@north-light/crouter 0.3.262 → 0.3.269

package/dist/core/runtime/broker/inbox.js

@@ -163,7 +163,9 @@ function cardEntry(entry, reportNodes) {
 }
 /** One-shot runtime cards an entry carries (rendered envelopes written by the
  *  message API). They ride the delivery their own entry belongs to, so a note
- *  can never land ahead of an unrelated person's message. */
+ *  can never land ahead of an unrelated person's message — except in the one
+ *  deliberate fold below, where deferred entries join a person's delivery as
+ *  the context their turn reads. */
 export function entryCards(entry) {
     const cards = entry.data?.['cards'];
     if (!Array.isArray(cards))
@@ -171,49 +173,77 @@ export function entryCards(entry) {
     return cards.filter((card) => typeof card === 'string');
 }
 /** Split unread entries into ordered deliveries: each human entry verbatim, and
- *  every node/system entry in one card landing where the first such sender fell. */
+ *  each CONTIGUOUS run of node/system entries as one card in the physical slot
+ *  that run occupies. A deferred-only card is folded into the person's delivery
+ *  waiting immediately behind it rather than being deliverable on its own.
+ *
+ *  The runs are what keep the cursor honest. Exactly one delivery goes out per
+ *  cycle and the rest requeue, while a sent delivery commits the cursor across
+ *  its own entries — so a delivery that spanned a person's message would commit
+ *  past words this cycle never sent. A run can never span one, and node mail
+ *  that arrived after a person's message now waits behind it. */
 export function coalesceBrokerInbox(entries, reportNodes) {
-    if (entries.length === 0)
-        return [];
-    const groups = new Map();
-    for (const entry of entries) {
-        const key = entry.from ?? 'system';
-        if (!groups.has(key))
-            groups.set(key, []);
-        groups.get(key).push(entry);
-    }
     const deliveries = [];
-    const sections = [];
-    let cardSlot = -1;
-    for (const [sender, items] of groups) {
-        if (sender === 'human') {
-            for (const entry of items) {
-                const body = inlineBody(entry);
-                deliveries.push({
-                    kind: 'human',
-                    text: body === '' ? entry.label : body,
-                    cards: entryCards(entry),
-                    entries: [entry],
-                });
-            }
-            continue;
+    let run = [];
+    const flushRun = () => {
+        if (run.length === 0)
+            return;
+        // Within one run the card still groups by sender, so a child that sent
+        // several entries reads as one section rather than a repeated header.
+        const sections = new Map();
+        for (const entry of run) {
+            const key = entry.from ?? 'system';
+            if (!sections.has(key))
+                sections.set(key, []);
+            sections.get(key).push(entry);
         }
-        if (cardSlot < 0) {
-            cardSlot = deliveries.length;
-            deliveries.push({ kind: 'card', text: '', cards: [], entries: [] });
+        const card = [...sections].map(([id, items]) => ({
+            id,
+            entries: items.map((entry) => cardEntry(entry, reportNodes)),
+        }));
+        deliveries.push({
+            kind: 'card',
+            text: formatInboxCard(card),
+            cards: run.flatMap((entry) => entryCards(entry)),
+            entries: run,
+        });
+        run = [];
+    };
+    for (const entry of entries) {
+        if ((entry.from ?? 'system') !== 'human') {
+            run.push(entry);
+            continue;
         }
-        sections.push({ id: sender, entries: items.map((entry) => cardEntry(entry, reportNodes)) });
+        flushRun();
+        const body = inlineBody(entry);
+        deliveries.push({
+            kind: 'human',
+            text: body === '' ? entry.label : body,
+            cards: entryCards(entry),
+            entries: [entry],
+        });
     }
-    if (cardSlot >= 0) {
-        // Card sections group by sender, so its entry list comes from the input
-        // array instead: a delivery's entry ids must be in physical inbox order.
-        const cardEntries = entries.filter((entry) => (entry.from ?? 'system') !== 'human');
-        deliveries[cardSlot] = {
-            kind: 'card',
-            text: formatInboxCard(sections),
-            cards: cardEntries.flatMap((entry) => entryCards(entry)),
-            entries: cardEntries,
+    flushRun();
+    // Deferred mail is background context, never a prompt of its own. With a
+    // person's words waiting immediately behind a deferred-only card, the card
+    // rides ahead of those words inside that SAME delivery: one turn, prompted by
+    // what the person actually said, with the card already in the transcript.
+    // Left as its own delivery it takes an earlier turn whose only prompt is
+    // invisible to the person reading along, so the agent answers something they
+    // cannot see. Folding backwards keeps the remaining indices valid.
+    for (let i = deliveries.length - 2; i >= 0; i -= 1) {
+        const card = deliveries[i];
+        const human = deliveries[i + 1];
+        if (card.kind !== 'card' || human.kind !== 'human')
+            continue;
+        if (!card.entries.every((entry) => entry.tier === 'deferred'))
+            continue;
+        deliveries[i] = {
+            ...human,
+            cards: [...card.cards, card.text, ...human.cards],
+            entries: [...card.entries, ...human.entries],
         };
+        deliveries.splice(i + 1, 1);
     }
     return deliveries;
 }

package/dist/core/runtime/broker-protocol.d.ts

@@ -2,6 +2,7 @@ import type { AgentSession, AgentSessionEvent, RpcExtensionUIRequest, RpcExtensi
 import type { Api, ImageContent, Model } from '@earendil-works/pi-ai';
 import type { BrokerErrorFrame, BrokerNodeNamedFrame } from '../../api/dto/broker.js';
 import type { ToolGroupSummary } from '../../shared/tool-groups.js';
+import type { MessageOrigin } from './stamp/protocol.js';
 /** pi's own RPC types, re-exported unchanged. `broker-protocol` stays the one
  *  import site for the wire union; the shapes themselves are pi's, versioned by
  *  pi, so a pi change is a compile error here instead of silent drift. */
@@ -143,6 +144,11 @@ export interface DeliverFrame {
      *  between a card and the body it belongs to. Each is its own custom
      *  message and none triggers a turn; the body is the sole trigger. */
     cards?: string[];
+    /** Who authored `text`, for the durable stamp the broker writes. The daemon
+     *  holds this provenance (an inbox sender, a park request, a person on a
+     *  dormant viewer) and the broker is the only process that can announce it,
+     *  so it rides the same frame as the body. */
+    origin?: MessageOrigin;
 }
 /** Run a `!` bash command — writable clients only. Maps to `session.executeBash()`,
  *  which runs the command, records a `bashExecution` message in context, and

package/dist/core/runtime/broker.js

@@ -52,6 +52,8 @@ import { EventProjection } from './broker/event-projection.js';
 import { createFrameDispatchContext, handleFrame, } from './broker/frame-dispatch.js';
 import { hydratePersistedAdvertisedCommandMessages, installAdvertisedCommandInvocationContract, } from './advertised-command-invocation.js';
 import { RebindDriver } from './broker/rebind.js';
+import { decodeKickoffOrigin, KICKOFF_ORIGIN_ENV } from './stamp/protocol.js';
+import { announceMessageOrigin } from './stamp/channel.js';
 import { brokerExtensionState, commitBrokerModel } from './broker/daemon-ops.js';
 import { FrameOverflowError, normalizeSnapshotTail, } from './broker-protocol.js';
 /** A review companion may only navigate or fork within a branch whose ancestry
@@ -201,6 +203,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     const launchFile = join(dir, 'broker-launch.json');
     const inv = JSON.parse(readFileSync(launchFile, 'utf8'));
     const cfg = piInvocationToSdkConfig(inv); // also merges inv.env
+    if (cfg.modelExact === true)
+        process.env['CRTR_MODEL_EXACT'] = '1';
+    else
+        delete process.env['CRTR_MODEL_EXACT'];
     // 2–4. Build the engine session via the SERVICES path (C3) — see
     //       buildBrokerSession below. Register it so the FATAL exit path (M3) can
     //       dispose it and reap detached bash children.
@@ -314,7 +320,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         const result = await commitBrokerModel(nodeId, { spec, pinnedOverride, userSelected });
         if (userSelected) {
             delete process.env['CRTR_MODEL_INTENT'];
+            process.env['CRTR_MODEL_EXACT'] = '1';
             cfg.model = result.modelOverride;
+            cfg.modelExact = true;
         }
         return result.modelOverride;
     };
@@ -637,6 +645,12 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // reload_auth re-drive resolves a model, at which point it fires. For the
         // common model-present path this fires immediately — unchanged behavior.
         if (cfg.firstPrompt !== undefined && cfg.firstPrompt !== '') {
+            // The spawner recorded who authored this kickoff (a birth mandate, a
+            // cron wake, a revive card); announce it against the exact text so the
+            // stamp writer claims it on the message pi persists.
+            const kickoffOrigin = decodeKickoffOrigin(process.env[KICKOFF_ORIGIN_ENV]);
+            if (kickoffOrigin !== null)
+                announceMessageOrigin(cfg.firstPrompt, kickoffOrigin);
             frameDispatch.kickoff(cfg.firstPrompt);
         }
     });

package/dist/core/runtime/canvas-extensions.d.ts

@@ -11,6 +11,7 @@ export declare const CANVAS_STRUCTURED_OUTPUT_PATH: string;
 export declare const CANVAS_BASH_VALVE_PATH: string;
 export declare const CANVAS_PREVIEW_RESULT_PATH: string;
 export declare const CANVAS_PROMPT_SCRUB_PATH: string;
+export declare const CANVAS_STAMP_PATH: string;
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session

package/dist/core/runtime/canvas-extensions.js

@@ -23,6 +23,7 @@ export const CANVAS_STRUCTURED_OUTPUT_PATH = resolveExtension('canvas-structured
 export const CANVAS_BASH_VALVE_PATH = resolveExtension('canvas-bash-valve');
 export const CANVAS_PREVIEW_RESULT_PATH = resolveExtension('canvas-preview-result');
 export const CANVAS_PROMPT_SCRUB_PATH = resolveExtension('canvas-prompt-scrub');
+export const CANVAS_STAMP_PATH = resolveExtension('canvas-stamp');
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session
@@ -46,6 +47,7 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_BASH_VALVE_PATH,
     CANVAS_PREVIEW_RESULT_PATH,
     CANVAS_PROMPT_SCRUB_PATH,
+    CANVAS_STAMP_PATH,
 ];
 /** Preserve the invariant: mandatory extensions are always present exactly once.
  *

package/dist/core/runtime/interactive-deliver.d.ts

@@ -1,3 +1,4 @@
+import type { MessageOrigin } from './stamp/protocol.js';
 /** Which engine call the broker routed a live deliver to (its ack `detail`):
  *  idle → `prompt`, turn in flight → `steer`. */
 export type LiveDeliverRoute = 'prompt' | 'steer';
@@ -7,8 +8,13 @@ export type LiveInterruptOutcome = 'turn' | 'bash' | 'idle';
 /** Deliver `text` to a LIVE node's engine on its serialized frame loop. The
  *  broker routes it itself (idle → prompt, streaming → steer) and acks once
  *  routed; resolves with the route taken. `cards` are rendered runtime-card
- *  envelopes placed ahead of the body inside that same frame handling. */
-export declare function deliverLive(nodeId: string, text: string, cards?: readonly string[]): Promise<LiveDeliverRoute>;
+ *  envelopes placed ahead of the body inside that same frame handling, and
+ *  `origin` is the authorship the broker stamps onto the persisted message —
+ *  it rides the same frame as the body it describes. */
+export declare function deliverLive(nodeId: string, text: string, opts?: {
+    cards?: readonly string[];
+    origin?: MessageOrigin;
+}): Promise<LiveDeliverRoute>;
 /** Abort whatever a LIVE node's engine is doing (turn or `!` bash). Resolves
  *  once the broker has PROCESSED the abort — which, on the single frame loop,
  *  also implies every earlier-accepted deliver was already routed (so a

package/dist/core/runtime/interactive-deliver.js

@@ -15,14 +15,23 @@ import { oneShotControllerRequest } from './broker-request.js';
 /** Deliver `text` to a LIVE node's engine on its serialized frame loop. The
  *  broker routes it itself (idle → prompt, streaming → steer) and acks once
  *  routed; resolves with the route taken. `cards` are rendered runtime-card
- *  envelopes placed ahead of the body inside that same frame handling. */
-export function deliverLive(nodeId, text, cards = []) {
+ *  envelopes placed ahead of the body inside that same frame handling, and
+ *  `origin` is the authorship the broker stamps onto the persisted message —
+ *  it rides the same frame as the body it describes. */
+export function deliverLive(nodeId, text, opts = {}) {
+    const cards = opts.cards ?? [];
     return oneShotControllerRequest({
         nodeId,
         what: 'the interactive delivery',
         ackFor: 'deliver',
         correlated: true,
-        frame: (id) => ({ type: 'deliver', id, text, ...(cards.length > 0 ? { cards: [...cards] } : {}) }),
+        frame: (id) => ({
+            type: 'deliver',
+            id,
+            text,
+            ...(cards.length > 0 ? { cards: [...cards] } : {}),
+            ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
+        }),
         result: (detail) => (detail === 'steer' ? 'steer' : 'prompt'),
     });
 }

package/dist/core/runtime/launch-target.js

@@ -34,7 +34,7 @@ export async function resolveLaunchTarget(req, options = {}) {
     const launch = (await buildLaunchSpecAsync(kind, mode, {
         lifecycle: req.root_lifecycle ?? (req.root === true ? 'resident' : 'terminal'),
         hasManager: req.root !== true,
-        ...(req.model !== undefined ? { model: req.model } : {}),
+        ...(req.model !== undefined ? { model: req.model, modelOverride: true } : {}),
         cwd,
         profileId,
     })).launch;

package/dist/core/runtime/launch.d.ts

@@ -15,12 +15,12 @@ export type { PortableModelSelection } from './model-selection.js';
  *  stays unpinned. */
 export declare function isProviderPinnedModelToken(model: string): boolean;
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
- *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
- *  passing through as a concrete id. Portable tokens are safe to PERSIST as
- *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
- *  ladder the running build ships, so they never freeze a stale concrete
- *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+ *  (`ultra`, `normal`, `opus`, …), a `<family>/<strength>` pair, or an
+ *  anthropic family alias — i.e. a logical preference rather than a concrete
+ *  provider/model id. Portable tokens are safe to PERSIST as defaults
+ *  (`persistDefaultKindModel`): they re-resolve against the declared routes or
+ *  ladder the running build ships, so they never freeze a stale concrete model
+ *  id to disk. */
 export declare function isPortableModelToken(model: string): boolean;
 export declare function logicalModelIntent(model: string, ladders?: ScopeConfig['modelLadders']): {
     family: string;
@@ -65,6 +65,12 @@ export interface LaunchBuildOptions {
     hasManager: boolean;
     extraEnv?: Record<string, string>;
     model?: string;
+    /** A newly supplied `--model` override. Resolve it through the target
+     *  ladder and any quality floor once, then freeze the resulting concrete
+     *  provider/id[:thinking] spec into the launch recipe so every launch,
+     *  revive, and retry consults exactly that model. Existing recipes instead
+     *  carry `modelExact`/`modelIntent` below verbatim. */
+    modelOverride?: boolean;
     /** The TARGET node's cwd — anchors the project-scope stack for kind/ladder
      *  resolution. Defaults to this process's own cwd, which is correct only
      *  when the caller IS resolving for itself; spawn/polymorph paths must

package/dist/core/runtime/launch.js

@@ -85,7 +85,7 @@ function findLadderCell(normalized, ladders, providers) {
  *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
  *   4. Anything else → pass through unchanged. */
 function modelTokenStrength(model) {
-    const slash = model.indexOf('/');
+    const slash = model.lastIndexOf('/');
     const provider = slash === -1 ? undefined : model.slice(0, slash);
     const rest = slash === -1 ? model : model.slice(slash + 1);
     const strength = STRENGTH_ALIASES[rest];
@@ -137,19 +137,19 @@ export function isProviderPinnedModelToken(model) {
     return model.includes('/') && !isPortableModelToken(model);
 }
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
- *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
- *  passing through as a concrete id. Portable tokens are safe to PERSIST as
- *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
- *  ladder the running build ships, so they never freeze a stale concrete
- *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+ *  (`ultra`, `normal`, `opus`, …), a `<family>/<strength>` pair, or an
+ *  anthropic family alias — i.e. a logical preference rather than a concrete
+ *  provider/model id. Portable tokens are safe to PERSIST as defaults
+ *  (`persistDefaultKindModel`): they re-resolve against the declared routes or
+ *  ladder the running build ships, so they never freeze a stale concrete model
+ *  id to disk. */
 export function isPortableModelToken(model) {
     if (model.includes('/')) {
-        const slash = model.indexOf('/');
-        const provider = model.slice(0, slash);
+        const slash = model.lastIndexOf('/');
+        const family = model.slice(0, slash);
         const rest = model.slice(slash + 1);
-        return (provider === 'anthropic' || provider === 'openai') && (STRENGTH_ALIASES[rest] !== undefined
-            || (provider === 'anthropic' && (rest === 'opus' || rest === 'sonnet' || rest === 'haiku')));
+        return family !== '' && (STRENGTH_ALIASES[rest] !== undefined
+            || (family === 'anthropic' && (rest === 'opus' || rest === 'sonnet' || rest === 'haiku')));
     }
     return STRENGTH_ALIASES[model] !== undefined || model === 'opus' || model === 'sonnet' || model === 'haiku';
 }
@@ -158,7 +158,7 @@ export function logicalModelIntent(model, ladders = modelLadders()) {
     if (strength === null)
         return undefined;
     if (model.includes('/'))
-        return { family: model.slice(0, model.indexOf('/')), strength };
+        return { family: model.slice(0, model.lastIndexOf('/')), strength };
     if (model === 'opus' || model === 'sonnet' || model === 'haiku')
         return { family: 'anthropic', strength };
     return { family: defaultProvider(ladders), strength };
@@ -251,16 +251,18 @@ function buildLaunchSpecFromMerged(kind, mode, opts, merged) {
     const ladders = merged.modelLadders;
     const kindModel = mode === 'orchestrator' ? kindConfig?.orchestratorModel ?? kindConfig?.model : kindConfig?.model;
     const chosenModel = opts.modelExact === true ? opts.model : floorReviewModel(kind, opts.model, kindModel, ladders);
-    const intent = opts.modelExact === true ? undefined : (opts.modelIntent ?? (chosenModel !== undefined ? logicalModelIntent(chosenModel, ladders) : undefined));
+    const exact = opts.modelExact === true || opts.modelOverride === true;
+    const resolvedModel = opts.modelExact === true
+        ? chosenModel
+        : (chosenModel !== undefined ? normalizeModel(chosenModel, ladders) : undefined);
+    const intent = exact ? undefined : (opts.modelIntent ?? (chosenModel !== undefined ? logicalModelIntent(chosenModel, ladders) : undefined));
     const launch = {
-        model: opts.modelExact === true
-            ? chosenModel
-            : (chosenModel !== undefined ? normalizeModel(chosenModel, ladders) : undefined),
+        model: resolvedModel,
         modelIntent: intent,
         modelProviderPinned: opts.modelProviderPinned !== undefined
             ? opts.modelProviderPinned
             : opts.model !== undefined && isProviderPinnedModelToken(opts.model),
-        modelExact: opts.modelExact === true ? true : undefined,
+        modelExact: exact ? true : undefined,
         tools: kindConfig?.tools ?? [],
         extensions: mergeCanvasExtensions([...CANVAS_EXTENSIONS, ...(kindConfig?.extensions ?? [])]),
         systemPrompt: LAUNCH_SYSTEM_PROMPT,

package/dist/core/runtime/model-swap.d.ts

@@ -2,7 +2,7 @@ import { type NodeMeta } from '../canvas/index.js';
 /** True when the node's broker engine is reachable: its recorded pid is alive
  *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
  *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
-export declare function isBrokerLive(meta: NodeMeta): boolean;
+export declare function isBrokerLive(node: Pick<NodeMeta, 'node_id' | 'pi_pid'>): boolean;
 /** Swap a LIVE node's model over its view.sock. Connects as a controller,
  *  sends `set_model`, and resolves with the broker-resolved durable spec from its
  *  `model_changed` frame. Rejects with the broker's message on an `error` frame (e.g.
@@ -16,9 +16,10 @@ export declare function isBrokerLive(meta: NodeMeta): boolean;
 export declare function setModelLive(nodeId: string, spec: string, pinned: boolean): Promise<string>;
 /** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
  *  what the broker's persistModelChoice writes on a live switch: `model_override`
- *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
- *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
- *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline).
+ *  (so polymorphs preserve it via buildLaunchSpec), `launch.model`, and its
+ *  exact-consult marker (the recipe buildPiArgv replays on revive). `spec` must
+ *  already be a concrete `provider/id` (normalizeModel maps tiers/aliases; a bare
+ *  substring cannot resolve offline).
  *  `pinned` is the durable-pin decision for this change — decided by the CALLER
  *  from the RAW pre-normalize token, never re-derived here from `spec`'s shape
  *  (a concrete `spec` always reads as "pinned", which would wrongly re-pin a

package/dist/core/runtime/model-swap.js

@@ -19,8 +19,8 @@ import { oneShotControllerRequest } from './broker-request.js';
 /** True when the node's broker engine is reachable: its recorded pid is alive
  *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
  *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
-export function isBrokerLive(meta) {
-    return isPidAlive(meta.pi_pid) && existsSync(viewSocketPath(meta.node_id));
+export function isBrokerLive(node) {
+    return isPidAlive(node.pi_pid) && existsSync(viewSocketPath(node.node_id));
 }
 /** Swap a LIVE node's model over its view.sock. Connects as a controller,
  *  sends `set_model`, and resolves with the broker-resolved durable spec from its
@@ -49,9 +49,10 @@ export function setModelLive(nodeId, spec, pinned) {
 }
 /** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
  *  what the broker's persistModelChoice writes on a live switch: `model_override`
- *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
- *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
- *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline).
+ *  (so polymorphs preserve it via buildLaunchSpec), `launch.model`, and its
+ *  exact-consult marker (the recipe buildPiArgv replays on revive). `spec` must
+ *  already be a concrete `provider/id` (normalizeModel maps tiers/aliases; a bare
+ *  substring cannot resolve offline).
  *  `pinned` is the durable-pin decision for this change — decided by the CALLER
  *  from the RAW pre-normalize token, never re-derived here from `spec`'s shape
  *  (a concrete `spec` always reads as "pinned", which would wrongly re-pin a
@@ -66,6 +67,7 @@ export function updateModelRecipe(meta, spec, pinnedOverride, userSelected) {
                 return {
                     ...rest,
                     model: spec,
+                    modelExact: true,
                     ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}),
                     env: remainingEnv,
                 };

package/dist/core/runtime/promote.js

@@ -23,6 +23,7 @@ function reshapeInputs(nodeId, opts) {
         node, kind, mode, lifecycle, profileId,
         launchOpts: {
             lifecycle, hasManager: node.parent !== null, model: opts.model ?? node.model_override ?? undefined,
+            modelOverride: opts.model !== undefined,
             modelProviderPinned: opts.model === undefined ? node.launch?.modelProviderPinned : undefined,
             modelIntent: opts.model === undefined ? node.launch?.modelIntent : undefined,
             modelExact: opts.model === undefined ? node.launch?.modelExact : undefined,
@@ -36,7 +37,7 @@ function persistReshape(nodeId, opts, input, launch, beforePersist) {
     return updateNode(nodeId, {
         kind: input.kind, mode: input.mode, lifecycle: input.lifecycle, profile_id: input.profileId, launch,
         ...(carriesDefaultHandle ? { name: input.kind } : {}),
-        ...(opts.model !== undefined ? { model_override: opts.model } : {}),
+        ...(opts.model !== undefined ? { model_override: launch?.model ?? opts.model } : {}),
     });
 }
 /** Synchronous reshape for CLI callers outside the daemon. */

package/dist/core/runtime/reset.js

@@ -85,9 +85,11 @@ export async function relaunchRoot(oldId, deps = {}) {
         lifecycle: 'resident',
         hasManager: false,
         model: old.model_override ?? undefined,
-        // A `/new` relaunch carries no new --model — preserve the old root's pin
-        // verbatim rather than re-deriving it from model_override's shape.
+        // A `/new` relaunch carries no new --model — preserve the old root's routing
+        // contract verbatim rather than re-deriving it from model_override's shape.
         modelProviderPinned: old.launch?.modelProviderPinned,
+        modelIntent: old.launch?.modelIntent,
+        modelExact: old.launch?.modelExact,
         // The OLD root's cwd + profile, not this process's ambient scope — the
         // relaunch is the same seat, so profile-scope kind defaults keep applying.
         cwd: old.cwd,

package/dist/core/runtime/revive.js

@@ -34,6 +34,7 @@ import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings, readGoal, readYieldMessage, RUNTIME_RESTART_CONTINUATION } from './kickoff.js';
 import { readRoadmap } from './roadmap.js';
 import { hasUnseenWakeMail } from '../feed/inbox.js';
+import { encodeKickoffOrigin, KICKOFF_ORIGIN_ENV } from './stamp/protocol.js';
 import { headlessBrokerHost } from './host.js';
 import { boundFleet, brokerCapReached, brokerThresholdsForDaemon } from './fleet.js';
 import { clearFault, beginBootFaultAttempt } from './fault.js';
@@ -367,12 +368,23 @@ function launchRevive(nodeId, meta, opts) {
     // unchanged (empty for true-fresh, both set for cycling) so buildPiArgv emits
     // the right argv either way.
     let inv;
+    // The provenance of whatever kickoff this branch composes, handed to the
+    // broker process through inv.env below. A promptless launch announces
+    // nothing — there is no message to stamp.
+    let kickoffOrigin = null;
+    const birthOrigin = () => ({
+        type: 'runtime',
+        kind: 'kickoff',
+        ...(meta.spawned_by != null && meta.spawned_by !== '' ? { spawnedBy: meta.spawned_by } : {}),
+    });
     if (forkBirthPending) {
         const goal = readGoal(nodeId);
         inv = buildPiArgv(meta, {
             forkFrom: forkSourceFile,
             ...(goal != null && goal !== '' ? { prompt: goal } : {}),
         });
+        if (goal != null && goal !== '')
+            kickoffOrigin = birthOrigin();
         initializeForkContextExposure(nodeId, findNodeBySessionFile(forkSourceFile)?.node_id ?? null);
     }
     else if (resuming) {
@@ -380,6 +392,9 @@ function launchRevive(nodeId, meta, opts) {
             ...resume,
             ...(opts.wakeReason === 'runtime-restart-abort' ? { prompt: RUNTIME_RESTART_CONTINUATION } : {}),
         });
+        if (opts.wakeReason === 'runtime-restart-abort') {
+            kickoffOrigin = { type: 'runtime', kind: 'restart-continuation' };
+        }
     }
     else if (!hasSessionPath &&
         // A clock-driven wake must keep its <crtr-wake> kickoff — the schedule IS
@@ -391,6 +406,8 @@ function launchRevive(nodeId, meta, opts) {
         // interactive node boots promptless and takes no turn at all.
         const goal = readGoal(nodeId)?.trim();
         inv = buildPiArgv(meta, goal !== undefined && goal !== '' ? { prompt: goal } : {});
+        if (goal !== undefined && goal !== '')
+            kickoffOrigin = birthOrigin();
         clearContextExposureState(nodeId);
     }
     else {
@@ -404,11 +421,16 @@ function launchRevive(nodeId, meta, opts) {
             ...resume,
             prompt: buildReviveKickoff(meta, bearings, opts.wakeReason === 'runtime-restart-abort' ? undefined : opts.wakeReason),
         });
+        kickoffOrigin = opts.wakeReason !== undefined && opts.wakeReason !== 'runtime-restart-abort'
+            ? { type: 'runtime', kind: 'wake', wake: opts.wakeReason }
+            : { type: 'runtime', kind: 'revive', cycle: meta.cycles ?? 0 };
         clearContextExposureState(nodeId);
     }
     // Every lifecycle launch emits the authoritative spine root rather than
     // inheriting whichever node happened to invoke reviveNode.
     inv.env = { ...inv.env, CRTR_SUBTREE: rootOfSpine(nodeId) };
+    if (kickoffOrigin !== null)
+        inv.env[KICKOFF_ORIGIN_ENV] = encodeKickoffOrigin(kickoffOrigin);
     // The broker host launches the detached engine. reviveNode keeps
     // transition+clearPid around it (the crash-safety ordering, unchanged). It
     // opens NO viewer — engine-only; existing viewers reconnect, and a viewer-less

package/dist/core/runtime/spawn.d.ts

@@ -44,9 +44,9 @@ export interface SpawnChildOpts {
     /** Pin the node to a model spec — exact `provider/id`, `provider/tier`
      *  (e.g. `openai/ultra`), bare tier (ultra/strong/medium/light), or family
      *  alias (opus/sonnet/haiku) — overriding the persona's declared default.
-     *  The RAW spec is persisted to `meta.model_override` (buildLaunchSpec
-     *  re-normalizes through the current ladders on every revive/polymorph, so
-     *  ladder config edits keep propagating). Omit to use the persona default. */
+     *  The supplied spec resolves once through the target ladders and its concrete
+     *  provider/model is persisted as the exact launch recipe. Omit to use the
+     *  persona default. */
     model?: string;
     /** Select the profile this node runs under — an exact profile id or a unique
      *  manifest name (or the closest match to one), resolved through

package/dist/core/runtime/spawn.js

@@ -21,6 +21,7 @@ import { writeGoal } from './kickoff.js';
 import { appendSituationalContext, formatSituationalProse } from './situational-context.js';
 import { hasRoadmap, seedRoadmap } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
+import { encodeKickoffOrigin, KICKOFF_ORIGIN_ENV } from './stamp/protocol.js';
 import { canonicalSessionFile, contextDir, findNodeBySessionFile, getNode, fullName, recordPid, setFrozen } from '../canvas/index.js';
 import { boundFleet, brokerThresholdsForDaemon } from './fleet.js';
 import { emitEvent } from '../events/emit.js';
@@ -238,7 +239,9 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
     if (opts.nodeId !== undefined)
         preflightNodeId(opts.nodeId);
     const profileId = await resolveProfileId(opts.profile, spawner, opts.cwd);
-    const preflightLaunch = (await buildLaunchSpecAsync(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model, cwd: opts.cwd, profileId })).launch;
+    const preflightLaunch = (await buildLaunchSpecAsync(opts.kind, mode, {
+        lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: opts.cwd, profileId,
+    })).launch;
     await assertLaunchModelRegistered(requestFromLaunch(preflightLaunch), { cwd: opts.cwd, profileId });
     const forkFrom = opts.forkFrom !== undefined ? resolveForkSource(opts.forkFrom) : undefined;
     const forkSourceNodeId = forkFrom === undefined
@@ -259,7 +262,9 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
         // this process's ambient scope (a front-door shell has no CRTR_PROFILE_ID,
         // which silently hid every profile-scope kind override).
         const launch = wantsWorktree
-            ? (await buildLaunchSpecAsync(opts.kind, mode, { lifecycle, hasManager: !root, model: opts.model, cwd: spawnCwd, profileId })).launch
+            ? (await buildLaunchSpecAsync(opts.kind, mode, {
+                lifecycle, hasManager: !root, model: opts.model, modelOverride: opts.model !== undefined, cwd: spawnCwd, profileId,
+            })).launch
             : preflightLaunch;
         if (wantsWorktree) {
             await assertLaunchModelRegistered(requestFromLaunch(launch), { cwd: spawnCwd, profileId });
@@ -280,7 +285,7 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
             profile_id: profileId,
             forkFrom: opts.forkFrom,
             forkSourceFile: forkFrom,
-            modelOverride: opts.model,
+            modelOverride: opts.model === undefined ? undefined : launch.model,
             ...(managedWorktree !== undefined ? { managedWorktree } : {}),
             ...(nodeId !== undefined ? { nodeId } : {}),
             launch,
@@ -335,6 +340,18 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
         // CRTR_SUBTREE (the spine root) rides the detached broker's env so it can group
         // the subtree; the host sets CRTR_FRONT_DOOR itself.
         inv.env = { ...inv.env, CRTR_SUBTREE: rootOfSpine(meta.node_id) };
+        // The kickoff's provenance rides the same env: it is composed here but sent
+        // by the broker process, which stamps it against the message pi persists.
+        if (hasKickoff) {
+            const kickoffOrigin = opts.wakeOrigin !== undefined
+                ? { type: 'runtime', kind: 'wake', wake: opts.wakeOrigin }
+                : {
+                    type: 'runtime',
+                    kind: 'kickoff',
+                    ...(meta.spawned_by != null && meta.spawned_by !== '' ? { spawnedBy: meta.spawned_by } : {}),
+                };
+            inv.env[KICKOFF_ORIGIN_ENV] = encodeKickoffOrigin(kickoffOrigin);
+        }
         // Snapshot the boot-fault attempt the instant before launch — see
         // beginBootFaultAttempt — so a later diagnostic read (root+await only, below)
         // can only ever surface a fault THIS launch recorded, never a stale one.