@north-light/crouter 0.3.236 → 0.3.238

package/dist/core/runtime/host.js

@@ -22,7 +22,7 @@ import { buildBrokerEnv } from './spawn-env.js';
 import { hostExecPath } from './branded-host.js';
 import { isPidAlive, killProcessTreePids, isAnyPidAlive, captureTeardownSnapshot } from '../canvas/pid.js';
 import { assertMandatoryCanvasExtensions } from './canvas-extensions.js';
-import { boundFleet } from './fleet.js';
+import { boundFleet, brokerCapReached, brokerThresholdsForDaemon } from './fleet.js';
 import { emitEvent } from '../events/emit.js';
 import { bindBrokerEventSource, eventSource } from '../events/source.js';
 import { envBrokerEngine } from '../../shared/env.js';
@@ -193,6 +193,19 @@ export const headlessBrokerHost = {
     launch(nodeId, inv, opts) {
         // Fast-fail known launch errors before we detach a broker process.
         preflightBrokerLaunch(nodeId, inv, opts.cwd);
+        // Resolve the fleet BEFORE opening any handle: an unbound-fleet launch must
+        // fail fast with nothing to clean up (design D-2 — broker launches happen
+        // only inside crtrd, or a test harness that explicitly bound a fleet).
+        const fleet = boundFleet();
+        // The ledger is the ONE admission gate for a broker process: every launch
+        // path (revive, spawn, recycle, reset) funnels through here, so claiming
+        // the slot before anything is opened — and giving it back on any path that
+        // does not end in a registered handle — is what makes the cap real rather
+        // than advisory. A caller that cannot proceed without a slot sees this
+        // typed refusal; a caller that can wait catches it and freezes instead.
+        if (!fleet.reserveSlot(nodeId)) {
+            throw brokerCapReached(brokerThresholdsForDaemon().automaticReviveCap, fleet.size());
+        }
         // Redirect the detached broker's stdout+stderr to a per-node log under the
         // node's existing job/ dir. It retains arbitrary engine/process residue and
         // failed-canonical fatal fallback output. Append-mode preserves crash-revive history.
@@ -233,10 +246,6 @@ export const headlessBrokerHost = {
         }
         if (eventSource() === undefined)
             bindBrokerEventSource(nodeId);
-        // Resolve the fleet BEFORE spawning: an unbound-fleet launch must fail
-        // fast with nothing to clean up (design D-2 — broker launches happen only
-        // inside crtrd, or a test harness that explicitly bound a fleet).
-        const fleet = boundFleet();
         // `--canvas-home` declares broker ownership in argv so the daemon's
         // startup epoch census can match its own canvas' brokers exactly (crtrd's
         // brokerCommandDeclaresCanvasHome) instead of inferring from install
@@ -244,12 +253,20 @@ export const headlessBrokerHost = {
         // daemon's census reaps every prior-epoch broker without adoption (D-8).
         // Both precede the node id: the node id is by contract the FINAL argv
         // token (both broker-cli and the ps census parse it that way).
-        const child = spawn(hostExecPath(), [resolveBrokerEntry(), '--canvas-home', crtrHome(), '--epoch', fleet.epoch(), nodeId], {
-            cwd: opts.cwd,
-            detached: true,
-            stdio: ['ignore', logFd, logFd],
-            env: childEnv,
-        });
+        let child;
+        try {
+            child = spawn(hostExecPath(), [resolveBrokerEntry(), '--canvas-home', crtrHome(), '--epoch', fleet.epoch(), nodeId], {
+                cwd: opts.cwd,
+                detached: true,
+                stdio: ['ignore', logFd, logFd],
+                env: childEnv,
+            });
+        }
+        catch (error) {
+            fleet.releaseReservation(nodeId);
+            closeSync(logFd);
+            throw error;
+        }
         // The child holds its own dup of the fd; release the parent's copy so the
         // launching process (CLI or daemon) never leaks it.
         closeSync(logFd);
@@ -299,6 +316,10 @@ export const headlessBrokerHost = {
             fleet.register(nodeId, handle);
             void exited.then((status) => fleet.onChildExit(nodeId, status));
         }
+        else {
+            // Nothing was registered, so nothing will ever free this slot at exit.
+            fleet.releaseReservation(nodeId);
+        }
         return handle;
     },
     isAlive(node) {

package/dist/core/runtime/launch-prompt.d.ts

@@ -4,5 +4,5 @@
  *  before. ALL runtime/spine/lifecycle/kind prompting now lives as gated builtin
  *  memory docs (src/builtin-memory/), spliced in fresh every turn — this scaffold
  *  must never duplicate that prose. Imported by launch.ts (its own systemPrompt)
- *  and `sys prompt-review` so the two can never drift. */
+ *  and `sys context prompt-review` so the two can never drift. */
 export declare const LAUNCH_SYSTEM_PROMPT: string;

package/dist/core/runtime/launch-prompt.js

@@ -1,5 +1,5 @@
 // launch-prompt.ts — the minimal static system-prompt scaffold, isolated from
-// launch.ts so CLI consumers (`sys prompt-review`) can import the exact string
+// launch.ts so CLI consumers (`sys context prompt-review`) can import the exact string
 // boot uses WITHOUT pulling launch.ts's canvas-db reach (editorLabel et al.).
 // Pure: zero imports.
 /** The minimal static system prompt every node launches with — a thin launcher
@@ -8,6 +8,6 @@
  *  before. ALL runtime/spine/lifecycle/kind prompting now lives as gated builtin
  *  memory docs (src/builtin-memory/), spliced in fresh every turn — this scaffold
  *  must never duplicate that prose. Imported by launch.ts (its own systemPrompt)
- *  and `sys prompt-review` so the two can never drift. */
+ *  and `sys context prompt-review` so the two can never drift. */
 export const LAUNCH_SYSTEM_PROMPT = 'You are a node in the crtr canvas — an agentic runtime.\n\nGuidelines:\n' +
     '- Use the crtr canvas and memory substrate according to injected context.';

package/dist/core/runtime/lifecycle.d.ts

@@ -1,4 +1,4 @@
-import type { NodeMeta, NodeStatus, ExitIntent } from '../canvas/types.js';
+import type { NodeMeta, NodeStatus, ExitIntent, TerminalReason } from '../canvas/types.js';
 /** The lifecycle events — the only vocabulary for moving a node's status/intent.
  *  Each maps (in the table below) to a target status and/or intent plus the set
  *  of from-statuses it is legal from. */
@@ -9,7 +9,9 @@ export type LifecycleEvent = 'finish' | 'park' | 'cancel' | 'crash' | 'yield' |
  *
  *  Throws on an unknown node or an illegal move. The conditional update makes
  *  legality authoritative at SQLite write time rather than at a stale read. */
-export declare function transition(nodeId: string, event: LifecycleEvent): NodeMeta;
+export declare function transition(nodeId: string, event: LifecycleEvent, opts?: {
+    reason?: TerminalReason;
+}): NodeMeta;
 /** Whether this row is a PARKED node — terminalized by the unattended clock
  *  rather than by finishing its own work. The one read of the park marker:
  *  `done` qualified by `intent='parked'`, both written in the same atomic

package/dist/core/runtime/lifecycle.js

@@ -33,6 +33,14 @@
 // inside `core/canvas/`).
 import { getNode, cancelCronsOnWake, transitionStatusIntent } from '../canvas/index.js';
 const ANY = '*';
+const TERMINAL_REASONS = {
+    finish: 'finished',
+    park: 'parked',
+    cancel: 'stranded',
+    crash: 'crashed',
+    'refresh-launch': null,
+    revive: null,
+};
 /** The supervised statuses — a live node the daemon watches. */
 const LIVE = ['active', 'idle'];
 /** The legal transition table — derived directly from the (status, intent) pairs
@@ -69,15 +77,18 @@ const TRANSITIONS = {
  *
  *  Throws on an unknown node or an illegal move. The conditional update makes
  *  legality authoritative at SQLite write time rather than at a stale read. */
-export function transition(nodeId, event) {
+export function transition(nodeId, event, opts) {
     const spec = TRANSITIONS[event];
     const writeStatus = Object.prototype.hasOwnProperty.call(spec, 'status');
     const writeIntent = Object.prototype.hasOwnProperty.call(spec, 'intent');
+    const reason = opts?.reason ?? TERMINAL_REASONS[event];
     const fields = {};
     if (writeStatus)
         fields.status = spec.status;
     if (writeIntent)
         fields.intent = spec.intent ?? null;
+    if (reason !== undefined)
+        fields.terminal_reason = reason;
     // A committed canonical result is protected from a concurrent close.
     const changes = transitionStatusIntent(nodeId, fields, {
         fromStatuses: spec.from === ANY ? undefined : spec.from,

package/dist/core/runtime/memory.js

@@ -8,7 +8,7 @@ import { join } from 'node:path';
 // Import the pure path helper from paths.ts directly, NOT the canvas/index.js
 // barrel: the barrel re-exports `openDb`/canvas.ts accessors, so pulling it here
 // would drag canvas.db into the runtime graph of every pure-client CLI leaf that
-// resolves memory docs (e.g. `memory origin`, `sys prompt-review`). Stage B-9.
+// resolves memory docs (e.g. `memory origin`, `sys context prompt-review`). Stage B-9.
 import { contextDir } from '../canvas/paths.js';
 /** The node-local memory directory in a node's context dir — holds substrate
  *  docs (.md files with kind/when/why frontmatter). */

package/dist/core/runtime/reopen.js

@@ -38,8 +38,9 @@
 // mutating the live pointer — the explicit operation must not retract a
 // canonical final unless it can actually enact the requested re-task.
 import { join } from 'node:path';
-import { clearFinalReportIfMatches, getFinalReport, reportsDir, updateNode } from '../canvas/index.js';
+import { clearFinalReportIfMatches, getFinalReport, getNode, reportsDir, updateNode } from '../canvas/index.js';
 import { InputError } from '../io.js';
+import { transition } from './lifecycle.js';
 function currentFinalReport(nodeId) {
     return getFinalReport(nodeId);
 }
@@ -106,6 +107,14 @@ export function commitReopen(nodeId, expectedFinalReport) {
 export function commitReopenResident(nodeId) {
     const finalReport = currentFinalReport(nodeId);
     updateNode(nodeId, { lifecycle: 'resident' });
+    // A reopened node that is still parked in a terminal status has to come back
+    // to `active`, or its row keeps claiming it is finished while a broker runs
+    // its new mandate. Gated on terminal so a message landing on a live node
+    // never rewrites the intent it is working under.
+    const meta = getNode(nodeId);
+    if (meta !== null && (meta.status === 'done' || meta.status === 'canceled' || meta.status === 'dead')) {
+        transition(nodeId, 'revive');
+    }
     if (finalReport !== null)
         commitReopen(nodeId, finalReport);
 }

package/dist/core/runtime/reset.js

@@ -50,7 +50,7 @@ export function reapDescendants(rootId) {
             // sole .jsonl writer; tearDownNode then proactively closes the on-screen
             // viewer pane + registry row (attach auto-reconnects, so the viewer must be
             // closed here or it lingers ~30s in a misleading "reconnecting…" state).
-            transition(id, 'cancel');
+            transition(id, 'cancel', { reason: 'closed' });
             headlessBrokerHost.teardown(id);
             tearDownNode(id);
             reaped.push(id);

package/dist/core/runtime/revive-all.d.ts

@@ -52,6 +52,9 @@ export interface ReviveAllResult {
         node_id: string;
         error: string;
     }[];
+    /** Node ids the cap turned away. They are not failures: each row is frozen
+     *  and the daemon's tick relaunches it as slots free. */
+    frozen: string[];
 }
 /** RESUME every disconnected node. reviveNode is the ONLY sanctioned launcher
  *  and self-guards the double-spawn (a node whose broker pid is already live is a

package/dist/core/runtime/revive-all.js

@@ -92,13 +92,19 @@ export function listDisconnected() {
  *  with resume:true. One failing node never aborts the sweep — its error is
  *  collected and the rest proceed. */
 export function reviveAll() {
-    const result = { revived: [], failed: [] };
+    const result = { revived: [], failed: [], frozen: [] };
     for (const meta of listDisconnected()) {
         try {
             // Reconnecting a disconnected broker is recovery, not a wake — a node
-            // waiting on an armed deadline keeps it across the sweep.
-            reviveNode(meta.node_id, { resume: true, recovery: true });
-            result.revived.push(meta.node_id);
+            // waiting on an armed deadline keeps it across the sweep. A sweep over a
+            // whole canvas is the likeliest way to meet the cap, and every node in it
+            // is one the daemon wants back: freeze the overflow and let the tick
+            // bring them up as slots free.
+            const outcome = reviveNode(meta.node_id, { resume: true, recovery: true, capacity: 'freeze' }).outcome;
+            if (outcome === 'frozen')
+                result.frozen.push(meta.node_id);
+            else
+                result.revived.push(meta.node_id);
         }
         catch (err) {
             result.failed.push({ node_id: meta.node_id, error: err.message });

package/dist/core/runtime/revive.d.ts

@@ -51,7 +51,18 @@ export interface ReviveResult {
      *  Present only when a fresh launch actually happened (absent on the
      *  double-revive no-op, where nothing was cleared or relaunched). */
     faultExplanation?: () => string | null;
+    /** What this call actually did. `already-live` means a broker was already
+     *  running for the node and nothing was launched; `frozen` means no slot was
+     *  free and the row is now waiting for one — the tick thaws it. */
+    outcome: ReviveOutcome;
 }
+export type ReviveOutcome = 'launched' | 'already-live' | 'frozen';
+/** What a caller wants when the broker cap is full. `freeze` suits a caller
+ *  whose reason to run survives waiting (durable mail, a cron sink, a recovery
+ *  respawn): the row is marked frozen and the tick relaunches it when a slot
+ *  frees. `refuse` suits a caller that must have a live broker NOW (an attach,
+ *  a bridge, a companion bind) and can only report the refusal. */
+export type ReviveCapacityPolicy = 'freeze' | 'refuse';
 /** Relaunch `nodeId`'s broker engine from its persisted recipe and update canvas
  *  meta. Opens no viewer (engine-only).
  *
@@ -66,6 +77,7 @@ export interface ReviveResult {
  */
 export declare function reviveNode(nodeId: string, opts: {
     resume: boolean;
+    capacity: ReviveCapacityPolicy;
     wakeReason?: ReviveWakeReason;
     recovery?: boolean;
 }): ReviveResult;

package/dist/core/runtime/revive.js

@@ -24,7 +24,8 @@
 // reviveNode remains the ONLY sanctioned launcher of the node engine.
 import { existsSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
-import { findNodeBySessionFile, getNode, updateNode, clearPid, recordPid, fullName, subscribersOf, } from '../canvas/index.js';
+import { findNodeBySessionFile, getNode, updateNode, clearPid, recordPid, setFrozen, clearFrozen, fullName, subscribersOf, } from '../canvas/index.js';
+import { emitEvent } from '../events/emit.js';
 import { cancelCronsOnWake } from '../canvas/crons.js';
 import { isParked, transition } from './lifecycle.js';
 import { fanDoctrineWake } from './close.js';
@@ -34,7 +35,7 @@ import { buildReviveKickoff, drainBearings, readGoal, readYieldMessage, RUNTIME_
 import { readRoadmap } from './roadmap.js';
 import { hasUnseenWakeMail } from '../feed/inbox.js';
 import { headlessBrokerHost } from './host.js';
-import { boundFleet } from './fleet.js';
+import { boundFleet, brokerCapReached, brokerThresholdsForDaemon } from './fleet.js';
 import { clearFault, beginBootFaultAttempt } from './fault.js';
 import { clearContextExposureState, initializeForkContextExposure, } from '../substrate/injected-store.js';
 import { rootOfSpine } from './nodes.js';
@@ -126,13 +127,67 @@ export function reviveNode(nodeId, opts) {
     // check before the first's registration lands. A node with a live fleet
     // entry was already revived by another path — re-launching would put a
     // SECOND broker on the same session file.
-    if (boundFleet().has(nodeId)) {
+    const fleet = boundFleet();
+    if (fleet.has(nodeId)) {
+        // The node is already running, but the ROW may still say terminal: a reopen
+        // or a retask lands on a live broker, and only this transition puts the row
+        // back where its liveness already is. Both specs accept any prior status,
+        // so this is a no-op for a row that is already active.
+        transition(nodeId, meta.intent === 'refresh' ? 'refresh-launch' : 'revive');
         return {
             window: null,
             session: meta.tmux_session ?? null,
             resumed: false,
+            outcome: 'already-live',
         };
     }
+    // The cap, consulted BEFORE any mutation below: a node that cannot get a
+    // broker must not have its cycle counter bumped, its session identity
+    // cleared, or its bearings drained on the way to being turned away.
+    if (!fleet.reserveSlot(nodeId)) {
+        if (opts.capacity === 'refuse') {
+            throw brokerCapReached(brokerThresholdsForDaemon().automaticReviveCap, fleet.size());
+        }
+        // Freezing is durable and once-per-episode: the mark stays until a launch
+        // clears it, so a node frozen across many saturated ticks announces itself
+        // exactly once and keeps its original wait timestamp (the thaw order reads
+        // it).
+        if (meta.frozen_at == null) {
+            setFrozen(nodeId, new Date().toISOString());
+            // The row holds no engine and is not getting one this pass, so a pid left
+            // over from the instance that just died would read as stale-active on
+            // every status surface. Clearing it is what makes `isFrozenRow` true and
+            // what tells the tick this row has never launched OR has already been
+            // written off, so the freeze lane owes it a launch rather than a verdict.
+            clearPid(nodeId);
+            emitEvent({
+                level: 'info',
+                event: 'broker.frozen',
+                node_id: nodeId,
+                fields: { live_count: fleet.size(), hard_cap: brokerThresholdsForDaemon().automaticReviveCap },
+            });
+        }
+        return {
+            window: null,
+            session: meta.tmux_session ?? null,
+            resumed: false,
+            outcome: 'frozen',
+        };
+    }
+    try {
+        return launchRevive(nodeId, meta, opts);
+    }
+    finally {
+        // The slot is either consumed by the fleet registration inside `launch`
+        // (making this a no-op) or given back here — the one release path covering
+        // every preflight refusal and launch failure between the claim and the
+        // registration.
+        fleet.releaseReservation(nodeId);
+    }
+}
+/** The launch itself, from the cwd preflight through `recordPid`. Split out so
+ *  the capacity claim above has exactly one release path around it. */
+function launchRevive(nodeId, meta, opts) {
     // Preflight, before any state mutation below: a recorded cwd that no longer
     // exists (e.g. a closed managed worktree whose tombstone dir was later
     // reaped) can never host a launch. Fail loud with a typed, user-visible
@@ -345,11 +400,15 @@ export function reviveNode(nodeId, opts) {
     // and status surfaces (canvas views, the daemon's identity rechecks at
     // signal boundaries) still read it.
     recordPid(nodeId, launched.pid);
+    // A launch is the definition of not-frozen, and every launcher passes
+    // through here — so this is the one place the wait mark is retired.
+    clearFrozen(nodeId);
     return {
         window: null,
         session: meta.tmux_session ?? null,
         resumed: resuming,
         launch: launched,
         faultExplanation: bootFault.explanation,
+        outcome: 'launched',
     };
 }

package/dist/core/runtime/spawn.d.ts

@@ -95,6 +95,10 @@ export declare function assertLaunchModelRegistered(request: ModelRequest | unde
 }, registry?: ModelRegistryLike): Promise<void>;
 export interface SpawnChildResult {
     node: NodeMeta;
+    /** The birth found the broker cap full: the row exists and is marked frozen,
+     *  but no engine was launched. The node-lifecycle tick starts it when a slot
+     *  frees. */
+    frozen: boolean;
     /** The viewer window opened for a --root in tmux; null otherwise (a managed
      *  child opens no viewer, and a --root spawned outside tmux opens none). */
     window: string | null;

package/dist/core/runtime/spawn.js

@@ -21,7 +21,9 @@ import { writeGoal } from './kickoff.js';
 import { appendSituationalContext, formatSituationalProse } from './situational-context.js';
 import { hasRoadmap, seedRoadmap } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
-import { canonicalSessionFile, contextDir, findNodeBySessionFile, getNode, fullName, recordPid } from '../canvas/index.js';
+import { canonicalSessionFile, contextDir, findNodeBySessionFile, getNode, fullName, recordPid, setFrozen } from '../canvas/index.js';
+import { boundFleet, brokerThresholdsForDaemon } from './fleet.js';
+import { emitEvent } from '../events/emit.js';
 import { jobDir } from '../canvas/paths.js';
 import { openViewerWindow, focusOf, windowOfPane, } from './placement.js';
 import { waitForBrokerViewSocket } from './placement-tmux.js';
@@ -335,16 +337,43 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
         // Snapshot the boot-fault attempt the instant before launch — see
         // beginBootFaultAttempt — so a later diagnostic read (root+await only, below)
         // can only ever surface a fault THIS launch recorded, never a stale one.
+        // Claim the slot BEFORE the launch: `launchBrokerOrCrash` turns any launch
+        // failure — including the ledger's refusal — into a crashed row, and a birth
+        // that merely has to wait for capacity must not be crashed. Consulting the
+        // ledger here keeps the freeze decision ahead of that conversion. The
+        // reservation is consumed by the fleet's own `register` on a successful
+        // launch, so the release below is a no-op then and a give-back on any path
+        // that never registered a handle.
+        const fleet = boundFleet();
+        if (!fleet.reserveSlot(meta.node_id)) {
+            // Freezing is durable and once-per-episode; a birth is by definition the
+            // first, so the mark and its announcement always land here.
+            setFrozen(meta.node_id, new Date().toISOString());
+            emitEvent({
+                level: 'info',
+                event: 'broker.frozen',
+                node_id: meta.node_id,
+                fields: { live_count: fleet.size(), hard_cap: brokerThresholdsForDaemon().automaticReviveCap },
+            });
+            // No engine, so no readiness to wait for and no viewer to place.
+            return { node: getNode(meta.node_id), frozen: true, window: null, session: null };
+        }
         const bootFault = beginBootFaultAttempt(meta.node_id);
         // Broker is the only host: launch the detached broker ENGINE. A managed child
         // gets NO viewer — spawning it returns once the engine is launched and a human
         // opens a viewer on demand via `crtr surface node focus` / surface attach. A --root gets
         // a foreground viewer below.
-        const placed = launchBrokerOrCrash(meta.node_id, inv, {
-            cwd: meta.cwd,
-            name: fullName(meta),
-            resuming: false,
-        });
+        let placed;
+        try {
+            placed = launchBrokerOrCrash(meta.node_id, inv, {
+                cwd: meta.cwd,
+                name: fullName(meta),
+                resuming: false,
+            });
+        }
+        finally {
+            fleet.releaseReservation(meta.node_id);
+        }
         // Definitive failure: no broker pid ⇒ the node has no engine. Crash it (so the
         // daemon doesn't watch a zombie 'active') and throw so `crtr node new` exits
         // non-zero. transition('crash') is a legal from-LIVE move (still 'active' from
@@ -412,7 +441,7 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
             catch { /* best-effort — a headless spawn must never fail on viewer placement */ }
         }
         const saved = getNode(meta.node_id);
-        return { node: saved, window, session };
+        return { node: saved, frozen: false, window, session };
     }
     catch (err) {
         // Cleanup scope: a managed worktree is only removed on failure while NO

package/dist/core/runtime/tmux-bindings.js

@@ -36,6 +36,9 @@ const LEAF_MENU_ACTIONS = {
     // default dialog-sized popup clipped both the rail and the models matrix.
     'crtr.tmux.menu.providers': { description: 'settings', action: { kind: 'popup', run: 'sys settings', size: { w: '90%', h: '85%' } } },
     'crtr.tmux.menu.plugins': { description: 'plugins', action: { kind: 'popup', run: 'pkg browse', size: { w: '90%', h: '85%' } } },
+    // Three zones side by side; the snapshot rail and document list both lose
+    // usable width before the dossier does, so this takes the settings size.
+    'crtr.tmux.menu.context-admin': { description: 'context surface', action: { kind: 'popup', run: 'sys context admin', size: { w: '90%', h: '85%' } } },
     'crtr.tmux.menu.graph': { description: 'canvas graph', action: { kind: 'keys', keys: '/graph' } },
     'crtr.tmux.menu.focus-manager': { description: 'go to manager', action: { kind: 'command', run: 'surface node focus {manager}' } },
     'crtr.tmux.menu.copy-id': { description: 'copy node id', action: { kind: 'command', run: 'surface node id --pane {pane}' } },
@@ -307,6 +310,7 @@ function menuItems(bindings, entries) {
     addGroup('System', boundItems([
         'crtr.tmux.menu.providers',
         'crtr.tmux.menu.plugins',
+        'crtr.tmux.menu.context-admin',
         'crtr.tmux.menu.issues',
     ]));
     const prefixGestures = bindings.gestures('crtr.tmux.menu.open');

package/dist/core/substrate/frontmatter-validation.js

@@ -1,7 +1,7 @@
 import { isDocKind, parseSubstrateFrontmatter, SURFACE_EVENTS, SURFACE_RUNGS } from './schema.js';
 const RETIRED_FIELDS = ['system-prompt-visibility', 'file-read-visibility', 'applies-to', 'read-when'];
 const SURFACE_ENTRY_KEYS = ['on', 'match', 'match-frontmatter', 'gate', 'at'];
-export const SUPPRESSIBLE_RULES = ['length', 'broad-memory-read'];
+export const SUPPRESSIBLE_RULES = ['length', 'broad-memory-read', 'orphan'];
 /** Strict validation of one raw routing entry. Runtime parsing deliberately
  * tolerates malformed docs; this authoring/preflight contract does not. */
 export function lintSubstrateSurfaces(value) {

package/dist/core/substrate/index.d.ts

@@ -1,7 +1,10 @@
-export { KINDS, isDocKind, RUNGS, rungRank, rungAtLeast, SURFACE_EVENTS, SURFACE_RUNGS, bootRung, parseSubstrateFrontmatter, parseSubstrateDoc, previewLine, normalizeNameSegment, normalizeDocName, resolveDocName, } from './schema.js';
+export { KINDS, isDocKind, RUNGS, rungRank, rungAtLeast, SURFACE_EVENTS, SURFACE_RUNGS, parseSubstrateFrontmatter, parseSubstrateDoc, previewLine, normalizeNameSegment, normalizeDocName, resolveDocName, } from './schema.js';
 export type { DocKind, Rung, GatePredicate, SubstrateSchema, SubstrateDoc, SurfaceEntry, SurfaceEvent, SurfaceRung } from './schema.js';
 export { lintSubstrateFrontmatter, lintSubstrateSchema, lintSubstrateSurfaces, parsedSubstrateSurfaces } from './frontmatter-validation.js';
-export { matchesReadEntry, matchesMemoryReadEntry, matchesCommandEntry, readDeliveryRung, workspaceOpenRung, memoryReadDeliveryRung, commandDeliveryRung, owningRootOf, underOwningRoot } from './surface-match.js';
+export { matchesReadEntry, matchesMemoryReadEntry, matchesCommandEntry, readDeliveryRung, workspaceOpenRung, memoryReadDeliveryRung, commandDeliveryRung, matchingSurfaceEntry, surfaceEntryParticipates, owningRootOf, underOwningRoot } from './surface-match.js';
+export type { SurfaceMatchPayload } from './surface-match.js';
+export { planDelivery, bootPartitionOf } from './plan.js';
+export type { DeliveryPlan, DeliveryRecord, DeliveryPayload, EntryDecision, GateOutcome } from './plan.js';
 export { dirDedupKey, docsByName, isDirName, ancestorDirsOf, renderDirListing } from './listings.js';
 export { clearContextExposureState, cloneContextExposureState, cloneTranscriptExposureState, contentExposureIdentity, contextExposureStatesEqual, documentExposedAtOrAbove, emptyContextExposureState, exposedAtOrAbove, exposureTarget, freezePreferenceSnapshot, hasTranscriptExposure, initializeForkContextExposure, loadContextExposureState, mergeContextExposureState, registerDocumentExposure, registerExposure, replaceContextExposureState, saveContextExposureState, sharedContextExposureState, } from './injected-store.js';
 export type { ContextExposureState, ExposureSource, ExposureTarget } from './injected-store.js';
@@ -11,5 +14,5 @@ export { spineDepth, assembleNodeSubject } from './subject.js';
 export { gatePasses } from './gate.js';
 export { renderPreferencesForSubject, renderKnowledgeForSubject } from './render.js';
 export { renderPreferencesSection, renderKnowledgeBlock } from './render-node.js';
-export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject, renderOnCommandDocsForSubject, renderCandidateBlocks, memoryReadDocBlocks } from './on-read.js';
+export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject, renderOnCommandDocsForSubject, memoryReadDocBlocks } from './on-read.js';
 export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read-node.js';

package/dist/core/substrate/index.js

@@ -9,7 +9,7 @@ KINDS, isDocKind,
 // ladder
 RUNGS, rungRank, rungAtLeast, 
 // surfaces (event routing)
-SURFACE_EVENTS, SURFACE_RUNGS, bootRung, 
+SURFACE_EVENTS, SURFACE_RUNGS, 
 // parse + render-shared helpers
 parseSubstrateFrontmatter, parseSubstrateDoc, previewLine, 
 // display-name normalization
@@ -17,7 +17,8 @@ normalizeNameSegment, normalizeDocName,
 // substrate identity (explicit-name-then-path-fallback)
 resolveDocName, } from './schema.js';
 export { lintSubstrateFrontmatter, lintSubstrateSchema, lintSubstrateSurfaces, parsedSubstrateSurfaces } from './frontmatter-validation.js';
-export { matchesReadEntry, matchesMemoryReadEntry, matchesCommandEntry, readDeliveryRung, workspaceOpenRung, memoryReadDeliveryRung, commandDeliveryRung, owningRootOf, underOwningRoot } from './surface-match.js';
+export { matchesReadEntry, matchesMemoryReadEntry, matchesCommandEntry, readDeliveryRung, workspaceOpenRung, memoryReadDeliveryRung, commandDeliveryRung, matchingSurfaceEntry, surfaceEntryParticipates, owningRootOf, underOwningRoot } from './surface-match.js';
+export { planDelivery, bootPartitionOf } from './plan.js';
 export { dirDedupKey, docsByName, isDirName, ancestorDirsOf, renderDirListing } from './listings.js';
 export { clearContextExposureState, cloneContextExposureState, cloneTranscriptExposureState, contentExposureIdentity, contextExposureStatesEqual, documentExposedAtOrAbove, emptyContextExposureState, exposedAtOrAbove, exposureTarget, freezePreferenceSnapshot, hasTranscriptExposure, initializeForkContextExposure, loadContextExposureState, mergeContextExposureState, registerDocumentExposure, registerExposure, replaceContextExposureState, saveContextExposureState, sharedContextExposureState, } from './injected-store.js';
 export { scopeForCwd, profileNameFor } from './subject-fields.js';
@@ -25,5 +26,5 @@ export { spineDepth, assembleNodeSubject } from './subject.js';
 export { gatePasses } from './gate.js';
 export { renderPreferencesForSubject, renderKnowledgeForSubject } from './render.js';
 export { renderPreferencesSection, renderKnowledgeBlock } from './render-node.js';
-export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject, renderOnCommandDocsForSubject, renderCandidateBlocks, memoryReadDocBlocks } from './on-read.js';
+export { renderOnReadDocsForSubject, renderWorkspaceOpenDocsForSubject, renderOnCommandDocsForSubject, memoryReadDocBlocks } from './on-read.js';
 export { renderOnReadDocs, renderWorkspaceOpenDocs } from './on-read-node.js';

package/dist/core/substrate/on-read.d.ts

@@ -1,12 +1,5 @@
 import { type ContextExposureState, type ExposureTarget } from './injected-store.js';
-import { type Rung, type SubstrateDoc } from './schema.js';
 import type { NodeConfigSubject } from './subject-fields.js';
-interface EventCandidate {
-    doc: SubstrateDoc;
-    rung: Rung;
-}
-/** Render the selected candidates not already loaded at their matched rung. */
-export declare function renderCandidateBlocks(subject: NodeConfigSubject | null, candidates: EventCandidate[], target: ExposureTarget): string[];
 /** Surface docs whose `read` entries match a successfully read file, using
  * the caller-supplied daemon snapshot subject. */
 export declare function renderOnReadDocsForSubject(subject: NodeConfigSubject, readFilePath: string, target?: ExposureTarget): string;
@@ -46,4 +39,3 @@ export declare function corpusHasPreCommandSurfaces(): boolean;
  * held once and then silently absent for the rest of the session. Lives here
  * rather than in the extension because the corpus accessor is private. */
 export declare function demotePreCommandExposures(state: ContextExposureState): void;
-export {};