@north-light/crouter 0.3.263 → 0.3.270

package/dist/core/runtime/broker/fault-retry.js

@@ -12,6 +12,7 @@ import { markFatalOnExhaust, nextFaultRetry, policyFor } from '../fault-recovery
 import { parseModelSpec } from '../model-selection.js';
 import { endedByAbort } from '../session-cycles.js';
 import { resolveProviderCandidates } from '../../subscription-state.js';
+import { announceMessageOrigin } from '../stamp/channel.js';
 const MAX_TIMEOUT_MS = 2_147_483_647;
 /** Owns provider fallback and daemon-driven fault retry state for one broker session. */
 export class FaultRetry {
@@ -266,7 +267,9 @@ export class FaultRetry {
                 return;
             if (unconfigured)
                 clearFault(this.deps.nodeId, { link: 'pi→provider' });
-            await this.deps.turnAdmission.admit((release) => operationIdContext.fresh(() => candidateSession.prompt(formatCard('recovery', {}, formatModelFallbackRecovery(currentSpec, resolved, unconfigured ? 'credential' : 'not-found')), { preflightResult: release })));
+            const fallbackCard = formatCard('recovery', {}, formatModelFallbackRecovery(currentSpec, resolved, unconfigured ? 'credential' : 'not-found'));
+            announceMessageOrigin(fallbackCard, { type: 'runtime', kind: 'recovery' });
+            await this.deps.turnAdmission.admit((release) => operationIdContext.fresh(() => candidateSession.prompt(fallbackCard, { preflightResult: release })));
         })().catch((err) => {
             emitEvent({ level: 'debug', event: 'broker.runtime.diagnostic', fields: { message: `${unconfigured ? 'unconfigured-provider' : 'not_found'} fallback failed: ${err instanceof Error ? err.message : String(err)}` } });
         }).finally(() => {
@@ -405,7 +408,9 @@ export class FaultRetry {
                 return Promise.resolve();
             }
             recordFault(this.deps.nodeId, plan.fault);
-            return operationIdContext.fresh(() => candidateSession.prompt(formatCard('recovery', {}, fault.kind === 'connection' ? CONNECTION_FAULT_RECOVERY_BODY : PROVIDER_FAULT_RECOVERY_BODY), { preflightResult: release }));
+            const retryCard = formatCard('recovery', {}, fault.kind === 'connection' ? CONNECTION_FAULT_RECOVERY_BODY : PROVIDER_FAULT_RECOVERY_BODY);
+            announceMessageOrigin(retryCard, { type: 'runtime', kind: 'recovery' });
+            return operationIdContext.fresh(() => candidateSession.prompt(retryCard, { preflightResult: release }));
         });
     }
 }

package/dist/core/runtime/broker/frame-client.js

@@ -86,6 +86,9 @@ export function createClientHandlers(deps) {
                 type: 'prompt',
                 text: frame.text,
                 ...(frame.images !== undefined ? { images: frame.images } : {}),
+                delivery: {
+                    ...(frame.origin === undefined ? {} : { origin: frame.origin }),
+                },
             });
             if (via === 'steer' || outcome === undefined) {
                 turnAcceptance.cancel(ackAccepted);

package/dist/core/runtime/broker/frame-dispatch.js

@@ -1,5 +1,6 @@
 import { createFrameReplies } from './frame-replies.js';
 import { createEngineDriver } from './engine-drive.js';
+import { announceMessageOrigin } from '../stamp/channel.js';
 import { createClientHandlers } from './frame-client.js';
 import { createMemoryRefGuidance } from './frame-memory-refs.js';
 import { createAuthReloadGate } from './auth-reload.js';
@@ -51,6 +52,12 @@ export function createFrameDispatchContext(deps) {
     const handleDriveFrame = (client, frame) => {
         if (notWritable(client, 'drive the engine'))
             return;
+        // These frames are the viewer's input vocabulary — a person typed them.
+        // (crtrd's `deliver` never lands here: frame-client synthesizes its own
+        // prompt frame and calls driveEngine directly, announcing its own origin.)
+        if (frame.type === 'prompt' || frame.type === 'steer' || frame.type === 'follow_up') {
+            announceMessageOrigin(frame.text, { type: 'human', channel: { type: 'viewer' } });
+        }
         driveEngine(client, frame);
     };
     const clientHandlers = createClientHandlers({

package/dist/core/runtime/broker/inbox.d.ts

@@ -27,7 +27,9 @@ export declare function readBrokerCanceledEntryIds(nodeId: string): Set<BrokerIn
 export declare function reportRefNodeId(ref: string | undefined): string | undefined;
 /** One-shot runtime cards an entry carries (rendered envelopes written by the
  *  message API). They ride the delivery their own entry belongs to, so a note
- *  can never land ahead of an unrelated person's message. */
+ *  can never land ahead of an unrelated person's message — except in the one
+ *  deliberate fold below, where deferred entries join a person's delivery as
+ *  the context their turn reads. */
 export declare function entryCards(entry: BrokerInboxEntry): readonly string[];
 /** One deliverable user message: either a person's verbatim words or the whole
  *  `<runtime kind="inbox">` envelope. Never both — a reader parses an envelope
@@ -40,5 +42,13 @@ export interface InboxDelivery {
     entries: readonly BrokerInboxEntry[];
 }
 /** Split unread entries into ordered deliveries: each human entry verbatim, and
- *  every node/system entry in one card landing where the first such sender fell. */
+ *  each CONTIGUOUS run of node/system entries as one card in the physical slot
+ *  that run occupies. A deferred-only card is folded into the person's delivery
+ *  waiting immediately behind it rather than being deliverable on its own.
+ *
+ *  The runs are what keep the cursor honest. Exactly one delivery goes out per
+ *  cycle and the rest requeue, while a sent delivery commits the cursor across
+ *  its own entries — so a delivery that spanned a person's message would commit
+ *  past words this cycle never sent. A run can never span one, and node mail
+ *  that arrived after a person's message now waits behind it. */
 export declare function coalesceBrokerInbox(entries: readonly BrokerInboxEntry[], reportNodes: ReadonlyMap<string, BrokerReportNodeDTO>): readonly InboxDelivery[];

package/dist/core/runtime/broker/inbox.js

@@ -163,7 +163,9 @@ function cardEntry(entry, reportNodes) {
 }
 /** One-shot runtime cards an entry carries (rendered envelopes written by the
  *  message API). They ride the delivery their own entry belongs to, so a note
- *  can never land ahead of an unrelated person's message. */
+ *  can never land ahead of an unrelated person's message — except in the one
+ *  deliberate fold below, where deferred entries join a person's delivery as
+ *  the context their turn reads. */
 export function entryCards(entry) {
     const cards = entry.data?.['cards'];
     if (!Array.isArray(cards))
@@ -171,49 +173,77 @@ export function entryCards(entry) {
     return cards.filter((card) => typeof card === 'string');
 }
 /** Split unread entries into ordered deliveries: each human entry verbatim, and
- *  every node/system entry in one card landing where the first such sender fell. */
+ *  each CONTIGUOUS run of node/system entries as one card in the physical slot
+ *  that run occupies. A deferred-only card is folded into the person's delivery
+ *  waiting immediately behind it rather than being deliverable on its own.
+ *
+ *  The runs are what keep the cursor honest. Exactly one delivery goes out per
+ *  cycle and the rest requeue, while a sent delivery commits the cursor across
+ *  its own entries — so a delivery that spanned a person's message would commit
+ *  past words this cycle never sent. A run can never span one, and node mail
+ *  that arrived after a person's message now waits behind it. */
 export function coalesceBrokerInbox(entries, reportNodes) {
-    if (entries.length === 0)
-        return [];
-    const groups = new Map();
-    for (const entry of entries) {
-        const key = entry.from ?? 'system';
-        if (!groups.has(key))
-            groups.set(key, []);
-        groups.get(key).push(entry);
-    }
     const deliveries = [];
-    const sections = [];
-    let cardSlot = -1;
-    for (const [sender, items] of groups) {
-        if (sender === 'human') {
-            for (const entry of items) {
-                const body = inlineBody(entry);
-                deliveries.push({
-                    kind: 'human',
-                    text: body === '' ? entry.label : body,
-                    cards: entryCards(entry),
-                    entries: [entry],
-                });
-            }
-            continue;
+    let run = [];
+    const flushRun = () => {
+        if (run.length === 0)
+            return;
+        // Within one run the card still groups by sender, so a child that sent
+        // several entries reads as one section rather than a repeated header.
+        const sections = new Map();
+        for (const entry of run) {
+            const key = entry.from ?? 'system';
+            if (!sections.has(key))
+                sections.set(key, []);
+            sections.get(key).push(entry);
         }
-        if (cardSlot < 0) {
-            cardSlot = deliveries.length;
-            deliveries.push({ kind: 'card', text: '', cards: [], entries: [] });
+        const card = [...sections].map(([id, items]) => ({
+            id,
+            entries: items.map((entry) => cardEntry(entry, reportNodes)),
+        }));
+        deliveries.push({
+            kind: 'card',
+            text: formatInboxCard(card),
+            cards: run.flatMap((entry) => entryCards(entry)),
+            entries: run,
+        });
+        run = [];
+    };
+    for (const entry of entries) {
+        if ((entry.from ?? 'system') !== 'human') {
+            run.push(entry);
+            continue;
         }
-        sections.push({ id: sender, entries: items.map((entry) => cardEntry(entry, reportNodes)) });
+        flushRun();
+        const body = inlineBody(entry);
+        deliveries.push({
+            kind: 'human',
+            text: body === '' ? entry.label : body,
+            cards: entryCards(entry),
+            entries: [entry],
+        });
     }
-    if (cardSlot >= 0) {
-        // Card sections group by sender, so its entry list comes from the input
-        // array instead: a delivery's entry ids must be in physical inbox order.
-        const cardEntries = entries.filter((entry) => (entry.from ?? 'system') !== 'human');
-        deliveries[cardSlot] = {
-            kind: 'card',
-            text: formatInboxCard(sections),
-            cards: cardEntries.flatMap((entry) => entryCards(entry)),
-            entries: cardEntries,
+    flushRun();
+    // Deferred mail is background context, never a prompt of its own. With a
+    // person's words waiting immediately behind a deferred-only card, the card
+    // rides ahead of those words inside that SAME delivery: one turn, prompted by
+    // what the person actually said, with the card already in the transcript.
+    // Left as its own delivery it takes an earlier turn whose only prompt is
+    // invisible to the person reading along, so the agent answers something they
+    // cannot see. Folding backwards keeps the remaining indices valid.
+    for (let i = deliveries.length - 2; i >= 0; i -= 1) {
+        const card = deliveries[i];
+        const human = deliveries[i + 1];
+        if (card.kind !== 'card' || human.kind !== 'human')
+            continue;
+        if (!card.entries.every((entry) => entry.tier === 'deferred'))
+            continue;
+        deliveries[i] = {
+            ...human,
+            cards: [...card.cards, card.text, ...human.cards],
+            entries: [...card.entries, ...human.entries],
         };
+        deliveries.splice(i + 1, 1);
     }
     return deliveries;
 }

package/dist/core/runtime/broker/rebind.js

@@ -6,6 +6,7 @@ import { operationIdContext } from '../../events/operation-id.js';
 import { installPersonaTransitionGate } from '../broker-persona-guidance.js';
 import { abortSessionFromExtension } from './extension-abort.js';
 import { clearFault, invalidateProviderRetryEpisode, readFault } from '../fault.js';
+import { clearTurnVisibility } from '../turn-visibility.js';
 const MAX_ADMITTED_REPLACEMENTS = 2;
 const REPLACEMENT_DEADLINE_MS = 30_000;
 const REPLACEMENT_DEADLINE_EXCEEDED = Symbol('replacement-deadline-exceeded');
@@ -302,6 +303,12 @@ export class RebindDriver {
         catch (err) {
             emitEvent({ level: 'debug', event: 'broker.runtime.diagnostic', fields: { message: `event relay threw: ${String(err)}` } });
         }
+        finally {
+            // Projection sees the settlement while the run is still internal; every
+            // later input and output fails open to visible after this boundary.
+            if (event.type === 'agent_settled')
+                clearTurnVisibility();
+        }
     }
     ackTo(client, op, ok = true, detail, id) {
         this.deps.registry.sendFrame(client, { type: 'ack', for: op, ok, ...(detail !== undefined ? { detail } : {}), ...(id !== undefined ? { id } : {}) });

package/dist/core/runtime/broker-protocol.d.ts

@@ -2,6 +2,7 @@ import type { AgentSession, AgentSessionEvent, RpcExtensionUIRequest, RpcExtensi
 import type { Api, ImageContent, Model } from '@earendil-works/pi-ai';
 import type { BrokerErrorFrame, BrokerNodeNamedFrame } from '../../api/dto/broker.js';
 import type { ToolGroupSummary } from '../../shared/tool-groups.js';
+import type { MessageOrigin, MessageVisibility } from './stamp/protocol.js';
 /** pi's own RPC types, re-exported unchanged. `broker-protocol` stays the one
  *  import site for the wire union; the shapes themselves are pi's, versioned by
  *  pi, so a pi change is a compile error here instead of silent drift. */
@@ -21,6 +22,10 @@ export interface BrokerSnapshot {
     /** Stable session-entry ids aligned 1:1 with `messages`. Absent when the
      * session manager cannot expose its entry tree. */
     messageIds?: string[];
+    /** Presentation visibility aligned 1:1 with `messages`. */
+    messageVisibility: MessageVisibility[];
+    /** Presentation visibility of the run currently owned by the engine. */
+    turnVisibility: MessageVisibility;
     stats: SessionStats;
     /** pi's OWN `get_state` payload, verbatim — not a mirror. `buildSnapshot`
      *  fills it exactly as pi's `rpc-mode.js` does, from the same getters, so a
@@ -143,6 +148,11 @@ export interface DeliverFrame {
      *  between a card and the body it belongs to. Each is its own custom
      *  message and none triggers a turn; the body is the sole trigger. */
     cards?: string[];
+    /** Who authored `text`, for the durable stamp the broker writes. The daemon
+     *  holds this provenance (an inbox sender, a park request, a person on a
+     *  dormant viewer) and the broker is the only process that can announce it,
+     *  so it rides the same frame as the body. */
+    origin?: MessageOrigin;
 }
 /** Run a `!` bash command — writable clients only. Maps to `session.executeBash()`,
  *  which runs the command, records a `bashExecution` message in context, and
@@ -392,6 +402,11 @@ export interface WelcomeFrame {
  *  the other four learn nothing); the PAYLOAD is pi's — `Model`, exactly what
  *  pi's own `set_model` response carries and what `snapshot.state.model` holds.
  *  Undefined when the engine has none. */
+export interface TurnVisibilityFrame {
+    type: 'turn_visibility';
+    /** Presentation visibility of the run whose native events follow. */
+    visibility: MessageVisibility;
+}
 export interface WorkingActivityFrame {
     type: 'working_activity';
     /** Full display label selected from the user's configured gerunds. */
@@ -637,7 +652,7 @@ export interface ToolGroupSummaryFrame {
 /** Everything the broker can send. Live `AgentSessionEvent`s are relayed
  *  verbatim (the broker adds nothing); the broker's own control frames carry
  *  non-colliding `type` discriminants. */
-export type BrokerToClient = WelcomeFrame | WorkingActivityFrame | ModelChangedFrame | ResourcesReloadedFrame | ErrorFrame | NodeNamedFrame | AckFrame | BrokerDataFrame | BashStartFrame | BashOutputFrame | BashEndFrame | ExtensionUIRequestFrame | ExtensionUIDismissFrame | ToolGroupSummaryFrame | AgentSessionEvent;
+export type BrokerToClient = WelcomeFrame | TurnVisibilityFrame | WorkingActivityFrame | ModelChangedFrame | ResourcesReloadedFrame | ErrorFrame | NodeNamedFrame | AckFrame | BrokerDataFrame | BashStartFrame | BashOutputFrame | BashEndFrame | ExtensionUIRequestFrame | ExtensionUIDismissFrame | ToolGroupSummaryFrame | AgentSessionEvent;
 /** Encode one frame as a single newline-terminated JSON line. */
 export declare function encodeFrame(frame: ClientToBroker | BrokerToClient): string;
 /** Byte bounds for a {@link FrameDecoder} (C5). */

package/dist/core/runtime/broker.d.ts

@@ -29,7 +29,7 @@ interface PendingDialog {
  *  bash children. No-op before the session is built or after a clean dispose. */
 export declare function disposeActiveSession(): void;
 export declare function runBroker(nodeId: string, startupAt?: bigint, startupTs?: string): Promise<void>;
-export declare function snapshotMessages(session: CreateAgentSessionResult['session'], boundaryReviewId?: string): import("./session-cycles.js").IdentifiedMessage[] | undefined;
+export declare function snapshotMessages(session: CreateAgentSessionResult['session'], boundaryReviewId?: string): import("./session-visibility.js").ProjectedMessage[] | undefined;
 export declare function buildBrokerSession(engine: BrokerEngine, cfg: BrokerSdkConfig): Promise<{
     session: CreateAgentSessionResult['session'];
     services: AgentSessionServices;

package/dist/core/runtime/broker.js

@@ -40,7 +40,8 @@ import { modelRequestFromConfig, selectInitialModelRoute, unregisteredConcreteMo
 import { KNOWN_STREAM_WAIT_UI } from './stream-watchdog.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
 import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages } from './session-cycles.js';
-import { visibleMessages } from './session-visibility.js';
+import { projectTranscript } from './session-visibility.js';
+import { currentTurnVisibility } from './turn-visibility.js';
 import { isUnknownModel } from './model-selection.js';
 import { BrokerClientRegistry } from './broker/client-registry.js';
 import { ToolGroupTracker } from './broker/tool-groups.js';
@@ -52,6 +53,8 @@ import { EventProjection } from './broker/event-projection.js';
 import { createFrameDispatchContext, handleFrame, } from './broker/frame-dispatch.js';
 import { hydratePersistedAdvertisedCommandMessages, installAdvertisedCommandInvocationContract, } from './advertised-command-invocation.js';
 import { RebindDriver } from './broker/rebind.js';
+import { decodeKickoffOrigin, KICKOFF_ORIGIN_ENV } from './stamp/protocol.js';
+import { announceMessageOrigin } from './stamp/channel.js';
 import { brokerExtensionState, commitBrokerModel } from './broker/daemon-ops.js';
 import { FrameOverflowError, normalizeSnapshotTail, } from './broker-protocol.js';
 /** A review companion may only navigate or fork within a branch whose ancestry
@@ -201,6 +204,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     const launchFile = join(dir, 'broker-launch.json');
     const inv = JSON.parse(readFileSync(launchFile, 'utf8'));
     const cfg = piInvocationToSdkConfig(inv); // also merges inv.env
+    if (cfg.modelExact === true)
+        process.env['CRTR_MODEL_EXACT'] = '1';
+    else
+        delete process.env['CRTR_MODEL_EXACT'];
     // 2–4. Build the engine session via the SERVICES path (C3) — see
     //       buildBrokerSession below. Register it so the FATAL exit path (M3) can
     //       dispose it and reap detached bash children.
@@ -314,7 +321,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         const result = await commitBrokerModel(nodeId, { spec, pinnedOverride, userSelected });
         if (userSelected) {
             delete process.env['CRTR_MODEL_INTENT'];
+            process.env['CRTR_MODEL_EXACT'] = '1';
             cfg.model = result.modelOverride;
+            cfg.modelExact = true;
         }
         return result.modelOverride;
     };
@@ -389,6 +398,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         return ({
             messages,
             ...(retained === undefined ? {} : { messageIds: retained.map(({ id }) => id) }),
+            messageVisibility: retained?.map(({ visibility }) => visibility)
+                ?? messages.map(() => 'visible'),
+            turnVisibility: currentTurnVisibility(),
             stats: liveSession.getSessionStats(),
             // pi's `get_state` (rpc-mode.js), field for field, from the same getters.
             // The ONE divergence: a model-less session (undefined OR the SDK
@@ -637,6 +649,12 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // reload_auth re-drive resolves a model, at which point it fires. For the
         // common model-present path this fires immediately — unchanged behavior.
         if (cfg.firstPrompt !== undefined && cfg.firstPrompt !== '') {
+            // The spawner recorded who authored this kickoff (a birth mandate, a
+            // cron wake, a revive card); announce it against the exact text so the
+            // stamp writer claims it on the message pi persists.
+            const kickoffOrigin = decodeKickoffOrigin(process.env[KICKOFF_ORIGIN_ENV]);
+            if (kickoffOrigin !== null)
+                announceMessageOrigin(cfg.firstPrompt, kickoffOrigin);
             frameDispatch.kickoff(cfg.firstPrompt);
         }
     });
@@ -740,11 +758,17 @@ export function snapshotMessages(session, boundaryReviewId) {
     // payload), narrower than `CycleSessionManagerLike`'s structural read of the
     // `crtr-cycle` marker's `{cycle, fromLeaf}` shape — the fields we read off it
     // are ones ONLY this module's own `appendCustomEntry` call (above) ever writes.
-    const messages = cycleAwareMessages(session.sessionManager);
+    const manager = session.sessionManager;
+    const messages = cycleAwareMessages(manager);
     if (messages !== undefined) {
         hydratePersistedAdvertisedCommandMessages(messages.map(({ message }) => message));
     }
-    return messages === undefined ? undefined : visibleMessages(messages, { boundaryReviewId });
+    return messages === undefined
+        ? undefined
+        : projectTranscript(messages, {
+            boundaryReviewId,
+            sessionEntries: manager.getEntries?.(),
+        });
 }
 // resolveLaunchModel — the SOLE launch model-selection policy, module-scoped
 // so both buildForManager (initial boot, inside buildBrokerSession below) and

package/dist/core/runtime/canvas-extensions.d.ts

@@ -11,6 +11,7 @@ export declare const CANVAS_STRUCTURED_OUTPUT_PATH: string;
 export declare const CANVAS_BASH_VALVE_PATH: string;
 export declare const CANVAS_PREVIEW_RESULT_PATH: string;
 export declare const CANVAS_PROMPT_SCRUB_PATH: string;
+export declare const CANVAS_STAMP_PATH: string;
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session

package/dist/core/runtime/canvas-extensions.js

@@ -23,6 +23,7 @@ export const CANVAS_STRUCTURED_OUTPUT_PATH = resolveExtension('canvas-structured
 export const CANVAS_BASH_VALVE_PATH = resolveExtension('canvas-bash-valve');
 export const CANVAS_PREVIEW_RESULT_PATH = resolveExtension('canvas-preview-result');
 export const CANVAS_PROMPT_SCRUB_PATH = resolveExtension('canvas-prompt-scrub');
+export const CANVAS_STAMP_PATH = resolveExtension('canvas-stamp');
 /** The canvas extensions every node loads, in order. The inbox watcher commits
  *  its cursor at agent_settled before the stophook checks it for idle release.
  *  The review boundary must run before the stophook commits companion session
@@ -46,6 +47,7 @@ export const CANVAS_EXTENSIONS = [
     CANVAS_BASH_VALVE_PATH,
     CANVAS_PREVIEW_RESULT_PATH,
     CANVAS_PROMPT_SCRUB_PATH,
+    CANVAS_STAMP_PATH,
 ];
 /** Preserve the invariant: mandatory extensions are always present exactly once.
  *

package/dist/core/runtime/interactive-deliver.d.ts

@@ -1,3 +1,4 @@
+import type { MessageOrigin } from './stamp/protocol.js';
 /** Which engine call the broker routed a live deliver to (its ack `detail`):
  *  idle → `prompt`, turn in flight → `steer`. */
 export type LiveDeliverRoute = 'prompt' | 'steer';
@@ -7,8 +8,13 @@ export type LiveInterruptOutcome = 'turn' | 'bash' | 'idle';
 /** Deliver `text` to a LIVE node's engine on its serialized frame loop. The
  *  broker routes it itself (idle → prompt, streaming → steer) and acks once
  *  routed; resolves with the route taken. `cards` are rendered runtime-card
- *  envelopes placed ahead of the body inside that same frame handling. */
-export declare function deliverLive(nodeId: string, text: string, cards?: readonly string[]): Promise<LiveDeliverRoute>;
+ *  envelopes placed ahead of the body inside that same frame handling, and
+ *  `origin` is the authorship the broker stamps onto the persisted message —
+ *  it rides the same frame as the body it describes. */
+export declare function deliverLive(nodeId: string, text: string, opts?: {
+    cards?: readonly string[];
+    origin?: MessageOrigin;
+}): Promise<LiveDeliverRoute>;
 /** Abort whatever a LIVE node's engine is doing (turn or `!` bash). Resolves
  *  once the broker has PROCESSED the abort — which, on the single frame loop,
  *  also implies every earlier-accepted deliver was already routed (so a

package/dist/core/runtime/interactive-deliver.js

@@ -15,14 +15,23 @@ import { oneShotControllerRequest } from './broker-request.js';
 /** Deliver `text` to a LIVE node's engine on its serialized frame loop. The
  *  broker routes it itself (idle → prompt, streaming → steer) and acks once
  *  routed; resolves with the route taken. `cards` are rendered runtime-card
- *  envelopes placed ahead of the body inside that same frame handling. */
-export function deliverLive(nodeId, text, cards = []) {
+ *  envelopes placed ahead of the body inside that same frame handling, and
+ *  `origin` is the authorship the broker stamps onto the persisted message —
+ *  it rides the same frame as the body it describes. */
+export function deliverLive(nodeId, text, opts = {}) {
+    const cards = opts.cards ?? [];
     return oneShotControllerRequest({
         nodeId,
         what: 'the interactive delivery',
         ackFor: 'deliver',
         correlated: true,
-        frame: (id) => ({ type: 'deliver', id, text, ...(cards.length > 0 ? { cards: [...cards] } : {}) }),
+        frame: (id) => ({
+            type: 'deliver',
+            id,
+            text,
+            ...(cards.length > 0 ? { cards: [...cards] } : {}),
+            ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
+        }),
         result: (detail) => (detail === 'steer' ? 'steer' : 'prompt'),
     });
 }

package/dist/core/runtime/launch-target.js

@@ -34,7 +34,7 @@ export async function resolveLaunchTarget(req, options = {}) {
     const launch = (await buildLaunchSpecAsync(kind, mode, {
         lifecycle: req.root_lifecycle ?? (req.root === true ? 'resident' : 'terminal'),
         hasManager: req.root !== true,
-        ...(req.model !== undefined ? { model: req.model } : {}),
+        ...(req.model !== undefined ? { model: req.model, modelOverride: true } : {}),
         cwd,
         profileId,
     })).launch;

package/dist/core/runtime/launch.d.ts

@@ -15,12 +15,12 @@ export type { PortableModelSelection } from './model-selection.js';
  *  stays unpinned. */
 export declare function isProviderPinnedModelToken(model: string): boolean;
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
- *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
- *  passing through as a concrete id. Portable tokens are safe to PERSIST as
- *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
- *  ladder the running build ships, so they never freeze a stale concrete
- *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+ *  (`ultra`, `normal`, `opus`, …), a `<family>/<strength>` pair, or an
+ *  anthropic family alias — i.e. a logical preference rather than a concrete
+ *  provider/model id. Portable tokens are safe to PERSIST as defaults
+ *  (`persistDefaultKindModel`): they re-resolve against the declared routes or
+ *  ladder the running build ships, so they never freeze a stale concrete model
+ *  id to disk. */
 export declare function isPortableModelToken(model: string): boolean;
 export declare function logicalModelIntent(model: string, ladders?: ScopeConfig['modelLadders']): {
     family: string;
@@ -65,6 +65,12 @@ export interface LaunchBuildOptions {
     hasManager: boolean;
     extraEnv?: Record<string, string>;
     model?: string;
+    /** A newly supplied `--model` override. Resolve it through the target
+     *  ladder and any quality floor once, then freeze the resulting concrete
+     *  provider/id[:thinking] spec into the launch recipe so every launch,
+     *  revive, and retry consults exactly that model. Existing recipes instead
+     *  carry `modelExact`/`modelIntent` below verbatim. */
+    modelOverride?: boolean;
     /** The TARGET node's cwd — anchors the project-scope stack for kind/ladder
      *  resolution. Defaults to this process's own cwd, which is correct only
      *  when the caller IS resolving for itself; spawn/polymorph paths must

package/dist/core/runtime/launch.js

@@ -85,7 +85,7 @@ function findLadderCell(normalized, ladders, providers) {
  *      strong/medium/light, ALWAYS anthropic (ignores the env/config default).
  *   4. Anything else → pass through unchanged. */
 function modelTokenStrength(model) {
-    const slash = model.indexOf('/');
+    const slash = model.lastIndexOf('/');
     const provider = slash === -1 ? undefined : model.slice(0, slash);
     const rest = slash === -1 ? model : model.slice(slash + 1);
     const strength = STRENGTH_ALIASES[rest];
@@ -137,19 +137,19 @@ export function isProviderPinnedModelToken(model) {
     return model.includes('/') && !isPortableModelToken(model);
 }
 /** True when `model` is a PORTABLE ladder token — a bare strength/alias
- *  (`ultra`, `normal`, `opus`, …), an `anthropic|openai / strength` pair, or
- *  an anthropic family alias — i.e. a form `normalizeModel` resolves through the ladders rather than
- *  passing through as a concrete id. Portable tokens are safe to PERSIST as
- *  defaults (`persistDefaultKindModel`): they re-resolve against whatever
- *  ladder the running build ships, so they never freeze a stale concrete
- *  model id to disk. Mirrors `normalizeModel`'s branch structure exactly. */
+ *  (`ultra`, `normal`, `opus`, …), a `<family>/<strength>` pair, or an
+ *  anthropic family alias — i.e. a logical preference rather than a concrete
+ *  provider/model id. Portable tokens are safe to PERSIST as defaults
+ *  (`persistDefaultKindModel`): they re-resolve against the declared routes or
+ *  ladder the running build ships, so they never freeze a stale concrete model
+ *  id to disk. */
 export function isPortableModelToken(model) {
     if (model.includes('/')) {
-        const slash = model.indexOf('/');
-        const provider = model.slice(0, slash);
+        const slash = model.lastIndexOf('/');
+        const family = model.slice(0, slash);
         const rest = model.slice(slash + 1);
-        return (provider === 'anthropic' || provider === 'openai') && (STRENGTH_ALIASES[rest] !== undefined
-            || (provider === 'anthropic' && (rest === 'opus' || rest === 'sonnet' || rest === 'haiku')));
+        return family !== '' && (STRENGTH_ALIASES[rest] !== undefined
+            || (family === 'anthropic' && (rest === 'opus' || rest === 'sonnet' || rest === 'haiku')));
     }
     return STRENGTH_ALIASES[model] !== undefined || model === 'opus' || model === 'sonnet' || model === 'haiku';
 }
@@ -158,7 +158,7 @@ export function logicalModelIntent(model, ladders = modelLadders()) {
     if (strength === null)
         return undefined;
     if (model.includes('/'))
-        return { family: model.slice(0, model.indexOf('/')), strength };
+        return { family: model.slice(0, model.lastIndexOf('/')), strength };
     if (model === 'opus' || model === 'sonnet' || model === 'haiku')
         return { family: 'anthropic', strength };
     return { family: defaultProvider(ladders), strength };
@@ -251,16 +251,18 @@ function buildLaunchSpecFromMerged(kind, mode, opts, merged) {
     const ladders = merged.modelLadders;
     const kindModel = mode === 'orchestrator' ? kindConfig?.orchestratorModel ?? kindConfig?.model : kindConfig?.model;
     const chosenModel = opts.modelExact === true ? opts.model : floorReviewModel(kind, opts.model, kindModel, ladders);
-    const intent = opts.modelExact === true ? undefined : (opts.modelIntent ?? (chosenModel !== undefined ? logicalModelIntent(chosenModel, ladders) : undefined));
+    const exact = opts.modelExact === true || opts.modelOverride === true;
+    const resolvedModel = opts.modelExact === true
+        ? chosenModel
+        : (chosenModel !== undefined ? normalizeModel(chosenModel, ladders) : undefined);
+    const intent = exact ? undefined : (opts.modelIntent ?? (chosenModel !== undefined ? logicalModelIntent(chosenModel, ladders) : undefined));
     const launch = {
-        model: opts.modelExact === true
-            ? chosenModel
-            : (chosenModel !== undefined ? normalizeModel(chosenModel, ladders) : undefined),
+        model: resolvedModel,
         modelIntent: intent,
         modelProviderPinned: opts.modelProviderPinned !== undefined
             ? opts.modelProviderPinned
             : opts.model !== undefined && isProviderPinnedModelToken(opts.model),
-        modelExact: opts.modelExact === true ? true : undefined,
+        modelExact: exact ? true : undefined,
         tools: kindConfig?.tools ?? [],
         extensions: mergeCanvasExtensions([...CANVAS_EXTENSIONS, ...(kindConfig?.extensions ?? [])]),
         systemPrompt: LAUNCH_SYSTEM_PROMPT,

package/dist/core/runtime/model-swap.d.ts

@@ -2,7 +2,7 @@ import { type NodeMeta } from '../canvas/index.js';
 /** True when the node's broker engine is reachable: its recorded pid is alive
  *  AND its view.sock exists. Both are required — a dead pid with a stale socket,
  *  or a live pid mid-boot before it binds the socket, is NOT a live broker. */
-export declare function isBrokerLive(meta: NodeMeta): boolean;
+export declare function isBrokerLive(node: Pick<NodeMeta, 'node_id' | 'pi_pid'>): boolean;
 /** Swap a LIVE node's model over its view.sock. Connects as a controller,
  *  sends `set_model`, and resolves with the broker-resolved durable spec from its
  *  `model_changed` frame. Rejects with the broker's message on an `error` frame (e.g.
@@ -16,9 +16,10 @@ export declare function isBrokerLive(meta: NodeMeta): boolean;
 export declare function setModelLive(nodeId: string, spec: string, pinned: boolean): Promise<string>;
 /** Persist a model choice into a DORMANT node's durable recipe — mirrors exactly
  *  what the broker's persistModelChoice writes on a live switch: `model_override`
- *  (so polymorphs preserve it via buildLaunchSpec) and `launch.model` (the recipe
- *  buildPiArgv replays on revive). `spec` must already be a concrete `provider/id`
- *  (normalizeModel maps tiers/aliases; a bare substring cannot resolve offline).
+ *  (so polymorphs preserve it via buildLaunchSpec), `launch.model`, and its
+ *  exact-consult marker (the recipe buildPiArgv replays on revive). `spec` must
+ *  already be a concrete `provider/id` (normalizeModel maps tiers/aliases; a bare
+ *  substring cannot resolve offline).
  *  `pinned` is the durable-pin decision for this change — decided by the CALLER
  *  from the RAW pre-normalize token, never re-derived here from `spec`'s shape
  *  (a concrete `spec` always reads as "pinned", which would wrongly re-pin a