@north-light/crouter 0.3.232 → 0.3.234

package/dist/core/__tests__/integration/flagship-lifecycle.test.js

@@ -64,13 +64,11 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
 { timeout: 60_000 }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-flagship' });
     try {
-        // ===================================================================
         // S1 — A's ROW SHAPE: base × RESIDENT (the user's front door). A spawnRoot
         //   fixture pins the PERSISTED row shape the scenario builds on; the real
         //   resident-birth boot path (bootRoot execs pi inline) is unreachable
         //   headlessly, exactly as in the tmux flagship. The resident BEHAVIOR (no
         //   idle-release) is exercised in live-mutation.test.ts.
-        // ===================================================================
         const A = h.spawnRoot('top-level orchestrator');
         {
             const a = h.node(A);
@@ -79,11 +77,9 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(a.status, 'active', 'A active');
             assert.equal(a.intent ?? null, null, 'A no intent');
         }
-        // ===================================================================
         // S2 — A promotes: orchestrator × RESIDENT (top-level orchestrator). The
         //      real `node promote` verb; mode flips, lifecycle/status/intent
         //      untouched (no transition()).
-        // ===================================================================
         {
             const res = h.cli(A, ['node', 'promote']);
             assert.equal(res.code, 0, `promote A exit 0\n${res.stderr}`);
@@ -93,13 +89,11 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(a.status, 'active', 'A still active (promote does not transition)');
             assert.equal(a.intent ?? null, null, 'A intent untouched by promote');
         }
-        // ===================================================================
         // S3 — A spawns terminal child B: base × TERMINAL. Fabricated as a broker-
         //      hosted node (pi_pid dead + pi_session_id set, so its later dormant
         //      wake RESUMES that session); the spine seed is wired explicitly
         //      (fabrication does not auto-subscribe). B is born acked to its own
         //      persona (commitPersonaAck), mirroring a real birth.
-        // ===================================================================
         const B = h.fabricateBrokerNode({
             parent: A, kind: 'developer', mode: 'base', lifecycle: 'terminal',
             status: 'active', pi_pid: deadPid(), pi_session_id: 'sess-B',
@@ -117,10 +111,8 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.deepEqual(h.subscribers(B), [{ node_id: A, active: true }], "A is B's sole ACTIVE subscriber (spine seed)");
             assert.equal(h.inbox(A).length, 0, 'A inbox empty (spawn pushes nothing)');
         }
-        // ===================================================================
         // S4 — B spawns child C (base × terminal). B now holds an active live
         //      subscription to C → B is legitimately "awaiting" if it stops.
-        // ===================================================================
         const C = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
         subscribe(B, C, true);
         {
@@ -132,7 +124,6 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.deepEqual(h.subscriptions(B), [{ node_id: C, active: true }], 'B subscribes_to C (active)');
             assert.equal(h.status(B), 'active', 'B still active');
         }
-        // ===================================================================
         // S5 — B goes DORMANT. PURE precondition: B is TERMINAL holding an active
         //      live sub to C, so the stop-guard classifies its stop 'awaiting'
         //      (legitimate idle-release). We then enact the post-stop MODEL state
@@ -140,7 +131,6 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         //      broker is a dead pid; pi_pid was fabricated dead at S3). The actual
         //      agent_end idle-release COMMIT is locked by canvas-stophook-agentend
         //      ('natural stop while awaiting a live worker → idle-release …').
-        // ===================================================================
         {
             const stop = evaluateStop(B, { pushedFinal: false, requestedHumanReply: false });
             assert.equal(stop.action, 'allow', 'awaiting terminal B → allow (legit idle-release)');
@@ -155,11 +145,9 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         assert.equal(h.status(C), 'active', 'C still active while B sleeps');
         assert.equal(h.status(A), 'active', 'A still active (a dormant worker does not disturb its manager)');
         assert.equal(h.inbox(A).length, 0, 'A inbox still empty');
-        // ===================================================================
         // S6 — C FINISHES (pushFinal). The pointer fans to subscribersOf(C) = {B}
         //      ONLY. C → done/done. A is NOT a subscriber of C → A inbox stays
         //      empty — the one-hop wake contract at the push site.
-        // ===================================================================
         await pushFinal(C, 'C result body');
         {
             const c = h.node(C);
@@ -169,7 +157,6 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.ok(cFinal, "B inbox received C's final pointer (one hop)");
             assert.equal(h.inbox(A).length, 0, 'A inbox empty — A NOT woken by C (one-hop)');
         }
-        // ===================================================================
         // S7 — WAKE B. The in-process daemon second pass sees B idle/idle-release,
         //      pi dead, an unseen inbox entry → reviveNode(resume). reviveNode
         //      bumps cycles + transition('revive') BEFORE the (detached, unawaited)
@@ -177,7 +164,6 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         //      awaitBoot. (The real inbox-watcher's redelivery of C's report on the
         //      fresh boot is an engine artifact, out of the model tier; the wake
         //      DECISION is locked here by cycles + the S6 inbox entry.)
-        // ===================================================================
         assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
         await h.tick();
         {
@@ -188,10 +174,8 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
         }
         assert.equal(h.inbox(A).length, 0, 'A inbox STILL empty after B woke (one-hop confirmed)');
         assert.equal(h.status(A), 'active', 'A unchanged');
-        // ===================================================================
         // S8 — B PROMOTES: base → orchestrator, lifecycle TERMINAL unchanged
         //      (no --resident). orchestrator × terminal (the sub-orchestrator).
-        // ===================================================================
         {
             const res = h.cli(B, ['node', 'promote', '--kind', 'developer']);
             assert.equal(res.code, 0, `promote B exit 0\n${res.stderr}`);
@@ -201,11 +185,9 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(b.status, 'active', 'B still active');
             assert.equal(b.intent ?? null, null, 'B intent untouched by promote');
         }
-        // ===================================================================
         // S9 — The next provider request must first deliver the pending persona
         //      transition. Independently, agent_end would stall this orchestrator
         //      because it has no live subscription and has not pushed a final.
-        // ===================================================================
         {
             const drift = personaDrift(B);
             assert.ok(drift !== null, 'the provider gate has a pending persona transition');
@@ -217,13 +199,11 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(stop.reason, 'stalled', 'classified stalled');
             assert.equal(stop.action === 'reprompt' ? stop.message : '', formatCard('stop-guard', {}, STALL_REPROMPT), 'the stall reprompt nudge, delivered as a whole-message stop-guard envelope');
         }
-        // ===================================================================
         // S10 — B YIELDS. The real plain `node yield` verb sets intent=refresh
         //       while preserving mode (already orchestrator); persona survives the request. We
         //       then model the daemon's completed refresh-revive with transition
         //       ('revive') (the in-place fresh boot is engine; its model effect —
         //       active, intent cleared, persona preserved — is asserted here).
-        // ===================================================================
         {
             const res = h.cli(B, ['node', 'yield', 'refresh against the roadmap']);
             assert.equal(res.code, 0, `node yield exit 0\n${res.stderr}`);
@@ -240,9 +220,7 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(b.mode, 'orchestrator', 'B mode survives the refresh');
             assert.equal(b.lifecycle, 'terminal', 'B lifecycle survives the refresh');
         }
-        // ===================================================================
         // S11 — B spawns child D (base × terminal). New spine seed B→D active.
-        // ===================================================================
         const D = h.fabricateBrokerNode({ parent: B, mode: 'base', lifecycle: 'terminal', status: 'active' });
         subscribe(B, D, true);
         {
@@ -252,20 +230,16 @@ test('flagship: full node lifecycle — spawn, dormancy, one-hop wake, promote,
             assert.equal(d.status, 'active', 'D active');
             assert.ok(h.subscriptions(B).some((s) => s.node_id === D && s.active), 'B subscribes_to D (active)');
         }
-        // ===================================================================
         // S12 — D FINISHES → pointer to B (its only subscriber).
-        // ===================================================================
         await pushFinal(D, 'D result body');
         {
             assert.equal(h.node(D).status, 'done', 'D done');
             const dFinal = h.inbox(B).find((e) => e.from === D && e.kind === 'final');
             assert.ok(dFinal, "B inbox received D's final pointer");
         }
-        // ===================================================================
         // S13 — B pushes its FINAL up the spine → done/done; the pointer fans to
         //       subscribersOf(B) = {A}. NOW A finally hears B (its own explicit
         //       push — the only way the chain propagates a hop).
-        // ===================================================================
         await pushFinal(B, 'all work complete');
         {
             const b = h.node(B);

package/dist/core/__tests__/integration/live-mutation-verbs.test.js

@@ -47,7 +47,6 @@ function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
 const FULL_CLI_TEST_TIMEOUT_MS = 180_000;
-// ===========================================================================
 // (b) THE demote / recycle SPLIT — two DISTINCT verbs:
 //   • `node lifecycle demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
 //     its MODE and parentage, keeps running (active), is NOT finalized; it now
@@ -57,7 +56,6 @@ const FULL_CLI_TEST_TIMEOUT_MS = 180_000;
 //     node keeps mode=orchestrator (it is merely `done`).
 // This test drives demote via the real CLI verb and recycle via the real
 // recycleNode, pinning each behavior at the model layer.
-// ===========================================================================
 test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle recycle is FINISH+RECYCLE', 
 // Drives several full-CLI subprocess spawns (each a cold tsx compile of the
 // whole CLI) + recycleNode; this is a subprocess-heavy regression and gets a
@@ -118,13 +116,11 @@ test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle
         await h.dispose();
     }
 });
-// ===========================================================================
 // (b) A4 BOUNDARY — plain yield is mode-preserving; `yield --promote` is the
 //     explicit one-step promotion + refresh. A plain yield sets intent=refresh
 //     only, leaves the base persona acknowledged, and does NOT seed a roadmap.
 //     With `--promote`, the mode flips and a roadmap is seeded; persona drift
 //     remains pending until the replacement context persists its baseline.
-// ===========================================================================
 test('A4: a plain yield preserves base mode and does not seed a roadmap', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
 { timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {

package/dist/core/__tests__/integration/live-mutation.test.js

@@ -42,13 +42,11 @@ function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
 const SIGNALS = { pushedFinal: false, requestedHumanReply: false };
-// ===========================================================================
 // (a) LIFECYCLE FLIP — `crtr node config --lifecycle` on a LIVE node, both directions,
 //     observing the idle-release DECISION change. A round-trip on ONE node
 //     (terminal→resident→terminal) proves both directions: a flipped-resident
 //     node no longer idle-releases (evaluateStop → dormant); flipped-terminal it
 //     idle-releases again (evaluateStop → awaiting, on its active live sub).
-// ===========================================================================
 test('live lifecycle flip: terminal→resident suppresses idle-release; resident→terminal restores it', 
 // Full-CLI subprocess spawns under load — 20s blew on the slower CI runner
 // (passes fast locally); 60s = safe margin. Same class as live-mutation-verbs.
@@ -102,7 +100,7 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
             assert.equal(stop.action, 'allow', 'resident B → allow');
             assert.equal(stop.reason, 'dormant', 'resident B → dormant, NOT awaiting — idle-release SUPPRESSED by the live flip');
         }
-        // --- FLIP 2: resident → TERMINAL (live), on the now-resident node. ---
+        // FLIP 2: resident → TERMINAL (live), on the now-resident node.
         {
             const res = h.cli(B, ['node', 'config', '--lifecycle', 'terminal', '--node', B]);
             assert.equal(res.code, 0, `config --lifecycle terminal exit 0\n${res.stderr}`);
@@ -124,11 +122,9 @@ test('live lifecycle flip: terminal→resident suppresses idle-release; resident
         await h.dispose();
     }
 });
-// ===========================================================================
 // (b) MODE FLIP — promote: base → orchestrator on a LIVE node. Promotion leaves
 //     persona_ack pending; the next provider request appends and persists the
 //     transition before a guarded ack. This test pins that model precondition.
-// ===========================================================================
 test('live mode flip: promote base→orchestrator leaves persona_ack pending for provider-gated delivery', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
 { timeout: 60_000 }, async () => {

package/dist/core/__tests__/integration/refresh-stall-recycle.test.js

@@ -25,9 +25,7 @@ import { createHeadlessHarness } from '../helpers/harness.js';
 import { recordPid } from '../../canvas/canvas.js';
 import { isPidAlive } from '../../canvas/pid.js';
 import { yieldStallVerdict, YIELD_STALL_GRACE_MS } from '../../../daemon/reconcilers/broker-supervision.js';
-// ---------------------------------------------------------------------------
 // D4a — the pure refresh-stall truth table.
-// ---------------------------------------------------------------------------
 test('D4a yieldStallVerdict: kill ONLY a live, not-busy, refresh engine past the grace', () => {
     const G = YIELD_STALL_GRACE_MS;
     // The one 'kill' case: engine alive, intent=refresh, turn over (not busy), past grace.
@@ -35,9 +33,7 @@ test('D4a yieldStallVerdict: kill ONLY a live, not-busy, refresh engine past the
     // A working engine is NEVER killed, even past the grace.
     assert.equal(yieldStallVerdict(true, 'refresh', true, G + 60_000), 'leave', 'busy (mid-turn) → leave');
 });
-// ---------------------------------------------------------------------------
 // D4b — daemon integration: a stuck refresh on a LIVE engine is force-recycled.
-// ---------------------------------------------------------------------------
 const T0 = 7_000_000;
 const T_KILL = T0 + YIELD_STALL_GRACE_MS + 1; // one ms past the grace from t0
 test('D4b daemon force-recycles a stuck refresh: a live, not-busy refresh engine past the grace is SIGTERM\'d', { timeout: 30_000 }, async () => {
@@ -68,7 +64,7 @@ test('D4b daemon force-recycles a stuck refresh: a live, not-busy refresh engine
         h.fleet.register(id, { pid: enginePid, exited: new Promise(() => { }) });
         assert.equal(h.node(id).intent, 'refresh', 'precondition: intent=refresh pending');
         assert.notEqual(h.node(id).pi_pid_identity, null, 'precondition: live engine has a recorded identity');
-        // --- TICK @ t0: arms the stall clock (yieldStallSince). No kill yet. ---
+        // TICK @ t0: arms the stall clock (yieldStallSince). No kill yet.
         await h.tick(T0);
         assert.equal(isPidAlive(enginePid), true, 'within grace: the engine is NOT killed (clock just armed)');
         // --- TICK past the grace: the daemon concludes the refresh stalled and

package/dist/core/__tests__/integration/revive.test.js

@@ -104,9 +104,7 @@ after(() => {
         }
     }
 });
-// ---------------------------------------------------------------------------
 // resumeArgs — the pure resume-source selection
-// ---------------------------------------------------------------------------
 test('resumeArgs resumes by the absolute file path when it exists on disk', () => {
     mkdirSync(home, { recursive: true });
     const sessionFile = join(home, 'resume-args-exists.jsonl');
@@ -144,9 +142,7 @@ test('resumeArgs selects neither source on a refresh revive with no `.jsonl` on
     });
     assert.deepEqual(resumeArgs(m, false), {});
 });
-// ---------------------------------------------------------------------------
 // buildPiArgv — the `--session` argument the revive builds
-// ---------------------------------------------------------------------------
 test('buildPiArgv resumes by ABSOLUTE path when pi_session_file exists on disk', () => {
     mkdirSync(home, { recursive: true });
     const sessionFile = join(home, 'build-argv-exists.jsonl');
@@ -169,10 +165,8 @@ test('buildPiArgv passes no --session on a fresh (no-resume) launch', () => {
     assert.ok(!argv.includes('--session'), 'a fresh launch never resumes');
     assert.ok(argv.includes('go'), 'the kickoff prompt is the last positional');
 });
-// ---------------------------------------------------------------------------
 // buildPiArgv — the resumed argv replays the persisted launch spec faithfully
 // (kind/mode/lifecycle come back as the node's *current* self).
-// ---------------------------------------------------------------------------
 test('a resumed revive replays the persisted LaunchSpec (model, tools, extensions, prompt, env)', () => {
     mkdirSync(home, { recursive: true });
     const sessionFile = join(home, 'launchspec-replay.jsonl');
@@ -211,13 +205,11 @@ test('a resumed revive replays the persisted LaunchSpec (model, tools, extension
     assert.equal(env['CRTR_KIND'], 'developer');
     assert.equal(env['CRTR_MODE'], 'orchestrator');
 });
-// ---------------------------------------------------------------------------
 // Double-revive guard — reviveNode no-ops when the node has a live FLEET ENTRY
 // (design D-1: the entry IS liveness). Fabricated as a BROKER node with a
 // fabricated entry registered in the harness's in-process fleet, so the guard
 // is exercised with NO tmux and NO real boot. An entry → guard short-circuits
 // (cycles flat); no entry → revive proceeds (cycles bumped before the launch).
-// ---------------------------------------------------------------------------
 test('reviveNode no-ops when the node has a live fleet entry — double-revive guard', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-guard' });
     try {
@@ -272,14 +264,12 @@ test('reviveNode PROCEEDS when the node has NO fleet entry — cycle counter bum
         await h.dispose();
     }
 });
-// ---------------------------------------------------------------------------
 // BUG LOCKED — a recovery relaunch must not eat the node's armed deadline.
 // A node armed `crtr node wait deadline` and dormed; its broker then exited and
 // the daemon respawned it (fleet.#respawn → reviveNode). reviveNode used to
 // cancel every cancel-on-wake cron unconditionally, so the deadline vanished
 // with nothing having woken the node and the wait could never settle. A wake
 // (inbox delivery, attach, explicit revive) still consumes it.
-// ---------------------------------------------------------------------------
 function armDeadline(anchor, cronId) {
     armCron({
         cron_id: cronId,
@@ -449,11 +439,9 @@ test('reviveNode crashes and clears pid when launch/preflight throws', async ()
         await h.dispose();
     }
 });
-// ---------------------------------------------------------------------------
 // Crash-to-dead doctrine wake — a launch-refusal marks the node dead; a
 // manager waiting dormant on it must be told, or it hangs forever (the
 // daemon no longer supervises a dead node). Mirrors closeNode's step-4 fan-out.
-// ---------------------------------------------------------------------------
 test('reviveNode fans a doctrine wake to subscribers when launch/preflight throws (crash-to-dead)', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-crashwake' });
     const originalLaunch = headlessBrokerHost.launch;

package/dist/core/__tests__/integration/subscription-delivery.test.js

@@ -59,11 +59,9 @@ function edgeSet(arr) {
 test('one daemon tick revives the active subscriber of a finished target and leaves the passive one dormant', { timeout: 30_000 }, async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-subdeliv' });
     try {
-        // ===================================================================
         // Build the graph by FABRICATION (no boots). A is a resident root
         // (inline, daemon-untouched); B/T/K/P are broker nodes whose liveness
         // fields are set directly. Each parent→child spine edge is wired ACTIVE.
-        // ===================================================================
         const A = h.spawnRoot('front door'); // resident root, active, no placement
         // T (the target) and K (keepalive) are LIVE-active workers; B and P start
         // already DORMANT (idle-released, broker exited = dead pid) — exactly the
@@ -88,20 +86,16 @@ test('one daemon tick revives the active subscriber of a finished target and lea
         assert.equal(passive(P).length, 0, 'P passive accumulator empty before the push');
         assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
         assert.equal(h.node(P).cycles ?? 0, 0, 'P not yet revived');
-        // ===================================================================
         // T FINISHES via the model layer — the precondition the daemon decides on:
         // B's pointer lands in inbox.jsonl (the wake channel), P's in passive.jsonl.
-        // ===================================================================
         await pushFinal(T, 'TARGET-FINAL-BODY: the worker completed');
         closeDb();
         assert.ok(h.inbox(B).find((e) => e.from === T && e.kind === 'final'), 'ACTIVE subscriber B: T-final pointer delivered to inbox.jsonl');
         assert.equal(h.inbox(P).length, 0, 'PASSIVE subscriber P: inbox.jsonl stays empty (no wake channel)');
         assert.equal(passive(P).length, 1, 'PASSIVE subscriber P: exactly one passive entry');
-        // ===================================================================
         // The DAEMON decision pass. Its 2nd pass revives an idle-released node
         // ONLY on an unseen INBOX entry. B has one (active) → REVIVED. P has none
         // (its entry went to passive.jsonl) → stays idle. Decided in ONE tick.
-        // ===================================================================
         await h.tick();
         // ACTIVE subscriber: WOKEN — reviveNode bumped cycles + transition(revive).
         {

package/dist/core/__tests__/integration/tmux-surface.test.js

@@ -84,12 +84,13 @@ test('§2.2 driver invariant: every placement verb in tmux-driver.ts passes an e
     // three (new-window / split-window / respawn-pane).
     assert.ok(found >= 3, `expected to scan ≥3 placement verbs, saw ${found}`);
 });
-// ---------------------------------------------------------------------------
-// Lint guard — §5.1, ENFORCED. The driver (tmux-driver.ts) is imported only by
-// placement.ts, placement-tmux.ts, tmux-chrome.ts, and tmux-bindings.ts. Every
-// other module — runtime, daemon, commands, stophook, and tests — must route
-// through those sanctioned seams.
-// ---------------------------------------------------------------------------
+// Lint guard — §5.1, ENFORCED. The driver's PLACEMENT verbs (tmux-driver.ts)
+// are imported only by placement.ts, placement-tmux.ts, tmux-chrome.ts, and
+// tmux-bindings.ts. Every other module — runtime, daemon, commands, stophook,
+// and tests — must route through those sanctioned seams, and may import only
+// the two read-only reachability probes: those answer a question, drive no
+// pane, and are the very calls tmux-driver-boundary.test.ts requires every
+// would-be direct `spawnSync('tmux', …)` prober to route through instead.
 /** Every `.ts` file under `src` (recursively), excluding nothing. */
 function allTsFiles(dir) {
     const out = [];
@@ -102,13 +103,28 @@ function allTsFiles(dir) {
     }
     return out;
 }
-/** Files (basename) sanctioned to import the driver, per §2.1. */
+/** Files (basename) sanctioned to import the driver's full surface, per §2.1. */
 const ALLOWED_IMPORTERS = new Set(['placement.ts', 'placement-tmux.ts', 'tmux-chrome.ts', 'tmux-bindings.ts']);
+/** The read-only probes any module may import — they drive no pane. */
+const PROBE_IMPORTS = new Set(['tmuxSessionsReachable', 'tmuxClientsReachable']);
 function importsDriver(file) {
     const src = readFileSync(file, 'utf8');
     // A specifier whose basename is exactly `tmux-driver.js` (so
     // `tmux-bindings.js` is not matched). Covers `from '...'` and `import('...')`.
-    return [...src.matchAll(/(?:from|import\s*\()\s*'([^']+)'/g)].some((m) => basename(m[1]) === 'tmux-driver.js');
+    const specifiers = [...src.matchAll(/(?:from|import\s*\()\s*'([^']+)'/g)].filter((m) => basename(m[1]) === 'tmux-driver.js');
+    if (specifiers.length === 0)
+        return false;
+    // Every reference must be a named import clause naming only the probes; any
+    // other shape (a placement verb, a namespace, a re-export, a dynamic import)
+    // is a direct use of the driver.
+    const clauses = [...src.matchAll(/import\s+(?:type\s+)?\{([^}]*)\}\s*from\s*'([^']+)'/g)].filter((m) => basename(m[2]) === 'tmux-driver.js');
+    if (clauses.length !== specifiers.length)
+        return true;
+    return !clauses.every((m) => m[1]
+        .split(',')
+        .map((name) => name.trim().split(/\s+as\s+/)[0].trim())
+        .filter((name) => name !== '')
+        .every((name) => PROBE_IMPORTS.has(name)));
 }
 test('§5.1 lint: only sanctioned seams import the tmux driver', () => {
     const offenders = allTsFiles(SRC_ROOT)

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -252,7 +252,6 @@ test('autoDropCleanManagedWorktree refuses when the recorded base branch no long
     assert.ok(existsSync(wt.path));
     rmSync(repo, { recursive: true, force: true });
 });
-// ---------------------------------------------------------------------------
 // The Critical fix: the TOCTOU race between proving clean-and-contained and
 // the destructive branch delete. `proveCleanEmptyManagedWorktree` and
 // `autoDropCleanManagedWorktreeLocked` are exported specifically so these
@@ -260,7 +259,6 @@ test('autoDropCleanManagedWorktree refuses when the recorded base branch no long
 // exactly the window the repository lock does NOT close (it only serializes
 // crtr's own worktree mutations, not ordinary `git commit`/`git reset`/an
 // external base rewrite run by any other process against the checkout).
-// ---------------------------------------------------------------------------
 // A concurrent commit lands on the managed branch after the predicate proved
 // it clean-and-contained, but before cleanup deletes it. The atomic
 // compare-and-delete must refuse, leaving the branch (and the new commit)
@@ -326,7 +324,6 @@ test('the re-verified base containment refuses when the base is rewritten betwee
     assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 0, 'the branch ref must still exist — nothing was lost');
     rmSync(repo, { recursive: true, force: true });
 });
-// ---------------------------------------------------------------------------
 // The base-ref TOCTOU: a branch-only compare-and-delete refuses when the
 // BRANCH moves, but a base force-reset between the containment proof and the
 // delete could still leave the delete's own condition (the branch equals the
@@ -338,7 +335,6 @@ test('the re-verified base containment refuses when the base is rewritten betwee
 // re-check and its ref-deletion transaction — the same technique used above
 // for the branch-only race, and the same one the independent re-review used
 // to reproduce this exact Critical against `6de1c8d`.
-// ---------------------------------------------------------------------------
 test('close-landed atomic delete refuses when the base is force-reset between landing and the cleanup delete', () => {
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-close-base-window-'));
     run(['init', '-b', 'main'], repo);
@@ -387,13 +383,11 @@ PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
     assert.equal(refCheck.stdout.trim(), result.landed_sha, 'the preserved branch must still name the landed commit — no orphaned landed commit');
     rmSync(repo, { recursive: true, force: true });
 });
-// ---------------------------------------------------------------------------
 // Checkout-removal refusal: `bestEffortRemoveWorktreeCheckout` can report
 // `worktreeRemoved: false` (real Git refused `worktree remove` because a
 // file reappeared after the clean predicate ran). That refusal must itself
 // refuse the whole cleanup — never reach the low-level ref-deletion
 // transaction, which bypasses Git's own checked-out-branch protection.
-// ---------------------------------------------------------------------------
 test('auto-drop refuses and preserves the branch and checkout when checkout removal is refused after the clean predicate', async () => {
     const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
     const nodeId = 'wt-auto-drop-removal-refused';

package/dist/core/__tests__/lifecycle.test.js

@@ -48,9 +48,7 @@ after(() => {
 const ALL = ['active', 'idle', 'done', 'dead', 'canceled'];
 const LIVE = ['active', 'idle'];
 const TERMINAL = ['done', 'dead', 'canceled'];
-// ---------------------------------------------------------------------------
 // finalize → done + intent='done', legal only from active|idle
-// ---------------------------------------------------------------------------
 test('finalize: active|idle → done + intent=done', () => {
     for (const from of LIVE) {
         mk(`n_${from}`, from, 'refresh');
@@ -66,11 +64,9 @@ test('finalize: illegal from done|dead|canceled → throws, status untouched', (
         assert.equal(getNode(`n_${from}`)?.status, from, `${from} unchanged on illegal finalize`);
     }
 });
-// ---------------------------------------------------------------------------
 // park → done + intent='parked', legal only from active|idle. The intent IS the
 // durable park marker: it must land atomically with the `done` it qualifies,
 // read only through isParked, and be cleared by revival.
-// ---------------------------------------------------------------------------
 test('park: active|idle → done + intent=parked, and isParked reads exactly that pair', () => {
     for (const from of LIVE) {
         mk(`n_${from}`, from);
@@ -94,13 +90,11 @@ test('park: revival clears the marker, and no other done is parked', () => {
     mk('finished', 'active');
     assert.equal(isParked(transition('finished', 'finish')), false, 'a finished done is not a park');
 });
-// ---------------------------------------------------------------------------
 // cancel → canceled + intent cleared, legal from ANY status (forced teardown).
 // A5 (human-confirmed 2026-06-06): the `reap` event was COLLAPSED into `cancel`
 // — they were identical (status differed only; both intent=null, from=ANY, no
 // side effects in transition()). Every external reap (close cascade AND
 // reset/relaunch) now routes through `cancel`; `done` is reserved for finalize.
-// ---------------------------------------------------------------------------
 test('cancel: any status → canceled + intent cleared', () => {
     for (const from of ALL) {
         mk(`n_${from}`, from, 'idle-release');
@@ -109,9 +103,7 @@ test('cancel: any status → canceled + intent cleared', () => {
         assert.equal(m.intent, null, `cancel from ${from} clears intent`);
     }
 });
-// ---------------------------------------------------------------------------
 // crash → dead, intent UNCHANGED, legal only from active|idle
-// ---------------------------------------------------------------------------
 test('crash: active|idle → dead, intent preserved', () => {
     for (const from of LIVE) {
         mk(`n_${from}`, from, 'refresh');
@@ -126,9 +118,7 @@ test('crash: illegal from done|dead|canceled → throws', () => {
         assert.throws(() => transition(`n_${from}`, 'crash'), /illegal lifecycle transition/);
     }
 });
-// ---------------------------------------------------------------------------
 // yield → intent='refresh', status UNCHANGED, legal only from active|idle
-// ---------------------------------------------------------------------------
 test('yield: active|idle → intent=refresh, status preserved', () => {
     for (const from of LIVE) {
         mk(`n_${from}`, from);
@@ -143,9 +133,7 @@ test('yield: illegal from done|dead|canceled → throws', () => {
         assert.throws(() => transition(`n_${from}`, 'yield'), /illegal lifecycle transition/);
     }
 });
-// ---------------------------------------------------------------------------
 // release → idle + intent='idle-release', legal only from active|idle
-// ---------------------------------------------------------------------------
 test('release: active|idle → idle + intent=idle-release', () => {
     for (const from of LIVE) {
         mk(`n_${from}`, from);
@@ -160,10 +148,8 @@ test('release: illegal from done|dead|canceled → throws', () => {
         assert.throws(() => transition(`n_${from}`, 'release'), /illegal lifecycle transition/);
     }
 });
-// ---------------------------------------------------------------------------
 // refresh-launch → active + intent=refresh, legal from ANY status. This is the
 // provisional launch transition; session_start commits through revive below.
-// ---------------------------------------------------------------------------
 test('refresh-launch: any status → active + intent=refresh', () => {
     for (const from of ALL) {
         mk(`n_${from}`, from, 'idle-release');
@@ -172,9 +158,7 @@ test('refresh-launch: any status → active + intent=refresh', () => {
         assert.equal(m.intent, 'refresh', `refresh-launch from ${from} preserves refresh authority`);
     }
 });
-// ---------------------------------------------------------------------------
 // revive → active + intent cleared, legal from ANY status (the universal "back")
-// ---------------------------------------------------------------------------
 test('revive: any status → active + intent cleared', () => {
     for (const from of ALL) {
         mk(`n_${from}`, from, 'idle-release');
@@ -183,9 +167,7 @@ test('revive: any status → active + intent cleared', () => {
         assert.equal(m.intent, null, `revive from ${from} clears intent`);
     }
 });
-// ---------------------------------------------------------------------------
 // unknown node → throws for every event
-// ---------------------------------------------------------------------------
 test('transition on an unknown node throws', () => {
     for (const ev of ['finish', 'park', 'cancel', 'crash', 'yield', 'release', 'refresh-launch', 'revive']) {
         assert.throws(() => transition('ghost', ev), /unknown node/);

package/dist/core/__tests__/memory-resolver-precedence.test.js

@@ -66,7 +66,7 @@ beforeEach(() => {
     grandchild = join(child, 'grandchild');
     initWorktreeRepository(root, child);
     mkdirSync(grandchild, { recursive: true });
-    // --- main (FARTHER store, namespace root) ---
+    // main (FARTHER store, namespace root)
     writeDoc(join(root, '.crouter', 'memory', 'INDEX.md'), 'ROOT STORE INDEX', 'namespace: root');
     writeDoc(join(root, '.crouter', 'memory', 'shared.md'), 'ROOT SHARED BODY'); // root/shared
     writeDoc(join(root, '.crouter', 'memory', 'taste', 'INDEX.md'), 'ROOT TASTE INDEX'); // root/taste

package/dist/core/__tests__/migration.test.js

@@ -215,7 +215,7 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(rt['window'], null);
     assert.equal(rt['tmux_session'], null);
 });
-// --- v4: edges FK ON DELETE CASCADE (the one irreversible rebuild) ------------
+// v4: edges FK ON DELETE CASCADE (the one irreversible rebuild)
 /** Build a hand-rolled db at exactly v3 (baseline tables + the four runtime
  *  columns, edges with NO foreign key, `user_version = 3`) — the shape the live
  *  fleet reaches just before v4. Caller seeds it, we close it; the next openDb()
@@ -352,7 +352,7 @@ test('v16 repairs a v15 database missing canonical finalization columns', () =>
         db.close();
     }
 });
-// --- v22: legacy schedules → crons ------------------------------------------
+// v22: legacy schedules → crons
 function buildV21Db() {
     ensureHome();
     const raw = new DatabaseSync(canvasDbPath());

package/dist/core/__tests__/on-read-dedup-resume.test.js

@@ -94,7 +94,7 @@ test('on-read exposure survives a strict resume and resets for a fresh context',
     const readFile = join(work, 'src', 'file.ts');
     mkdirSync(join(work, 'src'), { recursive: true });
     writeFileSync(readFile, 'export const x = 1;\n');
-    // --- pi process #1: cold load; first read surfaces the doc ---
+    // pi process #1: cold load; first read surfaces the doc
     const state = loadContextExposureState(node);
     const transcript = exposureTarget(state, 'transcript');
     const first = renderOnReadDocs(node, readFile, transcript);
@@ -102,11 +102,11 @@ test('on-read exposure survives a strict resume and resets for a fresh context',
     saveContextExposureState(node, state);
     // The active ledger suppresses an equal-rung repeat.
     assert.ok(!renderOnReadDocs(node, readFile, transcript).includes(FIXTURE_BODY), 'same-context repeat read is already exposed');
-    // --- dormancy → revive(resume): NEW process rehydrates the state from disk ---
+    // dormancy → revive(resume): NEW process rehydrates the state from disk
     const stateAfterRevive = loadContextExposureState(node);
     assert.deepEqual(stateAfterRevive, state, 'revive(resume) rehydrates the persisted context state');
     assert.ok(!renderOnReadDocs(node, readFile, exposureTarget(stateAfterRevive, 'transcript')).includes(FIXTURE_BODY), 'strict resume does not re-deliver the document');
-    // --- fresh launch (revive resume=false, e.g. a refresh-yield) clears the state ---
+    // fresh launch (revive resume=false, e.g. a refresh-yield) clears the state
     clearContextExposureState(node);
     const stateFresh = loadContextExposureState(node);
     assert.ok(renderOnReadDocs(node, readFile, exposureTarget(stateFresh, 'transcript')).includes(FIXTURE_BODY), 'a fresh transcript surfaces the doc again');

package/dist/core/__tests__/pid-identity-match.test.js

@@ -47,7 +47,7 @@ test('one side lacking ticks fails open to a base compare (transient /proc miss)
     assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026#53459'), true, 'coarse-vs-fine with matching base → match');
     assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026#53459'), false, 'coarse-vs-fine with different base → reuse');
 });
-// --- boot-scoped (new-format) identities ---
+// boot-scoped (new-format) identities
 const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
 const BOOT_B = '9e8d7c6b-5a40-4938-9271-fedcba098765';
 test('new-format: equal boot_id + equal ticks → match', () => {

package/dist/core/__tests__/plugin-kinds.test.js

@@ -110,7 +110,7 @@ test('a project-root plugin layers above user config, and the project config abo
     assert.equal(kinds['proj-kind']?.model, 'openai/medium'); // project config > project plugin
     assert.equal(kinds['proj-kind']?.whenToUse, 'project plugin kind');
 });
-// --- archive path -----------------------------------------------------------
+// archive path
 function minimalCommandsJson() {
     return {
         schemaVersion: 1,