@north-light/crouter 0.3.231 → 0.3.233

package/dist/daemon/api/__tests__/profile-metadata-route.test.js

@@ -0,0 +1,92 @@
+import { after, afterEach, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { routes } from '../../../api/index.js';
+import { CrtrError } from '../../../core/errors.js';
+import { closeDb } from '../../../core/canvas/db.js';
+import { createProfile, loadProfileManifest } from '../../../core/profiles/manifest.js';
+import { resetScopeCache } from '../../../core/scope.js';
+import { profileRoutes } from '../handlers/profiles.js';
+const previousCrtrHome = process.env['CRTR_HOME'];
+const previousHome = process.env.HOME;
+let home = '';
+beforeEach(() => {
+    closeDb();
+    home = mkdtempSync(join(tmpdir(), 'crtr-profile-metadata-home-'));
+    process.env.HOME = home;
+    process.env['CRTR_HOME'] = join(home, 'canvas');
+    resetScopeCache();
+});
+afterEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+});
+after(() => {
+    if (previousHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = previousHome;
+    if (previousCrtrHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = previousCrtrHome;
+    resetScopeCache();
+});
+function route(method, pattern) {
+    const found = profileRoutes.find((entry) => entry.method === method && entry.pattern === pattern);
+    assert.ok(found, `missing ${method} ${pattern} route`);
+    return found;
+}
+function context(params, body) {
+    return {
+        method: 'PATCH',
+        path: routes.profileMetadata(params['name']),
+        params,
+        query: new URLSearchParams(),
+        body,
+    };
+}
+async function invoke(entry, ctx) {
+    return entry.handler(ctx);
+}
+test('PATCH metadata updates an existing profile and GET returns the opaque value', async () => {
+    const profile = createProfile('worker profile');
+    assert.deepEqual(loadProfileManifest(profile.profileId).manifest.metadata, undefined);
+    const patch = route('PATCH', '/v1/profiles/:name/metadata');
+    const patched = await invoke(patch, context({ name: profile.manifest.name }, {
+        set: { northlight_default_node_id: 'nlw-applet-42' },
+    }));
+    assert.equal(patched.status, 200);
+    assert.deepEqual(patched.body.metadata, {
+        northlight_default_node_id: 'nlw-applet-42',
+    });
+    const get = route('GET', '/v1/profiles/:name');
+    const read = await invoke(get, context({ name: profile.manifest.name }, undefined));
+    assert.deepEqual(read.body.metadata, {
+        northlight_default_node_id: 'nlw-applet-42',
+    });
+});
+test('PATCH metadata rejects an unknown profile and invalid metadata keys', async () => {
+    const patch = route('PATCH', '/v1/profiles/:name/metadata');
+    await assert.rejects(() => invoke(patch, context({ name: 'missing-profile' }, { set: { role: 'worker' } })), (error) => error instanceof CrtrError && error.code === 'not_found');
+    const profile = createProfile('metadata validation');
+    await assert.rejects(() => invoke(patch, context({ name: profile.manifest.name }, { set: { 'not a key': 'value' } })), (error) => error instanceof CrtrError && error.code === 'usage');
+    assert.deepEqual(loadProfileManifest(profile.profileId).manifest.metadata, undefined);
+});
+test('PUT remains create-only after a metadata PATCH', async () => {
+    const profile = createProfile('create-only profile');
+    const patch = route('PATCH', '/v1/profiles/:name/metadata');
+    await invoke(patch, context({ name: profile.manifest.name }, { set: { role: 'worker' } }));
+    const ensure = route('PUT', '/v1/profiles/:name');
+    const result = await invoke(ensure, {
+        ...context({ name: profile.manifest.name }, { metadata: { role: 'changed' } }),
+        method: 'PUT',
+        path: routes.profile(profile.manifest.name),
+    });
+    assert.deepEqual(result.body.metadata, {
+        role: 'worker',
+    });
+});

package/dist/daemon/api/__tests__/reopen-delivery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/api/__tests__/reopen-delivery.test.js

@@ -0,0 +1,173 @@
+import { after, before, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { createNode, getNode, openDb } from '../../../core/canvas/index.js';
+import { closeDb } from '../../../core/canvas/db.js';
+import { viewSocketPath } from '../../../core/canvas/paths.js';
+import { readInboxSince } from '../../../core/feed/inbox.js';
+import { headlessBrokerHost } from '../../../core/runtime/host.js';
+import { messageRoutes } from '../handlers/messages.js';
+let home;
+const priorHome = process.env['CRTR_HOME'];
+before(() => {
+    // macOS limits Unix-socket paths to 104 bytes; the system temp directory's
+    // per-user prefix is already most of that budget.
+    home = mkdtempSync('/tmp/crtr-reopen-');
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    if (priorHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = priorHome;
+});
+function node(id, lifecycle, status, piPid) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp',
+        kind: 'general',
+        mode: 'base',
+        lifecycle,
+        status,
+        ...(piPid !== undefined ? { pi_pid: piPid } : {}),
+    };
+}
+function finalize(id) {
+    openDb()
+        .prepare("UPDATE nodes SET final_report = ?, finalized_at = ? WHERE node_id = ?")
+        .run('final.md', new Date().toISOString(), id);
+}
+async function sendMessage(id, body) {
+    const ctx = {
+        method: 'POST',
+        path: `/v1/nodes/${id}/messages`,
+        params: { id },
+        query: new URLSearchParams(),
+        body,
+    };
+    return messageRoutes[0].handler(ctx);
+}
+async function startLiveBroker(id, failDelivery = false) {
+    let observed = null;
+    const server = createServer((socket) => {
+        let pending = '';
+        socket.on('data', (chunk) => {
+            pending += chunk.toString('utf8');
+            let newline = pending.indexOf('\n');
+            while (newline !== -1) {
+                const line = pending.slice(0, newline);
+                pending = pending.slice(newline + 1);
+                const frame = JSON.parse(line);
+                if (frame.type === 'deliver') {
+                    observed = getNode(id);
+                    socket.write(`${JSON.stringify({
+                        type: 'ack',
+                        for: 'deliver',
+                        id: frame.id,
+                        ok: !failDelivery,
+                        detail: failDelivery ? 'forced delivery failure' : 'prompt',
+                    })}\n`);
+                }
+                newline = pending.indexOf('\n');
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(viewSocketPath(id), resolve);
+    });
+    return {
+        close: () => closeServer(server),
+        deliveryState: () => observed,
+    };
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => server.close((err) => (err === undefined ? resolve() : reject(err))));
+}
+function assertReopened(id) {
+    const meta = getNode(id);
+    assert.equal(meta?.lifecycle, 'resident');
+    assert.equal(meta?.final_report, null);
+}
+test('reopen makes live terminal, finalized terminal, and parked targets resident and unlatched before delivery', async () => {
+    const liveId = 'live-terminal';
+    createNode(node(liveId, 'terminal', 'active', process.pid));
+    const liveBroker = await startLiveBroker(liveId);
+    try {
+        const result = await sendMessage(liveId, { body: 'continue live work', reopen: true, delivery: 'interactive' });
+        assert.equal(result.body.delivered_via, 'engine');
+        assertReopened(liveId);
+        assert.equal(liveBroker.deliveryState()?.lifecycle, 'resident', 'engine delivery sees resident lifecycle');
+        assert.equal(liveBroker.deliveryState()?.final_report, null, 'engine delivery sees no final latch');
+        assert.equal(readInboxSince(liveId).length, 0, 'live delivery does not append an inbox entry');
+    }
+    finally {
+        await liveBroker.close();
+    }
+    const originalLaunch = headlessBrokerHost.launch;
+    headlessBrokerHost.launch = (() => ({ pid: 0x7ffffffe, exited: Promise.resolve({ code: 0, signal: null }) }));
+    try {
+        const finalizedId = 'finalized-terminal';
+        createNode(node(finalizedId, 'terminal', 'done'));
+        finalize(finalizedId);
+        await sendMessage(finalizedId, { body: 'new mandate', reopen: true });
+        assertReopened(finalizedId);
+        assert.equal(readInboxSince(finalizedId).length, 1, 'finalized target receives its durable message after reopening');
+        const parkedId = 'parked-resident';
+        createNode(node(parkedId, 'resident', 'done'));
+        await sendMessage(parkedId, { body: 'resume the parked session', reopen: true });
+        assertReopened(parkedId);
+        assert.equal(readInboxSince(parkedId).length, 1, 'parked target receives its durable message after reopening');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+    }
+});
+test('a reopen commit failure delivers nothing', async () => {
+    const id = 'commit-failure';
+    createNode(node(id, 'terminal', 'done'));
+    finalize(id);
+    const finalReport = getNode(id)?.final_report;
+    openDb().exec(`
+    CREATE TRIGGER fail_reopen_latch_clear
+    BEFORE UPDATE OF final_report ON nodes
+    WHEN NEW.final_report IS NULL
+    BEGIN
+      SELECT RAISE(FAIL, 'forced reopen failure');
+    END;
+  `);
+    try {
+        await assert.rejects(() => sendMessage(id, { body: 'must not deliver', reopen: true }), /forced reopen failure/);
+    }
+    finally {
+        openDb().exec('DROP TRIGGER IF EXISTS fail_reopen_latch_clear');
+    }
+    assert.equal(getNode(id)?.lifecycle, 'resident', 'lifecycle commit precedes the failed latch CAS');
+    assert.equal(getNode(id)?.final_report, finalReport, 'a failed CAS preserves the canonical-final pointer');
+    assert.equal(readInboxSince(id).length, 0, 'no inbox entry precedes a failed reopen commit');
+});
+test('a delivery failure after reopen leaves the target resident, unlatched, and without a message', async () => {
+    const id = 'delivery-failure';
+    createNode(node(id, 'terminal', 'done', process.pid));
+    finalize(id);
+    const broker = await startLiveBroker(id, true);
+    try {
+        await assert.rejects(() => sendMessage(id, { body: 'broker rejects this', reopen: true, delivery: 'interactive' }), /forced delivery failure/);
+        assertReopened(id);
+        assert.equal(broker.deliveryState()?.lifecycle, 'resident', 'failed engine delivery happened after reopen committed');
+        assert.equal(broker.deliveryState()?.final_report, null, 'failed engine delivery saw the cleared latch');
+        assert.equal(readInboxSince(id).length, 0, 'failed engine delivery creates no durable fallback message');
+    }
+    finally {
+        await broker.close();
+    }
+});

package/dist/daemon/api/handlers/broker-ops.js

@@ -16,6 +16,8 @@ import { evaluateStop } from '../../../core/runtime/stop-guard.js';
 import { clearFault } from '../../../core/runtime/fault.js';
 import { updateModelRecipe } from '../../../core/runtime/model-swap.js';
 import { completeCompanionRequestedSubmit } from '../../review/finish.js';
+import { consumePendingPark } from '../../park-pending.js';
+import { parkEvent } from '../../reconcilers/live-obligation.js';
 function objectBody(body, operation) {
     if (typeof body !== 'object' || body === null || Array.isArray(body)) {
         throw usage(`${operation} requires a JSON body`);
@@ -229,6 +231,11 @@ function hasUnseenNonDeferredInbox(nodeId) {
  * boundary. This handler intentionally never invokes the broker that called it:
  * the returned directive is the only Pi-side consequence. */
 function settleBroker(nodeId, request) {
+    // A parking turn in flight ends HERE, whatever it ended as. Consuming
+    // unconditionally is the abort rule expressed once: every early return below
+    // — clean quit, pushed final, human ask, interrupted turn, refresh — discards
+    // the park and leaves the node live under a restarted clock.
+    const parkPending = consumePendingPark(nodeId);
     const node = getNode(nodeId);
     if (node === null) {
         // A command may have recorded its Pi-local completion marker just as an
@@ -274,6 +281,20 @@ function settleBroker(nodeId, request) {
         clearFault(nodeId);
         return { action: 'shutdown' };
     }
+    // The parking turn just ended. Re-evaluate the verdict the clock reached
+    // before this turn ran: a `crtr human send`, new wake-worthy mail, a fresh
+    // subscription to a child it spawned, or a pending structured-output request
+    // all make the node live work again, and the ordinary stop policy applies
+    // instead. `pushedFinal` was checked above, so a node that finished during
+    // its parking turn ends latched rather than parked.
+    if (parkPending && parkEvent(nodeId, node.lifecycle) === 'park') {
+        clearFault(nodeId);
+        transition(nodeId, 'park');
+        if (focusOf(nodeId) !== null)
+            tearDownNode(nodeId);
+        setPresence(nodeId, { pane: null, tmux_session: null, window: null });
+        return { action: 'shutdown' };
+    }
     const decision = evaluateStop(nodeId, signals, request.backgroundJobsRunning);
     clearFault(nodeId);
     if (decision.action === 'reprompt')

package/dist/daemon/api/handlers/canvas.js

@@ -13,6 +13,9 @@ import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { listNodes, nowIso, ticketsAcrossCanvas } from '../../../index.js';
 import { getNode, pruneNodes, pruneToLimit, rebuildIndex, rosterEdges, rosterNodes, subscriptionsOf } from '../../../core/canvas/canvas.js';
+import { activeBackgroundBashJobs } from '../../../core/bash-jobs.js';
+import { contextDir } from '../../../core/canvas/paths.js';
+import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { dashboardRowsAll, enrichRows } from '../../../core/canvas/render.js';
 import { ticketCountsForNodes } from '../../../core/canvas/attention.js';
 import { buildCorpus, resolveRef, } from '../../../core/canvas/history.js';
@@ -26,6 +29,7 @@ function handleAttention() {
             name: t.name,
             cwd: t.cwd,
             count: t.count,
+            subjects: t.subjects,
         })),
     };
     return { status: 200, body };
@@ -273,6 +277,8 @@ function handleSnapshot() {
         return {
             node_id: row.node_id,
             name: row.name,
+            title: meta?.name ?? row.name,
+            description: meta?.description ?? null,
             kind: row.kind,
             mode: row.mode,
             lifecycle: row.lifecycle ?? meta?.lifecycle,
@@ -288,6 +294,10 @@ function handleSnapshot() {
             ...(row.mtimeMs !== undefined ? { last_activity: new Date(row.mtimeMs).toISOString() } : {}),
             ctx_tokens: row.ctx_tokens,
             streaming: row.streaming ?? false,
+            jobs_active: meta !== null && isBrokerLive(meta)
+                ? activeBackgroundBashJobs(contextDir(row.node_id)).length
+                : 0,
+            waiting_for: meta?.waiting_for ?? null,
             hanging: (row.hanging ?? null),
             viewed: row.viewed ?? false,
             final_report: meta?.final_report ?? null,

package/dist/daemon/api/handlers/messages.js

@@ -8,13 +8,12 @@ import { deliverLive, interruptLive } from '../../../core/runtime/interactive-de
 import { cancelPendingHumanMessages } from '../../../core/feed/inbox.js';
 import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { withFreshTerminalGuard } from '../../../core/canvas/canvas.js';
-import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../../../core/runtime/reopen.js';
+import { assertNotFinalized, assertFinalizedForReopen, commitReopen, commitReopenResident, } from '../../../core/runtime/reopen.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { appendSituationalContext, formatSituationalProse } from '../../../core/runtime/situational-context.js';
 import { formatDataCard } from '../../../shared/generated-context.js';
 import { hasNoNaturalCycle } from '../../../core/runtime/revive-all.js';
-import { readGoal } from '../../../core/runtime/kickoff.js';
-import { readRoadmap } from '../../../core/runtime/roadmap.js';
+import { hasFreshGroundState } from '../../../core/runtime/revive.js';
 import { notFound, usage } from '../../../core/errors.js';
 import { InputError } from '../../../core/io.js';
 import { ApiError } from '../../../api/index.js';
@@ -137,8 +136,8 @@ function parseSendBody(body) {
         // Runtime cards ARE accepted here: a card-bearing send is an ordinary human
         // send that happens to carry context, and the live deliver frame places the
         // cards ahead of the body in one turn (D11).
-        if (fresh || out.reopen === true || out.situational_context !== undefined || out.output_schema !== undefined) {
-            throw usage('interactive delivery supports a body and runtime cards only (no fresh, reopen, situational_context, or output_schema)');
+        if (fresh || out.situational_context !== undefined || out.output_schema !== undefined) {
+            throw usage('interactive delivery supports a body, runtime cards, and reopen only (no fresh, situational_context, or output_schema)');
         }
         if (!hasBody)
             throw usage('interactive delivery requires a non-empty body');
@@ -179,11 +178,7 @@ function deferredNoNaturalCycle(id, status) {
  *  would resume amnesiac. Rejected fail-loud (422) BEFORE any revive/arm — the
  *  CLI's old pure pre-check, relocated behind the API so `--fresh` parity holds. */
 function assertRecoverableForFresh(id) {
-    const goal = readGoal(id);
-    if (goal !== null && goal.trim() !== '')
-        return;
-    const roadmap = readRoadmap(id);
-    if (roadmap !== null && roadmap.trim() !== '')
+    if (hasFreshGroundState(id))
         return;
     // ApiError (not a plain literal) so its message survives `toErrorBody`.
     throw new ApiError(422, 'unprocessable', `node ${id} has no goal/roadmap on disk — a fresh revive would resume amnesiac.`);
@@ -236,6 +231,13 @@ async function handleMessage(ctx) {
         };
         return { status: 201, body };
     }
+    // An interactive reopen commits before even choosing its engine-or-inbox
+    // route. A live transport race then falls back with this same committed state.
+    let reopenCommitted = false;
+    if (req.delivery === 'interactive' && req.reopen) {
+        commitReopenResident(id);
+        reopenCommitted = true;
+    }
     // --- Interactive delivery: route via the LIVE broker's serialized frame
     //     loop (broker routes idle→prompt / streaming→steer itself) instead of
     //     the durable inbox — no watcher latency, and send/stop share one
@@ -261,19 +263,19 @@ async function handleMessage(ctx) {
             // fall through to the durable inbox path
         }
     }
-    // --- Immediate delivery (spec §7.7) — full CLI `deliverImmediate` parity:
-    //     reopen latch clear, one-off output-schema grant, situational sidecar,
-    //     then the single inbox append (body / one-off request / ambient-only). ---
+    // --- Immediate delivery (spec §7.7) — pre-delivery side effects first,
+    //     then the reopen commit, then exactly one inbox append. Once the commit
+    //     succeeds, an append failure makes no further state change. ---
     const deliverImmediate = () => {
-        const expectedFinalReport = req.reopen ? assertFinalizedForReopen(id) : null;
         if (!req.reopen)
             assertNotFinalized(id);
         if (schema !== null)
             writeOutputSchema(id, 'oneoff', schema);
         if (hasSidecar)
             appendSituationalContext(id, sidecar);
-        if (req.reopen)
-            commitReopen(id, expectedFinalReport);
+        if (req.reopen && !reopenCommitted) {
+            commitReopenResident(id);
+        }
         const cards = oneShotCards.length > 0 ? { cards: oneShotCards } : {};
         if (hasBody || schema !== null) {
             const messageBody = hasBody
@@ -302,6 +304,13 @@ async function handleMessage(ctx) {
     // cycle ahead of it, so a deferred entry would sit unseen forever — reject
     // fail-loud BEFORE any side effect, atomically with the append (the read and
     // the write share one canvas write-lock). Non-deferred tiers deliver directly.
+    //
+    // `--reopen` does NOT exempt a target from this guard. It commits the target
+    // resident and retracts the finalization latch, but it never moves `status`
+    // out of `done` — so a reopened target is still one `hasNoNaturalCycle` says
+    // nothing will ever bring back on its own, and a deferred entry appended to it
+    // would wait forever. Reopen widens the WAKE-CAPABLE tiers to a finalized
+    // target; deferred stays rejected, and the rejection names those tiers.
     let entry;
     if (tier === 'deferred') {
         const outcome = withFreshTerminalGuard(id, hasNoNaturalCycle, deliverImmediate);

package/dist/daemon/api/handlers/nodes.js

@@ -88,6 +88,9 @@ function parseCreateBody(body) {
     if (b['kind'] !== undefined && (typeof b['kind'] !== 'string' || b['kind'].trim() === '')) {
         throw usage('kind must be a non-empty string when provided');
     }
+    if (b['description'] !== undefined && (typeof b['description'] !== 'string' || b['description'].trim() === '')) {
+        throw usage('description must be a non-empty string when provided');
+    }
     const rootLifecycle = b['root_lifecycle'];
     if (rootLifecycle !== undefined &&
         rootLifecycle !== 'resident' &&
@@ -110,6 +113,8 @@ function buildRecipe(req, parent, cwd) {
         recipe.mode = req.mode;
     if (req.name !== undefined)
         recipe.name = req.name;
+    if (req.description !== undefined)
+        recipe.description = req.description;
     if (parent !== undefined)
         recipe.parent = parent;
     if (req.root === true)

package/dist/daemon/api/handlers/profiles.js

@@ -7,7 +7,8 @@
 //   GET    /v1/profiles/:name    resolve one profile by name or id
 //   DELETE /v1/profiles/:name    required-force cascade or detach
 import { assertInstalledKind } from '../../../core/config.js';
-import { assertProfileProjects, createProfile, ensureRootProfile, listProfiles, loadProfileManifest, } from '../../../core/profiles/manifest.js';
+import { usage } from '../../../core/errors.js';
+import { assertProfileProjects, createProfile, ensureRootProfile, listProfiles, loadProfileManifest, updateProfileMetadata, } from '../../../core/profiles/manifest.js';
 import { requestProfileDeletion } from '../../profile-delete.js';
 import { toProfileDTO } from '../map.js';
 const ROOT_PROFILE_NAME = 'root';
@@ -42,6 +43,25 @@ function handleEnsure(ctx) {
     });
     return { status: 200, body: toProfileDTO(created) };
 }
+/** `PATCH /v1/profiles/:name/metadata` — merge and remove metadata entries
+ * on an existing profile. Resolution accepts the profile id or unique name,
+ * matching the read and delete routes; this is deliberately separate from the
+ * create-only ensure route. */
+function handleSetMetadata(ctx) {
+    const profile = loadProfileManifest(ctx.params['name']);
+    const raw = ctx.body ?? {};
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw usage('profile metadata body must be an object', { field: 'body' });
+    }
+    const req = raw;
+    const unset = req.unset === undefined ? [] : req.unset;
+    if (!Array.isArray(unset) || unset.some((key) => typeof key !== 'string')) {
+        throw usage('profile metadata `unset` must be an array of strings', { field: 'unset' });
+    }
+    const set = req.set === undefined ? {} : req.set;
+    const updated = updateProfileMetadata(profile.profileId, set, unset);
+    return { status: 200, body: toProfileDTO(updated) };
+}
 /** `GET /v1/profiles` — every profile with a readable manifest. */
 function handleList() {
     return { status: 200, body: listProfiles().map(toProfileDTO) };
@@ -61,6 +81,7 @@ async function handleDelete(ctx) {
 }
 export const profileRoutes = [
     { method: 'PUT', pattern: '/v1/profiles/:name', handler: handleEnsure },
+    { method: 'PATCH', pattern: '/v1/profiles/:name/metadata', handler: handleSetMetadata },
     { method: 'DELETE', pattern: '/v1/profiles/:name', handler: handleDelete },
     { method: 'GET', pattern: '/v1/profiles', handler: handleList },
     { method: 'GET', pattern: '/v1/profiles/:name', handler: handleGet },

package/dist/daemon/cron-run.js

@@ -44,6 +44,9 @@ import { appendInbox } from '../core/feed/inbox.js';
 import { emitEvent } from '../core/events/emit.js';
 import { loadProfileManifest } from '../core/profiles/manifest.js';
 import { hasNoNaturalCycle } from '../core/runtime/revive-all.js';
+import { isParked } from '../core/runtime/lifecycle.js';
+import { reviveNode } from '../core/runtime/revive.js';
+import { isBrokerLive } from '../core/runtime/model-swap.js';
 import { spawnChild } from '../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../core/runtime/bearings.js';
 import { nextSlotAfter, cadenceDisplay } from '../core/wake.js';
@@ -181,7 +184,12 @@ function deliverNodeSink(c, target, stdout) {
     const meta = getNode(target);
     if (meta === null)
         throw new Error(`node sink ${target} is gone`);
-    if (hasNoNaturalCycle(meta)) {
+    // A node parked by the unattended clock is written `done` with the park
+    // marker. Its cron is an explicit next cycle, unlike mass revival or deferred
+    // delivery, so accept precisely that parked shape. A final latch, a
+    // cancellation, or a node finished any other way remains undeliverable and
+    // takes the ordinary failure path.
+    if (hasNoNaturalCycle(meta) && !isParked(meta)) {
         throw new Error(`node sink ${target} has no natural cycle ahead (done or finalized)`);
     }
     const from = c.created_by != null && getNode(c.created_by) !== null ? c.created_by : null;
@@ -192,6 +200,16 @@ function deliverNodeSink(c, target, stdout) {
         label: `⏰ cron ${c.name}`,
         data: { body: stdout },
     });
+    // Mirror ordinary durable message delivery: the append is authoritative, and
+    // a wake failure must not turn that successful delivery into a cron failure.
+    if (c.tier !== 'deferred' && !isBrokerLive(meta)) {
+        try {
+            reviveNode(target, { resume: true });
+        }
+        catch {
+            /* best-effort wake — the entry is durably appended regardless */
+        }
+    }
 }
 /** Birth a fresh node with stdout as its kickoff (the recommended sink for
  *  jobs meant to outlive their creator). Returns the newborn's node id. */

package/dist/daemon/manage.d.ts

@@ -99,7 +99,22 @@ export declare function stopDaemonProcess(pid: number, timeoutMs?: number, deps?
  *  If the daemon is already running, returns {started:false, existing_pid}.
  *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
 export declare function spawnDaemon(): Promise<SpawnDaemonResult>;
-/** Start the daemon if it is not already running. No-op if already up.
+/** Whether autostart is suppressed for this invocation. `--no-autostart` or
+ *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
+ *  for environments that manage crtrd externally and want the diagnostic, and
+ *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
+ *  autostarted daemon there is detached and resident, so it outlives both the
+ *  test process and the deleted temp home with nothing left to stop it.
+ *
+ *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
+ *  daemon implicitly, so the check belongs here rather than at each caller —
+ *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
+ *  reach `ensureDaemon` without going through the CLI client at all. An
+ *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
+ *  deliberately unaffected. */
+export declare function autostartDisabled(): boolean;
+/** Start the daemon if it is not already running. No-op if already up, or if
+ *  autostart is suppressed for this invocation.
  *  Silently swallows spawn errors (the canvas still works without the daemon;
  *  nodes just won't be auto-revived). */
 export declare function ensureDaemon(): void;

package/dist/daemon/manage.js

@@ -379,10 +379,29 @@ export async function spawnDaemon() {
 // ---------------------------------------------------------------------------
 // ensureDaemon — fire-and-forget front-door helper
 // ---------------------------------------------------------------------------
-/** Start the daemon if it is not already running. No-op if already up.
+/** Whether autostart is suppressed for this invocation. `--no-autostart` or
+ *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
+ *  for environments that manage crtrd externally and want the diagnostic, and
+ *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
+ *  autostarted daemon there is detached and resident, so it outlives both the
+ *  test process and the deleted temp home with nothing left to stop it.
+ *
+ *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
+ *  daemon implicitly, so the check belongs here rather than at each caller —
+ *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
+ *  reach `ensureDaemon` without going through the CLI client at all. An
+ *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
+ *  deliberately unaffected. */
+export function autostartDisabled() {
+    return process.env['CRTR_NO_DAEMON_AUTOSTART'] === '1' || process.argv.includes('--no-autostart');
+}
+/** Start the daemon if it is not already running. No-op if already up, or if
+ *  autostart is suppressed for this invocation.
  *  Silently swallows spawn errors (the canvas still works without the daemon;
  *  nodes just won't be auto-revived). */
 export function ensureDaemon() {
+    if (autostartDisabled())
+        return;
     if (!isDaemonRunning()) {
         void spawnDaemon().catch(() => {
             // Intentionally silent — a missing dist/daemon/crtrd-cli.js (dev mode,

package/dist/daemon/park-pending.d.ts

@@ -0,0 +1,13 @@
+/** Arm a pending park for `nodeId`. The caller delivers the parking prompt. */
+export declare function beginPendingPark(nodeId: string, now: number): void;
+export declare function isPendingPark(nodeId: string): boolean;
+/** When the pending park was armed, or undefined when none is armed. */
+export declare function pendingParkStartedAt(nodeId: string): number | undefined;
+/** Delete-and-report: true only for the caller that actually took the pending
+ *  park. Both the supervision tick and the settle handler run on the daemon
+ *  thread with no await between their check and this call, so exactly one of
+ *  them ever enacts a given park. */
+export declare function consumePendingPark(nodeId: string): boolean;
+/** Every node with a parking turn in flight — the reconciler's sweep drops the
+ *  ones whose broker has left the fleet. */
+export declare function pendingParkIds(): string[];