@north-light/crouter 0.3.236 → 0.3.238

package/dist/core/substrate/render.js

@@ -10,10 +10,10 @@
 // rung (preview → a `# read when:` routing line; name → a bare entry), a
 // directory that carries its own document rendering that entry on the
 // directory's own row; a doc with NO boot entry leaks only into its dir's
-// `[+N more]` count, never a name — EXCEPT a node-store doc with no boot entry:
-// renderKnowledgeForSubject floors it up to `name` so it still shows its bare
-// name rather than collapsing into a hidden count. A node-store doc with boot
-// entries remains absent when none of those entries participates.
+// `[+N more]` count, never a name — EXCEPT a node-store doc with no boot entry,
+// which the plan floors up to `name` so it still shows its bare name rather
+// than collapsing into a hidden count. A node-store doc with boot entries
+// remains absent when none of those entries participates.
 //
 //   • the SYSTEM-PROMPT half — `<memory kind="preference">`
 //     (renderPreferencesSection) — the always-present memory-usage guidance plus
@@ -31,13 +31,11 @@
 // context rank. It never rewrites the frozen system snapshot.
 //
 // The pipeline is explicitly TWO-STEP and must never run in the other order:
-//   1. SELECT WINNERS — MemoryDoc → parseSubstrateDoc → (null-filter
-//      non-substrate) → per-doc boot rung (`bootRung`, the max `at` over
-//      participating `on: boot` surfaces entries) → gatePasses → first-wins DEDUP by
-//      name over the resolver's precedence order (nearest project > user >
-//      builtin). Node-store docs follow the same gate rule, but the
-//      knowledge-block render floors only a node-store doc with no boot entry to
-//      `name` — the one rung-floor exemption, scoped to the node store only.
+//   1. PLAN — planDelivery (plan.ts) computes every document's boot decision:
+//      rung, gates, profile cap, the node-store floor, and first-wins DEDUP by
+//      name over the corpus's precedence order (nearest project > user >
+//      builtin), per boot partition. This module only projects the plan's
+//      winners into its BootDoc render shape.
 //   2. RENDER IN DISPLAY ORDER — split winners into content vs. the rest;
 //      order content general→specific (builtin, user, project outermost→
 //      nearest, node store last) then by tree position then filename; place
@@ -63,82 +61,74 @@
 // directory's own line, with the directory's members nested beneath it.
 import { sep } from 'node:path';
 import { interpolateNodePaths } from '../canvas/paths.js';
-import { listAllMemoryDocs, loadMemoryTargetView, resolveMemoryDoc } from '../memory-resolver.js';
+import { ambientMemoryTarget, listAllMemoryDocs, loadMemoryTargetView, resolveMemoryDoc, } from '../memory-resolver.js';
 import { buildMemoryTree } from '../memory/tree.js';
 import { subKindsAvailableTo } from '../config.js';
 import { projectScopeRoots } from '../scope.js';
-import { gatePasses } from './gate.js';
 // De-barreled to LEAF modules on purpose: importing from './index.js' would
 // pull subject.js (canvas-db) transitively, re-tainting every CLI consumer of
 // the pure render fns. The canvas-db wrappers (renderPreferencesSection /
 // renderKnowledgeBlock) live in render-node.js instead.
 import { documentExposedAtOrAbove, registerDocumentExposure, } from './injected-store.js';
-import { bootRung, minRung, parseSubstrateDoc, previewLine, rungRank, } from './schema.js';
-import { cachedAllMemoryDocs, cachedSubstrateDocs } from './session-cache.js';
-/** First-wins dedup by (already-normalized) name, preserving the input's
- *  precedence order. The array's ORDER is the precedence signal — callers must
- *  pass docs already ordered highest-precedence-first; this function never
- *  reorders, only drops later duplicates. */
-function dedupeFirstWins(docs) {
-    const seen = new Set();
-    const out = [];
-    for (const d of docs) {
-        if (seen.has(d.name))
-            continue;
-        seen.add(d.name);
-        out.push(d);
-    }
-    return out;
-}
-/** STEP 1 — the resolver-provided WINNER docs of one `kind`, eligible at boot
- *  for `subject`: parsed (non-substrate docs null-filtered), gate-passed, then
- *  first-wins DEDUPED by name over the resolver's precedence order (nearest
- *  project > user > builtin) — each at its own boot rung, INCLUDING docs with
- *  NO boot entry (the tree counts them into `[+N more]`). This is winner
- *  selection ONLY; display ordering is a separate, later step (see
- *  renderGrouped) so a builtin doc can never mask a project/user override by
- *  virtue of sorting first. Uses the per-session cache so the full corpus is
- *  scanned + parsed at most once per session across the boot-render calls.
+import { bootPartitionOf, planDelivery } from './plan.js';
+import { parseSubstrateDoc, previewLine, rungRank, } from './schema.js';
+import { cachedEventCorpusInclusive } from './session-cache.js';
+/** The node's own store (`nodes/<id>/context/memory/`), loaded through the
+ *  resolver's descriptor loader like every other store. Returned across ALL
+ *  kinds — the node store is the catch-all this-node store and rides into the
+ *  knowledge block.
  *
- *  The profile relationship's cap applies HERE, before dedup: a `none` project
- *  leaves the corpus entirely (it contributes nothing, not even a `[+N more]`
- *  count, and so cannot shadow a wider-scope automatic winner), and every
- *  surviving doc's authored boot rung is clamped to its cap before dedup, the
- *  session cache, and delivery seeding see it. */
-function selectWinners(subject, kind) {
-    let corpus;
+ *  The store is addressed by the EXPLICIT `nodeId` rather than the host
+ *  process's, because one process renders for other nodes (crtrd claiming a
+ *  warm spare, `sys context prompt-review` walking the canvas). */
+function nodeStoreCorpus(nodeId) {
+    if (nodeId === null)
+        return [];
+    let sources;
     try {
-        corpus = bootCorpus();
+        // Narrowed to the node scope, so cwd and profile select no store.
+        sources = loadMemoryTargetView({ cwd: process.cwd(), profileId: null, nodeId }, { scope: 'node', quiet: true }).docs;
     }
     catch {
         return [];
     }
-    const eligible = [];
-    for (const d of corpus.docs) {
-        if (d.kind !== kind || d.projectMemory === 'none' || !gatePasses(d, subject))
-            continue;
-        const source = corpus.sources.get(d.path);
-        if (source === undefined)
-            continue;
-        eligible.push({ ...d, source, bootRung: minRung(bootRung(d, subject), d.projectMemory) });
+    const out = [];
+    for (const source of sources) {
+        const doc = parseSubstrateDoc(source);
+        if (doc !== null)
+            out.push({ doc, source });
     }
-    return dedupeFirstWins(eligible);
+    return out;
 }
-const bootSources = new WeakMap();
-/** The session's boot corpus, each parsed doc joined back to its descriptor.
- *  `cachedSubstrateDocs` is a filtered map of `cachedAllMemoryDocs`, and an
- *  absolute path names exactly one document in a corpus (store roots are
- *  realpath-deduped), so the path is the join key. The join is memoized per
- *  cached array because one session renders preferences, knowledge, and any
- *  config-change delta off the same corpus. */
-function bootCorpus() {
-    const docs = cachedSubstrateDocs(listAllMemoryDocs, parseSubstrateDoc);
-    let sources = bootSources.get(docs);
-    if (sources === undefined) {
-        sources = new Map(cachedAllMemoryDocs(listAllMemoryDocs).map((d) => [d.path, d]));
-        bootSources.set(docs, sources);
+/** The session's boot corpus in PRECEDENCE order: the resolver's stores first
+ *  (nearest project > user > builtin), the node's own store last so a resolver
+ *  document keeps its identity against a same-named node-local one. The
+ *  session cache already pairs each parsed doc with its descriptor, so the full
+ *  corpus is scanned and parsed at most once per session across the boot
+ *  renders. Node scope is filtered out of it because `nodeStoreCorpus` is the
+ *  one path that carries node docs into a boot render — they must not
+ *  double-surface. */
+function bootCorpus(nodeId) {
+    let resolver;
+    try {
+        resolver = cachedEventCorpusInclusive(listAllMemoryDocs, parseSubstrateDoc).filter((e) => e.doc.scope !== 'node');
+    }
+    catch {
+        return nodeStoreCorpus(nodeId);
     }
-    return { docs, sources };
+    return [...resolver, ...nodeStoreCorpus(nodeId)];
+}
+function bootPlan(subject, nodeId) {
+    return planDelivery(subject, { ...ambientMemoryTarget(), nodeId }, 'boot', {}, bootCorpus(nodeId));
+}
+/** STEP 1 — the plan's winners for one boot partition, in corpus order, each
+ *  carrying the rung the plan settled on. Display ordering is a separate, later
+ *  step (see renderGrouped) so a builtin doc can never mask a project/user
+ *  override by virtue of sorting first. */
+function bootWinners(plan, partition) {
+    return plan.docs
+        .filter((record) => record.winner && bootPartitionOf(record) === partition)
+        .map((record) => ({ ...record.doc, source: record.source, bootRung: record.finalRung }));
 }
 // Exposure registration
 function rendersAtBoot(doc) {
@@ -237,41 +227,6 @@ function renderGrouped(winners, rootLabel) {
         .join('\n\n');
     return { contentProse, tree: buildTree(rest, rootLabel), contentDocs: content };
 }
-/** The node's own store (`nodes/<id>/context/memory/`), loaded through the
- *  resolver's descriptor loader like every other store, then gate-passed.
- *  Returned across ALL kinds — the node store is the catch-all this-node store
- *  and rides into the knowledge block.
- *
- *  The store is addressed by the EXPLICIT `nodeId` rather than the host
- *  process's, because one process renders for other nodes (crtrd claiming a
- *  warm spare, `sys prompt-review` walking the canvas). The boot resolver
- *  corpus deliberately excludes node scope (`cachedAllMemoryDocs`), so this is
- *  the one path that carries node docs into a boot render and they cannot
- *  double-surface.
- *
- *  Node docs follow the same GATE rule as every other store. A doc with no boot
- *  entry is retained here; renderKnowledgeForSubject floors it to `name` so it
- *  shows as a bare name instead of collapsing into `[+N more]`. */
-function nodeStoreDocs(nodeId, subject) {
-    let docs;
-    try {
-        // Narrowed to the node scope, so cwd and profile select no store.
-        docs = loadMemoryTargetView({ cwd: process.cwd(), profileId: null, nodeId }, { scope: 'node', quiet: true }).docs;
-    }
-    catch {
-        return [];
-    }
-    const out = [];
-    for (const source of docs) {
-        const parsed = parseSubstrateDoc(source);
-        if (parsed === null || !gatePasses(parsed, subject))
-            continue;
-        const rung = bootRung(parsed, subject);
-        const floored = isVisible(rung) || parsed.surfaces.some((e) => e.on === 'boot') ? rung : 'name';
-        out.push({ ...parsed, source, bootRung: floored });
-    }
-    return out;
-}
 function leafSegment(name) {
     const i = name.lastIndexOf('/');
     return i === -1 ? name : name.slice(i + 1);
@@ -391,10 +346,10 @@ function renderChildren(dir, childPrefix, lines) {
  *  headed by `rootLabel`. Returns '' when there are no docs at all (the
  *  empty-tree contract).
  *
- *  Callers (renderGrouped) pass docs already first-wins deduped by step 1
- *  (selectWinners); merging them into the canonical tree keeps that first-wins
- *  outcome structurally, because a node's `document` is the first candidate at
- *  its identity in source order. */
+ *  Callers (renderGrouped) pass docs already first-wins deduped by the plan;
+ *  merging them into the canonical tree keeps that first-wins outcome
+ *  structurally, because a node's `document` is the first candidate at its
+ *  identity in source order. */
 function buildTree(docs, rootLabel) {
     if (docs.length === 0)
         return '';
@@ -463,7 +418,7 @@ function subKindDocCitation(subKind) {
 /** The computed "sub-personas you may spawn" menu for a subject's kind — the
  *  live restoration of the old `personas/resolve.ts` static menu, now derived
  *  at render time from the merged kind registry (`subKindsAvailableTo`) so it
- *  can never drift from `sys prompt-review --list`'s `subPersonas` metadata.
+ *  can never drift from `sys context prompt-review --list`'s `subPersonas` metadata.
  *  Returns '' when the kind has zero available sub-kinds (no dangling empty
  *  header). Emitted for BOTH base and orchestrator modes per the CTO's ruling —
  *  mode is irrelevant to which sub-kinds are spawnable. */
@@ -507,7 +462,9 @@ function buildPreferencesBlock(subject, target) {
     let protocol = '';
     let memBody = MEMORY_USAGE_GUIDANCE;
     if (subject !== null) {
-        const winners = selectWinners(subject, 'preference');
+        // No nodeId: a node-local doc rides the knowledge partition whatever its
+        // kind, so it never reaches the preference block.
+        const winners = bootWinners(bootPlan(subject, null), 'preference');
         recordRendered(target, winners);
         const grouped = renderGrouped(winners, 'preferences');
         contentDocs = grouped.contentDocs;
@@ -541,31 +498,20 @@ export function renderPreferencesForSubject(subject, target) {
     return buildPreferencesBlock(subject, target);
 }
 // 2. Knowledge — `<memory kind="knowledge">` (the first-message bearings).
-/** STEP 1 for the knowledge block, shared by the boot render and the
- *  config-change delta: the resolver's knowledge winners ∪ the node's own store
- *  (any kind), first-wins deduped resolver-first so a same-named node doc
- *  loses. Node docs carry the one rung floor — a node doc with NO boot entry is
- *  bumped to `name` so it surfaces as a bare name instead of collapsing into a
- *  `[+N more]` count; a node doc whose boot entries all fail their gates stays
- *  absent. */
-function knowledgeWinners(subject, nodeId) {
-    return dedupeFirstWins([...selectWinners(subject, 'knowledge'), ...nodeStoreDocs(nodeId, subject)]);
-}
 /** The `<memory kind="knowledge">` block embedded in the session_start bearings
  *  message (bearings.ts pushes it as a SIBLING of `<crtr-bearings>`, or drops it
  *  when ''). The consultable catalog: every eligible `kind: knowledge` resolver
  *  doc PLUS the node-local memory docs (any kind) — resolver docs win
  *  first-wins dedup over a same-named node-local doc. GROUPED by rung exactly
  *  like the preference block: content prose first (general→specific,
- *  node-local last), then the preview/name catalog tree. Node-local docs are
- *  floored HERE — a bootless node-local doc's rung is bumped to `name` before
- *  grouping, so it still surfaces as a bare-name tree entry rather than
- *  collapsing into a `[+N more]` count (its body still never renders: floored
- *  docs never reach the `content` rung). Procedural guidance and factual
+ *  node-local last), then the preview/name catalog tree. A bootless node-local
+ *  doc arrives floored to `name`, so it surfaces as a bare-name tree entry
+ *  rather than collapsing into a `[+N more]` count (its body still never
+ *  renders: floored docs never reach the `content` rung). Procedural guidance and factual
  *  references both live here as `knowledge`. Returns '' when nothing is
  *  eligible. */
 export function renderKnowledgeForSubject(subject, nodeId, target) {
-    const winners = knowledgeWinners(subject, nodeId);
+    const winners = bootWinners(bootPlan(subject, nodeId), 'knowledge');
     recordRendered(target, winners);
     const { contentProse, tree } = renderGrouped(winners, 'knowledge');
     if (contentProse === '' && tree === '')
@@ -601,8 +547,9 @@ function undelivered(target, docs) {
  *  because content already loaded into this context cannot be withdrawn.
  *  Rendered deltas register as transcript exposure through `target`. */
 export function renderConfigChangeDelta(subject, nodeId, target) {
-    const prefs = undelivered(target, selectWinners(subject, 'preference'));
-    const knowledgeDelta = undelivered(target, knowledgeWinners(subject, nodeId));
+    const plan = bootPlan(subject, nodeId);
+    const prefs = undelivered(target, bootWinners(plan, 'preference'));
+    const knowledgeDelta = undelivered(target, bootWinners(plan, 'knowledge'));
     recordRendered(target, [...prefs, ...knowledgeDelta]);
     const { contentDocs, tree } = renderGrouped(prefs, 'preferences');
     // Same split as the boot preference render: shipped bodies are protocol prose

package/dist/core/substrate/schema.d.ts

@@ -1,6 +1,5 @@
 import { type ProfileProjectMemory } from '../../api/dto/profiles.js';
 import type { MemoryDoc, MemoryScope } from '../memory-resolver.js';
-import type { NodeConfigSubject } from './subject-fields.js';
 export declare const KINDS: readonly ["knowledge", "preference"];
 export type DocKind = (typeof KINDS)[number];
 /** Is `v` one of the two valid document kinds? */
@@ -19,7 +18,7 @@ export declare const SURFACE_EVENTS: readonly ["boot", "workspace-open", "read",
 export type SurfaceEvent = (typeof SURFACE_EVENTS)[number];
 /** The rungs an entry may deliver at. There is no `none` — silence is the
  *  absence of an entry. (`Rung`'s `none` survives only as the internal
- *  ranking floor, e.g. `bootRung` of a doc with no boot entry.) */
+ *  ranking floor — the planner's verdict for a doc that delivers nothing.) */
 export declare const SURFACE_RUNGS: readonly ["name", "preview", "content"];
 export type SurfaceRung = (typeof SURFACE_RUNGS)[number];
 /** One routing entry: when event `on` exposes a subject that fits `match`
@@ -41,10 +40,6 @@ export interface SurfaceEntry {
     gate?: GatePredicate;
     at: SurfaceRung;
 }
-/** A doc's boot rung for `subject`: the highest `at` over participating
- *  `boot` entries, `none` when it carries none. The boot render's per-doc
- *  selection input. */
-export declare function bootRung(doc: Pick<SubstrateSchema, 'surfaces'>, subject: NodeConfigSubject): Rung;
 /** A gate predicate tree, evaluated by predicate.ts (`evalCondition`) against
  *  the node-config subject. Typed loosely on purpose — the matcher engine owns
  *  validation; structurally it is a field→matcher map with optional

package/dist/core/substrate/schema.js

@@ -8,7 +8,6 @@
 // never throw): invalid `surfaces` entries are dropped rather than crashing a
 // render, and `crtr memory lint` owns strict authoring-time enforcement.
 import { PROFILE_PROJECT_MEMORY_VALUES } from '../../api/dto/profiles.js';
-import { surfaceEntryGatePasses } from './gate.js';
 // Kinds — the two semantic kinds (design §3): `knowledge` (consult — procedural
 // playbooks + factual references merged) vs `preference` (behave — standing
 // directives). `kind` is a load-bearing binary, not a content taxonomy.
@@ -51,21 +50,8 @@ export { normalizeNameSegment, normalizeDocName, resolveLocalName as resolveDocN
 export const SURFACE_EVENTS = ['boot', 'workspace-open', 'read', 'memory-read', 'command', 'pre-command'];
 /** The rungs an entry may deliver at. There is no `none` — silence is the
  *  absence of an entry. (`Rung`'s `none` survives only as the internal
- *  ranking floor, e.g. `bootRung` of a doc with no boot entry.) */
+ *  ranking floor — the planner's verdict for a doc that delivers nothing.) */
 export const SURFACE_RUNGS = ['name', 'preview', 'content'];
-/** A doc's boot rung for `subject`: the highest `at` over participating
- *  `boot` entries, `none` when it carries none. The boot render's per-doc
- *  selection input. */
-export function bootRung(doc, subject) {
-    let r = 'none';
-    for (const e of doc.surfaces) {
-        if (e.on !== 'boot' || !surfaceEntryGatePasses(e, subject))
-            continue;
-        if (rungRank(e.at) > rungRank(r))
-            r = e.at;
-    }
-    return r;
-}
 // Parse / validate.
 /** Parse a raw frontmatter record (from `parseFrontmatterGeneric`, via the
  *  resolver) into a typed schema with defaults applied. Returns `null` when the

package/dist/core/substrate/session-cache.d.ts

@@ -16,20 +16,12 @@ export declare function clearSessionCache(): void;
 /** The FULL corpus (listAllMemoryDocs()), INCLUDING node scope, scanned at
  *  most once per session. `listFn` is injected by the caller to avoid
  *  circular imports at module init. This is the single filesystem walk the
- *  whole module performs — `cachedAllMemoryDocs` below derives its
- *  node-excluded view from this result rather than re-scanning. Consumers
- *  that need every referenceable doc (inline memory-reference inventory) call
- *  this directly instead of `cachedAllMemoryDocs`. */
+ *  whole module performs — every other entry derives from this result rather
+ *  than re-scanning. */
 export declare function cachedAllMemoryDocsInclusive(listFn: ListAllMemoryDocsFn): MemoryDoc[];
 /** allMemoryDocsInclusive parsed and paired with its descriptors, INCLUDING
  *  node scope — the event corpus, and the module's only parse pass. */
 export declare function cachedEventCorpusInclusive(listFn: ListAllMemoryDocsFn, parseFn: ParseSubstrateDocFn): EventCorpusDoc[];
 /** The parsed docs of the inclusive event corpus, without their descriptors. */
 export declare function cachedSubstrateDocsInclusive(listFn: ListAllMemoryDocsFn, parseFn: ParseSubstrateDocFn): SubstrateDoc[];
-/** All memory docs (listAllMemoryDocs()), scanned once per session.
- *  `listFn` is injected by the caller to avoid circular imports at module init. */
-export declare function cachedAllMemoryDocs(listFn: ListAllMemoryDocsFn): MemoryDoc[];
-/** The node-excluded parsed view — render.ts's boot corpus. Projected out of
- *  the inclusive parse rather than parsed again. */
-export declare function cachedSubstrateDocs(listFn: ListAllMemoryDocsFn, parseFn: ParseSubstrateDocFn): SubstrateDoc[];
 export {};

package/dist/core/substrate/session-cache.js

@@ -23,22 +23,17 @@
 //                        filtering/mapping, never by calling listFn() again.
 //   • eventCorpusInclusive — allMemoryDocsInclusive parsed once, each surviving
 //                        SubstrateDoc paired with the resolver descriptor it
-//                        parsed from. The ONE parse pass; both substrate views
-//                        below project out of it. on-read.ts consumes the pairs
-//                        because `./` memory-read globs anchor on the
-//                        descriptor's canonical routing anchor.
+//                        parsed from. The ONE parse pass every delivery plan
+//                        reads from. The pairs matter: `./` memory-read globs
+//                        anchor on the descriptor's canonical routing anchor,
+//                        and the boot tree orders by its physical path. Boot
+//                        filters node scope out of it and loads the node's own
+//                        store separately (render.ts), so a node doc never
+//                        double-surfaces there.
 //   • substrateDocsInclusive — the parsed docs alone, still including node
 //                        scope. Consumers that need every referenceable doc
 //                        (e.g. the inline memory-reference inventory) use this
 //                        pair with allMemoryDocsInclusive.
-//   • allMemoryDocs    — allMemoryDocsInclusive with node-scope docs excluded
-//                        (boot-only view — see the comment on
-//                        cachedAllMemoryDocs). Consumed by render.ts.
-//   • substrateDocs    — the same node-excluded view, parsed.  Used by
-//                        render.ts's resolver corpus. The event corpus
-//                        (on-read.ts) uses the INCLUSIVE pairs instead: node
-//                        docs' surfaces entries fire on read/memory-read/
-//                        command like any other store's.
 // Node subjects are deliberately NOT cached: lifecycle, mode, kind, and other
 // gate inputs can change while a resident broker/session remains live. Rendering
 // must always gate against the current persisted node metadata.
@@ -46,8 +41,6 @@ const _cache = {
     allMemoryDocsInclusive: null,
     eventCorpusInclusive: null,
     substrateDocsInclusive: null,
-    allMemoryDocs: null,
-    substrateDocs: null,
 };
 /** Called by canvas-doc-substrate.ts on every `session_start`.
  *  Resets all cached values so the next access triggers a fresh scan.  */
@@ -55,16 +48,12 @@ export function clearSessionCache() {
     _cache.allMemoryDocsInclusive = null;
     _cache.eventCorpusInclusive = null;
     _cache.substrateDocsInclusive = null;
-    _cache.allMemoryDocs = null;
-    _cache.substrateDocs = null;
 }
 /** The FULL corpus (listAllMemoryDocs()), INCLUDING node scope, scanned at
  *  most once per session. `listFn` is injected by the caller to avoid
  *  circular imports at module init. This is the single filesystem walk the
- *  whole module performs — `cachedAllMemoryDocs` below derives its
- *  node-excluded view from this result rather than re-scanning. Consumers
- *  that need every referenceable doc (inline memory-reference inventory) call
- *  this directly instead of `cachedAllMemoryDocs`. */
+ *  whole module performs — every other entry derives from this result rather
+ *  than re-scanning. */
 export function cachedAllMemoryDocsInclusive(listFn) {
     if (_cache.allMemoryDocsInclusive === null) {
         _cache.allMemoryDocsInclusive = listFn();
@@ -92,30 +81,3 @@ export function cachedSubstrateDocsInclusive(listFn, parseFn) {
     }
     return _cache.substrateDocsInclusive;
 }
-/** All memory docs (listAllMemoryDocs()), scanned once per session.
- *  `listFn` is injected by the caller to avoid circular imports at module init. */
-export function cachedAllMemoryDocs(listFn) {
-    if (_cache.allMemoryDocs === null) {
-        // The BOOT pipeline (render.ts) EXCLUDES node-scope docs: node-local
-        // memory surfaces at boot via render.ts's nodeLocalDocs (any kind, floored
-        // into the knowledge block), NOT through the resolver corpus, so a node doc
-        // must not also enter there (it would double-surface at boot). The event
-        // corpus (on-read.ts) uses the inclusive view — node docs' surfaces
-        // entries fire on read/memory-read/command. The `node` scope reaches CLI
-        // read/list/find/delete through the uncached listAllMemoryDocs() path.
-        // Derived from the inclusive cache by filtering, so listFn() itself still
-        // runs at most once per session even though both views are consumed.
-        _cache.allMemoryDocs = cachedAllMemoryDocsInclusive(listFn).filter((d) => d.scope !== 'node');
-    }
-    return _cache.allMemoryDocs;
-}
-/** The node-excluded parsed view — render.ts's boot corpus. Projected out of
- *  the inclusive parse rather than parsed again. */
-export function cachedSubstrateDocs(listFn, parseFn) {
-    if (_cache.substrateDocs === null) {
-        _cache.substrateDocs = cachedEventCorpusInclusive(listFn, parseFn)
-            .filter((e) => e.doc.scope !== 'node')
-            .map((e) => e.doc);
-    }
-    return _cache.substrateDocs;
-}

package/dist/core/substrate/subject-fields.d.ts

@@ -31,10 +31,7 @@ export interface NodeConfigSubject {
 }
 /** The scope a cwd resolves into: `project` when scope.ts finds a
  *  nearest-ancestor `.crouter/` at/above it, else `user`. Reuses the existing
- *  resolver (`projectScopeRoot`). NOTE: `findProjectScopeRoot` is process-cached
- *  on first call, so for a node assembling its OWN subject (cwd === process.cwd)
- *  this is exact; resolving an arbitrary unrelated cwd in the same process would
- *  return the cached root — fine for per-node subject assembly. */
+ *  resolver (`projectScopeRoot`). */
 export declare function scopeForCwd(cwd: string): 'user' | 'project';
 /** Resolve `profile_id` to the manifest's mutable `name` for the gate subject.
  *  NEVER throws: a missing/deleted profile resolves to `null` silently (the

package/dist/core/substrate/subject-fields.js

@@ -1,7 +1,7 @@
 // subject-fields.ts — the PURE half of subject assembly: the NodeConfigSubject
 // shape plus the two derived-field resolvers (`scopeForCwd`, `profileNameFor`)
 // that read scope/profile config but NEVER the canvas-db. Split out of
-// subject.ts so CLI consumers (`sys prompt-review`) can build a subject from an
+// subject.ts so CLI consumers (`sys context prompt-review`) can build a subject from an
 // API-fetched node without pulling subject.ts's canvas-db reach (getNode/getRow).
 // The canvas-db assembler (`assembleNodeSubject`, `spineDepth`) stays in
 // subject.ts for broker/daemon-side callers.
@@ -10,10 +10,7 @@ import { loadProfileManifest } from '../profiles/manifest.js';
 import { CrtrError } from '../errors.js';
 /** The scope a cwd resolves into: `project` when scope.ts finds a
  *  nearest-ancestor `.crouter/` at/above it, else `user`. Reuses the existing
- *  resolver (`projectScopeRoot`). NOTE: `findProjectScopeRoot` is process-cached
- *  on first call, so for a node assembling its OWN subject (cwd === process.cwd)
- *  this is exact; resolving an arbitrary unrelated cwd in the same process would
- *  return the cached root — fine for per-node subject assembly. */
+ *  resolver (`projectScopeRoot`). */
 export function scopeForCwd(cwd) {
     return projectScopeRoot(cwd) !== null ? 'project' : 'user';
 }

package/dist/core/substrate/surface-match.d.ts

@@ -1,4 +1,4 @@
-import { type Rung, type SubstrateDoc, type SurfaceEntry } from './schema.js';
+import { type Rung, type SubstrateDoc, type SurfaceEntry, type SurfaceEvent } from './schema.js';
 import type { NodeConfigSubject } from './subject-fields.js';
 /** The project directory owning a doc's store: the path segment stack above
  *  the doc's `.crouter` dir. `null` when the doc's path carries no `.crouter`
@@ -14,12 +14,12 @@ export declare function underOwningRoot(doc: Pick<SubstrateDoc, 'path'>, absFile
  *  realpathed. `readFrontmatter` is the read file's own parsed YAML (empty
  *  for non-markdown files); an empty record never satisfies
  *  `matchFrontmatter`. */
-export declare function matchesReadEntry(entry: SurfaceEntry, doc: Pick<SubstrateDoc, 'path' | 'scope'>, subject: NodeConfigSubject, absReadFile: string, readFrontmatter: Record<string, unknown>): boolean;
+export declare function matchesReadEntry(entry: SurfaceEntry, doc: Pick<SubstrateDoc, 'path' | 'scope'>, subject: NodeConfigSubject | null, absReadFile: string, readFrontmatter: Record<string, unknown>): boolean;
 /** Does a `memory-read` entry on a carrier anchored at `routingAnchor` fit a
  *  resolved read of the doc known by its exact canonical `name`? */
 export declare function matchesMemoryReadEntry(entry: SurfaceEntry, routingAnchor: string, subject: NodeConfigSubject | null, name: string): boolean;
 /** Does a `command` entry fit the executed command string? */
-export declare function matchesCommandEntry(entry: SurfaceEntry, subject: NodeConfigSubject, command: string): boolean;
+export declare function matchesCommandEntry(entry: SurfaceEntry, subject: NodeConfigSubject | null, command: string): boolean;
 /** Remove heredoc BODIES (the stdin data between `<<DELIM` and its closing
  *  `DELIM` line) from a command before it is matched. The opening line is kept
  *  — `crtr push final <<'EOF'` is still a real `push final` invocation — but the
@@ -34,21 +34,41 @@ export declare function stripHeredocs(command: string): string;
  *  command with its heredoc bodies stripped. Subshell parentheses, backticks,
  *  and path-prefixed binaries stay unhandled: this is a guardrail against the
  *  faithful-but-uninformed action, not an enforcement boundary. */
-export declare function matchesPreCommandEntry(entry: SurfaceEntry, subject: NodeConfigSubject, command: string): boolean;
+export declare function matchesPreCommandEntry(entry: SurfaceEntry, subject: NodeConfigSubject | null, command: string): boolean;
+/** What an event occurrence exposes for matching. A field the event does not
+ *  use is ignored; a field the event needs and lacks matches nothing. */
+export interface SurfaceMatchPayload {
+    /** `read`: the read file, already realpathed. */
+    absoluteFile?: string;
+    /** `read`: the read file's own parsed YAML (empty for a non-markdown file). */
+    readFrontmatter?: Record<string, unknown>;
+    /** `memory-read`: the exact canonical name the read resolved to. */
+    resolvedCanonicalName?: string;
+    /** `memory-read`: the CARRIER's routing anchor, from its resolver descriptor
+     *  — not derivable from a canonical name, which cannot say whether the doc
+     *  fronts its own directory. */
+    routingAnchor?: string;
+    /** `command` / `pre-command`: the command string. */
+    command?: string;
+}
+/** A doc as the matchers see it. `path`/`scope` are consulted only by `read`
+ *  (a `./`-anchored glob resolves against the store's owning repo dir). */
+type MatchDoc = Pick<SubstrateDoc, 'surfaces'> & Partial<Pick<SubstrateDoc, 'path' | 'scope'>>;
+/** Does ONE entry of `event` fit this occurrence — constraints and the entry's
+ *  own gate together? */
+export declare function surfaceEntryParticipates(entry: SurfaceEntry, doc: MatchDoc, subject: NodeConfigSubject | null, event: SurfaceEvent, payload: SurfaceMatchPayload): boolean;
+/** The entry that decides this doc's delivery for one event occurrence: the
+ *  highest-rung participating entry, or null when none participates. */
+export declare function matchingSurfaceEntry(doc: MatchDoc, subject: NodeConfigSubject | null, event: SurfaceEvent, payload: SurfaceMatchPayload): SurfaceEntry | null;
 /** The doc's delivery rung for a read of `absReadFile` (already realpathed). */
-export declare function readDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces' | 'path' | 'scope'>, subject: NodeConfigSubject, absReadFile: string, readFrontmatter: Record<string, unknown>): Rung;
-/** The doc's workspace-open rung. Presence of an entry is the match; callers
- *  scope the corpus to project stores mounted by the subject's cwd/profile. */
-export declare function workspaceOpenRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject): Rung;
+export declare function readDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces' | 'path' | 'scope'>, subject: NodeConfigSubject | null, absReadFile: string, readFrontmatter: Record<string, unknown>): Rung;
+/** The doc's workspace-open rung. */
+export declare function workspaceOpenRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject | null): Rung;
 /** The doc's delivery rung for a `crtr memory read` that resolved a doc known
- *  by its exact canonical `name` — no mount-stripped or other alias.
- *  `routingAnchor` comes from the doc's resolver descriptor — it is not
- *  derivable from the canonical name, which cannot say whether the doc fronts
- *  its own directory. */
+ *  by its exact canonical `name` — no mount-stripped or other alias. */
 export declare function memoryReadDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces'>, routingAnchor: string, subject: NodeConfigSubject | null, name: string): Rung;
 /** The doc's delivery rung for an executed command string. */
-export declare function commandDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject, command: string): Rung;
-/** The doc's delivery rung for a command about to run — the highest `at`
- *  over the doc's matching `pre-command` entries, folded the same way as every
- *  other event. */
-export declare function preCommandDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject, command: string): Rung;
+export declare function commandDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject | null, command: string): Rung;
+/** The doc's delivery rung for a command about to run. */
+export declare function preCommandDeliveryRung(doc: Pick<SubstrateDoc, 'surfaces'>, subject: NodeConfigSubject | null, command: string): Rung;
+export {};