordering. A mid-revive race (liveness said live, connection refused)
     //     falls back to the durable path below; a genuinely dormant target skips
     //     straight there (append + revive, watcher delivers post-boot). ---
-    if (req.delivery === 'interactive' && isBrokerLive(meta)) {
+    if (req.delivery === 'interactive' && !paused && isBrokerLive(meta)) {
         try {
             if (hasSidecar)
                 appendSituationalContext(id, sidecar);
@@ -310,7 +317,7 @@ async function handleMessage(ctx) {
     // A wake-capable tier revives a dormant target so its inbox-watcher delivers
     // this; deferred never wakes — it rides the target's next natural cycle.
     let revived = false;
-    if (tier !== 'deferred' && !isBrokerLive(meta)) {
+    if (tier !== 'deferred' && !paused && !isBrokerLive(meta)) {
         try {
             const result = reviveNode(id, { resume: true });
             revived = result.launch !== undefined;

package/dist/daemon/api/handlers/nodes.d.ts

@@ -1,8 +1,10 @@
 import { type ModelRegistryLike } from '../../../core/model-routes.js';
+import { assertProfileActive } from '../../../core/profiles/manifest.js';
 import type { HandlerResult, RequestContext, RouteTable } from '../router.js';
 interface NodeHandlerDeps {
     modelRegistry?: ModelRegistryLike;
 }
+export declare function resolveCreateKind(kind: string | undefined, profile: ReturnType<typeof assertProfileActive>): string;
 export declare function handleCreate(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;
 export declare function handlePromote(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;
 export declare function handleYield(ctx: RequestContext, deps?: NodeHandlerDeps): Promise<HandlerResult>;

package/dist/daemon/api/handlers/nodes.js

@@ -32,7 +32,7 @@ import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js'
 import { isBrokerLive, persistDormantModel, setModelLive } from '../../../core/runtime/model-swap.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { claimWarmNode, refillWarmPool, warmPoolEnabled } from '../../../core/runtime/warm-pool.js';
-import { profileHome } from '../../../core/profiles/manifest.js';
+import { assertProfileActive, profileHome } from '../../../core/profiles/manifest.js';
 import { fullName } from '../../../core/canvas/labels.js';
 import { getCron } from '../../../core/canvas/crons.js';
 import { cronWakeOrigin } from '../../../core/runtime/bearings.js';
@@ -81,11 +81,11 @@ function countFiles(id) {
 /** Validate + narrow the create body (spec §6.2). */
 function parseCreateBody(body) {
     if (typeof body !== 'object' || body === null) {
-        throw usage('a node create requires a JSON body { kind, ... }');
+        throw usage('a node create requires a JSON body');
     }
     const b = body;
-    if (typeof b['kind'] !== 'string' || b['kind'].trim() === '') {
-        throw usage('a node create requires a kind');
+    if (b['kind'] !== undefined && (typeof b['kind'] !== 'string' || b['kind'].trim() === '')) {
+        throw usage('kind must be a non-empty string when provided');
     }
     const rootLifecycle = b['root_lifecycle'];
     if (rootLifecycle !== undefined &&
@@ -184,6 +184,9 @@ function warmRequestFor(req, cwd, profileId) {
         name: req.name ?? null,
     };
 }
+export function resolveCreateKind(kind, profile) {
+    return kind ?? profile?.manifest.default_kind ?? 'general';
+}
 function requestFromLaunch(launch) {
     const intent = launch.modelIntent === undefined
         ? undefined
@@ -227,8 +230,12 @@ export async function handleCreate(ctx, deps = {}) {
     // to this daemon, never to the possibly-remote CLI caller.
     const contextCwd = req.cwd ?? process.cwd();
     const profileId = await resolveProfileId(req.profile, parent ?? null, contextCwd);
-    const cwd = resolveNodeCwd(req, parent, profileId, contextCwd);
-    const launch = buildLaunchSpec(req.kind, (req.mode ?? 'base'), {
+    const profile = assertProfileActive(profileId);
+    const kind = resolveCreateKind(req.kind, profile);
+    assertKindServer(kind);
+    const resolvedReq = { ...req, kind };
+    const cwd = resolveNodeCwd(resolvedReq, parent, profileId, contextCwd);
+    const launch = buildLaunchSpec(kind, (resolvedReq.mode ?? 'base'), {
         lifecycle: req.root === true ? (req.root_lifecycle ?? 'resident') : 'terminal',
         hasManager: req.root !== true,
         ...(req.model !== undefined ? { model: req.model } : {}),
@@ -239,7 +246,7 @@ export async function handleCreate(ctx, deps = {}) {
     // --- Warm path: hand out an already-booted spare instead of paying a full
     //     engine boot. A miss is not a failure — it falls through to the cold
     //     spawn below and mints the spare that serves the NEXT create. ---
-    const warm = warmRequestFor(req, cwd, profileId);
+    const warm = warmRequestFor(resolvedReq, cwd, profileId);
     if (warm !== null) {
         const claimed = await claimWarmNode(warm);
         refillWarmPool(warm);
@@ -249,7 +256,7 @@ export async function handleCreate(ctx, deps = {}) {
             return { status: 201, body: detailOf(claimed) };
         }
     }
-    const recipe = buildRecipe(req, parent, cwd);
+    const recipe = buildRecipe(resolvedReq, parent, cwd);
     recipe.readiness = req.root === true ? 'await' : 'launch';
     const result = await spawnChild(recipe);
     if (schema !== null)

package/dist/daemon/api/handlers/profiles.js

@@ -12,7 +12,9 @@ import { toProfileDTO } from '../map.js';
 const ROOT_PROFILE_NAME = 'root';
 /** `PUT /v1/profiles/:name` — idempotent ensure. `root` maps to the singleton
  *  root profile; any other name returns the existing same-named profile if one
- *  exists (so a re-PUT yields the same id), else creates it. */
+ *  exists (so a re-PUT yields the same id), else creates it. `default_kind`
+ *  and `metadata` apply only at create — an existing profile is returned
+ *  untouched; mutation stays on `crtr profile kind` / `crtr profile meta`. */
 function handleEnsure(ctx) {
     const name = ctx.params['name'];
     const req = (ctx.body ?? {});
@@ -23,7 +25,10 @@ function handleEnsure(ctx) {
     if (existing !== undefined) {
         return { status: 200, body: toProfileDTO(existing) };
     }
-    const created = createProfile(name, req.projects ?? []);
+    const created = createProfile(name, req.projects ?? [], {
+        defaultKind: req.default_kind,
+        metadata: req.metadata,
+    });
     return { status: 200, body: toProfileDTO(created) };
 }
 /** `GET /v1/profiles` — every profile with a readable manifest. */

package/dist/daemon/api/map.js

@@ -264,6 +264,9 @@ export function toProfileDTO(entry) {
         name: entry.manifest.name,
         projects: [...entry.manifest.projects],
         home: entry.manifest.home,
+        paused_at: entry.manifest.paused_at,
+        default_kind: entry.manifest.default_kind ?? 'general',
+        metadata: { ...(entry.manifest.metadata ?? {}) },
         default_dir: null,
     };
 }

package/dist/daemon/fleet.js

@@ -425,11 +425,6 @@ export class DaemonFleet {
                 error: err,
             });
         }
-        try {
-            fanDoctrineWake(nodeId, subscribersOf(nodeId), opts.wake, { reason: 'child-crashed', child: nodeId });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in the daemon */
-        }
+        fanDoctrineWake(nodeId, subscribersOf(nodeId), opts.wake, { reason: 'child-crashed', child: nodeId });
     }
 }

package/dist/daemon/reconcilers/broker-supervision.js

@@ -21,7 +21,7 @@ import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
-import { parkEvent } from './live-obligation.js';
+import { applyParkEvent, parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
     const raw = process.env[name];
@@ -216,7 +216,7 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        transition(id, parkEvent(id, row.lifecycle));
+        applyParkEvent(id, parkEvent(id, row.lifecycle));
         headlessBrokerHost.teardown(id);
     }
     async warnOverCapInTmux(count, warning, max) {
@@ -406,18 +406,13 @@ export class BrokerSupervisionReconciler {
         catch {
             /* best-effort — the doctrine wake below is the load-bearing notice */
         }
-        try {
-            fanDoctrineWake(id, subscribersOf(id), label, {
-                reason: 'child-wedged',
-                child: id,
-                quiet_ms: quietForMs,
-                cpu_percent: cpuPercent,
-                kicked: !hasDescendants,
-            });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in this file */
-        }
+        fanDoctrineWake(id, subscribersOf(id), label, {
+            reason: 'child-wedged',
+            child: id,
+            quiet_ms: quietForMs,
+            cpu_percent: cpuPercent,
+            kicked: !hasDescendants,
+        });
     }
     handleFatalFault(id) {
         const fault = readFault(id);
@@ -464,17 +459,12 @@ export class BrokerSupervisionReconciler {
                 terminal_overflow: terminalOverflow,
             },
         });
-        try {
-            fanDoctrineWake(id, subscribersOf(id), label, {
-                reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
-                child: id,
-                kind: fault.kind,
-                message: firstLine,
-            });
-        }
-        catch {
-            /* best-effort, mirrors every other fan-out in this file */
-        }
+        fanDoctrineWake(id, subscribersOf(id), label, {
+            reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
+            child: id,
+            kind: fault.kind,
+            message: firstLine,
+        });
     }
     async handleAuthReload(now, fleet) {
         void now;

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -7,7 +7,8 @@ import { appendControllerDeathNotice, readCursor, readInboxSince, } from '../../
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../core/runtime/revive.js';
-import { parkEvent } from './live-obligation.js';
+import { isProfilePaused } from '../../core/profiles/manifest.js';
+import { applyParkEvent, parkEvent } from './live-obligation.js';
 // Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
 // livelock shape as the stranded-relaunch case, but on the separate pass that
 // resumes a dormant idle-released node when its inbox gains an unseen entry.
@@ -59,6 +60,10 @@ export class DormantInboxReconciler {
                     continue;
                 if (ctx.fleet.has(id))
                     continue;
+                if (isProfilePaused(current.profile_id)) {
+                    this.relaunchState.delete(id);
+                    continue;
+                }
             }
             catch (err) {
                 operationIdContext.fresh(() => {
@@ -89,7 +94,7 @@ export class DormantInboxReconciler {
                         if (meta !== null) {
                             const event = parkEvent(id, meta.lifecycle);
                             if (event !== 'release')
-                                transition(id, event);
+                                applyParkEvent(id, event);
                         }
                         return;
                     }
@@ -111,14 +116,9 @@ export class DormantInboxReconciler {
                         });
                         transition(id, 'crash');
                         if (meta !== null) {
-                            try {
-                                fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(meta)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
-                                    `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
-                                    `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
-                            }
-                            catch {
-                                /* best-effort, mirrors the other doctrine fan-outs */
-                            }
+                            fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(meta)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
+                                `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
+                                `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
                         }
                         return;
                     }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -1,4 +1,5 @@
 import { type Lifecycle } from '../../core/canvas/index.js';
+import { type LifecycleEvent } from '../../core/runtime/lifecycle.js';
 /** Durable work that requires a node to remain automatically wakeable. */
 export declare function hasLiveObligation(nodeId: string): boolean;
 /** Whether anything would drive a turn if this node's engine came back right
@@ -28,4 +29,7 @@ export declare function hasPendingWake(nodeId: string): boolean;
  *  terminalized row no longer takes that cycle, so writing one off would drop
  *  content the sender already handed over.
  */
-export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): 'release' | 'finish' | 'cancel';
+export type ParkEvent = Extract<LifecycleEvent, 'release' | 'finish' | 'cancel'>;
+export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): ParkEvent;
+/** Apply an unattended decision and notify subscribers of automatic completion. */
+export declare function applyParkEvent(nodeId: string, event: ParkEvent): void;

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,9 +1,12 @@
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, subscribersOf, } from '../../core/canvas/index.js';
+import { fullName } from '../../core/canvas/labels.js';
 import { countTickets } from '../../core/canvas/attention.js';
 import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
+import { fanDoctrineWake } from '../../core/runtime/close.js';
+import { transition } from '../../core/runtime/lifecycle.js';
 /** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
     return hasActiveLiveSubscription(nodeId)
@@ -27,24 +30,6 @@ export function hasPendingWake(nodeId) {
         return true;
     return focusOf(nodeId) !== null || hasAttachedBrokerViewers(nodeId);
 }
-/** What parking an unattended node actually amounts to — the one rule both the
- *  live-broker park clock (broker-supervision) and the already-parked
- *  reconciliation (dormant-inbox) apply.
- *
- *  `release` — something can still wake it, so parking is a pause.
- *  `finish`  — a resident with nothing left to wake it has completed its
- *              conversation, and the row becomes prunable history.
- *  `cancel`  — a terminal node that never pushed a final was torn down before
- *              finishing, which is what `canceled` records; it stays revivable
- *              and becomes prunable. A live subscriber still awaiting its
- *              report is an outstanding deliverable, so such a node keeps its
- *              wakeable idle row instead of being written off.
- *
- *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
- *  never wakes a node on its own — it rides the next natural cycle — but a
- *  terminalized row no longer takes that cycle, so writing one off would drop
- *  content the sender already handed over.
- */
 export function parkEvent(nodeId, lifecycle) {
     if (hasLiveObligation(nodeId))
         return 'release';
@@ -54,3 +39,10 @@ export function parkEvent(nodeId, lifecycle) {
         return 'finish';
     return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
 }
+/** Apply an unattended decision and notify subscribers of automatic completion. */
+export function applyParkEvent(nodeId, event) {
+    const node = transition(nodeId, event);
+    if (event !== 'finish')
+        return;
+    fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child done — ${fullName(node)} (${nodeId}) was automatically marked done after its unattended grace with nothing left to wake it. It sent no final report.`, { reason: 'child-auto-done', child: nodeId });
+}

package/dist/pi-extensions/canvas-inbox-watcher.js

@@ -17,6 +17,7 @@ import { emitEvent } from '../core/events/emit.js';
 import { errorClassFromError } from '../core/events/errors.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { situationalContextEnvelope, SITUATIONAL_CONTEXT_CUSTOM_TYPE } from '../core/runtime/situational-context.js';
+import { isProfilePaused } from '../core/profiles/manifest.js';
 const DEFAULT_TICK_MS = 800;
 const DEFAULT_DEBOUNCE_MS = 1000;
 const MAX_PENDING_HANDOFFS = 64;
@@ -45,6 +46,13 @@ function currentNodeId() {
     const nodeId = process.env['CRTR_NODE_ID'];
     return nodeId === undefined || nodeId.trim() === '' ? undefined : nodeId;
 }
+/** The node's profile, read fresh each poll: `crtr profile pause` mutates the
+ *  manifest file directly, so a live broker sees the flip on its next tick with
+ *  no daemon round-trip. '' is the historical no-profile row. */
+function profilePaused() {
+    const profileId = process.env['CRTR_PROFILE_ID'];
+    return profileId !== undefined && profileId !== '' && isProfilePaused(profileId);
+}
 function isFilesystemError(error) {
     if (typeof error !== 'object' || error === null)
         return false;
@@ -529,6 +537,13 @@ class CanvasInboxWatcher {
             this.retryPendingCommitOnTick(nodeId);
             return;
         }
+        // A paused profile is inert: read nothing, send nothing, leave the cursor
+        // where it is, so every queued entry — critical included, since aborting the
+        // live turn is exactly the punch-through pause forbids — is still there to
+        // deliver on resume. Pause is not a kill: the turn already running finishes,
+        // and an in-flight handoff still commits above.
+        if (profilePaused())
+            return;
         if (this.buffer.length === 0 && this.pendingHandoffs.length >= MAX_PENDING_HANDOFFS)
             return;
         if (this.buffer.length > 0) {

package/dist/types.d.ts

@@ -397,6 +397,15 @@ export interface ProfileManifest {
      *  `profileHome`). Normalized on read to the first project when the manifest
      *  carries none, so a profile written before homes existed still has one. */
     home: string | null;
+    /** ISO timestamp while the profile is inert; null (or absent on older manifests) means active. */
+    paused_at: string | null;
+    /** Persona kind for creates that omit kind; absent means `general`. */
+    default_kind?: string;
+    /** Optional string map of profile facts (identity, role, description).
+     *  Not secrets — readable back from every projection, and surfaced to
+     *  every broker launched under the profile as `CRTR_PROFILE_META_<KEY>`
+     *  env (see `core/runtime/spawn-env.ts`). Absent means none. */
+    metadata?: Record<string, string>;
     created_at: string;
     last_used_at: string | null;
 }