@north-light/crouter 0.3.233 → 0.3.235

package/dist/commands/sys/setup-wizard.d.ts

@@ -1,7 +1,7 @@
-import { ModelRegistry, ModelRuntime } from "@earendil-works/pi-coding-agent";
-import { TUI, type Component, type Focusable } from "@earendil-works/pi-tui";
-import { type BindingId, type BindingResolution } from "../../core/keybindings/index.js";
-import { type SetupPackageId, type SetupPackageManifestEntry, type SetupSubmission, type SetupSystemInstallPlan } from "./setup-core.js";
+import { ModelRegistry, ModelRuntime } from '@earendil-works/pi-coding-agent';
+import { TUI, type Component, type Focusable } from '@earendil-works/pi-tui';
+import { type BindingId, type BindingResolution } from '../../core/keybindings/index.js';
+import { type SetupPackageId, type SetupPackageManifestEntry, type SetupSubmission, type SetupSystemInstallPlan } from './setup-core.js';
 /** The host owns step navigation, focus, submission and composition. Each step
  *  owns its own mutable UI state. */
 export declare class SetupWizard implements Component, Focusable {

package/dist/commands/sys/setup-wizard.js

@@ -5,14 +5,14 @@
 // broker limits, updates — lives in settings-shell.ts. Both hosts share the
 // panels in ./panels; this one is a linear stepper that ends in a single
 // confirmed install, that one is a persistent editor that saves as you go.
-import { matchesKey, truncateToWidth, visibleWidth, } from "@earendil-works/pi-tui";
-import { formatGesture, matchesPiTuiInput, } from "../../core/keybindings/index.js";
-import { buildSetupInitialState, executeSetupSubmission, formatSetupExecutionSummary, packagePlanAction, reconcileInboxFrontDoor, renderSetupStaticInstructions, } from "./setup-core.js";
-import { runSetupSettingsProcess } from "./setup-settings-runner.js";
-import { DependenciesPanel } from "./panels/dependencies-panel.js";
-import { PAGE_CHROME_ROWS, pageFrame, theme, } from "../../core/tui/panel.js";
-import { PluginsPanel } from "./panels/plugins-panel.js";
-import { ProviderPanel } from "./panels/provider-panel.js";
+import { matchesKey, truncateToWidth, visibleWidth, } from '@earendil-works/pi-tui';
+import { formatGesture, matchesPiTuiInput, } from '../../core/keybindings/index.js';
+import { buildSetupInitialState, executeSetupSubmission, formatSetupExecutionSummary, packagePlanAction, reconcileInboxFrontDoor, renderSetupStaticInstructions, } from './setup-core.js';
+import { runSetupSettingsProcess } from './setup-settings-runner.js';
+import { DependenciesPanel } from './panels/dependencies-panel.js';
+import { PAGE_CHROME_ROWS, pageFrame, theme, } from '../../core/tui/panel.js';
+import { PluginsPanel } from './panels/plugins-panel.js';
+import { ProviderPanel } from './panels/provider-panel.js';
 const STEPS = ["Providers", "Plugins", "Dependencies"];
 /** The host owns step navigation, focus, submission and composition. Each step
  *  owns its own mutable UI state. */

package/dist/commands/sys/support/prepare.js

@@ -16,7 +16,7 @@ const BUNDLE_NAME = 'bundle.jsonl';
 const CAP_BYTES = 2_097_152;
 const MAX_RUNTIME_STATE_BYTES = MAX_EVENT_RECORD_BYTES - 1;
 const CATEGORIES = ['events', 'runtime_state', 'raw_residue'];
-// ---- reference generation ----
+// reference generation
 function pad(value, length) {
     return String(value).padStart(length, '0');
 }
@@ -26,7 +26,7 @@ function generateReference(now) {
     const time = `${pad(now.getUTCHours(), 2)}${pad(now.getUTCMinutes(), 2)}${pad(now.getUTCSeconds(), 2)}${pad(now.getUTCMilliseconds(), 3)}`;
     return `${date}T${time}Z-${randomBytes(4).toString('hex')}`;
 }
-// ---- compact bundle records ----
+// compact bundle records
 function compactLine(record) {
     return Buffer.from(`${JSON.stringify(record)}\n`, 'utf8');
 }
@@ -123,7 +123,7 @@ function collectRuntimeState(nodeId, ts, sources) {
     }
     return records;
 }
-// ---- manifest + cap fitting ----
+// manifest + cap fitting
 function renderManifestBuffer(base, sources) {
     const manifest = {
         reference: base.reference,
@@ -157,7 +157,7 @@ function fitToCap(records, sources, base) {
             state.truncated = true;
     }
 }
-// ---- core ----
+// core
 /** Output-free: collects and writes the prepared artifact and returns a
  *  small result. Never prints; the leaf below owns argv/rendering. */
 export function prepareSupportBundle(nodeId) {

package/dist/commands/sys/support/submit.js

@@ -43,7 +43,7 @@ export function defaultGhRunner(args, input) {
     const included = args.includes('--include') ? splitIncludedResponse(raw) : { body: raw, httpStatus: undefined };
     return { code: result.status, stdout: included.body, stderr, httpStatus: included.httpStatus };
 }
-// ---- symlink-free, TOCTOU-safe filesystem access ----
+// symlink-free, TOCTOU-safe filesystem access
 // `~/.crouter/support/<reference>/` is user-writable, so every open here rejects symlinks
 // and confirms the thing opened is the thing later read/uploaded — never an arbitrary path.
 function closeSafe(fd) {
@@ -194,7 +194,7 @@ function openReference(reference) {
         throw error;
     }
 }
-// ---- manifest and bundle validation ----
+// manifest and bundle validation
 // An ordinary manifest: every field is either fixed input (the reference) or independently
 // checked against its own declared shape. Nothing here is self-referential — the cap is
 // enforced by directly measuring the two files, not by trusting a declared byte count.

package/dist/commands/sys/sync-deps.js

@@ -449,9 +449,7 @@ export function runDepsSync(opts) {
     writeText(join(depsDir, '.gitignore'), '*\n');
     return rows;
 }
-// ---------------------------------------------------------------------------
 // The `sys sync deps` leaf.
-// ---------------------------------------------------------------------------
 function renderDepsSummary(rows) {
     const imported = rows.filter((r) => r.status === 'imported').length;
     const wouldImport = rows.filter((r) => r.status === 'would-import').length;

package/dist/commands/sys/sync-project-guidance.js

@@ -2,6 +2,7 @@
 // CLAUDE.md/AGENTS.md/.claude/rules into repository-root and nested
 // `.crouter/memory/` stores. Only the repository root owns the namespace and
 // workspace front door; nested stores derive their prefix from their path.
+import { envProfileId } from '../../shared/env.js';
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { basename, join, resolve } from 'node:path';
 import { defineLeaf } from '../../core/command.js';
@@ -33,7 +34,7 @@ function projectDocRoots(sourceArg) {
     if (sourceArg !== undefined)
         return [resolve(sourceArg)];
     const roots = [resolve(process.cwd())];
-    const profileId = process.env['CRTR_PROFILE_ID'];
+    const profileId = envProfileId();
     if (profileId !== undefined && profileId !== '') {
         try {
             const { manifest } = loadProfileManifest(profileId);

package/dist/commands/sys/sysprompt.js

@@ -1,3 +1,4 @@
+import { envNodeId } from '../../shared/env.js';
 import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -34,7 +35,7 @@ export const sysSyspromptLeaf = defineLeaf({
         preview: { suppressOutput: true },
     },
     run: async (input) => {
-        const nodeId = input['node']?.trim() || process.env['CRTR_NODE_ID'];
+        const nodeId = input['node']?.trim() || envNodeId();
         if (nodeId === undefined || nodeId === '') {
             throw new InputError({ error: 'empty_node', message: 'a node id is required', field: 'node', next: 'Pass a node id or run from inside a node.' });
         }

package/dist/commands/sys.js

@@ -24,6 +24,7 @@ export function registerSys() {
         help: {
             name: 'sys',
             summary: 'crtr system configuration, settings, diagnostics, and self-management',
+            model: 'Configuration and settings own durable behavior; diagnostics and support observe it. Setup, migration, sync, and update change installed or generated state, while daemon control owns the supervisor lifecycle.',
         },
         children: [sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, sysSyspromptLeaf, promptReviewLeaf, sysFeedbackLeaf, sysLogsLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysMigrateLeaf, sysSyncBranch, daemonBranch],
     });

package/dist/core/__tests__/boot.test.js

@@ -59,9 +59,7 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-// ---------------------------------------------------------------------------
 // bootChanged — pure core
-// ---------------------------------------------------------------------------
 test('bootChanged: no persisted history is never a change (never clears a genuinely live pid)', () => {
     assert.equal(bootChanged(ident('boot-A', 1_000_000), null), false);
 });
@@ -84,12 +82,8 @@ test('bootChanged: wall-clock fallback (no boot_id) — epochs within tolerance
 test('bootChanged: wall-clock fallback (no boot_id) — epochs far apart are a DIFFERENT boot', () => {
     assert.equal(bootChanged(ident(null, 1_000_000 + 10 * 60_000), ident(null, 1_000_000)), true, '10min apart — different boot');
 });
-// ---------------------------------------------------------------------------
 // reconcileBootLiveness — the impure sweep against a real canvas.db
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
 // migrateLegacyPidIdentities — one-time in-place format migration at startup
-// ---------------------------------------------------------------------------
 test('migrateLegacyPidIdentities: a live legacy lstart#ticks broker is re-recorded to <bootId>#<ticks>', () => {
     createNode(node('n1'));
     setPidIdentity('n1', 111, 'Sat Jul 11 17:51:45 2026#53459'); // legacy baseline
@@ -193,7 +187,6 @@ test('reconcileBootLiveness: after reconciling, the SAME boot no longer re-trigg
     assert.deepEqual(result, { changed: false, cleared: [], sameBootProven: true });
     assert.equal(getRow('n1')?.pi_pid, 999, 'a pid recorded AFTER reconciliation, within the same boot, is never touched');
 });
-// ---------------------------------------------------------------------------
 // bootProvenSame + the daemon migration gate (Major-1 regression)
 //
 // The legacy identity migration blesses a recorded pid as a current-boot
@@ -202,7 +195,6 @@ test('reconcileBootLiveness: after reconciling, the SAME boot no longer re-trigg
 // NOT that proof — it is also true with no/malformed marker or the wall-clock
 // epoch fallback, where an unrelated cross-boot process can collide on
 // pid+ticks and be permanently baptized.
-// ---------------------------------------------------------------------------
 test('bootProvenSame: exact equal boot_id on both sides is proof', () => {
     assert.equal(bootProvenSame(ident('boot-A', 2_000), ident('boot-A', 1_000)), true);
 });

package/dist/core/__tests__/broker-extension-canvas-db-boundary.test.js

@@ -3,12 +3,33 @@
 // and rejects any reach to the single DB accessor module.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { dirname, join, normalize, resolve } from 'node:path';
 import ts from 'typescript';
 import { CANVAS_EXTENSION_NAMES } from '../canvas/extensions.js';
 const SOURCE_ROOT = resolve(process.cwd(), 'src');
 const DB_MODULE = normalize(join(SOURCE_ROOT, 'core/canvas/db.ts'));
+// The builtin pi-crtr-extensions package loads into the SAME broker process
+// as the shipped pi-extensions/ roots below (its own package.json declares
+// `pi.extensions: ["extensions/*.ts", "extensions/*/index.ts"]`), so it must
+// clear the identical canvas.db-free bar. Read the glob's two shapes directly
+// off disk rather than hardcoding a name list, so a future extension added to
+// the package is covered automatically.
+function builtinPiCrtrExtensionRoots() {
+    const extDir = join(SOURCE_ROOT, 'builtin-pi-packages/pi-crtr-extensions/extensions');
+    const roots = [];
+    for (const entry of readdirSync(extDir, { withFileTypes: true })) {
+        if (entry.isFile() && entry.name.endsWith('.ts') && !entry.name.includes('.test.')) {
+            roots.push(join(extDir, entry.name));
+        }
+        else if (entry.isDirectory()) {
+            const indexFile = join(extDir, entry.name, 'index.ts');
+            if (existsSync(indexFile))
+                roots.push(indexFile);
+        }
+    }
+    return roots;
+}
 function resolveLocalImport(from, specifier) {
     if (!specifier.startsWith('.'))
         return null;
@@ -45,6 +66,7 @@ test('every shipped broker extension and the prospective preflight are transitiv
     const roots = [
         ...CANVAS_EXTENSION_NAMES.map((name) => join(SOURCE_ROOT, 'pi-extensions', `${name}.ts`)),
         join(SOURCE_ROOT, 'core/runtime/prospective-inventory-cli.ts'),
+        ...builtinPiCrtrExtensionRoots(),
     ];
     for (const root of roots) {
         const reach = dbReach(root);

package/dist/core/__tests__/canvas-db-boundary.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/canvas-db-boundary.test.js

@@ -0,0 +1,46 @@
+// canvas.ts declares itself "the one place that reads/writes the node+edge
+// model" for the runtime layer (spawn, push, lifecycle, daemon) that builds on
+// it — every node/edge write from `runtime/` goes through a named canvas.ts
+// accessor, never a raw SQL statement of its own. This grep-enforces that
+// boundary at the one layer the convention actually claims: `core/runtime/`.
+// (Other canvas.db tables — reviews, review_comments — are a SEPARATE
+// subsystem's tables with their own owner in `core/review/`, and `feed.ts`'s
+// `commitCanonicalFinal` is the one documented sanctioned exception outside
+// `runtime/` entirely — see `core/canvas/.crouter/memory/INDEX.md` — so
+// neither is in scope here.)
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+const RUNTIME_ROOT = resolve(process.cwd(), 'src/core/runtime');
+function tsFilesUnder(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const path = join(dir, entry);
+        const stat = statSync(path);
+        if (stat.isDirectory()) {
+            if (entry === '__tests__')
+                continue;
+            out.push(...tsFilesUnder(path));
+        }
+        else if (entry.endsWith('.ts') && !entry.endsWith('.test.ts')) {
+            out.push(path);
+        }
+    }
+    return out;
+}
+test('no file under core/runtime/ prepares a raw SQL statement — canvas.ts is the one node+edge DAO', () => {
+    const offenders = [];
+    for (const file of tsFilesUnder(RUNTIME_ROOT)) {
+        const source = readFileSync(file, 'utf8');
+        const lines = source.split('\n');
+        lines.forEach((line, index) => {
+            // Skip comment lines referencing `.prepare(` in prose (backtick-quoted).
+            if (/`\.prepare\(`/.test(line))
+                return;
+            if (line.includes('.prepare('))
+                offenders.push(`${file}:${index + 1}`);
+        });
+    }
+    assert.deepEqual(offenders, [], `raw .prepare( call(s) outside core/canvas/:\n${offenders.join('\n')}`);
+});

package/dist/core/__tests__/canvas.test.js

@@ -118,7 +118,7 @@ test('recordSpawn writes the audit-only spawned_by edge', () => {
     assert.equal(subscriptionsOf('child').length, 0);
     assert.equal(subscribersOf('parent').length, 0);
 });
-// --- Durability contract: meta.json is durable and never truncated -------
+// Durability contract: meta.json is durable and never truncated
 // writeMeta uses atomic rename with fsync on both the temp file and parent
 // directory to ensure atomicity and durability. readMeta/rebuildIndex tolerate
 // an empty/corrupt meta.json as MISSING (returning null) rather than throwing,

package/dist/core/__tests__/child-death-wake.test.js

@@ -110,7 +110,6 @@ after(() => {
     delete process.env['CRTR_HOME'];
     resetFleetForTests();
 });
-// ===========================================================================
 // BROKER CUT — exit-event authority REPLACES daemon pane-gone reaping. A booted
 // child whose engine pid is dead (and whose viewer pane is gone) is REVIVABLE,
 // not reaped, and the daemon's tick fans NO wake to the dormant parent. This
@@ -120,7 +119,6 @@ after(() => {
 // node recovery rides real exit events), the daemon treats them all identically
 // — no reap, no liveness wake — so the old CRUX (no spurious wake on healthy
 // dormancy) holds by construction.
-// ===========================================================================
 test('exit-event authority: a dead-engine booted child is revivable, NOT reaped, and the tick fans NO wake to its dormant parent', async () => {
     inboxWaitingParent('PARENT');
     deadEngineChild('CHILD');

package/dist/core/__tests__/cli-help-contract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/cli-help-contract.test.js

@@ -0,0 +1,150 @@
+// Help-contract gate for the whole command tree.
+// Run with: node --import tsx/esm --test src/core/__tests__/cli-help-contract.test.ts
+//
+// The cli-design rules that hold for every node are enforced here rather than
+// per command, because help text is written one command at a time and drifts
+// the same way every time: a branch ships its selection prose in the
+// description attribute, a rubric restates the description it sits beside, or
+// a constraint copied from a sibling leaf keeps naming a value this leaf's
+// enum rejects. Each rule below is mechanical — a judgment call about whether
+// a rubric actually helps an agent choose belongs to review, not to this file.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildRoot } from '../../build-root.js';
+import { resetScopeCache } from '../scope.js';
+// buildRoot() composes external command-plugin branches from the effective
+// enabled plugins. Pin HOME to an isolated no-plugin home: a third party's
+// help text is not this repo's contract to enforce.
+let home;
+let realHome;
+let realProfile;
+before(() => {
+    realHome = process.env['HOME'];
+    realProfile = process.env['CRTR_PROFILE_ID'];
+    home = mkdtempSync(join(tmpdir(), 'crtr-help-contract-'));
+    delete process.env['CRTR_PROFILE_ID'];
+    process.env['HOME'] = home;
+    resetScopeCache();
+});
+after(() => {
+    if (realHome !== undefined)
+        process.env['HOME'] = realHome;
+    else
+        delete process.env['HOME'];
+    if (realProfile !== undefined)
+        process.env['CRTR_PROFILE_ID'] = realProfile;
+    rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+});
+async function everyNode() {
+    const root = await buildRoot();
+    const out = [];
+    const visit = (node, path) => {
+        out.push({ node, path });
+        if (node.kind === 'branch')
+            for (const child of node.children)
+                visit(child, `${path} ${child.name}`);
+    };
+    for (const subtree of root.subtrees)
+        visit(subtree, subtree.name);
+    return out;
+}
+function normalize(text) {
+    if (text === undefined)
+        return '';
+    return text.toLowerCase().replace(/\s+/g, ' ').replace(/[.\s]+$/, '').trim();
+}
+function enumFlags(leaf) {
+    return (leaf.help.params ?? []).filter((param) => param.kind === 'flag' && param.type === 'enum' && param.choices !== undefined);
+}
+test('every branch offering a choice carries the model prose that frames it', async () => {
+    const offenders = [];
+    for (const { node, path } of await everyNode()) {
+        if (node.kind !== 'branch')
+            continue;
+        const choices = node.children.filter((child) => child.tier !== 'hidden');
+        if (choices.length < 2)
+            continue;
+        const model = node.help.model;
+        if (model === undefined || model.trim() === '')
+            offenders.push(`${path} (${choices.length} children)`);
+    }
+    assert.deepEqual(offenders, [], `branches with 2+ visible children and no help.model:\n  ${offenders.join('\n  ')}`);
+});
+test('no rubric restates the description it is read beside', async () => {
+    const offenders = [];
+    for (const { node, path } of await everyNode()) {
+        const description = normalize(node.description ?? '');
+        const rubric = normalize(node.whenToUse ?? '');
+        if (description === '' || rubric === '')
+            continue;
+        if (rubric === description || rubric.includes(description))
+            offenders.push(`${path}: whenToUse repeats "${node.description}"`);
+    }
+    assert.deepEqual(offenders, [], `rubrics restating their own description:\n  ${offenders.join('\n  ')}`);
+});
+// A constraint may name a value its own enum rejects only while saying so —
+// the copy-paste failure this catches states the foreign value as if it were
+// selectable. Vocabulary is per flag NAME, so it only fires where one flag
+// genuinely carries different choices on different leaves.
+const NEGATION = /\b(?:reject\w*|refus\w*|invalid|unsupported|forbid\w*|not\s+accepted)\b/i;
+test('no enum constraint names a value that enum does not accept', async () => {
+    const offenders = [];
+    for (const { node, path } of await everyNode()) {
+        if (node.kind !== 'branch')
+            continue;
+        const leaves = node.children.filter((child) => child.kind === 'leaf');
+        // Vocabulary is pooled across ONE branch's leaves, because that is where a
+        // constraint gets copied: two sibling verbs carrying the same flag with
+        // different choices. Pooling tree-wide would compare unrelated commands
+        // that merely share a flag name and flag ordinary English words that
+        // happen to be some distant enum's value.
+        const vocabulary = new Map();
+        for (const leaf of leaves) {
+            for (const flag of enumFlags(leaf)) {
+                const known = vocabulary.get(flag.name) ?? new Set();
+                for (const choice of flag.choices)
+                    known.add(choice.toLowerCase());
+                vocabulary.set(flag.name, known);
+            }
+        }
+        for (const leaf of leaves) {
+            for (const flag of enumFlags(leaf)) {
+                const own = new Set(flag.choices.map((choice) => choice.toLowerCase()));
+                const foreign = [...(vocabulary.get(flag.name) ?? [])].filter((value) => !own.has(value));
+                if (foreign.length === 0)
+                    continue;
+                for (const sentence of flag.constraint.split(/(?<=[.;:])\s+/)) {
+                    if (NEGATION.test(sentence))
+                        continue;
+                    const named = foreign.filter((value) => new RegExp(`\\b${value}\\b`, 'i').test(sentence));
+                    if (named.length > 0)
+                        offenders.push(`${path} ${leaf.name} --${flag.name}: names ${named.join(', ')} — accepts only ${flag.choices.join(', ')}`);
+                }
+            }
+        }
+    }
+    assert.deepEqual(offenders, [], `enum constraints naming values they reject:\n  ${offenders.join('\n  ')}`);
+});
+test('every leaf declares its effects, and none contradicts a claim of none', async () => {
+    const offenders = [];
+    for (const { node, path } of await everyNode()) {
+        if (node.kind !== 'leaf')
+            continue;
+        const effects = node.help.effects;
+        if (effects.length === 0 || effects.some((effect) => effect.trim() === '')) {
+            offenders.push(`${path}: declares no effects`);
+            continue;
+        }
+        // A leaf may describe what read-only means for it — several usefully do.
+        // What it may not do is open with "None" and then list effects underneath:
+        // an agent reading the first entry stops there.
+        if (effects.length > 1 && /^none\b/i.test(effects[0].trim())) {
+            offenders.push(`${path}: claims "${effects[0]}" and then lists ${effects.length - 1} more effect(s)`);
+        }
+    }
+    assert.deepEqual(offenders, [], `leaves with a broken effects declaration:\n  ${offenders.join('\n  ')}`);
+});

package/dist/core/__tests__/cron-armed-context-failure.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/cron-armed-context-failure.test.js

@@ -0,0 +1,145 @@
+// Run with: npm test -- --test-name-pattern='armed'
+//
+// A cron run executes under the context it was ARMED under: the `--env`
+// snapshot and the profile stored on the row. When that stored context cannot
+// be rebuilt, the run must FAIL LOUDLY rather than execute the command under a
+// context nobody armed — the class of defect that otherwise runs wrong, every
+// tick, forever, with a clean run log.
+import { after, afterEach, before, beforeEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { listNodes } from '../canvas/canvas.js';
+import { armCron, getCron, listCronRuns } from '../canvas/crons.js';
+import { closeDb } from '../canvas/db.js';
+import { createProfile, profileManifestPath, profileRoot } from '../profiles/manifest.js';
+import { resetScopeCache } from '../scope.js';
+import { headlessBrokerHost } from '../runtime/host.js';
+import { resetFleetForTests } from '../runtime/fleet.js';
+import { executeCron } from '../../daemon/cron-run.js';
+import { bindTestFleet } from './helpers/fleet.js';
+let userHome;
+let canvasHome;
+let priorHome;
+let priorCanvasHome;
+let fleet;
+let originalLaunch;
+/** The marker a run writes if the command actually executed. */
+function marker(id) {
+    return join(canvasHome, `${id}.ran`);
+}
+function arm({ cron_id, ...overrides }) {
+    armCron({
+        cron_id,
+        name: cron_id,
+        created_by: null,
+        // Records the profile the command actually ran under, so a root fallback is
+        // observable rather than inferred.
+        command: `printf "%s" "$CRTR_PROFILE_ID" > ${marker(cron_id)}`,
+        fire_at: new Date(Date.now() - 1_000).toISOString(),
+        recur: null, // a one-shot: retention is observable
+        tz: null,
+        expires_at: null,
+        anchor_node: null,
+        cancel_on_wake: false,
+        cwd: canvasHome,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'on-failure',
+        sink: '{}',
+        tier: 'normal',
+        ...overrides,
+    });
+}
+before(() => {
+    // realpath: the profile store persists realpath-resolved paths, and macOS
+    // hands back a symlinked /var/folders prefix.
+    userHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-cron-armed-user-')));
+    canvasHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-cron-armed-canvas-')));
+    priorHome = process.env['HOME'];
+    priorCanvasHome = process.env['CRTR_HOME'];
+    process.env['HOME'] = userHome; // the profile store lives under the USER root
+    process.env['CRTR_HOME'] = canvasHome;
+    resetScopeCache();
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(canvasHome, { recursive: true, force: true });
+    mkdirSync(canvasHome, { recursive: true });
+    resetFleetForTests();
+    fleet = bindTestFleet();
+    originalLaunch = headlessBrokerHost.launch;
+    headlessBrokerHost.launch = ((nodeId) => {
+        const handle = { pid: 0x7ffffffe, exited: new Promise(() => { }) };
+        fleet.fleet.register(nodeId, handle);
+        return handle;
+    });
+});
+afterEach(() => {
+    headlessBrokerHost.launch = originalLaunch;
+    closeDb();
+    resetFleetForTests();
+});
+after(() => {
+    rmSync(canvasHome, { recursive: true, force: true });
+    rmSync(userHome, { recursive: true, force: true });
+    if (priorHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = priorHome;
+    if (priorCanvasHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = priorCanvasHome;
+    resetScopeCache();
+});
+/** Every way an armed context fails settles identically: no child, a record
+ *  naming the cause, a paused row that keeps its one-shot, and one escalation
+ *  node. */
+function assertSettledAsArmingFailure(id, record, cause, nodesBefore) {
+    assert.equal(existsSync(marker(id)), false, `${id}: the command never ran`);
+    assert.equal(record?.exit_code, null, `${id}: no process existed to exit`);
+    assert.match(record?.stderr_head ?? '', cause, `${id}: the record names the cause`);
+    assert.match(record?.delivered ?? '', /^failure: cron paused, escalation node /, `${id}: the failure is escalated`);
+    assert.equal(listNodes().length, nodesBefore + 1, `${id}: exactly one escalation node was created`);
+    const row = getCron(id);
+    assert.notEqual(row, null, `${id}: the one-shot is retained, not consumed`);
+    assert.equal(row.state, 'paused', `${id}: the row pauses, so it does not refire every tick`);
+    assert.equal(row.run_state, 'idle', `${id}: no lease was ever taken`);
+    assert.deepEqual(listCronRuns(id).map((r) => r.run_id), [record.run_id], `${id}: the failure left exactly one record`);
+}
+test('a corrupt armed env snapshot fails the run instead of silently dropping the operator variables', async () => {
+    // Both shapes the arm-time validator rejects, so neither can reach a row
+    // through the supported path: unparseable JSON, and a non-string value.
+    const corrupt = [
+        ['env-unparseable', '{"API_BASE": '],
+        ['env-nonstring', '{"API_BASE": 42}'],
+    ];
+    for (const [id, envJson] of corrupt) {
+        arm({ cron_id: id, env_json: envJson });
+        const nodesBefore = listNodes().length;
+        const record = await executeCron(getCron(id), { outOfBand: false });
+        assertSettledAsArmingFailure(id, record, /run could not be armed: the armed env snapshot/, nodesBefore);
+    }
+});
+test('an unreadable profile manifest fails the run, while a deleted profile still runs as root', async () => {
+    const unreadable = createProfile('cron-unreadable').profileId;
+    const deleted = createProfile('cron-deleted').profileId;
+    // Corrupt one manifest in place and delete the other profile outright: the
+    // two states the old resolver could not tell apart.
+    writeFileSync(profileManifestPath(unreadable), '{ not json', 'utf8');
+    rmSync(profileRoot(deleted), { recursive: true, force: true });
+    arm({ cron_id: 'profile-unreadable', profile: unreadable });
+    const nodesBefore = listNodes().length;
+    const failed = await executeCron(getCron('profile-unreadable'), { outOfBand: false });
+    assertSettledAsArmingFailure('profile-unreadable', failed, /run could not be armed: the armed profile .* manifest could not be read/, nodesBefore);
+    arm({ cron_id: 'profile-deleted', profile: deleted });
+    const ran = await executeCron(getCron('profile-deleted'), { outOfBand: false });
+    assert.equal(ran?.exit_code, 0, 'a deleted profile is the spec root fallback — the run proceeds');
+    assert.equal(readFileSync(marker('profile-deleted'), 'utf8'), '', 'the run carries no profile id: it ran as root');
+    assert.equal(getCron('profile-deleted'), null, 'an ordinary settled one-shot is consumed');
+});

package/dist/core/__tests__/daemon-wedge.test.js

@@ -37,12 +37,10 @@ test('wedgeVerdict: fires ONLY when busy + quiet-past-grace + near-zero cpu all
     assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: 0 }), 'wedged');
     assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS + 60_000, cpuPercent: WEDGE_CPU_MAX_PERCENT }), 'wedged', 'at the cpu ceiling (inclusive)');
 });
-// ---------------------------------------------------------------------------
 // sumTreeCpu (pure) — process-tree CPU sampling. Review fix for issue #110:
 // sampling only the broker pid false-fired on a broker awaiting a busy CHILD
 // subprocess. These lock the tree-sum behavior directly, independent of any
 // `ps` shell-out.
-// ---------------------------------------------------------------------------
 test('sumTreeCpu: a busy CHILD subprocess exonerates an idle broker (the false-positive this fixes)', () => {
     const ps = [
         '  100     1  0.0', // broker, idle
@@ -85,11 +83,9 @@ test('sumTreeCpu: malformed/blank lines are skipped; empty output returns null',
     assert.equal(sumTreeCpu('', 100), null);
     assert.equal(sumTreeCpu('   \n  \n', 100), null);
 });
-// ---------------------------------------------------------------------------
 // treeHasDescendants (pure) — issue #119: the broker-alone case has no
 // subprocess to kill, so remediation must branch on this instead of assuming
 // a runaway child always exists.
-// ---------------------------------------------------------------------------
 test('treeHasDescendants: broker alone in its own tree — nothing to kill', () => {
     const ps = ['  100     1  0.0'].join('\n');
     assert.equal(treeHasDescendants(ps, 100), false);