@north-light/crouter 0.3.274 → 0.3.276

package/dist/core/runtime/spawn.d.ts

@@ -62,6 +62,8 @@ export interface SpawnChildOpts {
     worktree?: boolean;
     /** Local branch the managed worktree is cut from and later landed onto. */
     worktreeBase?: string;
+    /** Invocation-selected repository from which to cut a managed worktree. */
+    worktreeCwd?: string;
     /** Preallocated node id, used when a managed worktree must be named before birth. */
     nodeId?: string;
     /** Hidden ambient "current situation" text — NOT the visible prompt/body.

package/dist/core/runtime/spawn.js

@@ -251,7 +251,7 @@ export async function spawnChildPrepared(opts, beforeBrokerLaunch) {
     let spawnCwd = opts.cwd;
     try {
         if (wantsWorktree) {
-            managedWorktree = createManagedWorktree(opts.cwd, nodeId, opts.worktreeBase);
+            managedWorktree = createManagedWorktree(opts.worktreeCwd ?? opts.cwd, nodeId, opts.worktreeBase);
             spawnCwd = managedWorktree.path;
         }
         // Spine: a managed child reports up to its spawner (has a manager); an

package/dist/core/runtime/surface-bg.d.ts

@@ -1,10 +1,12 @@
-/** The SGR escape that turns ON the distinct-surface background (theme
- *  `selectedBg`), e.g. `\x1b[48;2;58;58;74m`. Pair with `\x1b[49m` to reset just
+/** The SGR escape that turns ON the distinct-surface background (the theme's
+ *  card plane), e.g. `\x1b[48;2;52;53;65m`. Pair with `\x1b[49m` to reset just
  *  the background. Throws if no process has initialized the theme — callers on a
  *  render path (the attach overlay) always have, by construction. */
 export declare function surfaceBgAnsi(): string;
-/** tmux flags that frame a `display-menu` / `display-popup` on the distinct
- *  surface background — a rounded border + the surface bg on the body and border.
+/** tmux flags that frame a `display-menu` / `display-popup` as a distinct
+ *  surface — a rounded border in the theme accent around a body painted with the
+ *  theme's card plane. The accent border is what carries the "you are somewhere
+ *  else" signal, because a card sits close to the page by design.
  *  Empty when the theme is unavailable in this process (chrome stays default; the
  *  attach viewer re-installs the menu with these once it has themed). One knob:
  *  every crtr tmux float shares this single definition. */

package/dist/core/runtime/surface-bg.js

@@ -3,10 +3,24 @@
 // crtr's overlays and popups must read as a SEPARATE surface from the normal one
 // (CTO ruling, insights/terminal-ui/inline-ui-placement #11): a popup whose background matches
 // the surface has invisible edges, so you can't tell where the float begins. We
-// paint them with the active pi theme's `selectedBg` role — theme-derived, so it
-// adapts to light/dark and is ONE centralized knob, not a scattered hardcode.
+// paint them from the active pi theme — theme-derived, so it adapts to light/dark
+// and is ONE centralized knob, not a scattered hardcode.
 //
-// pi 0.79 does not re-export `selectedBg` through its public API (the `.` entry
+// WHICH ROLE: `userMessageBg`, the theme's CARD plane — not `selectedBg`. Every
+// theme places its card one step off the page background (gruvbox-material
+// #32302f vs #282828; pi's own dark #343541, light #e8e8e8) while `selectedBg` is
+// a SELECTION BAND, deliberately pushed far off the page so a highlighted row
+// lifts. Painting a 90%×85% takeover with the selection band made the whole
+// screen that band: every dim/muted role lost the contrast it was designed
+// against (gruvbox dim text fell to 2.1:1), and the row highlight drawn ON TOP
+// had nowhere left to go. The card plane keeps content legibility and leaves the
+// selection band free to do its actual job inside the popup.
+//
+// A card sits close to the page by design, so the EDGE signal rule 11 demands
+// comes from the border, not the fill: we paint the rounded border in the theme
+// accent so the float's boundary is unmistakable.
+//
+// pi 0.79 does not re-export these roles through its public API (the `.` entry
 // omits `getResolvedThemeColors` and the live `theme` singleton). It DOES publish
 // the live `Theme` instance on a process-global symbol once `initTheme()` has run
 // — the same hook pi's own SDK reads (see broker.ts `ctx.ui.theme`). We read it
@@ -26,43 +40,46 @@ function liveTheme() {
     const t = globalThis[THEME_SYMBOL];
     return (t ?? undefined);
 }
-/** The SGR escape that turns ON the distinct-surface background (theme
- *  `selectedBg`), e.g. `\x1b[48;2;58;58;74m`. Pair with `\x1b[49m` to reset just
+/** The SGR escape that turns ON the distinct-surface background (the theme's
+ *  card plane), e.g. `\x1b[48;2;52;53;65m`. Pair with `\x1b[49m` to reset just
  *  the background. Throws if no process has initialized the theme — callers on a
  *  render path (the attach overlay) always have, by construction. */
 export function surfaceBgAnsi() {
     const t = liveTheme();
     if (t === undefined)
         throw new Error('surfaceBgAnsi: pi theme not initialized in this process');
-    return t.getBgAnsi('selectedBg');
+    return t.getBgAnsi('userMessageBg');
 }
-/** The distinct-surface background as a tmux colour token (`#rrggbb` on a
- *  truecolor theme, `colourN` on a 256-colour theme), or undefined when the theme
- *  is not yet loaded in this process OR defines no selection background. tmux
- *  cannot read pi's theme, so we translate the SGR pi resolved for us. */
-function surfaceBgTmux() {
-    const t = liveTheme();
-    if (t === undefined)
-        return undefined;
-    const ansi = t.getBgAnsi('selectedBg');
-    const tc = /48;2;(\d+);(\d+);(\d+)/.exec(ansi);
+/** An SGR colour parameter (`48;2;r;g;b` or `38;5;n`) as a tmux colour token —
+ *  `#rrggbb` on a truecolor theme, `colourN` on a 256-colour one. tmux cannot
+ *  read pi's theme, so we translate the SGR pi already resolved for us.
+ *  undefined when the role is empty (the SGR is a bare default-colour reset). */
+function tmuxColor(ansi) {
+    const tc = /[34]8;2;(\d+);(\d+);(\d+)/.exec(ansi);
     if (tc !== null) {
         const hex = (n) => Number(n).toString(16).padStart(2, '0');
         return `#${hex(tc[1])}${hex(tc[2])}${hex(tc[3])}`;
     }
-    const c256 = /48;5;(\d+)/.exec(ansi);
+    const c256 = /[34]8;5;(\d+)/.exec(ansi);
     if (c256 !== null)
         return `colour${c256[1]}`;
-    return undefined; // empty/default selectedBg → nothing distinct to paint
+    return undefined;
 }
-/** tmux flags that frame a `display-menu` / `display-popup` on the distinct
- *  surface background — a rounded border + the surface bg on the body and border.
+/** tmux flags that frame a `display-menu` / `display-popup` as a distinct
+ *  surface — a rounded border in the theme accent around a body painted with the
+ *  theme's card plane. The accent border is what carries the "you are somewhere
+ *  else" signal, because a card sits close to the page by design.
  *  Empty when the theme is unavailable in this process (chrome stays default; the
  *  attach viewer re-installs the menu with these once it has themed). One knob:
  *  every crtr tmux float shares this single definition. */
 export function surfaceTmuxStyleArgs() {
-    const bg = surfaceBgTmux();
+    const t = liveTheme();
+    if (t === undefined)
+        return [];
+    const bg = tmuxColor(t.getBgAnsi('userMessageBg'));
     if (bg === undefined)
         return [];
-    return ['-b', 'rounded', '-s', `bg=${bg}`, '-S', `bg=${bg}`];
+    const accent = tmuxColor(t.getFgAnsi('accent'));
+    const border = accent === undefined ? `bg=${bg}` : `fg=${accent},bg=${bg}`;
+    return ['-b', 'rounded', '-s', `bg=${bg}`, '-S', border];
 }

package/dist/core/tui/draw.d.ts

@@ -1,3 +1,5 @@
+export declare const META_FG = "38;5;246";
+export declare const RECESSIVE_FG = "38;5;243";
 export interface Size {
     cols: number;
     rows: number;

package/dist/core/tui/draw.js

@@ -22,6 +22,21 @@ const REVERSE = `${ESC}7m`;
 const DIM = `${ESC}2m`;
 const BOLD = `${ESC}1m`;
 const ITALIC = `${ESC}3m`;
+// ── The recessive text ramp ────────────────────────────────────────────
+//
+// Two explicit greys for text that must sit BEHIND the primary content without
+// disappearing into it. Use these instead of the two things that look equivalent
+// and are not:
+//
+//   - basic-16 bright-black (`90`) resolves against the TERMINAL's palette, which
+//     a dark theme routinely sets within a hair of its own background;
+//   - SGR DIM (`2`) is a multiplier, so stacking it on an already-dark grey lands
+//     at mud — and stacking it on THESE would undo the contrast they encode.
+//
+// Never combine either with these. Ratios below are against the two planes a
+// raw-ANSI view can render on: a bare dark terminal and a themed popup card.
+export const META_FG = '38;5;246'; // 4.3–4.9:1 — metadata you actively scan
+export const RECESSIVE_FG = '38;5;243'; // 2.9–3.3:1 — deliberately behind, still read
 /** An SGR fg/bg parameter is digits and semicolons only (e.g. '32', '1;36', '236').
  *  Guards styleSpan against a non-numeric value (a color name) producing a broken
  *  escape sequence. */

package/dist/core/worktree-sweep.js

@@ -336,7 +336,7 @@ export async function reconcileManagedWorktree(nodeId, guard, now = Date.now())
         return { status: 'skipped', reason: 'already_reconciled' };
     const cwd = existsSync(wt.path) ? wt.path : wt.repo_root;
     if (!existsSync(cwd)) {
-        return finish(nodeId, wt, { status: 'refused', reason: 'repo_unavailable', detail: `neither the managed checkout (${wt.path}) nor its repository root (${wt.repo_root}) is present` }, { base: null, branch: null, checkout: null }, now, guard);
+        return persistComplete(nodeId, wt, guard);
     }
     const commonDir = await commonGitDirAsync(cwd);
     if (commonDir === null) {
@@ -423,9 +423,15 @@ async function reconcilePresentCheckout(nodeId, wt, guard) {
     const list = await gitAsync(['worktree', 'list', '--porcelain'], wt.path);
     if (list.status !== 0)
         return { status: 'failed', reason: 'worktree_list_failed', detail: detailOf(list) };
-    const registeredPath = registeredCheckoutPath(list.stdout, wt.path, wt.branch);
+    // An explicit `close` already proved a branch-moved checkout's identity and
+    // authorized its later disposal for THIS exact branch — never adopted here.
+    // Only the recorded authorization changes which branch this pass expects;
+    // everything else below is re-verified exactly as for an ordinary record.
+    const disposal = wt.disposal;
+    const expectedBranch = disposal?.observed_branch ?? wt.branch;
+    const registeredPath = registeredCheckoutPath(list.stdout, wt.path, expectedBranch);
     if (registeredPath === null) {
-        return { status: 'refused', reason: 'not_registered', detail: `${wt.path} is not registered to refs/heads/${wt.branch}; crtr will not act on a path it cannot prove it owns` };
+        return { status: 'refused', reason: 'not_registered', detail: `${wt.path} is not registered to refs/heads/${expectedBranch}; crtr will not act on a path it cannot prove it owns` };
     }
     const main = mainWorktreePath(list.stdout);
     if (main === null || samePath(main, registeredPath) || !existsSync(main)) {
@@ -439,8 +445,8 @@ async function reconcilePresentCheckout(nodeId, wt, guard) {
     const head = await gitAsync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path);
     if (head.status !== 0)
         return { status: 'failed', reason: 'branch_check_failed', detail: detailOf(head) };
-    if (head.stdout.trim() !== wt.branch) {
-        return { status: 'refused', reason: 'wrong_branch', detail: `expected ${wt.branch}, found ${head.stdout.trim() === 'HEAD' ? 'detached HEAD' : head.stdout.trim()}` };
+    if (head.stdout.trim() !== expectedBranch) {
+        return { status: 'refused', reason: 'wrong_branch', detail: `expected ${expectedBranch}, found ${head.stdout.trim() === 'HEAD' ? 'detached HEAD' : head.stdout.trim()}` };
     }
     // Uncommitted work blocks removal unconditionally. No containment proof
     // overrides this: those reason about committed content, and nothing here has
@@ -454,6 +460,23 @@ async function reconcilePresentCheckout(nodeId, wt, guard) {
     let branchSha = await revParseRef(wt.path, 'HEAD');
     if (branchSha === null)
         return { status: 'failed', reason: 'head_unreadable', detail: `could not read HEAD in ${wt.path}` };
+    if (disposal !== undefined) {
+        // Re-verify the exact identity `close` authorized before mutating anything.
+        // A mismatch invalidates the authorization instead of adopting whatever is
+        // observed now — only the explicit command that wrote it may refresh it.
+        const commonDir = await commonGitDirAsync(wt.path);
+        if (commonDir !== disposal.common_dir || branchSha !== disposal.observed_sha) {
+            return { status: 'refused', reason: 'disposal_authorization_stale', detail: `${wt.path} changed since \`close\` authorized its disposal; rerun \`crtr node worktree close\` from that node to re-authorize, or ask the user with \`crtr human send\`` };
+        }
+        if (!guard.stillEligible())
+            return NODE_REVIVED;
+        const removed = await gitAsync(['worktree', 'remove', registeredPath], main);
+        if (removed.status !== 0)
+            return { status: 'refused', reason: 'worktree_remove_failed', detail: detailOf(removed) };
+        // `disposal.observed_branch` is not a `crtr/*` branch crouter created — it
+        // is preserved, never deleted, unlike the ordinary path below.
+        return persistComplete(nodeId, wt, guard);
+    }
     let proof = await proveContained(wt.path, wt, branchSha);
     let stash;
     if (proof === null && wt.land_intent !== undefined) {

package/dist/core/worktree.d.ts

@@ -115,17 +115,6 @@ export interface AutoDroppedWorktree {
  * explicit close: removal and branch deletion are deferred until that owner
  * has exited. */
 export declare function autoDropCleanManagedWorktreeLocked(nodeId: string, wt: ManagedWorktree, proof: CleanEmptyProof): AutoDroppedWorktree | null;
-/** `push final`'s escape hatch: a managed worktree that has
- *  nothing to land is auto-dropped instead of blocking on an explicit
- *  `node worktree close` — one the caller may have been told NOT to run
- *  because a manager already landed the same change another way, or
- *  that never had anything to close in the first place (a read-only
- *  review node). Returns null and changes nothing when the worktree is not
- *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
- *  concurrent mutation invalidates that proof before the record is closed
- *  (see `autoDropCleanManagedWorktreeLocked`); the caller's existing
- *  `open_managed_worktree` guard then still applies unchanged — real
- *  commits, real uncommitted changes, and a lost race all require the
- *  explicit path. */
+export declare function branchIsPushedAtCurrentTip(wt: ManagedWorktree): Promise<boolean>;
 export declare function autoDropCleanManagedWorktree(nodeId: string): AutoDroppedWorktree | null;
 export {};

package/dist/core/worktree.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { dirname, join, resolve } from 'node:path';
-import { gitSync } from './git.js';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { gitAsync, gitSync } from './git.js';
 import { crtrHome } from './canvas/paths.js';
 import { isPidAlive } from './canvas/pid.js';
 import { getNode, updateNode } from './canvas/index.js';
@@ -44,7 +44,27 @@ export function openManagedWorktreeForNode(nodeId) {
     return wt?.state === 'open' ? wt : null;
 }
 function repoRootFor(cwd) {
-    return runGit(cwd, ['rev-parse', '--show-toplevel'], 'not_git_repo', 'Pass --cwd pointing inside a git repository.');
+    const result = gitSync(['rev-parse', '--show-toplevel'], cwd);
+    if (result.status !== 0) {
+        const detail = (result.stderr.trim() || result.stdout.trim()).trim();
+        throw new WorktreeError('not_git_repo', `cwd ${cwd} is not a git repository`, 'Pass --cwd <real repo> pointing inside a git repository.', detail);
+    }
+    return result.stdout.trim();
+}
+function isManagedWorktreeBase(repoRoot) {
+    const path = relative(canonicalPath(managedWorktreesRoot()), canonicalPath(repoRoot));
+    return path !== '' && path !== '..' && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+function recordedBranchExists(cwd, branch) {
+    const ref = `refs/heads/${branch}`;
+    const exists = gitSync(['show-ref', '--verify', '--quiet', ref], cwd);
+    if (exists.status === 0)
+        return true;
+    if (exists.status === 1 && exists.executionFailed !== true)
+        return false;
+    const stderr = exists.stderr.trim() || '<empty>';
+    const execution = exists.processError === undefined ? '' : `\nprocess error: ${exists.processError}`;
+    throw new WorktreeError('recorded_branch_inspection_failed', `could not inspect recorded branch '${branch}' (git show-ref exited with status ${exists.status})`, 'Inspect the repository and its Git metadata, then retry.', `status: ${exists.status}\nstderr: ${stderr}${execution}`);
 }
 function resolveLandableBase(repoRoot, baseRef) {
     const ref = `refs/heads/${baseRef}`;
@@ -142,6 +162,43 @@ function registeredWorktree(repoRoot, path, branch) {
     }
     return false;
 }
+function proveBranchContained(cwd, baseRef, branchSha) {
+    const candidates = [];
+    const localBaseRef = `refs/heads/${baseRef}`;
+    const localBase = gitSync(['rev-parse', '--verify', '--quiet', localBaseRef], cwd);
+    if (localBase.status === 0)
+        candidates.push({ ref: localBaseRef, sha: localBase.stdout.trim() });
+    const upstream = gitSync(['rev-parse', '--symbolic-full-name', '--verify', `${baseRef}@{upstream}`], cwd);
+    const upstreamRef = upstream.status === 0 && upstream.stdout.trim().startsWith('refs/') ? upstream.stdout.trim() : `refs/remotes/origin/${baseRef}`;
+    const upstreamSha = gitSync(['rev-parse', '--verify', '--quiet', upstreamRef], cwd);
+    if (upstreamSha.status === 0)
+        candidates.push({ ref: upstreamRef, sha: upstreamSha.stdout.trim() });
+    if (candidates.length === 0)
+        return null;
+    for (const c of candidates) {
+        if (gitSync(['merge-base', '--is-ancestor', branchSha, c.sha], cwd).status === 0)
+            return { containingRef: c.ref, containingSha: c.sha };
+    }
+    for (const c of candidates) {
+        const cherry = gitSync(['cherry', c.sha, branchSha], cwd);
+        if (cherry.status !== 0)
+            continue;
+        const lines = cherry.stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '');
+        if (lines.every((l) => l.startsWith('-')))
+            return { containingRef: c.ref, containingSha: c.sha };
+    }
+    for (const c of candidates) {
+        const candidateTree = gitSync(['rev-parse', '--verify', `${c.sha}^{tree}`], cwd);
+        if (candidateTree.status !== 0)
+            continue;
+        const merged = gitSync(['merge-tree', '--write-tree', c.sha, branchSha], cwd);
+        if (merged.status !== 0)
+            continue;
+        if (merged.stdout.split('\n')[0]?.trim() === candidateTree.stdout.trim())
+            return { containingRef: c.ref, containingSha: c.sha };
+    }
+    return null;
+}
 /** Undo a creation attempt, but only resources whose recorded path, branch,
  * and original base still prove they belong to that attempt. */
 function rollbackManagedWorktreeLocked(wt, pathWasAbsent) {
@@ -235,6 +292,9 @@ function seedManagedWorktreeExclude(repoRoot) {
 }
 export function createManagedWorktree(cwd, nodeId, baseRef = 'main') {
     const repoRoot = repoRootFor(cwd);
+    if (isManagedWorktreeBase(repoRoot)) {
+        throw new WorktreeError('managed_worktree_base', `cwd ${repoRoot} is a managed worktree and cannot be used as a managed worktree base`, 'Pass --cwd <real repo> pointing at the repository’s primary checkout.');
+    }
     return withRepositoryWorktreeLock(repoRoot, () => {
         const baseSha = resolveLandableBase(repoRoot, baseRef);
         const path = managedWorktreePath(nodeId);
@@ -386,6 +446,67 @@ function deferredCleanupResult(wt) {
         branch_delete_error: `cleanup pending: local branch ${wt.branch} remains checked out at ${wt.path}; delete it only after that checkout is removed and its landed commit is still contained in ${wt.base_ref}.`,
     };
 }
+/** The disposal path for `close` when the recorded `crtr/*` branch is gone:
+ *  ordinary PR work moved this checkout onto a real branch. This never lands
+ *  or rebases that branch — it belongs to a workflow crouter does not own —
+ *  and never deletes it. It only AUTHORIZES the daemon sweep to remove the
+ *  checkout later, once this node's own broker has exited, and only after
+ *  proving the branch's content is already delivered. Runs after the caller
+ *  already proved the checkout clean and not mid-rebase. */
+function closeBranchMovedWorktree(nodeId, wt, actualBranch) {
+    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true) {
+        throw new WorktreeError('wrong_branch', `managed worktree's recorded branch ${wt.branch} no longer exists, and its checkout at ${wt.path} is not registered to ${actualBranch} either`, `Inspect ${wt.path} and its git worktree registration, then ask the user with \`crtr human send\` if you are unsure how to proceed.`);
+    }
+    const actualSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.');
+    const proof = proveBranchContained(wt.path, wt.base_ref, actualSha);
+    if (proof === null) {
+        throw new WorktreeError('branch_moved_unlanded', `managed worktree's recorded branch ${wt.branch} no longer exists; its checkout is now on ${actualBranch} at ${actualSha}, which carries content local base branch '${wt.base_ref}' does not yet contain`, `Land or push ${actualBranch} through its own workflow (merge its PR, or fast-forward '${wt.base_ref}' to include it) before closing, or ask the user with \`crtr human send\` if you are unsure how ${actualBranch} should be delivered.`);
+    }
+    const commonDir = commonGitDir(wt.repo_root);
+    // Recheck identity immediately before writing the authorization: nothing
+    // about the checkout may have moved between the proof above and this write.
+    const stillRegistered = registeredWorktree(wt.repo_root, wt.path, actualBranch) === true;
+    const stillOnBranch = currentBranch(wt.path) === actualBranch;
+    const stillAtSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.') === actualSha;
+    if (!stillRegistered || !stillOnBranch || !stillAtSha) {
+        throw new WorktreeError('wrong_branch', `managed worktree at ${wt.path} changed while closing`, `Inspect ${wt.path}, then rerun \`crtr node worktree close\`.`);
+    }
+    const disposal = { observed_branch: actualBranch, observed_sha: actualSha, common_dir: commonDir, authorized: new Date().toISOString() };
+    persistClosedWorktreeState(nodeId, { ...wt, disposal }, 'pending');
+    const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
+    return {
+        node_id: nodeId,
+        branch: actualBranch,
+        worktree_path: wt.path,
+        // Nothing was rebased or fast-forwarded here: `${actualBranch}`'s content
+        // was already proven contained in `${proof.containingRef}` at `${proof.containingSha}`.
+        landed_sha: actualSha,
+        worktree_removed: false,
+        worktree_remove_error: `cleanup pending: the caller checkout at ${wt.path} remains intact. After its node exits, run \`${remove}\` after confirming it is safe to delete.`,
+        branch_deleted: false,
+        branch_delete_error: `${actualBranch} is not a crtr-managed branch and will never be deleted automatically; it is preserved once the checkout above is removed.`,
+    };
+}
+/** Word the `no_managed_worktree` refusal from the record's ACTUAL state
+ *  rather than a blanket "no worktree". A `closed`/`cleanup: pending` record
+ *  still has its checkout on disk, scheduled for the daemon sweep to finish —
+ *  that is not lost ownership, and three separate reports (#849, #862, #872)
+ *  were misdiagnosed because the old wording read as if it were. */
+function noManagedWorktreeMessage(nodeId, verb) {
+    const wt = getNode(nodeId)?.managed_worktree;
+    if (wt == null)
+        return { message: `node ${nodeId} has no managed worktree`, next: `Nothing to ${verb} for this node.` };
+    if (wt.state === 'abandoned') {
+        const branch = wt.abandoned?.branch ?? wt.branch;
+        return { message: `node ${nodeId}'s managed worktree was already abandoned`, next: `Nothing to ${verb} for this node; its work was retained on branch ${branch}.` };
+    }
+    if (wt.state === 'closed') {
+        return wt.cleanup === 'complete'
+            ? { message: `node ${nodeId}'s managed worktree is already closed and its cleanup is complete`, next: `Nothing to ${verb} for this node.` }
+            : { message: `node ${nodeId}'s managed worktree is already closed; this is not lost ownership — its checkout at ${wt.path} is scheduled for automatic cleanup once that is safe`, next: `Nothing to ${verb} for this node. The daemon sweep finishes removing ${wt.path} on its own; inspect it directly only if it still needs manual attention.` };
+    }
+    return { message: `node ${nodeId} has no open managed worktree`, next: `Nothing to ${verb} for this node.` };
+}
 function closeManagedWorktreeLocked(nodeId) {
     const node = getNode(nodeId);
     if (node === null) {
@@ -393,7 +514,8 @@ function closeManagedWorktreeLocked(nodeId) {
     }
     const wt = openManagedWorktreeForNode(nodeId);
     if (wt === null) {
-        throw new WorktreeError('no_managed_worktree', `node ${nodeId} has no open managed worktree`, 'Nothing to close for this node.');
+        const { message, next } = noManagedWorktreeMessage(nodeId, 'close');
+        throw new WorktreeError('no_managed_worktree', message, next);
     }
     if (!existsSync(wt.path)) {
         const proof = proveAbsentPathManagedWorktree(wt);
@@ -427,7 +549,16 @@ function closeManagedWorktreeLocked(nodeId) {
     const branch = currentBranch(wt.path);
     if (branch !== wt.branch) {
         const found = branch === 'HEAD' ? 'detached HEAD' : branch;
-        throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, `Check out ${wt.branch} in ${wt.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`);
+        const recordedRefExists = recordedBranchExists(wt.path, wt.branch);
+        if (recordedRefExists || branch === 'HEAD') {
+            throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, recordedRefExists
+                ? `Check out ${wt.branch} in ${wt.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`
+                : `The recorded branch ${wt.branch} no longer exists, and ${wt.path} is in detached HEAD, so there is no branch to preserve. Check out or create a branch there before closing, or ask the user with \`crtr human send\` if you are unsure how to proceed.`);
+        }
+        // The recorded crtr/* branch is gone: ordinary PR work moved this checkout
+        // onto a real branch. The checkout is already proven clean and not
+        // mid-rebase (both checked above), so disposal may proceed.
+        return closeBranchMovedWorktree(nodeId, wt, branch);
     }
     let baseSha;
     try {
@@ -527,16 +658,45 @@ export function closeManagedWorktree(nodeId) {
 const ABANDON_AUTHOR_NAME = 'crtr-abandon';
 const ABANDON_AUTHOR_EMAIL = 'crtr-abandon@localhost';
 const ABANDON_SUBJECT = 'crtr-abandon';
-function persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by) {
+function persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by, branch = wt.branch) {
     updateNode(nodeId, {
         cwd: wt.repo_root,
         managed_worktree: {
             ...wt,
             state: 'abandoned',
-            abandoned: { branch: wt.branch, tip_sha: tipSha, at, by },
+            abandoned: { branch, tip_sha: tipSha, at, by },
         },
     });
 }
+/** The disposal path for `abandon` when the recorded `crtr/*` branch is gone:
+ *  ordinary PR work moved this checkout onto a real branch. Abandon never
+ *  lands that branch and — unlike the ordinary path above — never invents a
+ *  commit on it: a synthetic `crtr-abandon` marker on someone's real PR
+ *  branch is not a trade this code may make on their behalf. So this
+ *  requires the checkout already clean and not mid-operation, then removes
+ *  only the checkout and preserves the actual branch and its commits exactly
+ *  as they stand. The caller already confirmed the node is not running. */
+function abandonBranchMovedWorktree(nodeId, wt, actualBranch, by) {
+    if (isRebaseInProgress(wt.path)) {
+        throw new WorktreeError('rebase_in_progress', 'this managed worktree is mid-rebase', `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree abandon\`.`);
+    }
+    const dirty = statusPorcelain(wt.path);
+    if (dirty !== '') {
+        throw new WorktreeError('dirty_worktree', 'managed worktree has uncommitted changes', `The recorded branch ${wt.branch} no longer exists; its checkout is now on ${actualBranch} with uncommitted changes crtr will not commit on your behalf. Commit or stash them in ${wt.path}, then rerun \`crtr node worktree abandon\`.`);
+    }
+    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true) {
+        throw new WorktreeError('wrong_branch', `managed worktree's recorded branch ${wt.branch} no longer exists, and its checkout at ${wt.path} is not registered to ${actualBranch} either`, `Inspect ${wt.path} and its git worktree registration, then ask the user with \`crtr human send\` if you are unsure how to proceed.`);
+    }
+    const actualSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'abandon_tip_failed', 'Inspect the worktree manually, then retry.');
+    // Recheck identity immediately before the destructive step.
+    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true || currentBranch(wt.path) !== actualBranch) {
+        throw new WorktreeError('wrong_branch', `managed worktree at ${wt.path} changed while abandoning`, `Inspect ${wt.path}, then rerun \`crtr node worktree abandon\`.`);
+    }
+    runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
+    const at = new Date().toISOString();
+    persistAbandonedWorktreeState(nodeId, wt, actualSha, at, by, actualBranch);
+    return { node_id: nodeId, branch: actualBranch, tip_sha: actualSha, worktree_path: wt.path, branch_deleted: false };
+}
 function createAbandonMarker(wt, parentSha, nodeId, at) {
     const treeSha = runGit(wt.repo_root, ['rev-parse', `${parentSha}^{tree}`], 'abandon_tree_failed', 'Inspect the branch manually, then retry.');
     const markerSha = runGit(wt.repo_root, ['-c', `user.name=${ABANDON_AUTHOR_NAME}`, '-c', `user.email=${ABANDON_AUTHOR_EMAIL}`, 'commit-tree', treeSha, '-p', parentSha, '-m', ABANDON_SUBJECT, '-m', `Crtr-Abandon: ${nodeId} ${at}`], 'abandon_commit_failed', 'Inspect the branch manually, then retry.');
@@ -550,7 +710,8 @@ function abandonManagedWorktreeLocked(nodeId, by) {
     }
     const wt = openManagedWorktreeForNode(nodeId);
     if (wt === null) {
-        throw new WorktreeError('no_managed_worktree', `node ${nodeId} has no open managed worktree`, 'Nothing to abandon for this node.');
+        const { message, next } = noManagedWorktreeMessage(nodeId, 'abandon');
+        throw new WorktreeError('no_managed_worktree', message, next);
     }
     if (node.status === 'active' || node.status === 'idle' || isPidAlive(node.pi_pid)) {
         throw new WorktreeError('node_running', `node ${nodeId} is still running`, 'Stop the node before abandoning its managed worktree.');
@@ -558,8 +719,17 @@ function abandonManagedWorktreeLocked(nodeId, by) {
     if (!existsSync(wt.path)) {
         throw new WorktreeError('worktree_missing', `managed worktree path is missing: ${wt.path}`, missingWorktreeRecoveryHint(wt));
     }
-    if (currentBranch(wt.path) !== wt.branch) {
-        throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch})`, `Check out ${wt.branch} in ${wt.path}, then rerun \`crtr node worktree abandon\`.`);
+    const actualBranch = currentBranch(wt.path);
+    if (actualBranch !== wt.branch) {
+        const recordedRefExists = recordedBranchExists(wt.path, wt.branch);
+        if (recordedRefExists || actualBranch === 'HEAD') {
+            throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}${actualBranch === 'HEAD' ? ', found detached HEAD' : ''})`, recordedRefExists
+                ? `Check out ${wt.branch} in ${wt.path}, then rerun \`crtr node worktree abandon\`.`
+                : `The recorded branch ${wt.branch} no longer exists, and ${wt.path} is in detached HEAD, so there is no branch to preserve. Check out or create a branch there, then rerun \`crtr node worktree abandon\`.`);
+        }
+        // The recorded crtr/* branch is gone: ordinary PR work moved this checkout
+        // onto a real branch.
+        return abandonBranchMovedWorktree(nodeId, wt, actualBranch, by);
     }
     const at = new Date().toISOString();
     const clean = proveCleanEmptyManagedWorktree(wt);
@@ -575,6 +745,15 @@ function abandonManagedWorktreeLocked(nodeId, by) {
         persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by);
         return { node_id: nodeId, branch: wt.branch, tip_sha: tipSha, worktree_path: wt.path, branch_deleted: false };
     }
+    // A clean branch with committed work already has its complete history. The
+    // abandon record supplies the disposition; an empty provenance commit would
+    // only move the local branch away from an already-pushed tip.
+    if (!isRebaseInProgress(wt.path) && statusPorcelain(wt.path) === '') {
+        runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
+        const tipSha = runGit(wt.repo_root, ['rev-parse', `refs/heads/${wt.branch}`], 'abandon_tip_failed', 'Inspect the branch manually, then retry.');
+        persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by);
+        return { node_id: nodeId, branch: wt.branch, tip_sha: tipSha, worktree_path: wt.path, branch_deleted: false };
+    }
     runGit(wt.path, ['add', '--all'], 'abandon_stage_failed', 'Inspect the worktree manually, then retry.');
     runGit(wt.path, ['-c', `user.name=${ABANDON_AUTHOR_NAME}`, '-c', `user.email=${ABANDON_AUTHOR_EMAIL}`, 'commit', '--allow-empty', '-m', ABANDON_SUBJECT, '-m', `Crtr-Abandon: ${nodeId} ${at}`], 'abandon_commit_failed', 'Inspect the worktree manually, then retry.');
     runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
@@ -775,6 +954,39 @@ export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
  *  `open_managed_worktree` guard then still applies unchanged — real
  *  commits, real uncommitted changes, and a lost race all require the
  *  explicit path. */
+function cleanCurrentBranchTip(wt) {
+    if (wt.state !== 'open' || !existsSync(wt.path) || isRebaseInProgress(wt.path))
+        return null;
+    const branch = gitSync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path);
+    if (branch.status !== 0 || branch.stdout.trim() !== wt.branch)
+        return null;
+    const status = gitSync(['status', '--porcelain'], wt.path);
+    if (status.status !== 0 || status.stdout.trim() !== '')
+        return null;
+    const head = gitSync(['rev-parse', 'HEAD'], wt.path);
+    return head.status === 0 ? head.stdout.trim() : null;
+}
+export async function branchIsPushedAtCurrentTip(wt) {
+    const initialTip = cleanCurrentBranchTip(wt);
+    if (initialTip === null)
+        return false;
+    // A cached origin/<branch> can be stale in either direction. Query origin's
+    // branch ref directly and require exact-tip equality: a remote that has an
+    // older commit would still leave newer local work stranded at finalization.
+    // This runs asynchronously with a bounded, non-interactive Git invocation so
+    // an unreachable remote never stalls crtrd's event loop.
+    const ssh = process.env['GIT_SSH_COMMAND'] ?? process.env['GIT_SSH'] ?? 'ssh';
+    const remote = await gitAsync(['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${wt.branch}`], wt.path, undefined, { timeoutMs: 10_000, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_SSH_COMMAND: `${ssh} -o BatchMode=yes` } });
+    if (remote.status !== 0)
+        return false;
+    const expectedRef = `refs/heads/${wt.branch}`;
+    const matchingLine = remote.stdout.split('\n').find((line) => line.endsWith(`\t${expectedRef}`));
+    if (matchingLine?.slice(0, matchingLine.indexOf('\t')) !== initialTip)
+        return false;
+    // The remote proof is useful only if the local checkout is still the exact
+    // clean tip it inspected when finalization begins.
+    return cleanCurrentBranchTip(wt) === initialTip;
+}
 export function autoDropCleanManagedWorktree(nodeId) {
     const wt = openManagedWorktreeForNode(nodeId);
     if (wt === null)

package/dist/daemon/api/handlers/crons.js

@@ -170,12 +170,13 @@ function handleArm(ctx) {
         ? requireUtcIso(req.expires_at, 'expires_at')
         : null;
     const envJson = typeof req.env_json === 'string' && req.env_json !== '' ? requireEnvJson(req.env_json) : null;
-    const onOutput = requireEnum(req.on_output, 'on_output', ['silent', 'on-failure', 'always', 'on-change'], 'on-failure');
-    const overlap = requireEnum(req.overlap, 'overlap', ['skip', 'queue', 'replace'], 'skip');
-    const tier = requireEnum(req.tier, 'tier', ['normal', 'urgent', 'critical'], 'normal');
     // Sink: required by the delivering dispositions, meaningless otherwise —
-    // progressive disclosure via the error that names the need.
+    // progressive disclosure via the error that names the need. A node sink is
+    // polling its recipient, so unchanged stdout must not wake it again by default.
     const rawSink = typeof req.sink === 'string' && req.sink.trim() !== '' ? req.sink.trim() : null;
+    const onOutput = requireEnum(req.on_output, 'on_output', ['silent', 'on-failure', 'always', 'on-change'], rawSink?.startsWith('node:') ? 'on-change' : 'on-failure');
+    const overlap = requireEnum(req.overlap, 'overlap', ['skip', 'queue', 'replace'], 'skip');
+    const tier = requireEnum(req.tier, 'tier', ['normal', 'urgent', 'critical'], 'normal');
     const delivers = onOutput === 'always' || onOutput === 'on-change';
     if (delivers && rawSink === null) {
         throw new InputError({

package/dist/daemon/api/handlers/messages.js

@@ -232,6 +232,11 @@ async function handleMessage(ctx) {
         };
         return { status: 201, body };
     }
+    // Interactive delivery has the same finalization doorway as durable mail:
+    // a live broker remains reachable briefly after its final claim, but must not
+    // accept a mandate it cannot finalize. `--reopen` is the deliberate exception.
+    if (req.delivery === 'interactive' && !req.reopen)
+        assertNotFinalized(id);
     // An interactive reopen commits before even choosing its engine-or-inbox
     // route. A live transport race then falls back with this same committed state.
     let reopenCommitted = false;

package/dist/daemon/api/handlers/nodes.js

@@ -141,6 +141,8 @@ function buildRecipe(req, parent, cwd) {
         recipe.worktree = true;
     if (typeof req.worktree === 'string')
         recipe.worktreeBase = req.worktree;
+    if (req.worktree !== undefined)
+        recipe.worktreeCwd = resolve(req.pin_cwd ?? req.cwd ?? cwd);
     if (req.fork_from !== undefined)
         recipe.forkFrom = req.fork_from;
     if (req.model !== undefined)