@north-light/crouter 0.3.227 → 0.3.229

package/dist/pi-extensions/canvas-doc-substrate.js

@@ -5,29 +5,9 @@
 // (registered in CANVAS_EXTENSIONS, src/core/runtime/launch.ts). INERT when
 // CRTR_NODE_ID is absent (a plain pi session or legacy job agent loads it as a no-op).
 //
-// It owns the substrate's pi hooks:
-//
-//   1. before_agent_start — the BOOT system-prompt half. Splices the rendered
-//      `<memory kind="preference">` block (memory-usage guidance + preferences)
-//      into `event.systemPrompt`, right after pi's native "Available tools" list
-//      (before the `\n\nGuidelines:` anchor), so the substrate's standing
-//      directives sit in the tool-selection frame the agent reads while choosing
-//      a capability. Falls back to appending when the anchor is absent. (The `<memory kind="knowledge">`
-//      catalog rides the bearings message instead — see core/substrate/render.ts.)
-//
-//   2. tool_result (gated on `read` and `bash`) — the EVENT half. For each
-//      non-error `read`, evaluates the read file against every doc's `read`
-//      surfaces entries across the resolved corpus and any project stores
-//      enclosing the read file; for each non-error `bash`, evaluates the
-//      executed command string against every doc's `command` entries. Matches
-//      render at their matched rung in `<auto-loaded-context>` before the
-//      tool output. A transcript-scoped (realpath → rung) map deduplicates
-//      repeated deliveries and resumed broker processes.
-//
-// Both handler bodies are wrapped in try/catch and degrade to INERT on error —
-// a substrate bug must never brick node boot or break a `read`, only quietly
-// stop surfacing docs. The pure render lives in core/substrate/ (render.ts +
-// on-read.ts); this file is only the pi-hook plumbing.
+// before_agent_start splices the context's frozen preference snapshot after the
+// native tool list. Successful read/bash results append matching memory through
+// the shared context exposure state. Pure rendering lives in core/substrate/.
 //
 // Plain TS-with-types — NO imports from @earendil-works/* (a local structural
 // PiLike interface stands in), so it compiles inside crouter's own tsc build
@@ -38,7 +18,7 @@ import { brokerExtensionState } from '../core/runtime/broker/daemon-ops.js';
 import { renderPreferencesFromState } from '../core/runtime/broker-extension-render.js';
 import { renderOnCommandDocsForSubject, renderOnReadDocsForSubject } from '../core/substrate/on-read.js';
 import { clearSessionCache } from '../core/substrate/session-cache.js';
-import { loadInjectedDocs, mergeInjectedDocs, saveInjectedDocs, sharedInjectedDocs } from '../core/substrate/injected-store.js';
+import { cloneContextExposureState, exposureTarget, freezePreferenceSnapshot, loadContextExposureState, mergeContextExposureState, replaceContextExposureState, saveContextExposureState, sharedContextExposureState, } from '../core/substrate/injected-store.js';
 import { autoLoadedContextInner, mergeAutoLoadedContext } from './envelope-merge.js';
 // ---------------------------------------------------------------------------
 // Extension
@@ -48,120 +28,73 @@ import { autoLoadedContextInner, mergeAutoLoadedContext } from './envelope-merge
  *  to reach for while reading the tools, so memory docs/preferences must sit
  *  there, not far below. Falls back to appending if absent. */
 const TOOLS_ANCHOR = '\n\nGuidelines:';
-/**
- * Register the document substrate's pi hooks on `pi`.
- *
- * Returns immediately (inert) when CRTR_NODE_ID is absent — a non-canvas pi
- * session gets no hooks. Each handler is independently wrapped so a failure
- * degrades to a no-op (boot proceeds, the read returns) rather than bricking.
- */
 export function registerCanvasDocSubstrate(pi) {
     const nodeId = process.env['CRTR_NODE_ID'];
     if (nodeId === undefined || nodeId.trim() === '')
         return; // not a canvas node — inert
-    // Per-TRANSCRIPT set of injected doc realpaths → a doc surfaces at most once
-    // across the node's conversation, EVEN across a dormancy → revive(resume)
-    // cycle. A resume reuses the same .jsonl transcript in a NEW pi process, so
-    // the set is REHYDRATED from disk at process start (not started empty) and is
-    // NOT cleared on session_start — a resume continues the transcript, so the
-    // dedup must carry forward. The one launch path that begins a FRESH transcript
-    // (reviveNode with resume=false) deletes the file, so a new conversation
-    // rehydrates empty here. See core/substrate/injected-store.ts.
-    //
-    // The set is the PROCESS-SHARED instance (sharedInjectedDocs), so the
-    // context-intro extension's workspace-open render grows the same set this
-    // hook dedups against — a front door delivered at boot never re-delivers on
-    // a later read beneath its store.
-    const injectedDocs = sharedInjectedDocs(nodeId);
+    // One in-place state object is shared with context-intro and rehydrated on a
+    // strict resume. New-context launch paths clear it before baseline assembly.
+    const contextExposure = sharedContextExposureState(nodeId);
     pi.on('session_start', () => {
-        // Only the per-session substrate PARSE cache resets each session (so the
-        // corpus is re-scanned, picking up memory writes). injectedDocs is
-        // transcript-scoped, not session-scoped — deliberately NOT cleared here.
         clearSessionCache();
     });
-    // 1. BOOT system-prompt half — splice the `<memory kind="preference">` block
-    //    (memory-usage guidance + preferences). The guidance frame is always
-    //    present for a canvas node (the memory system always exists), so the block
-    //    is never empty even when no preference is eligible. (The knowledge catalog
-    //    does not enter the system prompt — it rides the bearings message via
-    //    renderKnowledgeBlock.)
     pi.on('before_agent_start', async (event) => {
-        try {
+        mergeContextExposureState(contextExposure, loadContextExposureState(nodeId));
+        let block = contextExposure.preferenceSnapshot;
+        if (block === null) {
             const state = await brokerExtensionState(nodeId);
-            // Merge the on-disk set first so this save never clobbers an
-            // out-of-process delivery (the daemon's warm-spare bearings push), then
-            // seed each rendered preference at its boot rung. Boot renders every
-            // agent run and never skips; re-seeding at the same rung is idempotent.
-            mergeInjectedDocs(injectedDocs, loadInjectedDocs(nodeId));
-            const block = renderPreferencesFromState(state, injectedDocs);
-            saveInjectedDocs(nodeId, injectedDocs);
-            if (block === '')
-                return; // nothing eligible — leave the prompt untouched
-            const idx = event.systemPrompt.indexOf(TOOLS_ANCHOR);
-            if (idx === -1) {
-                return { systemPrompt: `${event.systemPrompt}\n\n${block}` };
-            }
-            return {
-                systemPrompt: `${event.systemPrompt.slice(0, idx)}\n\n${block}${event.systemPrompt.slice(idx)}`,
-            };
-        }
-        catch {
-            return; // inert on error — never brick node boot
+            const next = cloneContextExposureState(contextExposure);
+            block = freezePreferenceSnapshot(next, renderPreferencesFromState(state, exposureTarget(next, 'system')));
+            saveContextExposureState(nodeId, next);
+            replaceContextExposureState(contextExposure, next);
         }
+        if (block === '')
+            return;
+        const idx = event.systemPrompt.indexOf(TOOLS_ANCHOR);
+        if (idx === -1)
+            return { systemPrompt: `${event.systemPrompt}\n\n${block}` };
+        return {
+            systemPrompt: `${event.systemPrompt.slice(0, idx)}\n\n${block}${event.systemPrompt.slice(idx)}`,
+        };
     });
-    // 2. EVENT half — augment a non-error `read` with docs matched by the read
-    //    file, and a non-error `bash` with docs matched by the command string.
     pi.on('tool_result', async (event, ctx) => {
-        try {
-            if (event.isError === true)
-                return;
-            let injected;
-            if (event.toolName === 'read') {
-                const input = event.input;
-                const rawPath = input?.path ?? input?.file_path;
-                if (rawPath === undefined || rawPath === '')
-                    return;
-                // Resolve to an absolute path (renderOnReadDocsForSubject realpaths it).
-                // pi's read tool expands a leading `~`, but event.input keeps the raw
-                // form, so expand it ourselves before resolving against the session cwd.
-                const cwd = typeof ctx?.cwd === 'string' && ctx.cwd !== '' ? ctx.cwd : process.cwd();
-                const expanded = rawPath.startsWith('~') ? join(homedir(), rawPath.slice(1)) : rawPath;
-                const absFile = resolve(cwd, expanded);
-                const state = await brokerExtensionState(nodeId);
-                // Merge the on-disk set: an out-of-process delivery (the daemon's
-                // warm-spare claim pushes bearings — including workspace-open docs —
-                // into the live session and persists what it delivered) must dedup here
-                // too. Cheap: one tiny JSON read per tool result.
-                mergeInjectedDocs(injectedDocs, loadInjectedDocs(nodeId));
-                injected = renderOnReadDocsForSubject(state.subject, absFile, injectedDocs);
-            }
-            else if (event.toolName === 'bash') {
-                const input = event.input;
-                const command = input?.command;
-                if (typeof command !== 'string' || command.trim() === '')
-                    return;
-                const state = await brokerExtensionState(nodeId);
-                mergeInjectedDocs(injectedDocs, loadInjectedDocs(nodeId));
-                injected = renderOnCommandDocsForSubject(state.subject, command, injectedDocs);
-            }
-            else {
+        if (event.isError === true)
+            return;
+        let readFile = null;
+        let command = null;
+        if (event.toolName === 'read') {
+            const input = event.input;
+            const rawPath = input?.path ?? input?.file_path;
+            if (rawPath === undefined || rawPath === '')
                 return;
-            }
-            if (injected === '')
-                return; // nothing surfaced — pass the result through unchanged
-            // A doc surfaced → the render grew injectedDocs; persist the set so the
-            // dedup survives a later dormancy → revive(resume).
-            saveInjectedDocs(nodeId, injectedDocs);
-            // Fold into any existing auto-loaded-context block from sibling hooks;
-            // otherwise prepend one quiet block ahead of the tool output.
-            const inner = autoLoadedContextInner(injected);
-            if (inner === null)
+            const cwd = typeof ctx?.cwd === 'string' && ctx.cwd !== '' ? ctx.cwd : process.cwd();
+            const expanded = rawPath.startsWith('~') ? join(homedir(), rawPath.slice(1)) : rawPath;
+            readFile = resolve(cwd, expanded);
+        }
+        else if (event.toolName === 'bash') {
+            const input = event.input;
+            if (typeof input?.command !== 'string' || input.command.trim() === '')
                 return;
-            return { content: mergeAutoLoadedContext([inner], event.content) };
+            command = input.command;
         }
-        catch {
-            return; // inert on error — a bug must degrade a tool result, never break it
+        else {
+            return;
         }
+        const state = await brokerExtensionState(nodeId);
+        mergeContextExposureState(contextExposure, loadContextExposureState(nodeId));
+        const next = cloneContextExposureState(contextExposure);
+        const target = exposureTarget(next, 'transcript');
+        const injected = readFile !== null
+            ? renderOnReadDocsForSubject(state.subject, readFile, target)
+            : renderOnCommandDocsForSubject(state.subject, command, target);
+        if (injected === '')
+            return;
+        const inner = autoLoadedContextInner(injected);
+        if (inner === null)
+            throw new Error('substrate renderer returned an invalid auto-loaded context block');
+        saveContextExposureState(nodeId, next);
+        replaceContextExposureState(contextExposure, next);
+        return { content: mergeAutoLoadedContext([inner], event.content) };
     });
 }
 export default registerCanvasDocSubstrate;

package/dist/pi-extensions/canvas-stophook.js

@@ -25,9 +25,8 @@ import { join } from 'node:path';
 import { contextDir, jobDir } from '../core/canvas/paths.js';
 import { markBusy, clearBusy, touchBusy } from '../core/runtime/busy.js';
 import { clearFault } from '../core/runtime/fault.js';
-import { personaDriftFromBrokerState } from '../core/runtime/broker-persona-guidance.js';
 import { clearStopSignals, consumeStopSignals } from '../core/runtime/stop-signals.js';
-import { bindBrokerSession, brokerExtensionState, commitBrokerPersonaAck, relaunchBrokerRoot, settleBroker } from '../core/runtime/broker/daemon-ops.js';
+import { bindBrokerSession, brokerExtensionState, relaunchBrokerRoot, settleBroker } from '../core/runtime/broker/daemon-ops.js';
 import { emitEvent } from '../core/events/emit.js';
 import { activeBackgroundBashJobs } from '../core/bash-jobs.js';
 import { CONTEXT_NUDGE_CUSTOM_TYPE, formatCard } from '../shared/generated-context.js';
@@ -376,6 +375,7 @@ export function registerCanvasStophook(pi) {
                         fields: { operation: 'relaunch_root' },
                     });
                 });
+                return;
             }
         }
         catch (error) {
@@ -584,7 +584,8 @@ export function registerCanvasStophook(pi) {
         // is a ~2-token uncached delta each turn), so the bands were unreachable and
         // the nudge never fired.
         try {
-            const node = (await brokerExtensionState(nodeId)).node;
+            const state = await brokerExtensionState(nodeId);
+            const node = state.node;
             const at = contextTokens !== null ? steerBand(contextTokens) : null;
             if (at !== null && !firedBands.has(at)) {
                 firedBands.add(at);
@@ -596,17 +597,9 @@ export function registerCanvasStophook(pi) {
                     pi.sendMessage({ customType: CONTEXT_NUDGE_CUSTOM_TYPE, content: note, display: true }, { deliverAs: 'nextTurn' });
                 }
             }
-            // Persona-transition steering. The daemon read snapshots both the
-            // expected ack and current persona; its guarded ack below can only commit
-            // exactly the transition this broker just described.
-            const drift = personaDriftFromBrokerState(node);
-            if (drift !== null) {
-                pi.sendUserMessage(formatCard('persona-transition', {}, drift.guidance), { deliverAs: 'steer' });
-                await commitBrokerPersonaAck(nodeId, { from: drift.from, to: drift.to });
-            }
         }
-        catch {
-            /* steering is best-effort */
+        catch (error) {
+            emitDaemonOperationFailure('turn_boundary', error);
         }
     });
     // Pi may emit several agent_end attempts while it compacts, retries, and

package/dist/shared/generated-context.d.ts

@@ -6,8 +6,6 @@ export declare const SITUATIONAL_CONTEXT_CUSTOM_TYPE = "crtr-situational-context
 export declare const CONTEXT_NUDGE_CUSTOM_TYPE = "crtr-context-nudge";
 /** Custom message that opens a review companion's visible transcript. */
 export declare const REVIEW_BOUNDARY_CUSTOM_TYPE = "crtr-review-boundary";
-/** Opening text of a pre-envelope fresh-revive kickoff user message. */
-export declare const REVIVE_KICKOFF_SENTINEL = "You have been revived fresh after a context refresh";
 /** Generic completion mandate issued by the terminal-node stop guard. */
 export declare const STALL_REPROMPT: string;
 /** Static recovery prompts shared by the broker producer and display classifier. */
@@ -69,4 +67,3 @@ export declare function formatDataCard(kind: string, facts: Record<string, strin
 export declare function parseCard(message: GeneratedContextMessageLike): GeneratedCard | null;
 /** Format a complete inbox card from report bodies resolved by the caller. */
 export declare function formatInboxCard(sections: readonly InboxCardSection[]): string;
-export declare function isLegacyRuntimeText(text: string): boolean;

package/dist/shared/generated-context.js

@@ -10,8 +10,6 @@ export const SITUATIONAL_CONTEXT_CUSTOM_TYPE = 'crtr-situational-context';
 export const CONTEXT_NUDGE_CUSTOM_TYPE = 'crtr-context-nudge';
 /** Custom message that opens a review companion's visible transcript. */
 export const REVIEW_BOUNDARY_CUSTOM_TYPE = 'crtr-review-boundary';
-/** Opening text of a pre-envelope fresh-revive kickoff user message. */
-export const REVIVE_KICKOFF_SENTINEL = 'You have been revived fresh after a context refresh';
 /** Generic completion mandate issued by the terminal-node stop guard. */
 export const STALL_REPROMPT = "You've stopped but you're not waiting on anyone and haven't finished. " +
     "Pipe the result to `crtr push final` through a single-quoted heredoc if the work is done, or use `crtr human send` if you are blocked or need the user.";
@@ -212,58 +210,3 @@ export function formatInboxCard(sections) {
     }).join('\n');
     return formatCard('inbox', {}, body);
 }
-// LEGACY — landed 2026-08-14. Pre-envelope runtime text, kept ONLY so old
-// scrollback is not attributed to the person. Delete this section and its
-// callers one week after that date; after deletion, pre-cut scrollback
-// misattributes and that cost is accepted.
-const LEGACY_RESTART_CONTINUATION = '<runtime-restart-continuation>\ncontinue\n</runtime-restart-continuation>';
-const CONTEXT_NUDGE_PREFIX = '[crtr] Context ~';
-const PERSONA_TRANSITION_OPEN = '<persona-transition>';
-const PERSONA_TRANSITION_CLOSE = '</persona-transition>';
-const INBOX_SENDER_ID = '[a-z0-9]+(?:-[a-z0-9]+)+';
-const INBOX_HEADER_RE = new RegExp(`^From (?:(.+?) \\[(${INBOX_SENDER_ID})\\]|(${INBOX_SENDER_ID}|system|human|crtrd)) — (\\d+) update`, 'm');
-function isPersonaTransition(body) {
-    return body.startsWith(`${PERSONA_TRANSITION_OPEN}\n`) && body.endsWith(`\n${PERSONA_TRANSITION_CLOSE}`);
-}
-function isReviewApproval(body) {
-    return body.startsWith(`${REVIEW_APPROVAL_OPEN}\n`) && body.endsWith(`\n${REVIEW_APPROVAL_CLOSE}`);
-}
-function isStructuredOutputReprompt(body) {
-    if (!body.startsWith(STRUCTURED_OUTPUT_REPROMPT_PREFIX) || !body.endsWith(STRUCTURED_OUTPUT_REPROMPT_SUFFIX)) {
-        return false;
-    }
-    const schema = body.slice(STRUCTURED_OUTPUT_REPROMPT_PREFIX.length, -STRUCTURED_OUTPUT_REPROMPT_SUFFIX.length);
-    try {
-        JSON.parse(schema);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-const MODEL_CREDENTIAL_RECOVERY_RE = /^The previous model \([^\n]+\) had no usable provider credential, so you were automatically switched to [^\n]+\. Continue the task from where the failed turn left off\.$/;
-const MODEL_NOT_FOUND_RECOVERY_RE = /^The previous model \([^\n]+\) was unavailable \(provider 404 not_found\), so you were automatically switched to [^\n]+\. Continue the task from where the failed turn left off\.$/;
-function isModelFallbackRecovery(body) {
-    if (!body.startsWith(`${MODEL_FALLBACK_RECOVERY_OPEN}\n`) || !body.endsWith(`\n${MODEL_FALLBACK_RECOVERY_CLOSE}`)) {
-        return false;
-    }
-    const guidance = body.slice(MODEL_FALLBACK_RECOVERY_OPEN.length + 1, -(MODEL_FALLBACK_RECOVERY_CLOSE.length + 1));
-    return MODEL_CREDENTIAL_RECOVERY_RE.test(guidance) || MODEL_NOT_FOUND_RECOVERY_RE.test(guidance);
-}
-function isRecoveryBody(body) {
-    return body === AUTH_FAULT_RECOVERY_BODY
-        || body === CONNECTION_FAULT_RECOVERY_BODY
-        || body === PROVIDER_FAULT_RECOVERY_BODY
-        || body === LEGACY_RESTART_CONTINUATION
-        || isModelFallbackRecovery(body);
-}
-export function isLegacyRuntimeText(text) {
-    return text.startsWith(REVIVE_KICKOFF_SENTINEL)
-        || text.startsWith(CONTEXT_NUDGE_PREFIX)
-        || INBOX_HEADER_RE.test(text)
-        || isReviewApproval(text)
-        || isPersonaTransition(text)
-        || text === STALL_REPROMPT
-        || isStructuredOutputReprompt(text)
-        || isRecoveryBody(text);
-}

package/dist/shared/tool-groups.js

@@ -1,7 +1,7 @@
 // Shared transcript-boundary rules for broker-owned tool-group summaries.
 // Keep this independent of renderer state: both live event tracking and snapshot
 // reconstruction must agree on which prose closes a run of tools.
-import { generatedContextText, isLegacyRuntimeText, parseCard } from './generated-context.js';
+import { generatedContextText, parseCard } from './generated-context.js';
 /** Card kinds that close a run of tools instead of joining one. The broker
  * segments and the viewer folds on the same seams, so this one answer is shared;
  * everything else about a card is the display's own business. */
@@ -60,6 +60,5 @@ export function assistantVisibleText(message) {
 /** A person-authored user message closes the preceding group. Runtime-generated
  * user context retains role=user for delivery semantics but is not human prose. */
 export function isTrueUserMessage(message) {
-    const text = generatedContextText(message);
-    return message.role === 'user' && parseCard(message) === null && !isLegacyRuntimeText(text);
+    return message.role === 'user' && parseCard(message) === null;
 }

package/dist/types.d.ts

@@ -62,7 +62,7 @@ export interface PluginManifest {
     source?: string;
     owner?: OwnerRef;
     /** Kind-registry contributions, keyed by full kind string (top-level e.g.
-     *  `applet-builder`, or sub-kind e.g. `plan/reviewers/security`). Each entry
+     *  `applet-builder`, or sub-kind e.g. `audit/security`). Each entry
      *  is any subset of `KindConfig` fields: it FIELD-MERGES over a kind a lower
      *  layer already defines (`whenToUse` included — overriding just the spawn
      *  guidance never strips the kind's model tier), and defines a NEW kind when
@@ -202,14 +202,14 @@ export interface ModelRoutingConfig {
     strengthFallback?: ModelStrength[];
 }
 /** Launch metadata for one kind (a top-level kind like `developer`, or a full
- *  sub-kind string like `plan/reviewers/security`) — the settings-file
+ *  sub-kind string like `audit/security`) — the settings-file
  *  replacement for per-kind persona frontmatter. `model`/`tools`/`extensions`
  *  are launch knobs consumed by `buildLaunchSpec`; `whenToUse` is the
  *  one-line gloss shown in `node new -h` / `node promote -h`. `availableTo` is
  *  VISIBILITY-ONLY (never launch validation): the list of top-level kind names
  *  whose spawn menus surface this sub-kind, `'*'` meaning every kind; omitted
  *  defaults to the sub-kind's own top-level ancestor (e.g.
- *  `plan/reviewers/security` defaults to `['plan']`). A direct launch by full kind
+ *  `audit/security` defaults to `['audit']`). A direct launch by full kind
  *  string is always valid regardless of `availableTo`. */
 export interface KindConfig {
     model?: string;
@@ -320,7 +320,7 @@ export interface ScopeConfig {
     modelRouting?: ModelRoutingConfig;
     /** The kind registry (spec §1.5): kind existence + launch knobs, keyed by
      *  full kind string (top-level e.g. `developer`, or sub-kind e.g.
-     *  `plan/reviewers/security`). Builtins ship a default registry via
+     *  `audit/security`). Builtins ship a default registry via
      *  `defaultScopeConfig()`; user/project `config.json` adds or shadows
      *  entries at the same scope precedence as the rest of `ScopeConfig`. */
     kinds: Record<string, KindConfig>;
@@ -483,13 +483,10 @@ export declare function defaultScopeConfig(): ScopeConfig;
 /** No remote canvas targets are configured out of the box — every one is
  *  registered via `crtr canvas config add` (see `RemoteCanvasConfig`). */
 export declare function defaultRemoteCanvasConfig(): RemoteCanvasConfig;
-/** The builtin kind registry (spec §1.5): the built-in defaults for every
- *  top-level kind and its sub-persona kinds. `whenToUse`/`model` are the
- *  base-worker defaults; `orchestratorModel` optionally raises the default
- *  for a coordinating persona. Roadmap-shaping guidance is orchestrator-only —
- *  an orchestrator-gated memory doc keyed to the kind, not baked into the
- *  registry entry. Sub-persona `availableTo` is omitted where it only
- *  reproduces the default (its own top-level ancestor). */
+/** The builtin kind registry (spec §1.5): core role discovery and launch
+ *  defaults. `whenToUse`/`model` are the base-worker defaults;
+ *  `orchestratorModel` optionally raises the default for a coordinating
+ *  persona. Optional plugins contribute their own specialist sub-personas. */
 export declare function defaultKindsConfig(): Record<string, KindConfig>;
 export declare function defaultModelLaddersConfig(): ModelLaddersConfig;
 export declare function defaultScopeState(): ScopeState;

package/dist/types.js

@@ -111,13 +111,10 @@ export function defaultScopeConfig() {
 export function defaultRemoteCanvasConfig() {
     return { targets: {} };
 }
-/** The builtin kind registry (spec §1.5): the built-in defaults for every
- *  top-level kind and its sub-persona kinds. `whenToUse`/`model` are the
- *  base-worker defaults; `orchestratorModel` optionally raises the default
- *  for a coordinating persona. Roadmap-shaping guidance is orchestrator-only —
- *  an orchestrator-gated memory doc keyed to the kind, not baked into the
- *  registry entry. Sub-persona `availableTo` is omitted where it only
- *  reproduces the default (its own top-level ancestor). */
+/** The builtin kind registry (spec §1.5): core role discovery and launch
+ *  defaults. `whenToUse`/`model` are the base-worker defaults;
+ *  `orchestratorModel` optionally raises the default for a coordinating
+ *  persona. Optional plugins contribute their own specialist sub-personas. */
 export function defaultKindsConfig() {
     return {
         general: {
@@ -156,34 +153,10 @@ export function defaultKindsConfig() {
             whenToUse: 'Debug failures, investigate why something is broken or misbehaving, diagnose live/runtime issues, or give engineering advice and second opinions — reason from evidence and recommend the next move. Use advisor (not explore) whenever the task is to find out what is going wrong.',
             model: 'anthropic/strong',
         },
-        'plan/reviewers/requirements-coverage': {
-            whenToUse: 'every requirement and design constraint maps to a concrete plan task, classified Covered/Partial/Missing; flags only blocking gaps',
-            model: 'medium',
-        },
-        'plan/reviewers/pattern-consistency': {
-            whenToUse: "the plan honors the codebase's real conventions; reads actual source and cites the pattern each finding deviates from; owns contract-level conflicts between parts",
-            model: 'medium',
-        },
-        'plan/reviewers/code-smells': {
-            whenToUse: 'nullability mismatches, type conflicts across parts, hidden N+1s, over-fetching, missing error boundaries, leaky abstractions; owns file-level conflicts between parts',
-            model: 'medium',
-        },
-        'plan/reviewers/security': {
-            whenToUse: 'input validation, injection surfaces, auth/authz gaps, data exposure, races; reports only validated concrete exploit paths and asks the user about material unknown threat-model assumptions',
-            model: 'medium',
-        },
         'review/companion': {
             whenToUse: 'Born by the daemon for one human review; never spawned by an agent.',
             availableTo: [],
         },
-        'plan/reviewers/architecture-fit': {
-            whenToUse: "proposed files/modules/abstractions fit the system's existing decomposition; flags new units that duplicate existing ones or cross layer boundaries",
-            model: 'medium',
-        },
-        'spec/requirements': {
-            whenToUse: 'Derive testable EARS requirements from a finished, approved design — in isolation, from the rendered design text alone.',
-            model: 'medium',
-        },
     };
 }
 export function defaultModelLaddersConfig() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.227",
+  "version": "0.3.229",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -81,10 +81,11 @@
     "dev": "tsx --conditions=crtr-src src/cli.ts",
     "link": "npm link",
     "prepublishOnly": "npm run build",
-    "test": "node --conditions=crtr-src --import tsx/esm --test --test-concurrency=4 --test-timeout=10000 'src/**/__tests__/*.test.ts'",
-    "test:serial": "node --conditions=crtr-src --import tsx/esm --test --test-concurrency=1 --test-timeout=60000 'src/**/__tests__/serial/*.test.ts'",
+    "test": "node --conditions=crtr-src --import tsx/esm --test --test-force-exit --test-concurrency=$(node -p 'Math.max(4, require(`node:os`).availableParallelism() - 1)') --test-timeout=10000 'src/**/__tests__/*.test.ts'",
+    "test:integration": "node --conditions=crtr-src --import tsx/esm --test --test-concurrency=$(node -p 'Math.min(8, Math.max(2, require(`node:os`).availableParallelism() - 1))') --test-timeout=60000 'src/**/__tests__/integration/*.test.ts'",
     "test:seam": "npm run build && npm run test:seam:built",
-    "test:seam:built": "node --test --test-concurrency=2 --test-timeout=180000 'dist/**/__tests__/seam/*.test.js'"
+    "test:seam:built": "node --test --test-concurrency=4 --test-timeout=180000 'dist/**/__tests__/seam/*.test.js'",
+    "test:all": "npm test && npm run test:integration && npm run test:seam"
   },
   "overrides": {
     "@earendil-works/pi-ai": "0.84.1",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.227",
+  "version": "0.3.229",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.227",
+      "version": "0.3.229",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/dist/builtin-memory/05-kinds/design/00-base.md

@@ -1,17 +0,0 @@
----
-kind: preference
-when-and-why-to-read: When a node is spawned as kind design in base mode, this preference should be read so implementers inherit one coherent architecture instead of reopening load-bearing decisions.
-gate: {kind: design, mode: base}
-rationale: >-
-  senior-engineer architecture thinking — cross-service, high-level decisions (performance, db design, patterns) worked out interactively with the user, deliberately not taking the most obvious solution. Distinct from plan, which is a crutch for model intelligence (steps a dumber model can mindlessly execute); design decides how it SHOULD be put together. Schema/key-field definitions belong; verbatim controller code does not, unless naming a template pattern others will replicate.
-surfaces:
-  - on: boot
-    at: content
----
-
-## When designing a bounded system
-You are a design agent. Given a bounded design task — a component, subsystem, or interaction surface — you produce one design document an implementer can build from without re-deciding anything you left open. That, not emitting a document, is the bar for done. When a decision turns on judgment the user should own — a performance tradeoff, a data-model shape, which pattern to adopt — work it out with them via `crtr human send` rather than picking the obvious option alone, because the obvious option is usually not the right one.
-
-Read your task for the scope, the constraints, and the interface contracts you must honor. Write the design to `design-<subject>.md` in your context dir, in the standard shape: Context & constraints, Architecture (lead with a diagram, then prose), Components & responsibilities, Interfaces & contracts, Data model, Key flows, Decisions, Open risks. Two things make it a design rather than a description: every decision that closes a real option is captured in Decisions with the alternatives you rejected and why — resolve the choice, never hand the implementer a branch to pick; and every interface is concrete enough that both sides can build to it without negotiating.
-
-Deliver the design file path plus a tight summary — one sentence per decision, what was chosen and what it closed off. Promote into a design orchestrator only when settled boundaries expose independent design surfaces; tightly coupled architecture stays base across yields so one mind owns its coherence.

package/dist/builtin-memory/05-kinds/design/01-orchestrator.md

@@ -1,15 +0,0 @@
----
-kind: preference
-when-and-why-to-read: When a node is spawned as kind design in orchestrator mode, this preference should be read so parallel sub-designs compose across their interfaces instead of producing a fragmented or contradictory architecture.
-gate: {kind: design, mode: orchestrator}
-surfaces:
-  - on: boot
-    at: content
----
-
-## Coordinating a design effort
-You are a **design orchestrator** — you own a design effort whose independent surfaces make parallel design worthwhile, and you deliver one coherent result by delegating each bounded sub-design to a `design` child and integrating what returns into a unified artifact.
-
-Before you shape the roadmap, read `crtr memory read design/roadmap` for the decomposition discipline. Your first act after reading it is to define the shared interface contracts between the sub-designs and write them to `design-contracts.md` in your context dir before any child starts — those contracts are the seams that let parallel sub-designs compose instead of collide. Each child gets the overall architecture framing, the contracts doc, and the explicit scope of its piece.
-
-Integration is the work, not a formality: read every sub-design, verify each contract is honored on *both* sides, reconcile the inconsistencies that only surface with the whole picture loaded, and synthesize a single document that reads as one voice — not a concatenation of pieces with the decision rationale lost between them. The design is done only when an implementer could build any piece from it without discovering that two pieces disagree.

package/dist/builtin-memory/05-kinds/design/design-contract.md

@@ -1,19 +0,0 @@
----
-kind: preference
-when-and-why-to-read: When a node is spawned as kind design, this preference should be read so the design closes the expensive decisions at the right altitude instead of drifting into implementation or over-specifying what the implementer could safely decide.
-gate: {kind: design}
-rationale: >-
-  The design personas described how to write the artifact but routed to no design guidance, so a base design node booted with no altitude rule and no bound on over-specification. Gates on the kind with no mode so design orchestrators load it too. Carries the contract only — the artifact shape and the decomposition decision stay in the docs it points at.
-surfaces:
-  - on: boot
-    at: content
----
-
-## What a design must settle
-A design fixes the load-bearing structure before anyone writes code: component boundaries and responsibilities, interface contracts and data models, key flows, and the decisions that close real options with their rationale and rejected alternatives.
-
-It is not requirements — those state the behavior the system must satisfy, while the design states how it is structured to produce that behavior. It is not a plan — plans order implementation work against the design. The altitude ceiling: a planner reading the design has no design questions left, and a coder reading it still has implementation choices to make. No function bodies, no algorithm walkthroughs, no library calls, no ordering of implementation steps; anything that could be pasted into source belongs downstream.
-
-Design enough to unblock parallelism and close the decisions that are expensive to reverse, and no further. Over-specification is as harmful as under-specification — it creates brittleness and deferred rework when reality does not match the paper — so leave the implementer what they can decide without risk. Name a genuinely unclear sub-section that is off the critical path as open rather than filling it with a plausible guess.
-
-Read `crtr memory read design/guide` for what each section of the artifact must contain and the top-down versus bottom-up call.

package/dist/builtin-memory/05-kinds/developer/00-base.md

@@ -1,17 +0,0 @@
----
-kind: preference
-when-and-why-to-read: When a node is spawned as kind developer in base mode, this preference should be read so implementation is proven against the requested behavior rather than declared done at compile time.
-gate: {kind: developer, mode: base}
-rationale: >-
-  Agents treated polish as a completion dependency, spending long iterations on nits while their parents could not advance the larger build. The developer needs to prove and report the first sound end-to-end path early, while retaining its existing done-bar for the final result. External critique works because agents can't self-audit; the reviewer must be primed neutrally — "review this", never "find what fails", which biases toward false positives.
-surfaces:
-  - on: boot
-    at: content
----
-
-## When implementing
-Work directly. Read the relevant files before editing, match the existing code style and module conventions, and keep your delegation shallow — a focused exploration or a review pass is worth handing off, but most of the work is yours. Throw errors early; no silent fallbacks. Break things correctly rather than patching them badly. Compatibility is governed by the approved spec or migration decision.
-
-Done means **provably correct against the spec's acceptance criteria** — not "it builds," not "the tests pass." Green output proves the code ran, not that it does what was asked; check the result against each acceptance criterion yourself. On a load-bearing change, get it critiqued by something other than you before calling it done — spawn a reviewer on the diff and fold in what it finds. Every Critical, Major, or acceptance-violating finding is fixed, always — keep the fix net-neutral-or-simpler, never bolt on complexity to patch it. A Minor or cosmetic finding that doesn't affect acceptance is fixed when the fix is net-neutral-or-simpler, or else closed with a one-line reason — closing is a resolution, not a deferral. But validate judiciously: a delegate's green report is settled evidence — don't re-run a suite or re-read a diff that already cleared its gate; check only what changed since. Promote into a developer orchestrator only when the change splits into genuinely independent implementation lanes; a long or tightly coupled build stays base across yields.
-
-When a working steel thread proves the task's end-to-end path and the remaining work cannot change its interface or acceptance outcome, report that readiness before polishing — name what is proven, what remains, and that whoever waits on this gate may advance. Then use judgment: finish net-simple polish in this window, but do not let nits or other non-blocking refinements hold the larger build. The final result still clears the full done-bar.

package/dist/builtin-memory/05-kinds/developer/01-orchestrator.md

@@ -1,15 +0,0 @@
----
-kind: preference
-when-and-why-to-read: When a node is spawned as kind developer in orchestrator mode, this preference should be read so feature-sized builds move coherently from implementation through independent review and end-to-end validation.
-gate: {kind: developer, mode: orchestrator}
-rationale: >-
-  Developer orchestrators need fact-dependent decisions sequenced behind shared evidence without blocking independent work. They also turned post-implementation “lenses” into mandatory parallel reviewers and then sought a fresh PASS after fixes, helping review dominate the canvas; one independent review assignment must own all relevant lenses, and changed behavior closes through evidence.
-surfaces:
-  - on: boot
-    at: content
----
-
-## When shaping a software roadmap
-Before you shape a software roadmap, read `crtr memory read development` for development styles, roadmap shapes, and exit criteria that fit the goal's risk.
-
-Treat implementation as complete only when it is **provably correct against the spec's acceptance criteria**, not merely when it compiles.