@north-light/crouter 0.3.227 → 0.3.228

package/dist/core/__tests__/{serial → integration}/command-plugins.test.js

@@ -1,5 +1,5 @@
 // Contract-seam tests for the external command-plugin seam (Phase 1).
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // All tests run against an ISOLATED home (HOME → a fresh temp dir, no ambient
 // user plugins) and pass an explicit no-`.crouter` startDir, so discovery is
@@ -23,7 +23,7 @@
 //     mount composition without executing the fixture binary.
 import { test, describe, before, after, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, chmodSync, existsSync, lstatSync, realpathSync } from 'node:fs';
 import { readFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
@@ -40,6 +40,7 @@ import { CrtrError } from '../../errors.js';
 import { resetScopeCache } from '../../scope.js';
 import { listInstalledPluginsInRoot } from '../../resolver.js';
 import { pluginShow } from '../../../commands/pkg/plugin-inspect.js';
+import { pluginDisable, pluginEnable, pluginInstall } from '../../../commands/pkg/plugin-manage.js';
 // The set of reserved core names discovery must fail closed against. We don't
 // import the real SUBTREE_NAMES (build-root.ts pulls the whole tree); a small
 // explicit set is enough for the collision contract and keeps the test cheap.
@@ -371,7 +372,7 @@ describe('protocol integration', () => {
 // 4b. True end-to-end CLI invocation (argv → parseArgv → adapter → renderer)
 // ---------------------------------------------------------------------------
 describe('end-to-end CLI invocation', () => {
-    // dist/cli.js is up 4 from src/core/__tests__/serial/. Requires a prior
+    // dist/cli.js is up 4 from src/core/__tests__/integration/. Requires a prior
     // `npm run build` (the harness/CI builds before tests). Drives the WHOLE seam: the
     // declared positional `app-id` must arrive as `appId` in the request, and
     // the rendered + --json outputs come through the real dispatcher.
@@ -663,3 +664,93 @@ process.stdout.write(JSON.stringify({ protocolVersion: 1, ok: true, result: { ap
         assertNotExecuted();
     });
 });
+// ---------------------------------------------------------------------------
+// Memory-corpus gate across the plugin lifecycle — install, and enable of a
+// package installed while disabled, both converge the candidate's memory store
+// onto exact canonical identity BEFORE it can mount. A local-path install stays
+// a live link, so the caller's own directory is the corpus that gets rewritten;
+// a corpus that cannot converge writes nothing and changes no config. Update
+// runs the same gate through the same helper, so it needs no cases of its own.
+// ---------------------------------------------------------------------------
+describe('memory corpus gate across the plugin lifecycle', () => {
+    let realCwd;
+    beforeEach(() => {
+        realCwd = process.cwd();
+        process.chdir(emptyStart); // no .crouter ancestor → the real repo is never a scope
+        resetScopeCache();
+    });
+    afterEach(() => {
+        process.chdir(realCwd);
+        resetScopeCache();
+    });
+    function writeDoc(path, frontmatter, body) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `---\n${frontmatter}\nwhen-and-why-to-read: When the fixture runs, this knowledge should be read because it proves the gate.\n---\n\n${body}\n`);
+    }
+    function pluginSource(name) {
+        const root = join(mintDir('crtr-plugin-src-'), name);
+        mkdirSync(join(root, '.crouter-plugin'), { recursive: true });
+        writeFileSync(join(root, '.crouter-plugin', 'plugin.json'), JSON.stringify({ name, version: '0.1.0', description: 'fixture' }));
+        return root;
+    }
+    function userConfig() {
+        const path = join(userRoot, 'config.json');
+        return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : { plugins: {} };
+    }
+    test('a local install migrates the caller-owned linked corpus in place and reports it', async () => {
+        const source = pluginSource('memfix');
+        writeDoc(join(source, 'memory', 'topics', 'INDEX.md'), 'kind: knowledge\nname: topics/INDEX', 'Topic overview.');
+        writeDoc(join(source, 'memory', 'overview.md'), 'kind: knowledge', 'Depth lives in [[memfix/topics/INDEX]].');
+        // Non-document files the substrate never loads as documents: the count
+        // below must not include them even though lint YAML-checks them too.
+        writeDoc(join(source, 'memory', 'SKILL.md'), 'kind: knowledge\nname: unrelated-skill', 'Skill body.');
+        writeDoc(join(source, 'memory', 'MEMORY.md'), 'kind: knowledge', 'Index body.');
+        resetScopeCache();
+        const out = await pluginInstall.run({ installRef: source, scope: 'user' });
+        const memory = out['memory'];
+        assert.deepEqual(memory.migrated, ['overview.md', 'topics/INDEX.md'], 'both phases rewrote a document');
+        assert.equal(memory.linkedSource, realpathSync(join(source, 'memory')), 'the report names the caller-owned directory it rewrote');
+        assert.equal(memory.docs, 2);
+        assert.equal(lstatSync(join(userRoot, 'plugins', 'memfix')).isSymbolicLink(), true, 'the install stays a live link');
+        // The rewrite landed in the caller's source, not in a copy.
+        assert.match(readFileSync(join(source, 'memory', 'overview.md'), 'utf8'), /\[\[memfix\/topics\]\]/);
+        assert.doesNotMatch(readFileSync(join(source, 'memory', 'topics', 'INDEX.md'), 'utf8'), /^name:/m);
+        assert.equal(userConfig().plugins['memfix']?.enabled, true);
+    });
+    test('a corpus that cannot converge blocks the install, writes nothing, and registers nothing', async () => {
+        const source = pluginSource('blocked');
+        writeDoc(join(source, 'memory', 'dup-a.md'), 'kind: knowledge\nname: dup', 'First claimant.');
+        writeDoc(join(source, 'memory', 'dup-b.md'), 'kind: knowledge\nname: dup', 'Second claimant.');
+        const before = ['dup-a.md', 'dup-b.md'].map((f) => readFileSync(join(source, 'memory', f), 'utf8'));
+        resetScopeCache();
+        await assert.rejects(pluginInstall.run({ installRef: source, scope: 'user' }), (error) => /cannot be migrated to exact canonical identity/.test(error.message) && /dup/.test(error.message));
+        assert.equal(existsSync(join(userRoot, 'plugins', 'blocked')), false, 'a blocked candidate installs nothing');
+        assert.equal(userConfig().plugins['blocked'], undefined, 'config is unchanged');
+        assert.deepEqual(['dup-a.md', 'dup-b.md'].map((f) => readFileSync(join(source, 'memory', f), 'utf8')), before, 'a blocked plan writes nothing');
+    });
+    test('enable migrates a package installed while disabled before it flips config', async () => {
+        const source = pluginSource('lifecycle');
+        writeDoc(join(source, 'memory', 'ready.md'), 'kind: knowledge', 'Already canonical.');
+        resetScopeCache();
+        await pluginInstall.run({ installRef: source, scope: 'user' });
+        resetScopeCache();
+        await pluginDisable.run({ name: 'lifecycle' });
+        resetScopeCache();
+        // The package gains an old-format document while it sits disabled.
+        writeDoc(join(source, 'memory', 'guide', 'INDEX.md'), 'kind: knowledge\nname: guide/INDEX', 'Guide.');
+        const enabled = await pluginEnable.run({ name: 'lifecycle' });
+        assert.equal(enabled['enabled'], true);
+        const memory = enabled['memory'];
+        assert.deepEqual(memory.migrated, ['guide/INDEX.md']);
+        assert.equal(memory.linkedSource, realpathSync(join(source, 'memory')));
+        assert.doesNotMatch(readFileSync(join(source, 'memory', 'guide', 'INDEX.md'), 'utf8'), /^name:/m);
+        assert.equal(userConfig().plugins['lifecycle']?.enabled, true);
+        resetScopeCache();
+        await pluginDisable.run({ name: 'lifecycle' });
+        resetScopeCache();
+        writeDoc(join(source, 'memory', 'dup-a.md'), 'kind: knowledge\nname: dup', 'First claimant.');
+        writeDoc(join(source, 'memory', 'dup-b.md'), 'kind: knowledge\nname: dup', 'Second claimant.');
+        await assert.rejects(pluginEnable.run({ name: 'lifecycle' }), /cannot be migrated to exact canonical identity/);
+        assert.equal(userConfig().plugins['lifecycle']?.enabled, false, 'a refused corpus leaves the plugin disabled');
+    });
+});

package/dist/core/__tests__/{serial → integration}/deferred-no-wake.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // REGRESSION LOCK — gh issue #341. `--tier deferred` is documented as the ONE
 // tier that never wakes an idle node ("read on its next natural cycle"), but

package/dist/core/__tests__/{serial → integration}/flagship-lifecycle.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // HEADLESS RETARGET (foundation-spec §C.9 + §E). The flagship end-to-end
 // lifecycle scenario, driven entirely at the MODEL layer against FABRICATED
@@ -29,20 +29,11 @@
 //     "B revived" asserts go RED. If a push wrongly fanned past its direct
 //     subscriber, the "A inbox empty" one-hop asserts go RED.
 //
-// STOPHOOK CAVEAT — split (option b). The original leaned on the REAL stophook
-// committing idle-release / the stall reprompt / the persona steer INSIDE a live
-// broker at agent_end/turn_end. Fabrication can set the post-stop row but cannot
-// run that hook. So for each such point this test fabricates the post-stop MODEL
-// state (or asserts the PURE decision the hook enacts — evaluateStop /
-// personaDrift) and asserts the downstream lifecycle/daemon CONSEQUENCE, leaving
-// the hook-commit proof to the already-pure siblings:
-//   • idle-release commit at agent_end → canvas-stophook-agentend.test.ts
-//     ('natural stop while awaiting a live worker → idle-release …').
-//   • stall reprompt at agent_end     → canvas-stophook-agentend.test.ts
-//     ('stalled leaf … is still reprompted').
-//   • persona-drift steer + ack commit at turn_end → persona.test.ts
-//     ('personaDrift detects base→orchestrator after promote, then clears on
-//     commit'). Here we assert only the PENDING drift the injector would deliver.
+// HOST-HOOK CAVEAT — fabrication cannot run agent_end or the broker's
+// pre-provider persona gate. This test enacts or asserts model state only;
+// canvas-stophook-agentend.test.ts pins idle release and stall reprompt, while
+// canvas-context-intro.test.ts pins persona transition delivery and ack. Here,
+// personaDrift proves the promoted node remains pending.
 //
 // 2×2 coverage (mode {base,orchestrator} × lifecycle {terminal,resident}):
 //   • base×resident         — A's fabricated row shape at S1 (a spawnRoot
@@ -114,7 +105,7 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-B',
         });
         subscribe(A, B, true); // the load-bearing spine seed: A subscribes_to B (active).
-        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' }); // born acked to its persona
+        commitPersonaAck(B, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }); // born acked to its persona
         {
             const b = h.node(B);
             assert.equal(b.host_kind, 'broker', 'B broker-hosted (paneless)');
@@ -211,20 +202,15 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(b.intent ?? null, null, 'B intent untouched by promote');
         }
         // ===================================================================
-        // S9 — The next turn's hooks, asserted as the PURE decisions they enact:
-        //      (a) turn_end would inject the base→orchestrator persona-drift steer —
-        //          personaDrift(B) reports that PENDING drift (the guidance the
-        //          injector delivers). The actual delivery + ack commit is locked
-        //          by persona.test.ts.
-        //      (b) agent_end would stall (orchestrator, no live sub — C done, D not
-        //          yet spawned — no final) → evaluateStop → 'stalled'/STALL_REPROMPT.
-        //          The actual reprompt injection is locked by canvas-stophook-agentend.
+        // S9 — The next provider request must first deliver the pending persona
+        //      transition. Independently, agent_end would stall this orchestrator
+        //      because it has no live subscription and has not pushed a final.
         // ===================================================================
         {
             const drift = personaDrift(B);
-            assert.ok(drift !== null, 'turn_end would inject a persona-drift steer (drift pending)');
-            assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
-            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
+            assert.ok(drift !== null, 'the provider gate has a pending persona transition');
+            assert.deepEqual(drift?.from, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
+            assert.deepEqual(drift?.to, { kind: 'developer', mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
             assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator guidance');
             const stop = evaluateStop(B, { pushedFinal: false, requestedHumanReply: false });
             assert.equal(stop.action, 'reprompt', 'orchestrator B with no live sub, no final → reprompt');

package/dist/core/__tests__/{serial → integration}/host-teardown-process-group.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // Regression cover for crouton-labs/crouter#98: a canceled/wedged child node
 // ORPHANS its subprocess tree (bash → test runner → spawned app) because

package/dist/core/__tests__/{serial → integration}/human-deliver-e2e.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // Drive a terminal ticket through the public crtrd ticket route. Terminal
 // delivery is daemon-owned; no subprocess handler or delivery receipt exists.

package/dist/core/__tests__/{live-mutation-verbs.test.js → integration/live-mutation-verbs.test.js}

@@ -16,9 +16,7 @@
 //       promote, no roadmap seeded, no persona_ack drift — it just sets
 //       intent=refresh. `node yield --promote` is the explicit opt-in that
 //       rides the promote() path (mode→orchestrator + roadmap seeded), and
-//       because its agent_end goes straight to the refresh-revive with NO
-//       preceding turn_end, the persona-drift steer that promotion would have
-//       queued is never delivered (ack left PENDING).
+//       leaves persona_ack pending until the fresh-context baseline persists.
 // (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — demote writes lifecycle on the row
 //     (setLifecycle→updateNode); recycle's FINISH+MINT half is pushFinal +
 //     spawnNode (pure model) — only its pane-respawn is tmux (a deliberately-
@@ -33,22 +31,17 @@
 //     or seed a roadmap, or if it committed the ack itself, the A4 'yield
 //     --promote' asserts go RED.
 //
-// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi so the
-// REAL stophook enacted recycle's viewer teardown and A4's refresh-revive ack-drain
-// at agent_end. Fabrication cannot run those hooks. So: recycle is driven through
-// the real recycleNode (its FINISH+MINT model half runs fully; the pane respawn
-// is the only tmux artifact, intentionally skipped → recycled:false). For A4 the
-// PURE pre-stop facts are asserted (mode preserved on a plain yield; mode flip +
-// roadmap seeded + ack PENDING on `--promote`); the ack-commit-at-refresh-drain
-// is locked by persona.test.ts ('… then clears on commit'), and the steer-bypass
-// follows because no turn_end ever fires on the yield path.
+// HOST-HOOK CAVEAT — fabrication cannot run the replacement context intro.
+// recycleNode still exercises its finish-and-mint model path; these A4 cases pin
+// the pre-refresh state. canvas-context-intro.test.ts proves the fresh baseline
+// persists before persona_ack advances.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { createHeadlessHarness } from './helpers/harness.js';
-import { subscribe } from '../canvas/canvas.js';
-import { recycleNode } from '../runtime/recycle.js';
-import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
-import { hasRoadmap } from '../runtime/roadmap.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { subscribe } from '../../canvas/canvas.js';
+import { recycleNode } from '../../runtime/recycle.js';
+import { commitPersonaAck, personaDrift } from '../../runtime/persona.js';
+import { hasRoadmap } from '../../runtime/roadmap.js';
 /** Normalize the two persona axes off a NodeMeta for deepEqual. */
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
@@ -117,7 +110,7 @@ test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle
         {
             const fresh = h.node(res.newRoot);
             assert.deepEqual(persona(fresh), { mode: 'base', lifecycle: 'resident' }, 'recycled root is born base×resident (general)');
-            assert.deepEqual(fresh.persona_ack, { mode: 'base', lifecycle: 'resident' }, 'fresh root born acked base×resident');
+            assert.deepEqual(fresh.persona_ack, { kind: 'general', mode: 'base', lifecycle: 'resident' }, 'fresh root born acked general×base×resident');
             assert.equal(fresh.parent ?? null, null, 'the fresh root is a root (no parent)');
         }
     }
@@ -129,9 +122,8 @@ test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle
 // (b) A4 BOUNDARY — plain yield is mode-preserving; `yield --promote` is the
 //     explicit one-step promotion + refresh. A plain yield sets intent=refresh
 //     only, leaves the base persona acknowledged, and does NOT seed a roadmap.
-//     With `--promote`, the mode flips and a roadmap is seeded; that promotion
-//     still leaves its persona drift pending, because agent_end goes STRAIGHT to
-//     refresh-revive with no preceding turn_end to deliver the steer.
+//     With `--promote`, the mode flips and a roadmap is seeded; persona drift
+//     remains pending until the replacement context persists its baseline.
 // ===========================================================================
 test('A4: a plain yield preserves base mode and does not seed a roadmap', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
@@ -141,7 +133,7 @@ test('A4: a plain yield preserves base mode and does not seed a roadmap',
         const A = h.spawnRoot('resident root');
         const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
         subscribe(A, B, true);
-        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        commitPersonaAck(B, { kind: 'developer', mode: 'base', lifecycle: 'terminal' });
         assert.equal(hasRoadmap(B), false, 'B has no roadmap before a plain yield');
         const y = h.cli(B, ['node', 'yield', 'refresh against the original goal']);
         assert.equal(y.code, 0, `node yield exit 0\n${y.stderr}`);
@@ -149,10 +141,10 @@ test('A4: a plain yield preserves base mode and does not seed a roadmap',
             const b = h.node(B);
             assert.equal(b.mode, 'base', 'plain yield preserves base mode');
             assert.equal(b.intent, 'refresh', 'intent=refresh set by the yield');
-            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'plain yield leaves the acknowledged base persona unchanged');
+            assert.deepEqual(b.persona_ack, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'plain yield leaves the acknowledged base persona unchanged');
         }
         assert.equal(hasRoadmap(B), false, 'plain yield does not seed a roadmap');
-        assert.equal(personaDrift(B), null, 'plain yield leaves no persona drift to steer');
+        assert.equal(personaDrift(B), null, 'plain yield leaves no persona transition pending');
     }
     finally {
         await h.dispose();
@@ -166,7 +158,7 @@ test('A4: yield --promote flips base→orchestrator, seeds a roadmap, and leaves
         const A = h.spawnRoot('resident root');
         const B = h.fabricateBrokerNode({ parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal', status: 'active' });
         subscribe(A, B, true);
-        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        commitPersonaAck(B, { kind: 'developer', mode: 'base', lifecycle: 'terminal' });
         assert.equal(hasRoadmap(B), false, 'B has no roadmap before yield --promote');
         const y = h.cli(B, ['node', 'yield', '--promote', 'refresh as an orchestrator']);
         assert.equal(y.code, 0, `node yield --promote exit 0\n${y.stderr}`);
@@ -174,19 +166,16 @@ test('A4: yield --promote flips base→orchestrator, seeds a roadmap, and leaves
             const b = h.node(B);
             assert.equal(b.mode, 'orchestrator', 'yield --promote flips base→orchestrator');
             assert.equal(b.intent, 'refresh', 'intent=refresh set by the yield');
-            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'ack STILL base — promote/yield never commits it; only an injector or the refresh drain does');
+            assert.deepEqual(b.persona_ack, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'ack stays base until provider-gated delivery or the fresh-context baseline completes');
         }
         assert.equal(hasRoadmap(B), true, 'yield --promote seeds a roadmap');
-        // THE A4 PENDING-DRIFT LOCK — the base→orchestrator guidance is left
-        // PENDING (personaDrift reports it) and is the ONLY thing the (bypassed)
-        // turn_end injector would have delivered as a steer. The ack's silent
-        // advance at the refresh drain — NOT via a steer — is locked by
-        // persona.test.ts; the steer is lost because no turn_end fires on this path.
+        // The refresh kickoff carries this framing into the replacement context;
+        // persona_ack stays pending until that context's snapshots persist.
         {
             const drift = personaDrift(B);
             assert.ok(drift !== null, 'the orchestration guidance is PENDING after yield --promote (drift detected)');
-            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'pending drift → orchestrator×terminal');
-            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the pending (lost) steer carries the orchestration guidance');
+            assert.deepEqual(drift?.to, { kind: 'developer', mode: 'orchestrator', lifecycle: 'terminal' }, 'pending drift → orchestrator×terminal');
+            assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the pending fresh-revive framing carries the orchestration guidance');
         }
     }
     finally {

package/dist/core/__tests__/{serial → integration}/live-mutation.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // HEADLESS RETARGET (foundation-spec §C.12 + §E). AXIS: LIVE MUTATION of the
 // 2×2 state vector (mode {base,orchestrator} × lifecycle {terminal,resident})
@@ -12,8 +12,7 @@
 // (1) BUG LOCKED — (a) a live lifecycle flip changes the idle-release decision:
 //     a resident node is NEVER forced dormant (suppressed), a terminal one with
 //     an active live sub IS legitimately awaiting (restored). (b) a live promote
-//     flips mode but leaves persona_ack PENDING for the injector — it never
-//     commits the ack itself.
+//     flips mode but leaves persona_ack pending for provider-gated delivery.
 // (2) WHY MODEL-LEVEL, NOT PANE/WINDOW — the flip writes lifecycle/mode on the
 //     row (updateNode) and the idle-release call is decided by the PURE
 //     evaluateStop (stop-guard.ts), which keys on lifecycle + active live subs,
@@ -28,16 +27,10 @@
 //     orchestrator PENDING; if promote wrongly committed the ack, drift reads
 //     null → the pending-drift assert goes RED.
 //
-// STOPHOOK CAVEAT — split (option b). The original drove a LIVE fake-pi turn so
-// the REAL stophook enacted the idle-release at agent_end and committed
-// persona_ack at turn_end. Fabrication cannot run those hooks. So this test
-// asserts the PURE decisions the hooks enact (evaluateStop / personaDrift) and
-// leaves the hook-commit proof to the already-pure siblings:
-//   • idle-release / resident-suppression commit at agent_end → canvas-stophook-
-//     agentend.test.ts ('natural stop while awaiting a live worker → idle-release'
-//     and '§5.1.7 resident attended … nothing happens').
-//   • persona_ack recompose at turn_end → persona.test.ts ('personaDrift detects
-//     base→orchestrator after promote, then clears on commit').
+// HOST-HOOK CAVEAT — fabrication cannot run agent_end or the broker's
+// pre-provider persona gate. This test asserts evaluateStop and personaDrift;
+// canvas-stophook-agentend.test.ts pins idle-release behavior, and
+// canvas-context-intro.test.ts pins transition delivery and guarded ack.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -132,15 +125,11 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
     }
 });
 // ===========================================================================
-// (b) MODE FLIP — promote: base → orchestrator on a LIVE node. The flip itself
-//     does NOT commit the persona ack; the turn_end injector recomposes (commits
-//     the ack + delivers the steer) on the next turn. The NEW assertions here
-//     are that promote leaves the ack PENDING (not committed) and personaDrift
-//     reports the exact base→orchestrator transition the injector would deliver —
-//     the model precondition of the recompose (whose commit is locked by
-//     persona.test.ts).
+// (b) MODE FLIP — promote: base → orchestrator on a LIVE node. Promotion leaves
+//     persona_ack pending; the next provider request appends and persists the
+//     transition before a guarded ack. This test pins that model precondition.
 // ===========================================================================
-test('live mode flip: promote base→orchestrator leaves persona_ack PENDING for the turn_end injector', 
+test('live mode flip: promote base→orchestrator leaves persona_ack pending for provider-gated delivery', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
 { timeout: 60_000 }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-mode' });
@@ -150,16 +139,14 @@ test('live mode flip: promote base→orchestrator leaves persona_ack PENDING for
         subscribe(A, B, true);
         // Born acked to its own persona (mirroring a real birth) → no spurious
         // drift before the promote (invariant 11).
-        commitPersonaAck(B, { mode: 'base', lifecycle: 'terminal' });
+        commitPersonaAck(B, { kind: 'developer', mode: 'base', lifecycle: 'terminal' });
         {
             const b = h.node(B);
             assert.deepEqual(persona(b), { mode: 'base', lifecycle: 'terminal' }, 'B born base×terminal');
-            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'persona_ack born equal to the initial persona (invariant 11)');
+            assert.deepEqual(b.persona_ack, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'persona_ack born equal to the initial persona (invariant 11)');
             assert.equal(personaDrift(B), null, 'no drift before the promote');
         }
-        // PROMOTE (live): mode→orchestrator, lifecycle UNCHANGED, status/intent
-        // untouched (no transition). Crucially promote does NOT commit the ack —
-        // the drift is left PENDING for the injector.
+        // PROMOTE changes mode only and leaves the transition pending.
         {
             const res = h.cli(B, ['node', 'promote', '--kind', 'developer']);
             assert.equal(res.code, 0, `promote exit 0\n${res.stderr}`);
@@ -168,27 +155,20 @@ test('live mode flip: promote base→orchestrator leaves persona_ack PENDING for
             assert.equal(b.lifecycle, 'terminal', 'lifecycle UNCHANGED (promote is mode-only)');
             assert.equal(b.status, 'active', 'status untouched by promote');
             assert.equal(b.intent ?? null, null, 'intent untouched by promote');
-            assert.deepEqual(b.persona_ack, { mode: 'base', lifecycle: 'terminal' }, 'promote does NOT commit the ack — drift left PENDING for the injector');
+            assert.deepEqual(b.persona_ack, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'promote leaves the previous persona acknowledged');
         }
-        // THE PENDING-DRIFT LOCK — personaDrift(B) reports the exact base→
-        // orchestrator transition the turn_end injector would deliver as a steer
-        // (and then commit). NON-VACUOUS: if promote wrongly committed the ack,
-        // personaDrift reads null and the asserts below go RED. The actual delivery
-        // + commit (and its idempotence on a second turn) is locked by
-        // persona.test.ts ('… then clears on commit').
+        // If promotion committed the ack itself, personaDrift would be null and
+        // these assertions would fail. Provider delivery is pinned separately.
         {
             const drift = personaDrift(B);
             assert.ok(drift !== null, 'a recompose is pending after the live promote');
-            assert.deepEqual(drift?.from, { mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
-            assert.deepEqual(drift?.to, { mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
+            assert.deepEqual(drift?.from, { kind: 'developer', mode: 'base', lifecycle: 'terminal' }, 'drift.from = the acked base×terminal');
+            assert.deepEqual(drift?.to, { kind: 'developer', mode: 'orchestrator', lifecycle: 'terminal' }, 'drift.to = the new orchestrator persona');
             assert.match(drift?.guidance ?? '', /ORCHESTRATOR/i, 'the steer carries the base→orchestrator orchestration guidance');
         }
-        // And the recompose IS the injector's job, committed at turn_end — modeled
-        // here by commitPersonaAck (what the injector calls), proving drift then
-        // clears (idempotent). The firing of that commit inside the live stophook
-        // is locked by persona.test.ts.
-        commitPersonaAck(B, { mode: 'orchestrator', lifecycle: 'terminal' });
-        assert.deepEqual(h.node(B).persona_ack, { mode: 'orchestrator', lifecycle: 'terminal' }, 'persona_ack recomposed to the new persona');
+        // Model a successful delivery ack and prove the detector clears.
+        commitPersonaAck(B, { kind: 'developer', mode: 'orchestrator', lifecycle: 'terminal' });
+        assert.deepEqual(h.node(B).persona_ack, { kind: 'developer', mode: 'orchestrator', lifecycle: 'terminal' }, 'persona_ack recomposed to the new persona');
         assert.equal(personaDrift(B), null, 'no fresh drift after the ack commit (idempotent recompose)');
     }
     finally {

package/dist/core/__tests__/integration/refresh-stall-recycle.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/{serial → integration}/refresh-stall-recycle.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // BUG-REGRESSION (broker-universal-host cut, design §H refresh-authority; U7
 // report mq8gq8we-4cadd8e6; stuck-refresh, parent mq7s5o93). A `node yield` /

package/dist/core/__tests__/integration/revive.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/{serial → integration}/revive.test.js

@@ -1,4 +1,4 @@
-// Run with: npm run test:serial
+// Run with: npm run test:integration
 //
 // HEADLESS RETARGET (foundation-spec §C.13 + §E). Covers the session-picker fix
 // (resume by ABSOLUTE session-file path, cwd-immune) and the double-revive guard
@@ -28,11 +28,11 @@
 //     goes RED.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
+import { mkdtempSync, realpathSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { createNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
+import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
 import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
 import { readInboxSince } from '../../feed/inbox.js';
 import { closeDb } from '../../canvas/db.js';
@@ -46,6 +46,7 @@ import { InputError } from '../../io.js';
 import { createHarness } from '../helpers/harness.js';
 import { bindTestFleet } from '../helpers/fleet.js';
 import { resetFleetForTests } from '../../runtime/fleet.js';
+import { emptyContextExposureState, exposureTarget, initializeForkContextExposure, loadContextExposureState, registerExposure, saveContextExposureState, } from '../../substrate/injected-store.js';
 let home;
 function node(id, over = {}) {
     return {
@@ -80,7 +81,10 @@ function disposableLivePid() {
     return c.pid;
 }
 before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-revive-'));
+    // realpath, not the raw mkdtemp path: on macOS `tmpdir()` is the /var symlink
+    // to /private/var, and the runtime resolves a fork's durable source file, so a
+    // raw temp path would compare unequal to the very path the runtime replays.
+    home = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-revive-')));
     process.env['CRTR_HOME'] = home;
 });
 beforeEach(() => {
@@ -345,7 +349,7 @@ test('reviveNode fresh-fallback clears the stale session identity (Major-3: no p
         await h.dispose();
     }
 });
-test('an unbound ordinary fork replays its immutable source with and without its goal', () => {
+test('unbound forks replay one durable source file for node-id, path, and UUID operands', () => {
     const originalLaunch = headlessBrokerHost.launch;
     const tf = bindTestFleet();
     const forkFile = join(home, 'ordinary-fork-source.jsonl');
@@ -353,26 +357,41 @@ test('an unbound ordinary fork replays its immutable source with and without its
     try {
         mkdirSync(home, { recursive: true });
         writeFileSync(forkFile, '{}\n', 'utf8');
+        createNode(node('ordinary-fork-source', { cwd: home, pi_session_file: forkFile }));
+        const sourceExposure = emptyContextExposureState();
+        registerExposure(exposureTarget(sourceExposure, 'system'), 'source-system-only', 'content');
+        registerExposure(exposureTarget(sourceExposure, 'transcript'), 'source-transcript', 'content');
+        saveContextExposureState('ordinary-fork-source', sourceExposure);
         headlessBrokerHost.launch = (nodeId, inv) => {
             launches.push([...inv.argv]);
             const handle = { pid: disposableLivePid(), exited: new Promise(() => { }) };
             tf.fleet.register(nodeId, handle);
             return handle;
         };
-        createNode(node('ordinary-fork-promptless', { cwd: home, fork_from: forkFile }));
-        reviveNode('ordinary-fork-promptless', { resume: true });
-        const promptless = launches[0];
-        const promptlessFork = promptless.indexOf('--fork');
-        assert.equal(promptless[promptlessFork + 1], forkFile, 'an unbound ordinary fork uses its immutable source');
-        assert.deepEqual(promptless, buildPiArgv(getNode('ordinary-fork-promptless'), { forkFrom: forkFile }).argv, 'a promptless fork has no trailing positional prompt');
-        createNode(node('ordinary-fork-goal', { cwd: home, fork_from: forkFile }));
-        writeGoal('ordinary-fork-goal', 'continue the forked task');
-        const goal = readGoal('ordinary-fork-goal');
-        reviveNode('ordinary-fork-goal', { resume: false });
-        const goalCarrying = launches[1];
-        const goalFork = goalCarrying.indexOf('--fork');
-        assert.equal(goalCarrying[goalFork + 1], forkFile, 'an unbound ordinary fork uses its immutable source regardless of requested resume mode');
-        assert.equal(goalCarrying.at(-1), goal, 'a goal-carrying fork preserves its exact goal as the trailing prompt');
+        const operands = ['ordinary-fork-source', forkFile, '019e8ce3-322e-7000-8000-000000000001'];
+        for (const [index, operand] of operands.entries()) {
+            const destination = `ordinary-fork-${index}`;
+            createNode(node(destination, {
+                cwd: home,
+                fork_from: operand,
+                fork_source_file: forkFile,
+            }));
+            initializeForkContextExposure(destination, 'ordinary-fork-source');
+            if (index === 1)
+                writeGoal(destination, 'continue the forked task');
+        }
+        deleteNode('ordinary-fork-source');
+        for (let index = 0; index < operands.length; index++) {
+            const destination = `ordinary-fork-${index}`;
+            reviveNode(destination, { resume: index !== 1 });
+            const argv = launches[index];
+            const fork = argv.indexOf('--fork');
+            assert.equal(argv[fork + 1], forkFile, `${operands[index]} retries from the durable resolved file`);
+            const exposure = loadContextExposureState(destination);
+            assert.deepEqual(exposure.exposures.get('source-transcript'), { transcript: 3 });
+            assert.equal(exposure.exposures.has('source-system-only'), false, 'forks never inherit source system exposure');
+        }
+        assert.equal(launches[1].at(-1), readGoal('ordinary-fork-1'), 'a goal-carrying fork preserves its exact goal');
     }
     finally {
         headlessBrokerHost.launch = originalLaunch;

package/dist/core/__tests__/integration/spawn-root.test.d.ts

@@ -0,0 +1 @@
+export {};