@north-light/crouter 0.3.248 → 0.3.250

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -29,6 +29,7 @@
 //   <nodeDir>/fake-pi.error          — any boot/import failure
 //   <nodeDir>/fake-pi.cmd            — harness writes ONE JSON command (turn|stop|auto_retry|dialog)
 //   <nodeDir>/fake-pi.dialog.jsonl   — one line per resolved unattended dialog (§5.4)
+import { spawn } from 'node:child_process';
 import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync, } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -940,6 +941,16 @@ class FakeSession {
     async dispatch(cmd) {
         const ctx = this.buildCtx();
         switch (cmd.cmd) {
+            case 'self_close': {
+                const cli = join(dirname(new URL(import.meta.url).pathname), '../../../cli.js');
+                const resultPath = join(this.dir, 'self-close-result');
+                const pidPath = join(this.dir, 'self-close-shell.pid');
+                const shell = spawn('sh', ['-c', `"${process.execPath}" "${cli}" node lifecycle close --node "$CRTR_NODE_ID"; code=$?; printf '%s\\n' "$code" > "${resultPath}"; while :; do sleep 1; done`], { detached: true, stdio: 'ignore', env: process.env });
+                if (shell.pid !== undefined)
+                    writeFileSync(pidPath, `${shell.pid}\n`);
+                shell.unref();
+                break;
+            }
             case 'stream':
                 // Drive a subscribe-channel streaming turn WITHOUT a controller (G3:
                 // produce-while-detached) or with sized frames (G8: a fast event stream

package/dist/core/__tests__/human-deliver.test.js

@@ -47,7 +47,7 @@ async function withMutedStdout(fn) {
 }
 function bridgeUnder() {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const bridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     return { parent, bridge };
 }
 function submitBridgePage(bridge) {
@@ -178,7 +178,7 @@ describe('terminal ticket delivery', () => {
     test('approved companions receive one canonical final while dismissed companions remain canceled', async () => {
         const { bridge } = bridgeUnder();
         const dir = submitBridgePage(bridge);
-        const companion = spawnNode({ kind: 'general', parent: bridge, cwd: home, name: 'feedback companion', lifecycle: 'resident' }).node_id;
+        const companion = spawnNode({ kind: 'general', parent: bridge, creator: bridge, cwd: home, name: 'feedback companion', lifecycle: 'resident' }).node_id;
         createPageFeedbackComment(dir, { quote: 'Ship it?', note: 'Confirm the release.', companionNodeId: companion });
         transition(companion, 'finish');
         await resolvePageTicket(bridge, { question: { text: 'yes', edited: true } });
@@ -195,7 +195,7 @@ describe('terminal ticket delivery', () => {
         assert.throws(() => reviveNode(companion, { resume: true, capacity: 'freeze' }), /finalization latch/);
         const { bridge: dismissedBridge } = bridgeUnder();
         const dismissedDir = submitBridgePage(dismissedBridge);
-        const dismissedCompanion = spawnNode({ kind: 'general', parent: dismissedBridge, cwd: home, name: 'dismissed feedback companion', lifecycle: 'resident' }).node_id;
+        const dismissedCompanion = spawnNode({ kind: 'general', parent: dismissedBridge, creator: dismissedBridge, cwd: home, name: 'dismissed feedback companion', lifecycle: 'resident' }).node_id;
         createPageFeedbackComment(dismissedDir, { quote: 'Ship it?', note: 'Do not ship.', companionNodeId: dismissedCompanion });
         await cancelHumanTicket(dismissedBridge, { reason: 'dismissed', actor: 'human' });
         assert.equal(getNode(dismissedCompanion)?.status, 'canceled');
@@ -207,7 +207,7 @@ describe('terminal ticket delivery', () => {
     });
     test('cancelHumanTicket finishes the bridge and notifies non-actor subscribers', async () => {
         const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
-        const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+        const bridge = spawnNode({ kind: 'human', parent: actor, creator: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
         const other = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'other' }).node_id;
         const { subscribe } = await import('../canvas/canvas.js');
         subscribe(other, bridge, true);
@@ -223,7 +223,7 @@ describe('terminal ticket delivery', () => {
     });
     test('cancellation reaches subscribers when the bridge is already done, and retries conflict rather than fail', async () => {
         const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
-        const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+        const bridge = spawnNode({ kind: 'human', parent: actor, creator: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
         const other = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'other' }).node_id;
         const { subscribe } = await import('../canvas/canvas.js');
         subscribe(other, bridge, true);

package/dist/core/__tests__/integration/deferred-no-wake.test.js

@@ -44,7 +44,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { DatabaseSync } from 'node:sqlite';
-import { createNode, deleteNode, getNode, setFrozen, setStatus, withFreshTerminalGuard } from '../../canvas/canvas.js';
+import { createNode, deleteNode, getNode, setFrozen, setStatus, subscribe, withFreshTerminalGuard } from '../../canvas/canvas.js';
 import { hasNoNaturalCycle } from '../../runtime/revive-all.js';
 import { canvasDbPath, nodeDir, apiSocketPath } from '../../canvas/paths.js';
 import { closeDb } from '../../canvas/db.js';
@@ -148,7 +148,10 @@ after(() => {
 // Command layer — the immediate-delivery wake block in node.ts
 test('node message send --tier deferred to an ordinary dormant (idle-released) target does not revive it — appended and held for the next natural cycle', { timeout: 30_000 }, async () => {
     const id = 'idleReleaseTarget';
-    createNode(node(id, { status: 'idle', intent: 'idle-release' }));
+    // Resident: the hold is what a target with a real later cycle gets. A
+    // terminal target takes no such cycle, so its mail is raised to the steering
+    // tier instead (locked by the next test).
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release' }));
     const inboxBefore = readInboxSince(id, undefined).length;
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
@@ -170,6 +173,30 @@ test('node message send --tier deferred to an ordinary dormant (idle-released) t
     assert.equal(after.status, 'idle', 'target left exactly where it was');
     assert.equal(after.intent, 'idle-release', 'target left exactly where it was');
 });
+test('node message send --tier deferred to a TERMINAL-lifecycle target is raised to the steering tier and wakes it', { timeout: 30_000 }, async () => {
+    const id = 'terminalLifecycleTarget';
+    createNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    // Fully stubbed (never delegates): the point is that the raised entry DOES
+    // attempt the wake, so a real detached broker must not be spawned to prove it.
+    const originalLaunch = headlessBrokerHost.launch;
+    let launchCalls = 0;
+    headlessBrokerHost.launch = (() => {
+        launchCalls++;
+        return { pid: 0x7ffffffe, exited: new Promise(() => { }) };
+    });
+    let res;
+    try {
+        res = (await messageSendLeaf().run({ to: id, tier: 'deferred', body: 'not held' }));
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+    }
+    const entries = readInboxSince(id, undefined);
+    assert.equal(entries.length, 1, 'the message is durably appended');
+    assert.equal(entries[0].tier, 'urgent', 'a terminal target takes no later cycle, so the entry is raised to the steering tier');
+    assert.equal(launchCalls, 1, 'the raised entry wakes the dormant terminal target instead of waiting for a cycle it never takes');
+    assert.equal(res['revived'], true, 'the send reports the wake it actually performed');
+});
 test('node message send --tier deferred rejects ordinary terminal targets but accepts a frozen terminal target with a thaw cycle owed', { timeout: 30_000 }, async () => {
     for (const status of ['done', 'canceled']) {
         const id = `terminal-${status}`;
@@ -385,7 +412,13 @@ test("withFreshTerminalGuard reports 'missing' — never runs the guarded body
 // proven separately below through the real inbox watcher.
 test('daemon second pass: a deferred-only unseen set never wakes an idle-released node; a later non-deferred entry wakes it (decision only — real delivery is proven separately below)', { timeout: 30_000 }, async () => {
     const id = 'idleReleaseDeferredDaemon';
-    createNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    // A live child is a standing obligation, which is what keeps this row
+    // idle-released across the tick. Without one it would settle into its park
+    // instead (the resident carve-out, locked in the next test) and the wake half
+    // below would be measuring a parked row.
+    createNode(node(`${id}Child`, { status: 'active' }));
+    subscribe(id, `${id}Child`);
     const baseline = readCursor(id); // undefined — the real watcher never ran here
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
@@ -437,6 +470,34 @@ test('daemon second pass: a deferred-only unseen set never wakes an idle-release
     const unseen = readInboxSince(id, baseline).map((e) => e.entry_id);
     assert.deepEqual(unseen, [deferredEntry.entry_id, normalEntry.entry_id], 'neither entry was dropped or skipped by the daemon');
 });
+test('the lifecycle tick parks a resident holding deferred-only mail — mail that never wakes it must not hold it idle forever either', { timeout: 30_000 }, async () => {
+    const id = 'residentDeferredOnly';
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    const originalLaunch = headlessBrokerHost.launch;
+    let launchCalls = 0;
+    headlessBrokerHost.launch = (() => {
+        launchCalls++;
+        return { pid: 0x7ffffffe, exited: new Promise(() => { }) };
+    });
+    try {
+        const held = appendInbox(id, {
+            from: null,
+            tier: 'deferred',
+            kind: 'message',
+            label: 'Child done — auto-done notice',
+            data: { reason: 'child-auto-done' },
+        });
+        await superviseTick();
+        const after = getNode(id);
+        assert.equal(after.status, 'done', 'the resident settles into its park instead of sitting idle behind mail that cannot wake it');
+        assert.equal(after.intent, 'parked', 'parked, not released');
+        assert.equal(launchCalls, 0, 'settling quietly never launches an engine');
+        assert.deepEqual(readInboxSince(id, undefined).map((e) => e.entry_id), [held.entry_id], 'the held entry survives the park, ready for the cycle that reopens the conversation');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+    }
+});
 function makeFakePi() {
     const handlers = {};
     return {
@@ -453,7 +514,7 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
     // The watcher may advance its cursor only for the current broker generation.
     // This fake Pi runs in this test process, so its fabricated node must carry
     // that process as the active broker just like a real launched node does.
-    createNode(node(id, { status: 'idle', intent: null, pi_pid: process.pid }));
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: null, pi_pid: process.pid }));
     const TICK_MS = 20;
     const DEBOUNCE_MS = 25;
     const SETTLE_MS = TICK_MS * 2 + DEBOUNCE_MS + 30;

package/dist/core/__tests__/integration/human-deliver-e2e.test.js

@@ -89,7 +89,7 @@ function reportBody(ref) {
 }
 test('malformed resolves leave the mounted ticket claim in place', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const pageBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const pageBridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     const pageDir = submitBridgePage(pageBridge);
     const pageClaim = claimTicket(pageDir);
     assert.ok(pageClaim !== null);
@@ -101,7 +101,7 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
         await expectReviewSubmitGuidance(pageBridge, body);
         assert.equal(readTicketClaim(pageDir)?.token, pageClaim.token, 'feedback-shaped input must not take over the live claim');
     }
-    const reviewBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-review', lifecycle: 'terminal' }).node_id;
+    const reviewBridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-review', lifecycle: 'terminal' }).node_id;
     const reviewDir = ticketDir(reviewBridge);
     const file = join(home, 'review.md');
     writeFileSync(file, '# Review\n');
@@ -114,7 +114,7 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
 });
 test('the ticket resolve route pushFinals the readable answer to the parent', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const bridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     const dir = submitBridgePage(bridge);
     const result = await client.resolveHumanTicket(bridge, { responses: { question: { text: 'yes, ship', edited: true } } });
     assert.deepEqual(result, { completed: true, reply_delivered: true, kind: 'page' });

package/dist/core/__tests__/integration/revive.test.js

@@ -36,6 +36,7 @@ import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../ca
 import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
 import { readInboxSince } from '../../feed/inbox.js';
 import { closeDb } from '../../canvas/db.js';
+import { apiSocketPath } from '../../canvas/paths.js';
 import { buildPiArgv } from '../../runtime/launch.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
 import { resumeArgs, reviveNode } from '../../runtime/revive.js';
@@ -43,6 +44,8 @@ import { readGoal, writeGoal } from '../../runtime/kickoff.js';
 import { parseCard } from '../../../shared/generated-context.js';
 import { seedRoadmap } from '../../runtime/roadmap.js';
 import { InputError } from '../../io.js';
+import { CrtrClient } from '../../../api/client.js';
+import { readFault } from '../../runtime/fault.js';
 import { createHarness } from '../helpers/harness.js';
 import { bindTestFleet } from '../helpers/fleet.js';
 import { resetFleetForTests } from '../../runtime/fleet.js';
@@ -309,6 +312,32 @@ test('a recovery relaunch keeps the armed deadline; a wake revive consumes it',
         await h.dispose();
     }
 });
+test('a second broker session-bound request is shut down instead of adopting a live node transcript (NL-162)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-session-owner' });
+    try {
+        const sessionFile = join(home, 'sessions', 'owned.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, '{}\n', 'utf8');
+        const owner = h.fabricateBrokerNode({
+            id: 'live-session-owner',
+            pi_pid: process.pid,
+            pi_session_id: 'owner-session',
+            pi_session_file: sessionFile,
+        });
+        const claimant = h.fabricateBrokerNode({ id: 'session-claimant', pi_pid: deadPid() });
+        const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
+        const result = await client.bindBrokerSession(claimant, {
+            piSessionId: 'claimant-session', sessionFile, pid: process.pid, reason: 'startup', reviewBoundaryIds: [],
+        });
+        assert.deepEqual(result, { action: 'shutdown' }, 'the second broker is refused before it can bind the live transcript');
+        assert.equal(h.node(owner)?.pi_session_file, sessionFile, 'the live owner retains its transcript coordinate');
+        assert.equal(h.node(claimant)?.pi_session_file, null, 'the claimant never adopts the owner transcript');
+        assert.equal(readFault(claimant)?.op, 'session-file-ownership', 'the refusal is durable and observable');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode fresh-fallback clears the stale session identity (Major-3: no phantom stranded-relaunch)', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-freshfb' });
     try {
@@ -414,6 +443,25 @@ test('reviveNode throws a typed cwd_missing error and does NOT crash the node wh
         await h.dispose();
     }
 });
+test('reviveNode relaunches fresh when the session header cwd was removed (NL-143)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-stale-session-cwd' });
+    try {
+        const removedCwd = join(home, 'removed-worktree');
+        const sessionFile = join(home, 'sessions', 'stale-cwd.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'stale-session', cwd: removedCwd })}\n`, 'utf8');
+        const M = h.fabricateBrokerNode({
+            status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'stale-session', pi_session_file: sessionFile,
+        });
+        const result = reviveNode(M, { resume: true, capacity: 'freeze', recovery: true });
+        assert.equal(result.resumed, false, 'the missing session cwd vetoes --session and launches fresh');
+        assert.equal(h.node(M)?.pi_session_id, null, 'the stale session id is cleared before the fresh launch');
+        assert.equal(h.node(M)?.pi_session_file, null, 'the stale session file is cleared before the fresh launch');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode crashes and clears pid when launch/preflight throws', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-fail' });
     const originalLaunch = headlessBrokerHost.launch;

package/dist/core/__tests__/integration/spawn-root.test.js

@@ -9,6 +9,8 @@ import { join } from 'node:path';
 import { createServer } from 'node:net';
 import { spawn as spawnProcess } from 'node:child_process';
 import { createNode, getNode, getRow, subscribersOf } from '../../canvas/canvas.js';
+import { coalesce, readInboxSince } from '../../feed/inbox.js';
+import { coalesceBrokerInbox } from '../../runtime/broker/inbox.js';
 import { closeDb } from '../../canvas/db.js';
 import { nodeDir } from '../../canvas/paths.js';
 import { spawnNode } from '../../runtime/nodes.js';
@@ -66,7 +68,7 @@ after(() => {
 });
 test('managed child: parent on the spine + active subscription + provenance', () => {
     createNode(spawner('A'));
-    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A' });
+    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: 'A' });
     const meta = getNode(child.node_id);
     assert.equal(meta.parent, 'A', 'child keeps its spine parent');
     assert.equal(meta.spawned_by, 'A', 'child provenance defaults to its parent');
@@ -76,6 +78,39 @@ test('managed child: parent on the spine + active subscription + provenance', ()
     assert.equal(subs[0].node_id, 'A');
     assert.equal(subs[0].active, true, 'parent subscription is active');
 });
+test('external child birth is deferred, persists its creator, and renders its age at delivery in both inbox mirrors', () => {
+    createNode(spawner('A'));
+    const creator = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null, name: 'Core' });
+    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: creator.node_id, name: 'worker' });
+    const saved = getNode(child.node_id);
+    assert.equal(saved.creator, creator.node_id, 'creator persists through meta.json and getNode');
+    const [entry] = readInboxSince('A');
+    assert.ok(entry, 'the parent receives exactly one birth entry');
+    assert.equal(entry.from, child.node_id, 'birth groups with the child’s future reports');
+    assert.equal(entry.tier, 'deferred', 'birth never starts a parent cycle');
+    assert.equal(entry.data?.['body'], `worker (${child.node_id}, developer) was created under you by Core [[CRTR_BIRTH_ANNOUNCEMENT_AGE]] ago. For your awareness only — no response or action is needed, and no need to mention it unless asked. Treat its future reports as background you already know about; investigate only if something genuinely needs you.`);
+    for (const [elapsed, age] of [
+        [0, 'moments'],
+        [60_000, '1 minute'],
+        [59 * 60_000, '59 minutes'],
+        [60 * 60_000, '1 hour'],
+        [47 * 60 * 60_000, '47 hours'],
+        [48 * 60 * 60_000, '2 days'],
+    ]) {
+        const aged = { ...entry, ts: new Date(Date.now() - elapsed).toISOString() };
+        const daemonCard = coalesce([aged])[0].text;
+        // The two inbox readers deserialize the same JSON shape under distinct entry-id brands.
+        const brokerCard = coalesceBrokerInbox([aged], new Map())[0].text;
+        for (const card of [daemonCard, brokerCard]) {
+            assert.ok(card.includes(`created under you by Core ${age} ago`), 'the renderer, not the stored body, computes age at delivery');
+            assert.doesNotMatch(card, /\[\[CRTR_BIRTH_ANNOUNCEMENT_AGE\]\]/, 'the marker is not visible to the recipient');
+        }
+    }
+    spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: 'A' });
+    assert.equal(readInboxSince('A').length, 1, 'a parent-created child stays silent');
+    spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: null });
+    assert.equal(readInboxSince('A').length, 1, 'a root never announces');
+});
 test('independent root: provenance only, no parent, no subscription', () => {
     createNode(spawner('A'));
     const root = spawnNode({

package/dist/core/__tests__/integration/worktree-land.test.js

@@ -71,7 +71,11 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     assert.equal(wt.base_ref, 'main', 'default base must remain backward-compatible with persisted main worktrees');
     assert.equal(wt.path, managedWorktreePath(nodeId));
     assert.ok(existsSync(wt.path), 'worktree checkout should exist after create');
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const sessionDir = join(home, 'sessions');
+    mkdirSync(sessionDir, { recursive: true });
+    const sessionFile = join(sessionDir, 'session.jsonl');
+    writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'wt-session', cwd: wt.path })}\n`);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt, pi_session_id: 'wt-session', pi_session_file: sessionFile }));
     const result = closeManagedWorktree(nodeId);
     assert.equal(result.worktree_removed, false);
     assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
@@ -83,6 +87,8 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     assert.equal(meta?.managed_worktree?.state, 'closed');
     assert.equal(meta?.managed_worktree?.cleanup, 'pending');
     assert.equal(meta?.cwd, wt.repo_root, 'a later revive uses the durable base checkout');
+    assert.equal(meta?.pi_session_id, null, 'the live transcript remains sole-writer-owned, so close invalidates its stale resume identity');
+    assert.equal(meta?.pi_session_file, null, 'a later revive launches fresh rather than loading the header that still names this checkout');
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
     const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;
@@ -334,7 +340,7 @@ test('rejects remote and nonexistent worktree bases before creating any resource
         assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/crtr/${nodeId}`], sourceDir).status, 1, `${base} must not leave a dedicated branch`);
     }
 });
-test('refuses to close when the recorded base was deleted and leaves the worktree open', () => {
+test('refuses to close a committed worktree when the recorded base was deleted', () => {
     const nodeId = 'wt-deleted-base';
     run(['branch', 'feature/deleted-base'], sourceDir);
     const mainBefore = gitSync(['rev-parse', 'main'], sourceDir).stdout.trim();
@@ -345,10 +351,83 @@ test('refuses to close when the recorded base was deleted and leaves the worktre
     run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'deleted base work'], wt.path);
     run(['branch', '-D', 'feature/deleted-base'], sourceDir);
     assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error && 'code' in error && error.code === 'missing_base_branch');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing base must not silently close or retarget the worktree');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing base with committed work must remain open for a human decision');
     assert.ok(existsSync(wt.path), 'the worktree must remain available for a human decision');
     assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), mainBefore, 'missing base must never auto-land onto main');
 });
+// NL-153/NL-154: the parent can land and finish before its clean child. Its
+// checkout and branch then disappear, leaving `repo_root` as an empty path;
+// the child itself still resolves the shared repository and is exactly at its
+// recorded creation SHA, so close is a no-op with only deferred cleanup left.
+test('close concludes a clean child after parent-first closure removes its checkout and base branch', () => {
+    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-parent-first-'));
+    try {
+        run(['init', '-b', 'main'], repo);
+        run(['config', 'user.email', 'test@example.com'], repo);
+        run(['config', 'user.name', 'Test'], repo);
+        writeFileSync(join(repo, 'README.md'), 'hello\n');
+        run(['add', '.'], repo);
+        run(['commit', '-m', 'init'], repo);
+        const parent = createManagedWorktree(repo, 'wt-parent-first-parent');
+        createNode(node('wt-parent-first-parent', { cwd: parent.path, managed_worktree: parent }));
+        const child = createManagedWorktree(parent.path, 'wt-parent-first-child', parent.branch);
+        createNode(node('wt-parent-first-child', { cwd: child.path, managed_worktree: child }));
+        assert.equal(gitSync(['rev-parse', 'HEAD'], child.path).stdout.trim(), child.base_sha, 'the child must be a clean zero-commit checkout at its recorded base');
+        closeManagedWorktree('wt-parent-first-parent');
+        run(['worktree', 'remove', parent.path], repo);
+        run(['branch', '-D', parent.branch], repo);
+        mkdirSync(parent.path, { recursive: true });
+        assert.notEqual(gitSync(['rev-parse', '--git-dir'], parent.path).status, 0, 'the recorded parent path must be an empty non-Git directory');
+        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${parent.branch}`], child.path).status, 1, 'the parent base branch must be gone');
+        const result = closeManagedWorktree('wt-parent-first-child');
+        assert.equal(result.landed_sha, child.base_sha, 'a no-op close reports the recorded creation SHA');
+        assert.equal(result.worktree_removed, false, 'the live caller checkout remains for deferred cleanup');
+        assert.equal(getNode('wt-parent-first-child')?.managed_worktree?.state, 'closed');
+        run(['worktree', 'remove', child.path], repo);
+        run(['branch', '-D', child.branch], repo);
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+    }
+});
+// A failed ref inspection is not proof that a clean child has nothing to
+// land: only show-ref's completed absent-ref result may take that no-op path.
+test('close surfaces a failed base ref inspection instead of closing a clean worktree', () => {
+    const nodeId = 'wt-base-ref-inspection-failure';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
+    const wrapperPath = join(wrapperDir, 'git');
+    const originalPath = process.env['PATH'] ?? '';
+    writeFileSync(wrapperPath, `#!/bin/sh
+if [ "$1" = "show-ref" ] && [ "$2" = "--verify" ] && [ "$3" = "--quiet" ] && [ "$4" = "refs/heads/main" ]; then
+  echo "simulated unreadable ref store" >&2
+  exit 128
+fi
+PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
+`);
+    chmodSync(wrapperPath, 0o755);
+    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
+    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
+    try {
+        assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error
+            && 'code' in error
+            && error.code === 'base_branch_inspection_failed'
+            && 'detail' in error
+            && typeof error.detail === 'string'
+            && error.detail.includes('status: 128')
+            && error.detail.includes('stderr: simulated unreadable ref store'));
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        delete process.env['CRTR_TEST_REAL_PATH'];
+        rmSync(wrapperDir, { recursive: true, force: true });
+        run(['worktree', 'remove', wt.path], sourceDir);
+        run(['branch', '-D', wt.branch], sourceDir);
+    }
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the failed inspection must not mark a clean worktree closed');
+    assert.ok(!existsSync(wt.path), 'the test must clean up its temporary checkout');
+});
 // Regression for #330/#331: crtr's own untracked `.crouter/config.json` /
 // `state.json` bookkeeping (written by ordinary project-scope init) must
 // never block `close`'s dirty check — Fix A seeds `.git/info/exclude` for

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -261,10 +261,9 @@ test('autoDropCleanManagedWorktree drops a branch with real commits already cont
     assert.equal(gitSync(['merge-base', '--is-ancestor', branchSha, 'main'], repo).status, 0, 'the landed commit must remain reachable from main after the drop');
     rmSync(repo, { recursive: true, force: true });
 });
-// A base that no longer resolves (renamed/deleted local branch) must refuse
-// auto-drop rather than guess — the SAME guard `resolveLandableBase` already
-// gives the explicit close path.
-test('autoDropCleanManagedWorktree refuses when the recorded base branch no longer resolves', async () => {
+// A clean child whose recorded base branch vanished has nothing to land only
+// when its live HEAD exactly matches the persisted creation SHA.
+test('autoDropCleanManagedWorktree drops a clean worktree at base_sha when its recorded base branch no longer resolves', async () => {
     const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-missingbase-'));
     run(['init', '-b', 'main'], repo);
@@ -279,11 +278,50 @@ test('autoDropCleanManagedWorktree refuses when the recorded base branch no long
     // The recorded base branch ('main') has been renamed away since creation.
     run(['branch', '-m', 'main', 'renamed-main'], repo);
     const result = autoDropCleanManagedWorktree(nodeId);
-    assert.equal(result, null, 'an unresolvable base must never be treated as safe to drop');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open');
+    assert.ok(result !== null, 'a clean worktree exactly at its recorded base SHA has nothing to land');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
     assert.ok(existsSync(wt.path));
     rmSync(repo, { recursive: true, force: true });
 });
+// Reap may take the same missing-base no-op only after show-ref completed with
+// its documented absent-ref status; inspection failures must remain visible.
+test('autoDropCleanManagedWorktree surfaces a failed base ref inspection', async () => {
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
+    const nodeId = 'wt-reap-base-ref-inspection-failure';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
+    const wrapperPath = join(wrapperDir, 'git');
+    const originalPath = process.env['PATH'] ?? '';
+    writeFileSync(wrapperPath, `#!/bin/sh
+if [ "$1" = "show-ref" ] && [ "$2" = "--verify" ] && [ "$3" = "--quiet" ] && [ "$4" = "refs/heads/main" ]; then
+  echo "simulated unreadable ref store" >&2
+  exit 128
+fi
+PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
+`);
+    chmodSync(wrapperPath, 0o755);
+    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
+    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
+    try {
+        assert.throws(() => autoDropCleanManagedWorktree(nodeId), (error) => error instanceof Error
+            && 'code' in error
+            && error.code === 'base_branch_inspection_failed'
+            && 'detail' in error
+            && typeof error.detail === 'string'
+            && error.detail.includes('status: 128')
+            && error.detail.includes('stderr: simulated unreadable ref store'));
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        delete process.env['CRTR_TEST_REAL_PATH'];
+        rmSync(wrapperDir, { recursive: true, force: true });
+        run(['worktree', 'remove', wt.path], sourceDir);
+        run(['branch', '-D', wt.branch], sourceDir);
+    }
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the failed inspection must not mark a clean worktree closed');
+    assert.ok(!existsSync(wt.path), 'the test must clean up its temporary checkout');
+});
 // The Critical fix: the TOCTOU race between proving clean-and-contained and
 // the destructive branch delete. `proveCleanEmptyManagedWorktree` and
 // `autoDropCleanManagedWorktreeLocked` are exported specifically so these

package/dist/core/__tests__/migration.test.js

@@ -215,6 +215,36 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(rt['window'], null);
     assert.equal(rt['tmux_session'], null);
 });
+test('session-file ownership migration deterministically clears duplicate claimants before creating its UNIQUE index', () => {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    migrateToVersion(raw, 35);
+    const sessionFile = '/tmp/preexisting-duplicate.jsonl';
+    const aliasedSessionFile = '/tmp/./preexisting-duplicate.jsonl';
+    for (const id of ['first-owner', 'later-claimant']) {
+        const nodeDir = join(home, 'nodes', id);
+        mkdirSync(nodeDir, { recursive: true });
+        writeFileSync(join(nodeDir, 'meta.json'), JSON.stringify({
+            node_id: id, name: id, created: id === 'first-owner' ? '2026-01-01T00:00:00.000Z' : '2026-01-02T00:00:00.000Z',
+            cwd: '/tmp', kind: 'developer', mode: 'base', lifecycle: 'terminal', pi_session_id: `${id}-session`, pi_session_file: id === 'first-owner' ? sessionFile : aliasedSessionFile,
+        }));
+    }
+    raw.prepare('INSERT INTO nodes (node_id, name, kind, mode, lifecycle, status, cwd, created, pi_session_file) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')
+        .run('first-owner', 'first-owner', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-01T00:00:00.000Z', sessionFile);
+    raw.prepare('INSERT INTO nodes (node_id, name, kind, mode, lifecycle, status, cwd, created, pi_session_file) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')
+        .run('later-claimant', 'later-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-02T00:00:00.000Z', aliasedSessionFile);
+    assert.doesNotThrow(() => migrate(raw), 'a real canvas with pre-existing duplicates must migrate');
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
+        ['first-owner', sessionFile],
+        ['later-claimant', null],
+    ], 'the oldest created row wins after aliases are canonicalized; later claimants are cleared');
+    const loser = JSON.parse(readFileSync(join(home, 'nodes', 'later-claimant', 'meta.json'), 'utf8'));
+    assert.equal(loser.pi_session_id, null, 'the loser meta cannot reindex its stale session id');
+    assert.equal(loser.pi_session_file, null, 'the loser meta cannot restore the duplicate projection');
+    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(sessionFile, 'later-claimant'), /UNIQUE/, 'the schema enforces the repaired invariant');
+    raw.close();
+});
 test('node lifecycle substrate migration adds six columns and backfills terminal reasons', () => {
     ensureHome();
     const raw = new DatabaseSync(canvasDbPath());

package/dist/core/__tests__/passive-subscription.test.js

@@ -13,6 +13,7 @@ import { mkdtempSync, mkdirSync, rmSync, existsSync, readFileSync, appendFileSyn
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
 import { createNode, subscribe } from '../canvas/canvas.js';
+import { armCron, getCron } from '../canvas/crons.js';
 import { closeDb } from '../canvas/db.js';
 import { inboxPath, passivePath, apiSocketPath } from '../canvas/paths.js';
 import { createApiServer } from '../../daemon/api/server.js';
@@ -99,16 +100,53 @@ test('passive push accumulates in passive.jsonl, not inbox.jsonl', async () => {
     assert.equal(acc[0].label, 'first observation');
     assert.match(acc[0].ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/, 'report refs use a compact random suffix');
 });
-test('active push still lands in inbox.jsonl (wakes)', async () => {
+test('active push still lands in inbox.jsonl (wakes) and clears the manager deadline', async () => {
     createNode(node('pub'));
     createNode(node('worker-mgr'));
     subscribe('worker-mgr', 'pub', true); // ACTIVE
+    armCron({
+        cron_id: 'manager-deadline',
+        name: 'manager deadline',
+        command: 'echo stale deadline',
+        fire_at: new Date(Date.now() + 60_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: 'worker-mgr',
+        cancel_on_wake: true,
+        created_by: null,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'silent',
+        sink: '{}',
+        tier: 'normal',
+    });
     await push('pub', { kind: 'update', body: 'active report' });
     assert.equal(existsSync(passivePath('worker-mgr')), false);
     const inbox = readInboxSince('worker-mgr');
     assert.equal(inbox.length, 1);
     assert.equal(inbox[0].from, 'pub');
     assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
+    assert.equal(getCron('manager-deadline'), null, 'the child report won the deadline race');
+});
+test('a deferred update still lands in an active subscriber inbox at deferred tier', async () => {
+    createNode(node('pub'));
+    // Resident: deferred mail to a TERMINAL target is bumped to urgent by the
+    // shipped tier bump, so only a resident subscriber shows the requested tier.
+    createNode(node('worker-mgr', { lifecycle: 'resident' }));
+    subscribe('worker-mgr', 'pub', true); // ACTIVE
+    await push('pub', { kind: 'update', deliveryTier: 'deferred', body: 'active report' });
+    assert.equal(existsSync(passivePath('worker-mgr')), false);
+    const inbox = readInboxSince('worker-mgr');
+    assert.equal(inbox.length, 1);
+    assert.equal(inbox[0].from, 'pub');
+    assert.equal(inbox[0].tier, 'deferred', 'requested delivery urgency reaches the subscriber unchanged');
+    assert.equal(inbox[0].kind, 'update', 'the stored report kind is untouched by delivery urgency');
+    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
 });
 test('mixed active + passive subscribers route to their own stores', async () => {
     createNode(node('pub'));