@north-light/crouter 0.3.300 → 0.3.302

package/dist/core/canvas/crons.d.ts

@@ -3,6 +3,16 @@ export type CronOverlap = 'skip' | 'queue' | 'replace';
 export type CronOnOutput = 'silent' | 'on-failure' | 'always' | 'on-change';
 export type CronState = 'active' | 'paused';
 export type CronRunState = 'idle' | 'running';
+/** The decoded delivery target of a stored cron sink. */
+export type ParsedCronSink = {
+    kind: 'node';
+    node: string;
+} | {
+    kind: 'spawn';
+    spawn: string;
+} | {
+    kind: 'human';
+} | null;
 /** A hydrated `crons` row. */
 export interface Cron {
     cron_id: string;
@@ -96,6 +106,10 @@ export interface CronRunRecord {
 /** Ring bound for `cron_runs`: recordCronRun prunes each cron's history to
  *  its most recent this-many rows. */
 export declare const CRON_RUN_RING = 20;
+/** Decode the stored cron sink JSON. A malformed or unrecognised value has no sink. */
+export declare function parseCronSink(sinkJson: string): ParsedCronSink;
+/** Render a stored cron sink as the arm-time CLI spec, or null when it has no destination. */
+export declare function cronSinkDisplay(sinkJson: string): string | null;
 /** The ONLY sanctioned way to signal a cron run's process group from a stored
  *  row. Re-captures the CURRENT identity of `run_pid` and signals only when it
  *  MATCHES the fingerprint recorded at lease acquisition. Returns whether the
@@ -180,10 +194,12 @@ export declare function setCronState(cron_id: string, state: CronState): boolean
  *  previous run's stdout. Written after EVERY settled run of an on-change
  *  cron, delivered or not. */
 export declare function setCronLastOutputHash(cron_id: string, hash: string): void;
-/** True when this node has a pending cancel-on-wake cron. The stop guard uses
- *  this focused deadline check to distinguish legitimate clock dormancy from a
- *  terminal node that stopped without finishing. */
-export declare function hasPendingCancelOnWakeCron(anchor_node: string): boolean;
+/** True when a cron can still wake this node. An active deadline is a wake
+ * source by its anchor; output delivery is a wake source by its decoded node
+ * sink. Scheduled rows must remain active and unexpired, while a leased run
+ * remains eligible through settlement even if it has since been paused or
+ * expired. */
+export declare function hasPendingCronWake(nodeId: string): boolean;
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
  *  A real wake consumes the wait at its delivery boundary or, as a dormant
  *  fallback, in reviveNode; recovery replacement is not a wake. Terminal

package/dist/core/canvas/crons.js

@@ -60,6 +60,36 @@ function cronFrom(r) {
         updated: r['updated'],
     };
 }
+/** Decode the stored cron sink JSON. A malformed or unrecognised value has no sink. */
+export function parseCronSink(sinkJson) {
+    try {
+        const sink = JSON.parse(sinkJson);
+        if (typeof sink['node'] === 'string')
+            return { kind: 'node', node: sink['node'] };
+        if (typeof sink['spawn'] === 'string')
+            return { kind: 'spawn', spawn: sink['spawn'] };
+        if (sink['human'] === true)
+            return { kind: 'human' };
+    }
+    catch {
+        // A malformed stored value cannot deliver but remains listable and runnable.
+    }
+    return null;
+}
+/** Render a stored cron sink as the arm-time CLI spec, or null when it has no destination. */
+export function cronSinkDisplay(sinkJson) {
+    const sink = parseCronSink(sinkJson);
+    if (sink === null)
+        return null;
+    switch (sink.kind) {
+        case 'node':
+            return `node:${sink.node}`;
+        case 'spawn':
+            return `spawn:${sink.spawn}`;
+        case 'human':
+            return 'human';
+    }
+}
 // Signal safety
 /** The ONLY sanctioned way to signal a cron run's process group from a stored
  *  row. Re-captures the CURRENT identity of `run_pid` and signals only when it
@@ -261,13 +291,30 @@ export function setCronLastOutputHash(cron_id, hash) {
         .prepare('UPDATE crons SET last_output_hash = ?, updated = ? WHERE cron_id = ?')
         .run(hash, new Date().toISOString(), cron_id);
 }
-/** True when this node has a pending cancel-on-wake cron. The stop guard uses
- *  this focused deadline check to distinguish legitimate clock dormancy from a
- *  terminal node that stopped without finishing. */
-export function hasPendingCancelOnWakeCron(anchor_node) {
-    return (openDb()
-        .prepare("SELECT 1 FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1 AND state = 'active' LIMIT 1")
-        .get(anchor_node) !== undefined);
+/** True when a cron can still wake this node. An active deadline is a wake
+ * source by its anchor; output delivery is a wake source by its decoded node
+ * sink. Scheduled rows must remain active and unexpired, while a leased run
+ * remains eligible through settlement even if it has since been paused or
+ * expired. */
+export function hasPendingCronWake(nodeId) {
+    const rows = openDb().prepare(`SELECT anchor_node, cancel_on_wake, sink
+     FROM crons
+     WHERE (anchor_node = ? AND cancel_on_wake = 1 AND state = 'active')
+        OR (
+          on_output IN ('always', 'on-change')
+          AND (
+            run_state = 'running'
+            OR (run_state = 'idle' AND state = 'active' AND (expires_at IS NULL OR expires_at > ?))
+          )
+        )`).all(nodeId, new Date().toISOString());
+    for (const row of rows) {
+        if (row['anchor_node'] === nodeId && Number(row['cancel_on_wake']) !== 0)
+            return true;
+        const sink = parseCronSink(row['sink']);
+        if (sink?.kind === 'node' && sink.node === nodeId)
+            return true;
+    }
+    return false;
 }
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
  *  A real wake consumes the wait at its delivery boundary or, as a dormant

package/dist/core/canvas/delivery-contract.d.ts

@@ -0,0 +1,19 @@
+export interface DeliveryFailure {
+    kind: 'exit' | 'signal' | 'timeout' | 'spawn_error';
+    exitCode?: number;
+    signal?: string;
+    message?: string;
+    stderr?: string;
+}
+export type DeliverySettlement = {
+    state: 'accepted';
+} | {
+    state: 'permanent_failed';
+    failure: DeliveryFailure;
+} | {
+    state: 'pending';
+    nextAttemptAt: number;
+    failure: DeliveryFailure;
+};
+/** Durable exponential retry delay for the attempt that just failed. */
+export declare function deliveryBackoffMs(attempt: number): number;

package/dist/core/canvas/delivery-contract.js

@@ -0,0 +1,8 @@
+// The durable contract shared by every retried delivery: what a failed attempt
+// records, how an attempt settles, and when the next attempt becomes due. The
+// canvas modules own the rows; `daemon/delivery/run-delivery.ts` owns the
+// process that produces these settlements.
+/** Durable exponential retry delay for the attempt that just failed. */
+export function deliveryBackoffMs(attempt) {
+    return Math.min(5_000 * 2 ** (attempt - 1), 3_600_000);
+}

package/dist/core/canvas/human-deliveries.d.ts

@@ -1,11 +1,6 @@
+import type { DeliveryFailure, DeliverySettlement } from './delivery-contract.js';
 export type ActionDeliveryState = 'pending' | 'running' | 'accepted' | 'permanent_failed';
-export interface ActionDeliveryFailure {
-    kind: 'exit' | 'signal' | 'timeout' | 'spawn_error';
-    exitCode?: number;
-    signal?: string;
-    message?: string;
-    stderr?: string;
-}
+export type ActionDeliveryFailure = DeliveryFailure;
 export interface ActionDeliveryRecord {
     requestId: string;
     state: ActionDeliveryState;
@@ -37,16 +32,7 @@ export declare function readActionDelivery(requestId: string): ActionDeliveryRec
 export declare function dueActionDeliveries(now: number): ActionDeliveryRecord[];
 /** Atomically start one due delivery attempt. A null result lost the claim. */
 export declare function claimActionDelivery(requestId: string, now: number, claimOwner: string): ActionDeliveryRecord | null;
-export type ActionDeliverySettlement = {
-    state: 'accepted';
-} | {
-    state: 'permanent_failed';
-    failure: ActionDeliveryFailure;
-} | {
-    state: 'pending';
-    nextAttemptAt: number;
-    failure: ActionDeliveryFailure;
-};
+export type ActionDeliverySettlement = DeliverySettlement;
 /** Settle only the still-owned running attempt, so a stale process cannot overwrite a newer claim. */
 export declare function settleActionDelivery(requestId: string, attempt: number, claimOwner: string, settlement: ActionDeliverySettlement, now: number): boolean;
 /** A new daemon deliberately redelivers interrupted completions at least once. */

package/dist/core/canvas/node-outcome-deliveries.d.ts

@@ -1,14 +1,7 @@
+import type { DeliveryFailure, DeliverySettlement } from './delivery-contract.js';
 import { type NodeOutcomeKind, type TerminalReason } from './types.js';
 export type OutcomeDeliveryState = 'armed' | 'pending' | 'running' | 'accepted' | 'permanent_failed';
-export interface OutcomeDeliveryFailure {
-    kind: 'exit' | 'signal' | 'timeout' | 'spawn_error';
-    exitCode?: number;
-    signal?: string;
-    message?: string;
-    stderr?: string;
-}
-/** Durable exponential retry delay for the attempt that just failed. */
-export declare function outcomeDeliveryBackoffMs(attempt: number): number;
+export type OutcomeDeliveryFailure = DeliveryFailure;
 export interface OutcomeDeliveryRecord {
     nodeId: string;
     state: OutcomeDeliveryState;
@@ -61,16 +54,7 @@ export declare function armOutcomeDelivery(row: {
 export declare function readOutcomeDelivery(nodeId: string): OutcomeDeliveryRecord | null;
 export declare function dueOutcomeDeliveries(now: number): OutcomeDeliveryRecord[];
 export declare function claimOutcomeDelivery(nodeId: string, now: number, claimOwner: string): OutcomeDeliveryRecord | null;
-export type OutcomeDeliverySettlement = {
-    state: 'accepted';
-} | {
-    state: 'permanent_failed';
-    failure: OutcomeDeliveryFailure;
-} | {
-    state: 'pending';
-    nextAttemptAt: number;
-    failure: OutcomeDeliveryFailure;
-};
+export type OutcomeDeliverySettlement = DeliverySettlement;
 /** Settle only the still-owned running attempt, fencing stale delivery processes. */
 export declare function settleOutcomeDelivery(nodeId: string, attempt: number, claimOwner: string, settlement: OutcomeDeliverySettlement, now: number): boolean;
 export declare function recoverRunningOutcomeDeliveries(now: number): number;

package/dist/core/canvas/node-outcome-deliveries.js

@@ -3,10 +3,6 @@ import { openDb, withCanvasWrite } from './db.js';
 import { getNode } from './canvas.js';
 import { OUTCOME_PAYLOAD_MAX_BYTES } from './types.js';
 import { composeNodeOutcomeDocument } from '../runtime/outcome-document.js';
-/** Durable exponential retry delay for the attempt that just failed. */
-export function outcomeDeliveryBackoffMs(attempt) {
-    return Math.min(5_000 * 2 ** (attempt - 1), 3_600_000);
-}
 function serializedPayload(payload) {
     if (payload === undefined)
         return null;

package/dist/core/keybindings/catalog.js

@@ -84,7 +84,7 @@ export const BINDING_CATALOG = Object.freeze([
     ...attachEntry('crtr.tmux.menu.attach.model-ladder.previous', 'crtr.attach.model-ladder.previous', 'Previous model', 'Move to the previous model ladder rung.', ['['], ['alt+shift+m']),
     ...attachEntry('crtr.tmux.menu.attach.command.inspect', 'crtr.attach.command.inspect', 'Inspect loaded command', 'Open the loaded slash command’s expanded prompt.', ['h'], ['alt+shift+h']),
     ...attachEntry('crtr.tmux.menu.attach.file-review', 'crtr.attach.file-review', 'Review a file', 'Open a line-anchored review of a file named in the transcript.', [], ['alt+shift+r']),
-    ...attachEntry('crtr.tmux.menu.attach.profile-files', 'crtr.attach.profile-files', 'Search profile files', 'Fuzzy-match path segments across the node family’s working directories, profile projects and memory, and ancestor crouter memory stores; Ctrl+Y copies a selected path.', ['f'], ['ctrl+f']),
+    ...attachEntry('crtr.tmux.menu.attach.profile-files', 'crtr.attach.profile-files', 'Search profile files', 'Fuzzy-match path segments across the node family’s working directories, their context and reports directories, profile projects and memory, and ancestor crouter memory stores; Ctrl+Y copies a selected path.', ['f'], ['ctrl+f']),
     ...attachEntry('crtr.tmux.menu.attach.search', 'crtr.attach.search', 'Search transcript', 'Search the transcript as it is currently displayed — folded tool output is not searched until it is unfolded.', ['/'], ['alt+/']),
     ...attachEntry('crtr.tmux.menu.attach.whip', 'crtr.attach.whip', 'Whip agent', 'Interrupt the agent and send a playful command.', ['w'], []),
     b('crtr.attach.scroll.up', 'Attach', 'Scroll up', 'Scroll the transcript one line up.', ['shift+up'], 'terminal', ATTACH_CONTEXTS),

package/dist/core/memory-resolver.d.ts

@@ -145,6 +145,8 @@ export interface MemoryResolutionOpts extends MemoryCandidateOpts {
      *  boot render, on-read resolvedDocs, the slash-command snapshot, and
      *  persona resolution, which stay on the flat ancestor+profile stack. */
     includeDescendants?: boolean;
+    /** Report when bounded descendant discovery omits an owner. Defaults to the inverse of `quiet`, so callers can preserve quiet malformed-document handling while still making an incomplete corpus visible to their caller. */
+    reportDiscovery?: boolean;
 }
 /** A loaded corpus and the exact-identity queries over it. */
 export interface MemoryView {
@@ -195,7 +197,7 @@ export declare function openProjectMemoryStore(ownerDir: string): MemoryStoreDes
 /** Every store a target sees, in precedence order: node, each project store
  *  nearest-first (its enabled plugins after it), then profile, user, builtin.
  *  One real store reached twice contributes once, at its first position. */
-export declare function memoryStoresInPrecedence(target: MemoryTarget, scope?: MemoryScope, includeDescendants?: boolean, quiet?: boolean): MemoryStoreDescriptor[];
+export declare function memoryStoresInPrecedence(target: MemoryTarget, scope?: MemoryScope, includeDescendants?: boolean, reportDiscovery?: boolean): MemoryStoreDescriptor[];
 /** The native (non-plugin) MOUNTED store dirs in resolution precedence.
  *  Addresses a store directly when the document itself may be absent, which is
  *  how a DELETED doc's revision log is still found: history outlives the doc,

package/dist/core/memory-resolver.js

@@ -193,7 +193,7 @@ export function openProjectMemoryStore(ownerDir) {
 /** Every store a target sees, in precedence order: node, each project store
  *  nearest-first (its enabled plugins after it), then profile, user, builtin.
  *  One real store reached twice contributes once, at its first position. */
-export function memoryStoresInPrecedence(target, scope, includeDescendants = false, quiet = false) {
+export function memoryStoresInPrecedence(target, scope, includeDescendants = false, reportDiscovery = true) {
     const out = [];
     const projectStores = (crtrRoot, projectMemory) => {
         out.push(projectStoreDescriptor(dirname(crtrRoot), join(crtrRoot, 'memory'), projectMemory));
@@ -211,7 +211,7 @@ export function memoryStoresInPrecedence(target, scope, includeDescendants = fal
             // nested one. They carry the neutral ceiling — no profile entry names
             // them, and descendant discovery is off for every automatic delivery path.
             if (includeDescendants) {
-                for (const root of descendantStoreRoots(annotated.map(({ root: r }) => r), quiet)) {
+                for (const root of descendantStoreRoots(annotated.map(({ root: r }) => r), reportDiscovery)) {
                     projectStores(root, NEUTRAL_PROJECT_MEMORY);
                 }
             }
@@ -438,7 +438,7 @@ function makeView(stores, docs, scope) {
  *  with its migration remedy and contributes nothing. */
 export function loadMemoryTargetView(target, opts = {}) {
     const quiet = opts.quiet ?? false;
-    const stores = memoryStoresInPrecedence(target, opts.scope, opts.includeDescendants ?? false, quiet);
+    const stores = memoryStoresInPrecedence(target, opts.scope, opts.includeDescendants ?? false, opts.reportDiscovery ?? !quiet);
     const docs = [];
     for (const store of stores) {
         if (store.mountStatus === 'absent')

package/dist/core/nested-stores.d.ts

@@ -9,7 +9,7 @@
  * excluding centrally gives the resolver and lint the identical call with no
  * duplicated dedupe logic.
  */
-export declare function descendantStoreRoots(ancestorRoots: string[], quiet?: boolean): string[];
+export declare function descendantStoreRoots(ancestorRoots: string[], reportBudgetExceeded?: boolean): string[];
 /** Complete descendant-store discovery for state migrations. Unlike the
  *  interactive addressing lane, this filesystem walk has no time or depth
  *  budget, crosses embedded repositories, admits plugin-only `.crouter` roots,

package/dist/core/nested-stores.js

@@ -39,7 +39,7 @@ const cache = new Map();
  * excluding centrally gives the resolver and lint the identical call with no
  * duplicated dedupe logic.
  */
-export function descendantStoreRoots(ancestorRoots, quiet = false) {
+export function descendantStoreRoots(ancestorRoots, reportBudgetExceeded = true) {
     const key = [...ancestorRoots].sort().join('\n');
     const cached = cache.get(key);
     if (cached !== undefined)
@@ -56,8 +56,8 @@ export function descendantStoreRoots(ancestorRoots, quiet = false) {
         owners.push(owner);
     }
     const tripBudget = (owner) => {
-        if (!quiet) {
-            warn(`memory: nested-store discovery under ${owner} exceeded its ${TIME_BUDGET_MS}ms budget — nested stores may be missing from this listing; register deep stores explicitly (add their dirs to the selected profile's projects)`);
+        if (reportBudgetExceeded) {
+            warn(`memory: nested-store discovery under ${owner} exceeded its ${TIME_BUDGET_MS}ms budget — this result may omit nested stores. To read a document from a known nested store, pass its owner as \`--dir <owner>\`; that exact-store read bypasses discovery.`);
         }
     };
     const found = [];

package/dist/core/runtime/bearings-render.js

@@ -237,5 +237,5 @@ export function buildIdentityAssertion(nodeId, kind, mode, forkFrom, sourceLabel
 export function worktreeNote(worktree) {
     if (worktree?.state !== 'open')
         return '';
-    return `Branch: \`${worktree.branch}\`\nWorktree: \`${worktree.path}\`\nBase: \`${worktree.base_ref}\` @ \`${worktree.base_sha}\`\nCommit work here. Land it with \`crtr node worktree close\` before finishing. Auto-drop applies only when the worktree is clean (no uncommitted changes) and nothing remains to land (zero commits ahead of the base, or its commits are already contained in the base); unlanded commits (commits not already contained in the base) or uncommitted changes require an explicit close/landing decision.`;
+    return `Branch: \`${worktree.branch}\`\nWorktree: \`${worktree.path}\`\nBase: \`${worktree.base_ref}\` @ \`${worktree.base_sha}\`\nCommit work here. Before finishing, land it with \`crtr node worktree close\` or keep the checkout and branch when the worktree is clean and its exact tip exists on any branch on origin. Auto-drop applies only when the worktree is clean (no uncommitted changes) and nothing remains to land (zero commits ahead of the base, or its commits are already contained in the base); otherwise, unlanded commits or uncommitted changes block finalization.`;
 }

package/dist/core/runtime/close.js

@@ -2,9 +2,11 @@
 //
 // Closing a node tears down the focused node and every descendant it
 // EXCLUSIVELY owns, walking DOWN the subscribes_to spine (subscriptionsOf = a
-// node's reports/children). Nothing is deleted: pi_session_id, the canvas
-// edges, and all on-disk state persist, so any closed node can later be revived
-// (`crtr node lifecycle revive` / focus → `pi --session <id>`). A close is a pause, not a reap.
+// node's reports/children). A node that never produced substantive assistant
+// output is reaped and cannot be revived. Streaming nodes and nodes with an open
+// managed worktree are retained; other closed nodes keep their pi session,
+// canvas edges, and on-disk state for a later revive (`crtr node lifecycle
+// revive` / focus → `pi --session <id>`).
 //
 // Per node, in this order — the order matters twice:
 //
@@ -171,9 +173,9 @@ export function closeNode(rootId, opts = {}) {
             // Surviving managers captured BEFORE any teardown — a reap (below) deletes
             //    this node's edges, so the step-4 fan-out must read them up front.
             const survivors = subscribersOf(id).filter((s) => !closing.has(s.node_id));
-            // 0) An EMPTY node (engine never produced an assistant message) is a useless
-            //    shell — don't park it as a canceled husk, reap it outright (engine +
-            //    viewer + row + dir). reapIfEmpty handles the teardown; when it fires we
+            // 0) A node with no substantive assistant output is a useless shell — don't
+            //    park it as a canceled husk; reap it outright (engine + viewer + row +
+            //    dir). reapIfEmpty handles the teardown; when it fires we
             //    skip the cancel transition + resume notice (the node is gone) but still
             //    fan the "child gone" wake out to surviving managers below.
             if (!reapIfEmpty(id)) {

package/dist/core/runtime/stop-guard.js

@@ -23,7 +23,7 @@
 //                      manual cleanup.
 //   • otherwise      → a TERMINAL node with nothing live to wait for and no
 //                      final pushed. Re-prompt it to finish or escalate.
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, getNode, contextDir } from '../canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCronWake, getNode, contextDir } from '../canvas/index.js';
 import { activeBackgroundBashJobs } from '../bash-jobs.js';
 import { formatCard, formatStructuredOutputReprompt, STALL_REPROMPT } from '../../shared/generated-context.js';
 import { readOutputRequest } from './structured-output.js';
@@ -41,12 +41,12 @@ function formatInvalidStructuredOutputReprompt(error) {
         `After resolving the file, retry with \`crtr push result\` (or \`crtr push result --decline "<reason>" --code <token>\` when the schema cannot be honestly satisfied). ` +
         `If this is unexpected, escalate to the user using \`crtr human send\`.`);
 }
-/** The wake sources that legitimize a terminal node's dormancy: a pending
- * cancel-on-wake deadline, an active subscription to a live publisher, an
- * explicit live controller wait, or a live background bash job whose completion
- * sends an inbox message. Parentage alone is deliberately absent. */
+/** The wake sources that legitimize a terminal node's dormancy: a pending cron
+ * wake, an active subscription to a live publisher, an explicit live controller
+ * wait, or a live background bash job whose completion sends an inbox message.
+ * Parentage alone is deliberately absent. */
 function wakeCapableWait(nodeId, backgroundJobsRunning) {
-    if (hasPendingCancelOnWakeCron(nodeId))
+    if (hasPendingCronWake(nodeId))
         return 'scheduled';
     if (hasActiveLiveSubscription(nodeId)
         || hasLiveMessageWait(nodeId)

package/dist/core/worktree.js

@@ -954,12 +954,9 @@ export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
  *  `open_managed_worktree` guard then still applies unchanged — real
  *  commits, real uncommitted changes, and a lost race all require the
  *  explicit path. */
-function cleanCurrentBranchTip(wt) {
+function cleanCurrentCheckoutTip(wt) {
     if (wt.state !== 'open' || !existsSync(wt.path) || isRebaseInProgress(wt.path))
         return null;
-    const branch = gitSync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path);
-    if (branch.status !== 0 || branch.stdout.trim() !== wt.branch)
-        return null;
     const status = gitSync(['status', '--porcelain'], wt.path);
     if (status.status !== 0 || status.stdout.trim() !== '')
         return null;
@@ -967,7 +964,7 @@ function cleanCurrentBranchTip(wt) {
     return head.status === 0 ? head.stdout.trim() : null;
 }
 export async function branchIsPushedAtCurrentTip(wt) {
-    const initialTip = cleanCurrentBranchTip(wt);
+    const initialTip = cleanCurrentCheckoutTip(wt);
     if (initialTip === null)
         return false;
     // A cached origin branch can be stale in either direction. Query origin's
@@ -989,7 +986,7 @@ export async function branchIsPushedAtCurrentTip(wt) {
         return false;
     // The remote proof is useful only if the local checkout is still the exact
     // clean tip it inspected when finalization begins.
-    return cleanCurrentBranchTip(wt) === initialTip;
+    return cleanCurrentCheckoutTip(wt) === initialTip;
 }
 export function autoDropCleanManagedWorktree(nodeId) {
     const wt = openManagedWorktreeForNode(nodeId);

package/dist/daemon/__tests__/node-outcome-delivery.test.js

@@ -8,7 +8,8 @@ import { createNode } from '../../core/canvas/canvas.js';
 import { isPidAlive, killProcessGroup } from '../../core/canvas/pid.js';
 import { armOutcomeDelivery, claimOutcomeDelivery, readOutcomeDelivery } from '../../core/canvas/node-outcome-deliveries.js';
 import { transition } from '../../core/runtime/lifecycle.js';
-import { OUTCOME_DELIVERY_TIMEOUT_MS, deliverOutcome } from '../node-outcome/deliver-outcome.js';
+import { DELIVERY_TIMEOUT_MS } from '../delivery/run-delivery.js';
+import { deliverOutcome } from '../node-outcome/deliver-outcome.js';
 let home;
 let processGroupFiles;
 const priorHome = process.env.CRTR_HOME;
@@ -70,7 +71,7 @@ test('timeout SIGKILL escalation reaps a SIGTERM-ignoring descendant after its l
     processGroupFiles.push(processGroupPid);
     const delivery = claimScript('timeout', `#!/bin/sh\necho $$ > ${processGroupPid}\n(\n  trap '' TERM\n  while :; do sleep 30; done\n) &\necho $! > ${childPid}\ntrap 'exit 0' TERM\nwhile :; do sleep 30; done\n`);
     const originalSetTimeout = global.setTimeout;
-    global.setTimeout = ((callback, delay, ...args) => originalSetTimeout(callback, delay === OUTCOME_DELIVERY_TIMEOUT_MS ? 1_000 : delay, ...args));
+    global.setTimeout = ((callback, delay, ...args) => originalSetTimeout(callback, delay === DELIVERY_TIMEOUT_MS ? 1_000 : delay, ...args));
     try {
         await deliverOutcome(delivery, 'test-daemon');
     }

package/dist/daemon/api/__tests__/seam/leaf-api-parity.test.js

@@ -29,7 +29,7 @@ import { CrtrClient } from '../../../../api/index.js';
 import { registerPush } from '../../../../commands/push.js';
 import { registerNode } from '../../../../commands/node.js';
 import { createNode, getNode } from '../../../../core/canvas/canvas.js';
-import { createManagedWorktree } from '../../../../core/worktree.js';
+import { branchIsPushedAtCurrentTip, createManagedWorktree } from '../../../../core/worktree.js';
 import { readInboxSince } from '../../../../core/feed/inbox.js';
 import { gitSync } from '../../../../core/git.js';
 import { InputError } from '../../../../core/io.js';
@@ -187,28 +187,38 @@ test('re-homed guard: `crtr push final` on a node with a managed worktree holdin
         rmSync(repo, { recursive: true, force: true });
     }
 });
-test('`crtr push final` concludes a clean managed worktree whose tip exists on origin only under a different branch name (#912)', async () => {
+test('`crtr push final` retains a clean managed worktree checked out on a pushed PR branch (#1109, #1061)', async () => {
     const repo = initRepo();
     const remote = mkdtempSync(join(tmpdir(), 'crtr-leafparity-remote-'));
     try {
         git(['init', '--bare'], remote);
         git(['remote', 'add', 'origin', remote], repo);
         git(['push', '-u', 'origin', 'main'], repo);
-        const id = 'wt-912-differently-named-remote-branch';
+        const id = 'wt-pushed-pr-branch-final';
         const wt = createManagedWorktree(repo, id);
         writeFileSync(join(wt.path, 'delivered-via-pr.txt'), 'delivered via a PR branch\n');
         git(['add', '.'], wt.path);
-        git(['commit', '-m', 'delivered via differently named branch'], wt.path);
+        git(['commit', '-m', 'delivered via PR branch'], wt.path);
         const tip = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-        const remoteBranch = 'fix/issue-912-worktree-final';
-        git(['push', 'origin', `HEAD:refs/heads/${remoteBranch}`], wt.path);
-        assert.equal(gitSync(['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${wt.branch}`], wt.path).status, 2, 'the recorded crtr branch is absent from origin');
-        assert.equal(gitSync(['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${remoteBranch}`], wt.path).stdout.split('\t')[0], tip, 'origin carries the exact tip under the PR branch name');
+        const prBranch = 'fix/pushed-pr-worktree-final';
+        git(['switch', '-c', prBranch], wt.path);
+        git(['push', 'origin', `HEAD:refs/heads/${wt.branch}`], wt.path);
+        git(['push', 'origin', `HEAD:refs/heads/${prBranch}`], wt.path);
+        assert.equal(gitSync(['rev-parse', `refs/heads/${wt.branch}`], wt.path).stdout.trim(), tip, 'the recorded branch remains at the checkout tip');
+        assert.equal(gitSync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path).stdout.trim(), prBranch, 'the checkout uses the PR branch instead of the recorded branch');
+        assert.equal(gitSync(['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${wt.branch}`], wt.path).stdout.split('\t')[0], tip, 'origin carries the recorded branch tip');
+        assert.equal(gitSync(['ls-remote', '--exit-code', '--heads', 'origin', `refs/heads/${prBranch}`], wt.path).stdout.split('\t')[0], tip, 'origin carries the PR branch tip');
+        const untracked = join(wt.path, 'generated.uid');
+        writeFileSync(untracked, 'untracked generated file\n');
+        assert.equal(await branchIsPushedAtCurrentTip(wt), false, 'an untracked file still rejects the origin-retention proof');
+        rmSync(untracked);
         createNode(worktreeNode(id, wt.path, wt));
-        const out = await runPushAs(id, 'final', 'delivered through a differently named PR branch');
+        const out = await runPushAs(id, 'final', 'delivered through a PR branch');
         assert.equal(out['worktree_auto_dropped'], undefined, 'the remote-tip allowance retains the open worktree');
-        assert.equal(getNode(id)?.managed_worktree?.state, 'open', 'the remote-tip allowance does not close the worktree');
-        assert.equal(getNode(id)?.status, 'done', 'the node finalizes when origin carries its exact tip under the PR branch name');
+        assert.equal(getNode(id)?.managed_worktree?.state, 'open', 'the remote-tip allowance does not close the worktree record');
+        assert.equal(getNode(id)?.managed_worktree?.branch, wt.branch, 'the retained record keeps its recorded branch');
+        assert.equal(gitSync(['rev-parse', '--abbrev-ref', 'HEAD'], wt.path).stdout.trim(), prBranch, 'finalization does not change the checked-out PR branch');
+        assert.equal(getNode(id)?.status, 'done', 'the node finalizes when both pushed branches have its exact tip');
     }
     finally {
         rmSync(repo, { recursive: true, force: true });

package/dist/daemon/api/handlers/reports.js

@@ -100,7 +100,7 @@ async function guardFinalWorktree(id) {
     // command-local mapper needed (plan C-5).
     throw new InputError({
         error: 'open_managed_worktree',
-        message: 'This node still owns an open managed worktree — `push final` is blocked until it is closed.',
+        message: 'This node still owns an open managed worktree that is neither clean and locally landed nor clean with its exact tip on origin — `push final` cannot finish.',
         next: (() => {
             const wt = getNode(id)?.managed_worktree;
             return wt !== null && wt !== undefined && wt.state === 'open' && !existsSync(wt.path)

package/dist/daemon/api/map.d.ts

@@ -1,7 +1,7 @@
 import type { ManagedWorktree, NodeMeta, NodeRow, NodeRuntime, SubscriptionRef } from '../../core/canvas/types.js';
 import type { OutcomeDeliveryRecord } from '../../core/canvas/node-outcome-deliveries.js';
 import type { ReviewComment, ReviewCommentEvent, ReviewErrorCode, ReviewRecord, ReviewResult } from '../../core/review/types.js';
-import type { Cron, CronRunRecord } from '../../core/canvas/crons.js';
+import { type Cron, type CronRunRecord } from '../../core/canvas/crons.js';
 import type { ProfileEntry } from '../../core/profiles/manifest.js';
 import type { ReviveResult } from '../../core/runtime/revive.js';
 import type { CloseNodeResult } from '../../core/runtime/close.js';

package/dist/daemon/api/map.js

@@ -12,6 +12,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { outputResultPath } from '../../core/runtime/structured-output.js';
 import { ReviewOperationError as ReviewOperationErrorClass } from '../../core/review/types.js';
+import { cronSinkDisplay } from '../../core/canvas/crons.js';
 import { isProfilePaused, sanitizeProfileMetadata } from '../../core/profiles/manifest.js';
 import { contextDir, inboxPath, nodeDir, nodeMetaPath, reportsDir, reviewResultPath, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
 import { FinalizationError } from '../../core/feed/feed.js';
@@ -21,7 +22,6 @@ import { CrtrError } from '../../core/errors.js';
 import { WorktreeError } from '../../core/worktree.js';
 import { ApiError } from '../../api/errors.js';
 import { ExitCode } from '../../types.js';
-import { sinkDisplay } from '../cron-sink.js';
 import { responsePath } from '../../core/human/convention.js';
 import { ticketDir } from '../../core/human/root.js';
 // Node projections
@@ -314,7 +314,7 @@ export function toCronDTO(c, lastRun) {
         run_timeout_s: c.run_timeout_s,
         overlap: c.overlap,
         on_output: c.on_output,
-        sink: sinkDisplay(c.sink),
+        sink: cronSinkDisplay(c.sink),
         tier: c.tier,
         state: c.state,
         held: c.held,

package/dist/daemon/cron/sinks.d.ts

@@ -1,2 +1,2 @@
-import type { Cron } from '../../core/canvas/crons.js';
+import { type Cron } from '../../core/canvas/crons.js';
 export declare function deliverToSink(c: Cron, stdout: string): Promise<string>;

package/dist/daemon/cron/sinks.js

@@ -13,7 +13,7 @@ import { reviveNode } from '../../core/runtime/revive.js';
 import { isBrokerLive } from '../../core/runtime/model-swap.js';
 import { spawnChild } from '../../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../../core/runtime/bearings.js';
-import { parseSink } from '../cron-sink.js';
+import { parseCronSink } from '../../core/canvas/crons.js';
 import { resolveLiveProfile, resolveLiveProfileName } from './armed-context.js';
 async function deliverNodeSink(c, target, stdout) {
     const meta = getNode(target);
@@ -89,7 +89,7 @@ function deliverHumanSink(c, stdout) {
     publishPage(ticketDir(id), prepared);
 }
 export async function deliverToSink(c, stdout) {
-    const sink = parseSink(c.sink);
+    const sink = parseCronSink(c.sink);
     if (sink === null)
         return 'no sink armed — nothing delivered';
     if (sink.kind === 'node') {

package/dist/daemon/delivery/run-delivery.d.ts

@@ -0,0 +1,25 @@
+import { type DeliverySettlement } from '../../core/canvas/delivery-contract.js';
+export declare const DELIVERY_TIMEOUT_MS = 120000;
+export declare const DELIVERY_STDERR_TAIL_BYTES: number;
+export interface DeliveryProcessOutcome {
+    exitCode: number | null;
+    signal: string | null;
+    timedOut: boolean;
+    spawnError?: Error;
+    stderr: string;
+}
+/** Process contract mapping. stdout deliberately does not participate. */
+export declare function deliverySettlementForOutcome(outcome: DeliveryProcessOutcome, attempt: number, now: number): DeliverySettlement;
+/** One already-claimed attempt: where to deliver, what to deliver, and which
+ *  attempt this is. The caller resolved argv and cwd when the target was
+ *  registered, so a later config edit cannot redirect this delivery. */
+export interface DeliveryJob {
+    argv: string[];
+    cwd: string;
+    /** The stored document; its `delivery.attempt` is stamped per attempt. */
+    document: unknown;
+    attempt: number;
+}
+/** Spawn and settle one already-claimed delivery. `settle` writes the outcome
+ *  to whichever durable row owns this attempt. */
+export declare function runDelivery(job: DeliveryJob, settle: (settlement: DeliverySettlement) => void): Promise<void>;