@north-light/crouter 0.3.300 → 0.3.302

package/dist/commands/memory/__tests__/command-selector-and-mutation-guards.test.js

@@ -14,7 +14,7 @@
 // Run: node --conditions=crtr-src --import tsx/esm --test --test-concurrency=4 --test-timeout=10000 src/commands/memory/__tests__/command-selector-and-mutation-guards.test.ts
 import { test, beforeEach, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { resetScopeCache } from '../../../core/scope.js';
@@ -23,6 +23,7 @@ import { createProfile, profileMemoryDir } from '../../../core/profiles/manifest
 import { openProjectMemoryStore } from '../../../core/memory-resolver.js';
 import { appendHistoryRecord, buildHistoryRecord, readHistoryRecords } from '../../../core/memory/history.js';
 import { CrtrError } from '../../../core/errors.js';
+import { gitSync } from '../../../core/git.js';
 import { deleteLeaf } from '../delete.js';
 import { editLeaf } from '../edit.js';
 import { historyLeaf } from '../history.js';
@@ -319,6 +320,34 @@ test('a targeted read suppresses malformed descendant-store warnings', async ()
     }
     assert.equal(writes.some((line) => line.includes('memory store not mounted')), false, writes.join(''));
 });
+test('a truncated nested-store read reports that its corpus was incomplete', async () => {
+    assert.equal(gitSync(['init', '-q'], root).status, 0, 'fixture repository initializes');
+    const fakeBin = join(base, 'slow-git');
+    mkdirSync(fakeBin);
+    const originalPath = process.env['PATH'] ?? '';
+    const fakeGit = join(fakeBin, 'git');
+    writeFileSync(fakeGit, `#!/bin/sh\nfor arg in "$@"; do\n  if [ "$arg" = "ls-files" ]; then sleep 1; exit 0; fi\ndone\nPATH=${JSON.stringify(originalPath)}\nexport PATH\nexec git "$@"\n`, 'utf8');
+    chmodSync(fakeGit, 0o755);
+    process.chdir(root);
+    resetScopeCache();
+    const stderr = process.stderr;
+    const originalWrite = stderr.write;
+    const writes = [];
+    stderr.write = ((chunk) => {
+        writes.push(String(chunk));
+        return true;
+    });
+    process.env['PATH'] = `${fakeBin}:${originalPath}`;
+    try {
+        const error = await thrownByAsync(() => readLeaf.run({ name: 'acme/child/foo', kind: undefined, frontmatter: false, scope: undefined, dir: undefined }));
+        assert.equal(error.code, 'not_found');
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        stderr.write = originalWrite;
+    }
+    assert.match(writes.join(''), /nested-store discovery.*result may omit nested stores.*--dir <owner>/s, `a timed-out scan must tell a failed read how to bypass discovery; got:\n${writes.join('')}`);
+});
 test('deleted history points at the revision holding the retained text, never a read that cannot answer', async () => {
     await deleteLeaf.run({ name: 'acme/disposable', dir: root });
     const result = (await historyLeaf.run({ name: 'acme/disposable', dir: root }));

package/dist/commands/memory/read.js

@@ -1,10 +1,9 @@
 import { envNodeId } from '../../shared/env.js';
 import { CrtrClient } from '../../api/index.js';
 import { defineLeaf } from '../../core/command.js';
-import { CrtrError } from '../../core/errors.js';
 import { memoryExtensionEffectiveCatalog, projectEffectiveMemoryExtensions } from '../../core/memory/extensions.js';
 import { docLinkNames } from '../../core/memory/doc-link-grammar.js';
-import { ambientMemoryTarget, createMemoryDocSnapshot, listAllMemoryDocs, loadMemoryStoreView, readMemoryDocContent, resolveMemoryCandidates, resolveMemoryDocs, } from '../../core/memory-resolver.js';
+import { ambientMemoryTarget, createMemoryDocSnapshot, listAllMemoryDocs, loadMemoryStoreView, loadMemoryTargetView, readMemoryDocContent, resolveMemoryDocs, } from '../../core/memory-resolver.js';
 import { expandShellBlocks, hasShellBlocks, makeNodeShellRunner } from '../../core/runtime/shell-expansion.js';
 import { emptyContextExposureState, exposureTarget, loadContextExposureState, registerDocumentExposure, registerExposure, saveContextExposureState, } from '../../core/substrate/injected-store.js';
 import { dirDedupKey, docsByName, isDirName, renderDirListing } from '../../core/substrate/listings.js';
@@ -121,18 +120,17 @@ export const readLeaf = defineLeaf({
                 ...(selector.scope === undefined ? {} : { scope: selector.scope }),
                 includeDescendants: true,
             };
-            // A named read must not turn malformed stores elsewhere in the corpus
-            // into warnings about the requested document. `memory lint` owns that
-            // corpus health report; resolution still includes every candidate.
-            listingByName = linkByName = docsByName(listAllMemoryDocs(selector.scope, true, true));
-            try {
-                set = resolveMemoryCandidates(nameRaw, resolveOpts);
-            }
-            catch (e) {
-                if (!(e instanceof CrtrError && e.code === 'not_found'))
-                    throw e;
-            }
-            fail = () => resolveMemoryCandidates(nameRaw, resolveOpts);
+            // A named read keeps unrelated malformed documents quiet, but a timed
+            // discovery leaves its corpus incomplete and must remain visible before
+            // this branch can report not_found.
+            const view = loadMemoryTargetView(ambientMemoryTarget(), {
+                ...resolveOpts,
+                quiet: true,
+                reportDiscovery: true,
+            });
+            listingByName = linkByName = docsByName(view.docs);
+            set = view.candidates(nameRaw, kindOpts);
+            fail = () => view.resolve(nameRaw, kindOpts);
         }
         const nodeId = envNodeId() || undefined;
         if (set === null) {

package/dist/commands/node/create.js

@@ -83,7 +83,7 @@ function nodeNewParams() {
         { kind: 'flag', name: 'parent', type: 'string', required: false, constraint: 'Parent node id. Defaults to the calling node.' },
         { kind: 'flag', name: 'node-id', type: 'string', required: false, constraint: 'Exact id for the new node; lowercase letters, digits, and hyphens only, at most 128 characters. Rejected if already present.' },
         { kind: 'flag', name: 'root', type: 'bool', required: false, constraint: 'Spawn an independent resident root with no parent or subscription. Mutually exclusive with --worktree.' },
-        { kind: 'flag', name: 'resident', type: 'bool', required: false, constraint: 'Birth the node as resident: it parks and stays wakeable without being forced to submit a final. Applies to managed children and roots; roots default to resident.' },
+        { kind: 'flag', name: 'resident', type: 'bool', required: false, constraint: 'Birth the node as resident: it parks and stays wakeable without being forced to submit a final. Pass it ONLY when the user will open this node’s viewer pane and work with it back and forth; a child that only other nodes message stays terminal. Applies to managed children and roots; roots default to resident.' },
         { kind: 'flag', name: 'worktree', type: 'string', required: false, constraint: 'Local base branch for a crouter-managed worktree for this child. Mutually exclusive with --root.' },
         { kind: 'flag', name: 'fork-from', type: 'string', required: false, constraint: 'Fork the new node from an existing node id, absolute session path, or partial pi session uuid.' },
         {

package/dist/commands/node/lifecycle.js

@@ -3,6 +3,8 @@ import { envNodeId } from '../../shared/env.js';
 import { defineBranch, defineLeaf } from '../../core/command.js';
 import { InputError } from '../../core/io.js';
 import { cliClient, getNodeOrNull, rethrowAsCliError } from '../api-client.js';
+import { contextDir } from '../../core/canvas/paths.js';
+import { DEFAULT_BASH_NICENESS, MAX_BASH_NICENESS, writeBashNiceness } from '../../core/bash-jobs.js';
 import { nodeReviveLeaf } from '../node-lifecycle-revive.js';
 import { assertKind, kindsStateBlock } from './create.js';
 import { MODEL_SPEC_FORMS } from '../../core/runtime/model-selection.js';
@@ -69,11 +71,11 @@ const nodeRecycle = defineLeaf({
 // node lifecycle close — close a node + cascade-cancel its exclusive subtree (Alt+C → x)
 const nodeClose = defineLeaf({
     name: 'close',
-    description: 'close a node + cascade-cancel its exclusive subtree (revivable)',
-    whenToUse: 'you want to tear a node down WITHOUT finishing it, cascade-cancelling every descendant it exclusively owns: abandoning a line of work, killing a stuck or wrong-turn subtree, clearing a branch you no longer need. Windows die but nothing is deleted — each closed node keeps its pi session and can be revived later (`node lifecycle revive`). Use `node lifecycle recycle` instead to FINISH the agent in your pane with a final report, and `push final` when a worker should end its own work normally (Alt+C → x)',
+    description: 'close a node + cascade-cancel its exclusive subtree',
+    whenToUse: 'you want to tear a node down WITHOUT finishing it, cascade-cancelling every descendant it exclusively owns: abandoning a line of work, killing a stuck or wrong-turn subtree, clearing a branch you no longer need. A node that never produced substantive assistant output is deleted and cannot be revived; streaming nodes and nodes with an open managed worktree are retained. Other closed nodes keep their pi session and can be revived later (`node lifecycle revive`). Use `node lifecycle recycle` instead to FINISH the agent in your pane with a final report, and `push final` when a worker should end its own work normally (Alt+C → x)',
     help: {
         name: 'node lifecycle close',
-        summary: 'close a node and cascade-cancel its subtree — kill its tmux window plus those of every descendant it EXCLUSIVELY owns (down the subscribes_to spine), mark them all canceled, and leave each a notice it reads on resume. A descendant still subscribed to by a manager outside the subtree is left running. Nothing is deleted: every closed node keeps its pi session and can be revived later (`crtr node lifecycle revive`)',
+        summary: 'close a node and cascade-cancel its subtree — kill its tmux window plus those of every descendant it EXCLUSIVELY owns (down the subscribes_to spine), mark retained nodes canceled, and leave them a notice they read on resume. A descendant still subscribed to by a manager outside the subtree is left running. A node that never produced substantive assistant output is deleted and cannot be revived; streaming nodes and nodes with an open managed worktree are retained. Other closed nodes keep their pi session and can be revived later (`crtr node lifecycle revive`)',
         params: [
             { kind: 'flag', name: 'node', type: 'string', required: false, constraint: 'Node to close. Defaults to the node occupying --pane (or your current pane).' },
             { kind: 'flag', name: 'pane', type: 'string', required: false, constraint: 'tmux pane id whose node to close. Defaults to $TMUX_PANE / your current pane. The Alt+C menu passes this for you.' },
@@ -86,9 +88,10 @@ const nodeClose = defineLeaf({
         ],
         outputKind: 'object',
         effects: [
-            'Marks the node and its exclusive descendants `canceled` and clears intent (the daemon never revives a canceled node).',
-            'Kills each closed node\'s tmux window; their pi sessions and canvas edges persist for a later revive.',
-            'Appends a cancellation notice to each closed node\'s inbox, surfaced on its next resume.',
+            'Marks retained nodes and their exclusive descendants `canceled` and clears intent (the daemon never revives a canceled node).',
+            'Deletes a non-streaming node with no substantive assistant output unless it has an open managed worktree; a deleted node cannot be revived.',
+            'Kills each closed node\'s tmux window; retained nodes keep their pi sessions and canvas edges for a later revive.',
+            'Appends a cancellation notice to each retained node\'s inbox, surfaced on its next resume.',
         ],
     },
     run: async (input) => {
@@ -140,6 +143,7 @@ export const nodeConfig = defineLeaf({
             { kind: 'flag', name: 'kind', type: 'string', required: false, constraint: 'Persona kind. The <kinds> list below names every top-level installable kind and when to use each; a registered sub-kind is valid too by exact path but not listed here.' },
             { kind: 'flag', name: 'mode', type: 'enum', choices: ['base', 'orchestrator'], required: false, constraint: 'Set persona mode headlessly. base is hands-on; orchestrator holds a roadmap and delegates. orchestrator seeds a roadmap scaffold if absent.' },
             { kind: 'flag', name: 'name', type: 'string', required: false, constraint: 'Rename the node; if the node has a live window, also rename that viewer window.' },
+            { kind: 'flag', name: 'nice', type: 'int', required: false, constraint: `Scheduler niceness every command this node's bash tool starts at, 0–${MAX_BASH_NICENESS} (default ${DEFAULT_BASH_NICENESS}). ${DEFAULT_BASH_NICENESS} keeps the node's builds and test suites below the daemon, the brokers, the viewers, and the person's own shell; 0 lets them compete on equal terms with everything else on the host; ${MAX_BASH_NICENESS} makes them yield to it. Applies to the node's very next command, foreground and background alike.` },
             { kind: 'flag', name: 'cwd', type: 'string', required: false, constraint: 'Repair-only replacement launch directory. Must be a non-empty absolute existing directory and used alone; the daemon accepts it only for a dormant, non-forked node with no open managed worktree whose recorded cwd is gone. Clears the saved Pi session, so the next revive starts fresh while durable node work remains.' },
         ],
         output: [
@@ -149,6 +153,7 @@ export const nodeConfig = defineLeaf({
             { name: 'kind', type: 'string', required: false, constraint: 'The new kind, present only when --kind changed it.' },
             { name: 'mode', type: 'string', required: false, constraint: 'The new mode, present only when --mode changed it.' },
             { name: 'name', type: 'string', required: false, constraint: 'The new name, present only when --name changed it.' },
+            { name: 'nice', type: 'number', required: false, constraint: 'The new bash niceness, present only when --nice changed it.' },
             { name: 'cwd', type: 'string', required: false, constraint: 'The lexically resolved replacement directory, present only after a cwd repair.' },
         ],
         outputKind: 'object',
@@ -157,6 +162,7 @@ export const nodeConfig = defineLeaf({
             'Kind, mode, and lifecycle changes rebuild the launch spec from the fresh node meta; setting mode to orchestrator seeds a roadmap scaffold if absent.',
             'Name changes update the row and, when the node already has a live window, rename that viewer window to the new full name.',
             'A cwd repair writes only the lexically resolved cwd and clears saved Pi session pointers; the old transcript and durable node work remain untouched.',
+            'A niceness change is stored with the node\'s own bash-job state, so it takes effect on the next command without a revive and survives one.',
         ],
         dynamicState: () => kindsStateBlock(),
     },
@@ -169,7 +175,7 @@ export const nodeConfig = defineLeaf({
         // clean listing error, and re-validated server-side against the TARGET
         // node's scope as a backstop.
         const cwdSpec = input['cwd'];
-        if (cwdSpec !== undefined && ['model', 'kind', 'lifecycle', 'mode', 'name'].some((flag) => input[flag] !== undefined)) {
+        if (cwdSpec !== undefined && ['model', 'kind', 'lifecycle', 'mode', 'name', 'nice'].some((flag) => input[flag] !== undefined)) {
             throw new InputError({ error: 'cwd_not_exclusive', message: 'cwd repair cannot be combined with another config flag', field: 'cwd', next: 'Pass --cwd alone.' });
         }
         const modelSpec = input['model']?.trim();
@@ -180,6 +186,15 @@ export const nodeConfig = defineLeaf({
         const lifecycleSpec = input['lifecycle']?.trim();
         const modeSpec = input['mode']?.trim();
         const nameSpec = input['name'];
+        const niceSpec = input['nice'];
+        if (niceSpec !== undefined && (niceSpec < 0 || niceSpec > MAX_BASH_NICENESS)) {
+            throw new InputError({
+                error: 'bad_nice',
+                message: `niceness must be between 0 and ${MAX_BASH_NICENESS}: ${niceSpec}`,
+                field: 'nice',
+                next: `A negative niceness needs root, so pass 0–${MAX_BASH_NICENESS}.`,
+            });
+        }
         if (kindSpec !== undefined)
             assertKind(kindSpec);
         if (lifecycleSpec !== undefined && lifecycleSpec.toLowerCase() !== 'terminal' && lifecycleSpec.toLowerCase() !== 'resident') {
@@ -214,8 +229,17 @@ export const nodeConfig = defineLeaf({
             patch.cwd = cwdSpec;
             applied.push('cwd');
         }
+        // Niceness is node-local bash-lane state, not canvas state: it is stored
+        // beside this node's job dirs so the valve reads it when it starts the next
+        // command, rather than waiting for a launch recipe to be rebuilt.
+        if (niceSpec !== undefined) {
+            writeBashNiceness(contextDir(nodeId), niceSpec);
+            applied.push('nice');
+            if (applied.length === 1)
+                return { node_id: nodeId, nice: niceSpec };
+        }
         if (applied.length === 0) {
-            throw new InputError({ error: 'no_change', message: 'no config changes requested', next: 'Pass at least one of --model, --lifecycle, --kind, --mode, --name, --cwd.' });
+            throw new InputError({ error: 'no_change', message: 'no config changes requested', next: 'Pass at least one of --model, --lifecycle, --kind, --mode, --name, --nice, --cwd.' });
         }
         const detail = await cliClient()
             .patchConfig(nodeId, patch)
@@ -233,6 +257,8 @@ export const nodeConfig = defineLeaf({
             result.mode = detail.mode;
         if (applied.includes('name'))
             result.name = detail.name;
+        if (applied.includes('nice'))
+            result.nice = niceSpec;
         return result;
     },
     render: (r) => {
@@ -249,6 +275,8 @@ export const nodeConfig = defineLeaf({
             bits.push(`mode=${r['mode']}`);
         if (r['name'] !== undefined)
             bits.push(`name=${r['name']}`);
+        if (r['nice'] !== undefined)
+            bits.push(`nice=${r['nice']}`);
         return `Configured ${r['node_id']} — ${bits.join(', ')}`;
     },
 });

package/dist/commands/push.js

@@ -160,8 +160,8 @@ function makePushLeaf(kind) {
                 ...(kind === 'final'
                     ? [
                         { name: 'transitioned', type: 'object', required: false, constraint: 'Present only for a final that flipped the node — { from, to } lifecycle-status transition applied server-side.' },
-                        { name: 'worktree_auto_dropped', type: 'boolean', required: false, constraint: 'Present only when this node owned a managed worktree with zero commits ahead of its base and no uncommitted changes — the server auto-dropped it instead of requiring `node worktree close` first (see worktree_auto_dropped_path).' },
-                        { name: 'worktree_auto_dropped_path', type: 'string', required: false, constraint: 'Present only alongside worktree_auto_dropped: the checkout path that was dropped.' },
+                        { name: 'worktree_auto_dropped', type: 'boolean', required: false, constraint: 'Present only when the server closed this node’s managed-worktree record without requiring `node worktree close`; cleanup of an existing checkout remains pending (see worktree_auto_dropped_path).' },
+                        { name: 'worktree_auto_dropped_path', type: 'string', required: false, constraint: 'Present only alongside worktree_auto_dropped: the closed worktree path; an existing checkout remains until pending cleanup.' },
                     ]
                     : []),
             ],
@@ -172,7 +172,7 @@ function makePushLeaf(kind) {
                 ...(kind === 'final'
                     ? [
                         'Marks the node done (status + intent) server-side; its engine shuts down on next stop.',
-                        'When this node owns a clean managed worktree already contained in its local base, the server auto-drops it instead of blocking on `node worktree close`. A clean worktree whose exact tip exists on any branch on origin may also finalize while retaining its branch and checkout; uncommitted changes or a tip absent from origin still block with open_managed_worktree.',
+                        'When this node owns a clean managed worktree already contained in its local base, the server closes its record with cleanup pending instead of blocking on `node worktree close`. A clean worktree whose exact tip exists on any branch on origin may also finalize while retaining its branch and checkout; uncommitted changes or a tip absent from origin still block with open_managed_worktree.',
                     ]
                     : []),
             ],
@@ -242,7 +242,7 @@ function makePushLeaf(kind) {
             const line = kind === 'final'
                 ? 'Result recorded — node finished; its engine shuts down on next stop. Nothing more to do here: STOP your turn immediately. Reply with just "Done." and nothing else.'
                 : `Progress report fanned to ${n} subscriber(s).`;
-            const dropNote = r['worktree_auto_dropped'] === true ? `\n\nAuto-dropped a clean, zero-commit managed worktree at ${String(r['worktree_auto_dropped_path'])} — nothing to land.` : '';
+            const dropNote = r['worktree_auto_dropped'] === true ? `\n\nClosed a clean managed-worktree record at ${String(r['worktree_auto_dropped_path'])} — nothing to land; cleanup remains pending if the checkout still exists.` : '';
             return `${line}\n\n- report: ${r['report_path']}${dropNote}`;
         },
     });

package/dist/core/__tests__/human-action-delivery.test.js

@@ -5,7 +5,9 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb } from '../canvas/db.js';
 import { claimActionDelivery, enqueueActionDelivery, readActionDelivery, } from '../canvas/human-deliveries.js';
-import { actionDeliveryBackoffMs, actionDeliverySettlementForOutcome, deliverAction, } from '../../daemon/human/deliver-action.js';
+import { deliveryBackoffMs } from '../canvas/delivery-contract.js';
+import { deliverySettlementForOutcome } from '../../daemon/delivery/run-delivery.js';
+import { deliverAction } from '../../daemon/human/deliver-action.js';
 let home;
 const priorHome = process.env['CRTR_HOME'];
 beforeEach(() => {
@@ -25,14 +27,14 @@ after(() => {
     else
         process.env['CRTR_HOME'] = priorHome;
 });
-test('action delivery retries follow the durable backoff and exit boundary', () => {
-    assert.equal(actionDeliveryBackoffMs(1), 5_000);
-    assert.equal(actionDeliveryBackoffMs(2), 10_000);
-    assert.equal(actionDeliveryBackoffMs(3), 20_000);
-    assert.equal(actionDeliveryBackoffMs(11), 3_600_000);
-    assert.equal(actionDeliveryBackoffMs(100), 3_600_000);
+test('delivery retries follow the durable backoff and exit boundary', () => {
+    assert.equal(deliveryBackoffMs(1), 5_000);
+    assert.equal(deliveryBackoffMs(2), 10_000);
+    assert.equal(deliveryBackoffMs(3), 20_000);
+    assert.equal(deliveryBackoffMs(11), 3_600_000);
+    assert.equal(deliveryBackoffMs(100), 3_600_000);
     const now = 1_000_000;
-    const outcome = (exitCode, signal = null) => actionDeliverySettlementForOutcome({
+    const outcome = (exitCode, signal = null) => deliverySettlementForOutcome({
         exitCode,
         signal,
         timedOut: false,
@@ -50,14 +52,14 @@ test('action delivery retries follow the durable backoff and exit boundary', ()
     });
     assert.equal(outcome(79).state, 'pending');
     assert.equal(outcome(null, 'SIGTERM').state, 'pending');
-    assert.equal(actionDeliverySettlementForOutcome({
+    assert.equal(deliverySettlementForOutcome({
         exitCode: null,
         signal: null,
         timedOut: true,
         stderr: '',
     }, 1, now).state, 'pending');
     // The kill escalation's signal is the only way to tell the graceful term from the SIGKILL.
-    assert.deepEqual(actionDeliverySettlementForOutcome({
+    assert.deepEqual(deliverySettlementForOutcome({
         exitCode: null,
         signal: 'SIGKILL',
         timedOut: true,
@@ -67,7 +69,7 @@ test('action delivery retries follow the durable backoff and exit boundary', ()
         nextAttemptAt: now + 5_000,
         failure: { kind: 'timeout', signal: 'SIGKILL', stderr: 'stalled' },
     });
-    assert.equal(actionDeliverySettlementForOutcome({
+    assert.equal(deliverySettlementForOutcome({
         exitCode: null,
         signal: null,
         timedOut: false,

package/dist/core/__tests__/integration/revive.test.js

@@ -33,7 +33,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
-import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
+import { armCron, getCron } from '../../canvas/crons.js';
 import { readInboxSince } from '../../feed/inbox.js';
 import { closeDb } from '../../canvas/db.js';
 import { apiSocketPath } from '../../canvas/paths.js';
@@ -304,11 +304,11 @@ test('a recovery relaunch keeps the armed deadline; a wake revive consumes it',
         const recovered = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
         armDeadline(recovered, 'cron-recovery');
         await reviveNode(recovered, { resume: true, recovery: true, capacity: 'freeze' });
-        assert.equal(hasPendingCancelOnWakeCron(recovered), true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
+        assert.equal(getCron('cron-recovery') !== null, true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
         const woken = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
         armDeadline(woken, 'cron-wake');
         await reviveNode(woken, { resume: true, capacity: 'freeze' });
-        assert.equal(hasPendingCancelOnWakeCron(woken), false, 'a wake revive won the race and cancels the deadline');
+        assert.equal(getCron('cron-wake'), null, 'a wake revive won the race and cancels the deadline');
     }
     finally {
         await h.dispose();

package/dist/core/__tests__/node-outcome.test.js

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { closeDb, MIGRATIONS } from '../canvas/db.js';
 import { createNode, getRow } from '../canvas/canvas.js';
-import { armOutcomeDelivery, claimOutcomeDelivery, outcomeDeliveryBackoffMs, readOutcomeDelivery, recoverRunningOutcomeDeliveries, settleOutcomeDelivery, } from '../canvas/node-outcome-deliveries.js';
+import { armOutcomeDelivery, claimOutcomeDelivery, readOutcomeDelivery, recoverRunningOutcomeDeliveries, settleOutcomeDelivery, } from '../canvas/node-outcome-deliveries.js';
 import { transition } from '../runtime/lifecycle.js';
 import { composeNodeOutcomeDocument } from '../runtime/outcome-document.js';
 import { pushFinal } from '../feed/feed.js';
@@ -153,11 +153,6 @@ test('outcome delivery state is fenced, recoverable, and follows the durable bac
         nextAttemptAt: readOutcomeDelivery('recover').nextAttemptAt,
         claimOwner: readOutcomeDelivery('recover').claimOwner,
     }, { state: 'pending', nextAttemptAt: recoveredAt, claimOwner: null });
-    assert.equal(outcomeDeliveryBackoffMs(1), 5_000);
-    assert.equal(outcomeDeliveryBackoffMs(2), 10_000);
-    assert.equal(outcomeDeliveryBackoffMs(3), 20_000);
-    assert.equal(outcomeDeliveryBackoffMs(11), 3_600_000);
-    assert.equal(outcomeDeliveryBackoffMs(100), 3_600_000);
 });
 test('v39 migrates a v38 database and backfills finalized and terminal rows', () => {
     const dbPath = join(home, 'v38.db');

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -22,6 +22,7 @@ import assert from 'node:assert/strict';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { appendInbox, readCursor, readInboxSince } from '../../feed/inbox.js';
+import { acquireCronRunLease, armCron, setCronState } from '../../canvas/crons.js';
 import { registerWarmSpare, subscribe, subscriptionsOf, updateNode } from '../../canvas/index.js';
 import { isPidAlive } from '../../canvas/pid.js';
 import { reviveNode } from '../../runtime/revive.js';
@@ -45,6 +46,47 @@ async function awaitReleased(nodeId) {
         return node?.status === 'idle' && node.intent === 'idle-release' && typeof node.pi_pid === 'number' && !isPidAlive(node.pi_pid);
     }, { label: `idle-release broker exit for ${nodeId}` });
 }
+async function assertCronWakeReleases(nodeId, running) {
+    const cronId = `${nodeId}-cron`;
+    const target = h.fabricateBrokerNode({ id: nodeId, parent: root, status: 'active' });
+    const now = new Date();
+    armCron({
+        cron_id: cronId,
+        name: cronId,
+        created_by: null,
+        command: 'printf wake',
+        fire_at: new Date(now.getTime() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: nodeId,
+        cancel_on_wake: false,
+        cwd: h.home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'always',
+        sink: JSON.stringify({ node: nodeId }),
+        tier: 'normal',
+    });
+    if (running) {
+        assert.equal(acquireCronRunLease(cronId, 'seam-fixture', process.pid, now.toISOString(), false), true);
+        setCronState(cronId, 'paused');
+    }
+    updateNode(target, { launch: { extensions: [], tools: [], systemPrompt: '', env: {} } });
+    await reviveNode(target, { resume: true, capacity: 'freeze' });
+    await h.awaitBoot(target);
+    await h.stop(target);
+    await awaitReleased(target);
+    await h.awaitFleetExit(target);
+    assert.equal(h.node(target)?.status, 'idle', `${running ? 'running' : 'scheduled'} cron did not trigger a stop-guard reprompt`);
+}
+test('an anchored node-sink cron releases a terminal broker when scheduled or in flight', { timeout: 60_000 }, async () => {
+    await assertCronWakeReleases('scheduled-cron-wake', false);
+    await assertCronWakeReleases('running-cron-wake', true);
+});
 test('idle-release settles its real watcher before exit; daemon revives exactly once for a later row', { timeout: 30_000 }, async () => {
     // Reproduce the observed #353/#362 edge: real pi reported
     // ctx.hasPendingMessages() === true at the sole agent_settled even though the

package/dist/core/__tests__/stop-guard.test.js

@@ -9,7 +9,9 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, deliverAndSettleMessageWait, getNode, subscribe, setMessageWait, setStatus } from '../canvas/canvas.js';
+import { armCron, cancelCron, setCronState } from '../canvas/crons.js';
 import { closeDb, openDb } from '../canvas/db.js';
+import { hasLiveObligation } from '../../daemon/reconcilers/live-obligation.js';
 import { contextDir } from '../canvas/paths.js';
 import { bashJobPaths } from '../bash-jobs.js';
 import { evaluateStop } from '../runtime/stop-guard.js';
@@ -29,6 +31,29 @@ function node(id, over = {}) {
     };
 }
 const noSignals = { pushedFinal: false, requestedHumanReply: false };
+function arm(overrides) {
+    armCron({
+        name: overrides.cron_id,
+        created_by: null,
+        command: 'printf cron',
+        fire_at: new Date(Date.now() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: null,
+        cancel_on_wake: false,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'always',
+        sink: '{}',
+        tier: 'normal',
+        ...overrides,
+    });
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-stopguard-'));
     process.env['CRTR_HOME'] = home;
@@ -82,6 +107,45 @@ test('a TERMINAL node awaiting a background bash job may dorm until its completi
     assert.equal(completed.action, 'reprompt');
     assert.equal(completed.reason, 'stalled');
 });
+test('a pending node-sink cron wake releases terminal nodes and holds unattended nodes', () => {
+    createNode(node('target'));
+    const assertsWake = (id) => {
+        assert.deepEqual(evaluateStop('target', noSignals), { action: 'allow', reason: 'scheduled' }, id);
+        assert.equal(hasLiveObligation('target'), true, `${id} holds the unattended node`);
+    };
+    const assertsNoWake = (id) => {
+        assert.equal(evaluateStop('target', noSignals).action, 'reprompt', id);
+        assert.equal(hasLiveObligation('target'), false, `${id} does not hold the unattended node`);
+    };
+    arm({ cron_id: 'scheduled', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
+    assertsWake('an anchored scheduled always sink');
+    cancelCron('scheduled');
+    arm({ cron_id: 'running', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
+    openDb().prepare("UPDATE crons SET run_state = 'running' WHERE cron_id = ?").run('running');
+    setCronState('running', 'paused');
+    assertsWake('a paused in-flight sink');
+    cancelCron('running');
+    arm({ cron_id: 'unanchored-change', on_output: 'on-change', sink: JSON.stringify({ node: 'target' }) });
+    assertsWake('an unanchored on-change sink');
+    cancelCron('unanchored-change');
+    arm({ cron_id: 'other-target', sink: JSON.stringify({ node: 'other' }) });
+    assertsNoWake('a sink for another node');
+    cancelCron('other-target');
+    arm({ cron_id: 'silent', on_output: 'silent', sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('a silent cron');
+    cancelCron('silent');
+    arm({ cron_id: 'on-failure', on_output: 'on-failure', sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('an on-failure cron');
+    cancelCron('on-failure');
+    arm({ cron_id: 'expired', expires_at: new Date(Date.now() - 1_000).toISOString(), sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('an expired idle cron');
+    cancelCron('expired');
+    arm({ cron_id: 'canceled', sink: JSON.stringify({ node: 'target' }) });
+    cancelCron('canceled');
+    assertsNoWake('a canceled cron');
+    arm({ cron_id: 'deadline', anchor_node: 'target', cancel_on_wake: true, on_output: 'on-failure' });
+    assertsWake('an active deadline');
+});
 test('only an explicit live controller wait permits dormancy; ancestry alone does not', () => {
     createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
     createNode(node('child', { parent: 'parent' }));

package/dist/core/bash-jobs.d.ts

@@ -36,6 +36,28 @@ export declare function readJobPgid(contextDir: string, jobId: string): number |
 /** The optional human-readable job label. Jobs created before labels existed
  * have no file and deliberately project null. */
 export declare function readJobPurpose(contextDir: string, jobId: string): string | null;
+/** Scheduler niceness every command a node runs is started with. Agent work —
+ * builds, test suites, typechecks — sits below the daemon, the brokers, the
+ * viewers, and the person's own shell, so a fan-out of release builds cannot
+ * starve them: the scheduler only honors this under contention and it costs
+ * nothing on an idle host. */
+export declare const DEFAULT_BASH_NICENESS = 10;
+/** The politest priority the scheduler accepts. A NEGATIVE niceness (more
+ * priority than the broker itself) needs root: `nice` prints a permission error
+ * into the command's own log and runs it at the inherited priority anyway, so
+ * the override range stops at 0. */
+export declare const MAX_BASH_NICENESS = 19;
+/** Per-node override of the bash niceness, written by `crtr node config --nice`
+ * and read by the valve when it starts each command. Node-local like the job
+ * dirs beside it, so a change applies to the node's very next command without
+ * waiting for a revive. */
+export declare function bashNicenessPath(contextDir: string): string;
+/** The niceness this node's commands run at. Any missing, malformed, or
+ * out-of-range file reads as the default rather than an odd priority. */
+export declare function readBashNiceness(contextDir: string): number;
+/** Set the node's bash niceness. The caller owns validation; the store keeps
+ * one integer so the valve's read stays a single file read per command. */
+export declare function writeBashNiceness(contextDir: string, niceness: number): void;
 /** The auto-background cancel deadline (epoch ms), or undefined for a job with
  * no deadline (a deliberate handoff, or a legacy job dir). A non-finite or
  * malformed file reads as no deadline rather than an instant expiry. */

package/dist/core/bash-jobs.js

@@ -3,7 +3,7 @@
 // job.bg, while foreground completion renames it to job.done. The detached
 // supervisor can therefore outlive pi and still decide whether to report exit.
 import { randomBytes } from 'node:crypto';
-import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 const MAX_BASH_JOB_PURPOSE_BYTES = 280;
 /** A purpose is display text, never shell input. Keep the file-backed control
@@ -66,6 +66,43 @@ export function readJobPurpose(contextDir, jobId) {
         return null;
     }
 }
+/** Scheduler niceness every command a node runs is started with. Agent work —
+ * builds, test suites, typechecks — sits below the daemon, the brokers, the
+ * viewers, and the person's own shell, so a fan-out of release builds cannot
+ * starve them: the scheduler only honors this under contention and it costs
+ * nothing on an idle host. */
+export const DEFAULT_BASH_NICENESS = 10;
+/** The politest priority the scheduler accepts. A NEGATIVE niceness (more
+ * priority than the broker itself) needs root: `nice` prints a permission error
+ * into the command's own log and runs it at the inherited priority anyway, so
+ * the override range stops at 0. */
+export const MAX_BASH_NICENESS = 19;
+/** Per-node override of the bash niceness, written by `crtr node config --nice`
+ * and read by the valve when it starts each command. Node-local like the job
+ * dirs beside it, so a change applies to the node's very next command without
+ * waiting for a revive. */
+export function bashNicenessPath(contextDir) {
+    return join(bashJobsDir(contextDir), 'niceness');
+}
+/** The niceness this node's commands run at. Any missing, malformed, or
+ * out-of-range file reads as the default rather than an odd priority. */
+export function readBashNiceness(contextDir) {
+    try {
+        const n = Number(readFileSync(bashNicenessPath(contextDir), 'utf8').trim());
+        if (!Number.isInteger(n) || n < 0 || n > MAX_BASH_NICENESS)
+            return DEFAULT_BASH_NICENESS;
+        return n;
+    }
+    catch {
+        return DEFAULT_BASH_NICENESS;
+    }
+}
+/** Set the node's bash niceness. The caller owns validation; the store keeps
+ * one integer so the valve's read stays a single file read per command. */
+export function writeBashNiceness(contextDir, niceness) {
+    mkdirSync(bashJobsDir(contextDir), { recursive: true });
+    writeFileSync(bashNicenessPath(contextDir), `${Math.trunc(niceness)}\n`);
+}
 /** The auto-background cancel deadline (epoch ms), or undefined for a job with
  * no deadline (a deliberate handoff, or a legacy job dir). A non-finite or
  * malformed file reads as no deadline rather than an instant expiry. */