@north-light/crouter 0.3.301 → 0.3.302

package/dist/commands/memory/__tests__/command-selector-and-mutation-guards.test.js

@@ -14,7 +14,7 @@
 // Run: node --conditions=crtr-src --import tsx/esm --test --test-concurrency=4 --test-timeout=10000 src/commands/memory/__tests__/command-selector-and-mutation-guards.test.ts
 import { test, beforeEach, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { resetScopeCache } from '../../../core/scope.js';
@@ -23,6 +23,7 @@ import { createProfile, profileMemoryDir } from '../../../core/profiles/manifest
 import { openProjectMemoryStore } from '../../../core/memory-resolver.js';
 import { appendHistoryRecord, buildHistoryRecord, readHistoryRecords } from '../../../core/memory/history.js';
 import { CrtrError } from '../../../core/errors.js';
+import { gitSync } from '../../../core/git.js';
 import { deleteLeaf } from '../delete.js';
 import { editLeaf } from '../edit.js';
 import { historyLeaf } from '../history.js';
@@ -319,6 +320,34 @@ test('a targeted read suppresses malformed descendant-store warnings', async ()
     }
     assert.equal(writes.some((line) => line.includes('memory store not mounted')), false, writes.join(''));
 });
+test('a truncated nested-store read reports that its corpus was incomplete', async () => {
+    assert.equal(gitSync(['init', '-q'], root).status, 0, 'fixture repository initializes');
+    const fakeBin = join(base, 'slow-git');
+    mkdirSync(fakeBin);
+    const originalPath = process.env['PATH'] ?? '';
+    const fakeGit = join(fakeBin, 'git');
+    writeFileSync(fakeGit, `#!/bin/sh\nfor arg in "$@"; do\n  if [ "$arg" = "ls-files" ]; then sleep 1; exit 0; fi\ndone\nPATH=${JSON.stringify(originalPath)}\nexport PATH\nexec git "$@"\n`, 'utf8');
+    chmodSync(fakeGit, 0o755);
+    process.chdir(root);
+    resetScopeCache();
+    const stderr = process.stderr;
+    const originalWrite = stderr.write;
+    const writes = [];
+    stderr.write = ((chunk) => {
+        writes.push(String(chunk));
+        return true;
+    });
+    process.env['PATH'] = `${fakeBin}:${originalPath}`;
+    try {
+        const error = await thrownByAsync(() => readLeaf.run({ name: 'acme/child/foo', kind: undefined, frontmatter: false, scope: undefined, dir: undefined }));
+        assert.equal(error.code, 'not_found');
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        stderr.write = originalWrite;
+    }
+    assert.match(writes.join(''), /nested-store discovery.*result may omit nested stores.*--dir <owner>/s, `a timed-out scan must tell a failed read how to bypass discovery; got:\n${writes.join('')}`);
+});
 test('deleted history points at the revision holding the retained text, never a read that cannot answer', async () => {
     await deleteLeaf.run({ name: 'acme/disposable', dir: root });
     const result = (await historyLeaf.run({ name: 'acme/disposable', dir: root }));

package/dist/commands/memory/read.js

@@ -1,10 +1,9 @@
 import { envNodeId } from '../../shared/env.js';
 import { CrtrClient } from '../../api/index.js';
 import { defineLeaf } from '../../core/command.js';
-import { CrtrError } from '../../core/errors.js';
 import { memoryExtensionEffectiveCatalog, projectEffectiveMemoryExtensions } from '../../core/memory/extensions.js';
 import { docLinkNames } from '../../core/memory/doc-link-grammar.js';
-import { ambientMemoryTarget, createMemoryDocSnapshot, listAllMemoryDocs, loadMemoryStoreView, readMemoryDocContent, resolveMemoryCandidates, resolveMemoryDocs, } from '../../core/memory-resolver.js';
+import { ambientMemoryTarget, createMemoryDocSnapshot, listAllMemoryDocs, loadMemoryStoreView, loadMemoryTargetView, readMemoryDocContent, resolveMemoryDocs, } from '../../core/memory-resolver.js';
 import { expandShellBlocks, hasShellBlocks, makeNodeShellRunner } from '../../core/runtime/shell-expansion.js';
 import { emptyContextExposureState, exposureTarget, loadContextExposureState, registerDocumentExposure, registerExposure, saveContextExposureState, } from '../../core/substrate/injected-store.js';
 import { dirDedupKey, docsByName, isDirName, renderDirListing } from '../../core/substrate/listings.js';
@@ -121,18 +120,17 @@ export const readLeaf = defineLeaf({
                 ...(selector.scope === undefined ? {} : { scope: selector.scope }),
                 includeDescendants: true,
             };
-            // A named read must not turn malformed stores elsewhere in the corpus
-            // into warnings about the requested document. `memory lint` owns that
-            // corpus health report; resolution still includes every candidate.
-            listingByName = linkByName = docsByName(listAllMemoryDocs(selector.scope, true, true));
-            try {
-                set = resolveMemoryCandidates(nameRaw, resolveOpts);
-            }
-            catch (e) {
-                if (!(e instanceof CrtrError && e.code === 'not_found'))
-                    throw e;
-            }
-            fail = () => resolveMemoryCandidates(nameRaw, resolveOpts);
+            // A named read keeps unrelated malformed documents quiet, but a timed
+            // discovery leaves its corpus incomplete and must remain visible before
+            // this branch can report not_found.
+            const view = loadMemoryTargetView(ambientMemoryTarget(), {
+                ...resolveOpts,
+                quiet: true,
+                reportDiscovery: true,
+            });
+            listingByName = linkByName = docsByName(view.docs);
+            set = view.candidates(nameRaw, kindOpts);
+            fail = () => view.resolve(nameRaw, kindOpts);
         }
         const nodeId = envNodeId() || undefined;
         if (set === null) {

package/dist/commands/node/lifecycle.js

@@ -71,11 +71,11 @@ const nodeRecycle = defineLeaf({
 // node lifecycle close — close a node + cascade-cancel its exclusive subtree (Alt+C → x)
 const nodeClose = defineLeaf({
     name: 'close',
-    description: 'close a node + cascade-cancel its exclusive subtree (revivable)',
-    whenToUse: 'you want to tear a node down WITHOUT finishing it, cascade-cancelling every descendant it exclusively owns: abandoning a line of work, killing a stuck or wrong-turn subtree, clearing a branch you no longer need. Windows die but nothing is deleted — each closed node keeps its pi session and can be revived later (`node lifecycle revive`). Use `node lifecycle recycle` instead to FINISH the agent in your pane with a final report, and `push final` when a worker should end its own work normally (Alt+C → x)',
+    description: 'close a node + cascade-cancel its exclusive subtree',
+    whenToUse: 'you want to tear a node down WITHOUT finishing it, cascade-cancelling every descendant it exclusively owns: abandoning a line of work, killing a stuck or wrong-turn subtree, clearing a branch you no longer need. A node that never produced substantive assistant output is deleted and cannot be revived; streaming nodes and nodes with an open managed worktree are retained. Other closed nodes keep their pi session and can be revived later (`node lifecycle revive`). Use `node lifecycle recycle` instead to FINISH the agent in your pane with a final report, and `push final` when a worker should end its own work normally (Alt+C → x)',
     help: {
         name: 'node lifecycle close',
-        summary: 'close a node and cascade-cancel its subtree — kill its tmux window plus those of every descendant it EXCLUSIVELY owns (down the subscribes_to spine), mark them all canceled, and leave each a notice it reads on resume. A descendant still subscribed to by a manager outside the subtree is left running. Nothing is deleted: every closed node keeps its pi session and can be revived later (`crtr node lifecycle revive`)',
+        summary: 'close a node and cascade-cancel its subtree — kill its tmux window plus those of every descendant it EXCLUSIVELY owns (down the subscribes_to spine), mark retained nodes canceled, and leave them a notice they read on resume. A descendant still subscribed to by a manager outside the subtree is left running. A node that never produced substantive assistant output is deleted and cannot be revived; streaming nodes and nodes with an open managed worktree are retained. Other closed nodes keep their pi session and can be revived later (`crtr node lifecycle revive`)',
         params: [
             { kind: 'flag', name: 'node', type: 'string', required: false, constraint: 'Node to close. Defaults to the node occupying --pane (or your current pane).' },
             { kind: 'flag', name: 'pane', type: 'string', required: false, constraint: 'tmux pane id whose node to close. Defaults to $TMUX_PANE / your current pane. The Alt+C menu passes this for you.' },
@@ -88,9 +88,10 @@ const nodeClose = defineLeaf({
         ],
         outputKind: 'object',
         effects: [
-            'Marks the node and its exclusive descendants `canceled` and clears intent (the daemon never revives a canceled node).',
-            'Kills each closed node\'s tmux window; their pi sessions and canvas edges persist for a later revive.',
-            'Appends a cancellation notice to each closed node\'s inbox, surfaced on its next resume.',
+            'Marks retained nodes and their exclusive descendants `canceled` and clears intent (the daemon never revives a canceled node).',
+            'Deletes a non-streaming node with no substantive assistant output unless it has an open managed worktree; a deleted node cannot be revived.',
+            'Kills each closed node\'s tmux window; retained nodes keep their pi sessions and canvas edges for a later revive.',
+            'Appends a cancellation notice to each retained node\'s inbox, surfaced on its next resume.',
         ],
     },
     run: async (input) => {

package/dist/commands/push.js

@@ -160,8 +160,8 @@ function makePushLeaf(kind) {
                 ...(kind === 'final'
                     ? [
                         { name: 'transitioned', type: 'object', required: false, constraint: 'Present only for a final that flipped the node — { from, to } lifecycle-status transition applied server-side.' },
-                        { name: 'worktree_auto_dropped', type: 'boolean', required: false, constraint: 'Present only when this node owned a managed worktree with zero commits ahead of its base and no uncommitted changes — the server auto-dropped it instead of requiring `node worktree close` first (see worktree_auto_dropped_path).' },
-                        { name: 'worktree_auto_dropped_path', type: 'string', required: false, constraint: 'Present only alongside worktree_auto_dropped: the checkout path that was dropped.' },
+                        { name: 'worktree_auto_dropped', type: 'boolean', required: false, constraint: 'Present only when the server closed this node’s managed-worktree record without requiring `node worktree close`; cleanup of an existing checkout remains pending (see worktree_auto_dropped_path).' },
+                        { name: 'worktree_auto_dropped_path', type: 'string', required: false, constraint: 'Present only alongside worktree_auto_dropped: the closed worktree path; an existing checkout remains until pending cleanup.' },
                     ]
                     : []),
             ],
@@ -172,7 +172,7 @@ function makePushLeaf(kind) {
                 ...(kind === 'final'
                     ? [
                         'Marks the node done (status + intent) server-side; its engine shuts down on next stop.',
-                        'When this node owns a clean managed worktree already contained in its local base, the server auto-drops it instead of blocking on `node worktree close`. A clean worktree whose exact tip exists on any branch on origin may also finalize while retaining its branch and checkout; uncommitted changes or a tip absent from origin still block with open_managed_worktree.',
+                        'When this node owns a clean managed worktree already contained in its local base, the server closes its record with cleanup pending instead of blocking on `node worktree close`. A clean worktree whose exact tip exists on any branch on origin may also finalize while retaining its branch and checkout; uncommitted changes or a tip absent from origin still block with open_managed_worktree.',
                     ]
                     : []),
             ],
@@ -242,7 +242,7 @@ function makePushLeaf(kind) {
             const line = kind === 'final'
                 ? 'Result recorded — node finished; its engine shuts down on next stop. Nothing more to do here: STOP your turn immediately. Reply with just "Done." and nothing else.'
                 : `Progress report fanned to ${n} subscriber(s).`;
-            const dropNote = r['worktree_auto_dropped'] === true ? `\n\nAuto-dropped a clean, zero-commit managed worktree at ${String(r['worktree_auto_dropped_path'])} — nothing to land.` : '';
+            const dropNote = r['worktree_auto_dropped'] === true ? `\n\nClosed a clean managed-worktree record at ${String(r['worktree_auto_dropped_path'])} — nothing to land; cleanup remains pending if the checkout still exists.` : '';
             return `${line}\n\n- report: ${r['report_path']}${dropNote}`;
         },
     });

package/dist/core/__tests__/integration/revive.test.js

@@ -33,7 +33,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
-import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
+import { armCron, getCron } from '../../canvas/crons.js';
 import { readInboxSince } from '../../feed/inbox.js';
 import { closeDb } from '../../canvas/db.js';
 import { apiSocketPath } from '../../canvas/paths.js';
@@ -304,11 +304,11 @@ test('a recovery relaunch keeps the armed deadline; a wake revive consumes it',
         const recovered = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
         armDeadline(recovered, 'cron-recovery');
         await reviveNode(recovered, { resume: true, recovery: true, capacity: 'freeze' });
-        assert.equal(hasPendingCancelOnWakeCron(recovered), true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
+        assert.equal(getCron('cron-recovery') !== null, true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
         const woken = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
         armDeadline(woken, 'cron-wake');
         await reviveNode(woken, { resume: true, capacity: 'freeze' });
-        assert.equal(hasPendingCancelOnWakeCron(woken), false, 'a wake revive won the race and cancels the deadline');
+        assert.equal(getCron('cron-wake'), null, 'a wake revive won the race and cancels the deadline');
     }
     finally {
         await h.dispose();

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -22,6 +22,7 @@ import assert from 'node:assert/strict';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { appendInbox, readCursor, readInboxSince } from '../../feed/inbox.js';
+import { acquireCronRunLease, armCron, setCronState } from '../../canvas/crons.js';
 import { registerWarmSpare, subscribe, subscriptionsOf, updateNode } from '../../canvas/index.js';
 import { isPidAlive } from '../../canvas/pid.js';
 import { reviveNode } from '../../runtime/revive.js';
@@ -45,6 +46,47 @@ async function awaitReleased(nodeId) {
         return node?.status === 'idle' && node.intent === 'idle-release' && typeof node.pi_pid === 'number' && !isPidAlive(node.pi_pid);
     }, { label: `idle-release broker exit for ${nodeId}` });
 }
+async function assertCronWakeReleases(nodeId, running) {
+    const cronId = `${nodeId}-cron`;
+    const target = h.fabricateBrokerNode({ id: nodeId, parent: root, status: 'active' });
+    const now = new Date();
+    armCron({
+        cron_id: cronId,
+        name: cronId,
+        created_by: null,
+        command: 'printf wake',
+        fire_at: new Date(now.getTime() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: nodeId,
+        cancel_on_wake: false,
+        cwd: h.home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'always',
+        sink: JSON.stringify({ node: nodeId }),
+        tier: 'normal',
+    });
+    if (running) {
+        assert.equal(acquireCronRunLease(cronId, 'seam-fixture', process.pid, now.toISOString(), false), true);
+        setCronState(cronId, 'paused');
+    }
+    updateNode(target, { launch: { extensions: [], tools: [], systemPrompt: '', env: {} } });
+    await reviveNode(target, { resume: true, capacity: 'freeze' });
+    await h.awaitBoot(target);
+    await h.stop(target);
+    await awaitReleased(target);
+    await h.awaitFleetExit(target);
+    assert.equal(h.node(target)?.status, 'idle', `${running ? 'running' : 'scheduled'} cron did not trigger a stop-guard reprompt`);
+}
+test('an anchored node-sink cron releases a terminal broker when scheduled or in flight', { timeout: 60_000 }, async () => {
+    await assertCronWakeReleases('scheduled-cron-wake', false);
+    await assertCronWakeReleases('running-cron-wake', true);
+});
 test('idle-release settles its real watcher before exit; daemon revives exactly once for a later row', { timeout: 30_000 }, async () => {
     // Reproduce the observed #353/#362 edge: real pi reported
     // ctx.hasPendingMessages() === true at the sole agent_settled even though the

package/dist/core/__tests__/stop-guard.test.js

@@ -9,7 +9,9 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, deliverAndSettleMessageWait, getNode, subscribe, setMessageWait, setStatus } from '../canvas/canvas.js';
+import { armCron, cancelCron, setCronState } from '../canvas/crons.js';
 import { closeDb, openDb } from '../canvas/db.js';
+import { hasLiveObligation } from '../../daemon/reconcilers/live-obligation.js';
 import { contextDir } from '../canvas/paths.js';
 import { bashJobPaths } from '../bash-jobs.js';
 import { evaluateStop } from '../runtime/stop-guard.js';
@@ -29,6 +31,29 @@ function node(id, over = {}) {
     };
 }
 const noSignals = { pushedFinal: false, requestedHumanReply: false };
+function arm(overrides) {
+    armCron({
+        name: overrides.cron_id,
+        created_by: null,
+        command: 'printf cron',
+        fire_at: new Date(Date.now() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: null,
+        cancel_on_wake: false,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'always',
+        sink: '{}',
+        tier: 'normal',
+        ...overrides,
+    });
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-stopguard-'));
     process.env['CRTR_HOME'] = home;
@@ -82,6 +107,45 @@ test('a TERMINAL node awaiting a background bash job may dorm until its completi
     assert.equal(completed.action, 'reprompt');
     assert.equal(completed.reason, 'stalled');
 });
+test('a pending node-sink cron wake releases terminal nodes and holds unattended nodes', () => {
+    createNode(node('target'));
+    const assertsWake = (id) => {
+        assert.deepEqual(evaluateStop('target', noSignals), { action: 'allow', reason: 'scheduled' }, id);
+        assert.equal(hasLiveObligation('target'), true, `${id} holds the unattended node`);
+    };
+    const assertsNoWake = (id) => {
+        assert.equal(evaluateStop('target', noSignals).action, 'reprompt', id);
+        assert.equal(hasLiveObligation('target'), false, `${id} does not hold the unattended node`);
+    };
+    arm({ cron_id: 'scheduled', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
+    assertsWake('an anchored scheduled always sink');
+    cancelCron('scheduled');
+    arm({ cron_id: 'running', anchor_node: 'target', sink: JSON.stringify({ node: 'target' }) });
+    openDb().prepare("UPDATE crons SET run_state = 'running' WHERE cron_id = ?").run('running');
+    setCronState('running', 'paused');
+    assertsWake('a paused in-flight sink');
+    cancelCron('running');
+    arm({ cron_id: 'unanchored-change', on_output: 'on-change', sink: JSON.stringify({ node: 'target' }) });
+    assertsWake('an unanchored on-change sink');
+    cancelCron('unanchored-change');
+    arm({ cron_id: 'other-target', sink: JSON.stringify({ node: 'other' }) });
+    assertsNoWake('a sink for another node');
+    cancelCron('other-target');
+    arm({ cron_id: 'silent', on_output: 'silent', sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('a silent cron');
+    cancelCron('silent');
+    arm({ cron_id: 'on-failure', on_output: 'on-failure', sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('an on-failure cron');
+    cancelCron('on-failure');
+    arm({ cron_id: 'expired', expires_at: new Date(Date.now() - 1_000).toISOString(), sink: JSON.stringify({ node: 'target' }) });
+    assertsNoWake('an expired idle cron');
+    cancelCron('expired');
+    arm({ cron_id: 'canceled', sink: JSON.stringify({ node: 'target' }) });
+    cancelCron('canceled');
+    assertsNoWake('a canceled cron');
+    arm({ cron_id: 'deadline', anchor_node: 'target', cancel_on_wake: true, on_output: 'on-failure' });
+    assertsWake('an active deadline');
+});
 test('only an explicit live controller wait permits dormancy; ancestry alone does not', () => {
     createNode(node('parent', { lifecycle: 'terminal', status: 'active' }));
     createNode(node('child', { parent: 'parent' }));

package/dist/core/canvas/crons.d.ts

@@ -3,6 +3,16 @@ export type CronOverlap = 'skip' | 'queue' | 'replace';
 export type CronOnOutput = 'silent' | 'on-failure' | 'always' | 'on-change';
 export type CronState = 'active' | 'paused';
 export type CronRunState = 'idle' | 'running';
+/** The decoded delivery target of a stored cron sink. */
+export type ParsedCronSink = {
+    kind: 'node';
+    node: string;
+} | {
+    kind: 'spawn';
+    spawn: string;
+} | {
+    kind: 'human';
+} | null;
 /** A hydrated `crons` row. */
 export interface Cron {
     cron_id: string;
@@ -96,6 +106,10 @@ export interface CronRunRecord {
 /** Ring bound for `cron_runs`: recordCronRun prunes each cron's history to
  *  its most recent this-many rows. */
 export declare const CRON_RUN_RING = 20;
+/** Decode the stored cron sink JSON. A malformed or unrecognised value has no sink. */
+export declare function parseCronSink(sinkJson: string): ParsedCronSink;
+/** Render a stored cron sink as the arm-time CLI spec, or null when it has no destination. */
+export declare function cronSinkDisplay(sinkJson: string): string | null;
 /** The ONLY sanctioned way to signal a cron run's process group from a stored
  *  row. Re-captures the CURRENT identity of `run_pid` and signals only when it
  *  MATCHES the fingerprint recorded at lease acquisition. Returns whether the
@@ -180,10 +194,12 @@ export declare function setCronState(cron_id: string, state: CronState): boolean
  *  previous run's stdout. Written after EVERY settled run of an on-change
  *  cron, delivered or not. */
 export declare function setCronLastOutputHash(cron_id: string, hash: string): void;
-/** True when this node has a pending cancel-on-wake cron. The stop guard uses
- *  this focused deadline check to distinguish legitimate clock dormancy from a
- *  terminal node that stopped without finishing. */
-export declare function hasPendingCancelOnWakeCron(anchor_node: string): boolean;
+/** True when a cron can still wake this node. An active deadline is a wake
+ * source by its anchor; output delivery is a wake source by its decoded node
+ * sink. Scheduled rows must remain active and unexpired, while a leased run
+ * remains eligible through settlement even if it has since been paused or
+ * expired. */
+export declare function hasPendingCronWake(nodeId: string): boolean;
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
  *  A real wake consumes the wait at its delivery boundary or, as a dormant
  *  fallback, in reviveNode; recovery replacement is not a wake. Terminal

package/dist/core/canvas/crons.js

@@ -60,6 +60,36 @@ function cronFrom(r) {
         updated: r['updated'],
     };
 }
+/** Decode the stored cron sink JSON. A malformed or unrecognised value has no sink. */
+export function parseCronSink(sinkJson) {
+    try {
+        const sink = JSON.parse(sinkJson);
+        if (typeof sink['node'] === 'string')
+            return { kind: 'node', node: sink['node'] };
+        if (typeof sink['spawn'] === 'string')
+            return { kind: 'spawn', spawn: sink['spawn'] };
+        if (sink['human'] === true)
+            return { kind: 'human' };
+    }
+    catch {
+        // A malformed stored value cannot deliver but remains listable and runnable.
+    }
+    return null;
+}
+/** Render a stored cron sink as the arm-time CLI spec, or null when it has no destination. */
+export function cronSinkDisplay(sinkJson) {
+    const sink = parseCronSink(sinkJson);
+    if (sink === null)
+        return null;
+    switch (sink.kind) {
+        case 'node':
+            return `node:${sink.node}`;
+        case 'spawn':
+            return `spawn:${sink.spawn}`;
+        case 'human':
+            return 'human';
+    }
+}
 // Signal safety
 /** The ONLY sanctioned way to signal a cron run's process group from a stored
  *  row. Re-captures the CURRENT identity of `run_pid` and signals only when it
@@ -261,13 +291,30 @@ export function setCronLastOutputHash(cron_id, hash) {
         .prepare('UPDATE crons SET last_output_hash = ?, updated = ? WHERE cron_id = ?')
         .run(hash, new Date().toISOString(), cron_id);
 }
-/** True when this node has a pending cancel-on-wake cron. The stop guard uses
- *  this focused deadline check to distinguish legitimate clock dormancy from a
- *  terminal node that stopped without finishing. */
-export function hasPendingCancelOnWakeCron(anchor_node) {
-    return (openDb()
-        .prepare("SELECT 1 FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1 AND state = 'active' LIMIT 1")
-        .get(anchor_node) !== undefined);
+/** True when a cron can still wake this node. An active deadline is a wake
+ * source by its anchor; output delivery is a wake source by its decoded node
+ * sink. Scheduled rows must remain active and unexpired, while a leased run
+ * remains eligible through settlement even if it has since been paused or
+ * expired. */
+export function hasPendingCronWake(nodeId) {
+    const rows = openDb().prepare(`SELECT anchor_node, cancel_on_wake, sink
+     FROM crons
+     WHERE (anchor_node = ? AND cancel_on_wake = 1 AND state = 'active')
+        OR (
+          on_output IN ('always', 'on-change')
+          AND (
+            run_state = 'running'
+            OR (run_state = 'idle' AND state = 'active' AND (expires_at IS NULL OR expires_at > ?))
+          )
+        )`).all(nodeId, new Date().toISOString());
+    for (const row of rows) {
+        if (row['anchor_node'] === nodeId && Number(row['cancel_on_wake']) !== 0)
+            return true;
+        const sink = parseCronSink(row['sink']);
+        if (sink?.kind === 'node' && sink.node === nodeId)
+            return true;
+    }
+    return false;
 }
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
  *  A real wake consumes the wait at its delivery boundary or, as a dormant

package/dist/core/memory-resolver.d.ts

@@ -145,6 +145,8 @@ export interface MemoryResolutionOpts extends MemoryCandidateOpts {
      *  boot render, on-read resolvedDocs, the slash-command snapshot, and
      *  persona resolution, which stay on the flat ancestor+profile stack. */
     includeDescendants?: boolean;
+    /** Report when bounded descendant discovery omits an owner. Defaults to the inverse of `quiet`, so callers can preserve quiet malformed-document handling while still making an incomplete corpus visible to their caller. */
+    reportDiscovery?: boolean;
 }
 /** A loaded corpus and the exact-identity queries over it. */
 export interface MemoryView {
@@ -195,7 +197,7 @@ export declare function openProjectMemoryStore(ownerDir: string): MemoryStoreDes
 /** Every store a target sees, in precedence order: node, each project store
  *  nearest-first (its enabled plugins after it), then profile, user, builtin.
  *  One real store reached twice contributes once, at its first position. */
-export declare function memoryStoresInPrecedence(target: MemoryTarget, scope?: MemoryScope, includeDescendants?: boolean, quiet?: boolean): MemoryStoreDescriptor[];
+export declare function memoryStoresInPrecedence(target: MemoryTarget, scope?: MemoryScope, includeDescendants?: boolean, reportDiscovery?: boolean): MemoryStoreDescriptor[];
 /** The native (non-plugin) MOUNTED store dirs in resolution precedence.
  *  Addresses a store directly when the document itself may be absent, which is
  *  how a DELETED doc's revision log is still found: history outlives the doc,

package/dist/core/memory-resolver.js

@@ -193,7 +193,7 @@ export function openProjectMemoryStore(ownerDir) {
 /** Every store a target sees, in precedence order: node, each project store
  *  nearest-first (its enabled plugins after it), then profile, user, builtin.
  *  One real store reached twice contributes once, at its first position. */
-export function memoryStoresInPrecedence(target, scope, includeDescendants = false, quiet = false) {
+export function memoryStoresInPrecedence(target, scope, includeDescendants = false, reportDiscovery = true) {
     const out = [];
     const projectStores = (crtrRoot, projectMemory) => {
         out.push(projectStoreDescriptor(dirname(crtrRoot), join(crtrRoot, 'memory'), projectMemory));
@@ -211,7 +211,7 @@ export function memoryStoresInPrecedence(target, scope, includeDescendants = fal
             // nested one. They carry the neutral ceiling — no profile entry names
             // them, and descendant discovery is off for every automatic delivery path.
             if (includeDescendants) {
-                for (const root of descendantStoreRoots(annotated.map(({ root: r }) => r), quiet)) {
+                for (const root of descendantStoreRoots(annotated.map(({ root: r }) => r), reportDiscovery)) {
                     projectStores(root, NEUTRAL_PROJECT_MEMORY);
                 }
             }
@@ -438,7 +438,7 @@ function makeView(stores, docs, scope) {
  *  with its migration remedy and contributes nothing. */
 export function loadMemoryTargetView(target, opts = {}) {
     const quiet = opts.quiet ?? false;
-    const stores = memoryStoresInPrecedence(target, opts.scope, opts.includeDescendants ?? false, quiet);
+    const stores = memoryStoresInPrecedence(target, opts.scope, opts.includeDescendants ?? false, opts.reportDiscovery ?? !quiet);
     const docs = [];
     for (const store of stores) {
         if (store.mountStatus === 'absent')

package/dist/core/nested-stores.d.ts

@@ -9,7 +9,7 @@
  * excluding centrally gives the resolver and lint the identical call with no
  * duplicated dedupe logic.
  */
-export declare function descendantStoreRoots(ancestorRoots: string[], quiet?: boolean): string[];
+export declare function descendantStoreRoots(ancestorRoots: string[], reportBudgetExceeded?: boolean): string[];
 /** Complete descendant-store discovery for state migrations. Unlike the
  *  interactive addressing lane, this filesystem walk has no time or depth
  *  budget, crosses embedded repositories, admits plugin-only `.crouter` roots,

package/dist/core/nested-stores.js

@@ -39,7 +39,7 @@ const cache = new Map();
  * excluding centrally gives the resolver and lint the identical call with no
  * duplicated dedupe logic.
  */
-export function descendantStoreRoots(ancestorRoots, quiet = false) {
+export function descendantStoreRoots(ancestorRoots, reportBudgetExceeded = true) {
     const key = [...ancestorRoots].sort().join('\n');
     const cached = cache.get(key);
     if (cached !== undefined)
@@ -56,8 +56,8 @@ export function descendantStoreRoots(ancestorRoots, quiet = false) {
         owners.push(owner);
     }
     const tripBudget = (owner) => {
-        if (!quiet) {
-            warn(`memory: nested-store discovery under ${owner} exceeded its ${TIME_BUDGET_MS}ms budget — nested stores may be missing from this listing; register deep stores explicitly (add their dirs to the selected profile's projects)`);
+        if (reportBudgetExceeded) {
+            warn(`memory: nested-store discovery under ${owner} exceeded its ${TIME_BUDGET_MS}ms budget — this result may omit nested stores. To read a document from a known nested store, pass its owner as \`--dir <owner>\`; that exact-store read bypasses discovery.`);
         }
     };
     const found = [];

package/dist/core/runtime/bearings-render.js

@@ -237,5 +237,5 @@ export function buildIdentityAssertion(nodeId, kind, mode, forkFrom, sourceLabel
 export function worktreeNote(worktree) {
     if (worktree?.state !== 'open')
         return '';
-    return `Branch: \`${worktree.branch}\`\nWorktree: \`${worktree.path}\`\nBase: \`${worktree.base_ref}\` @ \`${worktree.base_sha}\`\nCommit work here. Land it with \`crtr node worktree close\` before finishing. Auto-drop applies only when the worktree is clean (no uncommitted changes) and nothing remains to land (zero commits ahead of the base, or its commits are already contained in the base); unlanded commits (commits not already contained in the base) or uncommitted changes require an explicit close/landing decision.`;
+    return `Branch: \`${worktree.branch}\`\nWorktree: \`${worktree.path}\`\nBase: \`${worktree.base_ref}\` @ \`${worktree.base_sha}\`\nCommit work here. Before finishing, land it with \`crtr node worktree close\` or keep the checkout and branch when the worktree is clean and its exact tip exists on any branch on origin. Auto-drop applies only when the worktree is clean (no uncommitted changes) and nothing remains to land (zero commits ahead of the base, or its commits are already contained in the base); otherwise, unlanded commits or uncommitted changes block finalization.`;
 }

package/dist/core/runtime/close.js

@@ -2,9 +2,11 @@
 //
 // Closing a node tears down the focused node and every descendant it
 // EXCLUSIVELY owns, walking DOWN the subscribes_to spine (subscriptionsOf = a
-// node's reports/children). Nothing is deleted: pi_session_id, the canvas
-// edges, and all on-disk state persist, so any closed node can later be revived
-// (`crtr node lifecycle revive` / focus → `pi --session <id>`). A close is a pause, not a reap.
+// node's reports/children). A node that never produced substantive assistant
+// output is reaped and cannot be revived. Streaming nodes and nodes with an open
+// managed worktree are retained; other closed nodes keep their pi session,
+// canvas edges, and on-disk state for a later revive (`crtr node lifecycle
+// revive` / focus → `pi --session <id>`).
 //
 // Per node, in this order — the order matters twice:
 //
@@ -171,9 +173,9 @@ export function closeNode(rootId, opts = {}) {
             // Surviving managers captured BEFORE any teardown — a reap (below) deletes
             //    this node's edges, so the step-4 fan-out must read them up front.
             const survivors = subscribersOf(id).filter((s) => !closing.has(s.node_id));
-            // 0) An EMPTY node (engine never produced an assistant message) is a useless
-            //    shell — don't park it as a canceled husk, reap it outright (engine +
-            //    viewer + row + dir). reapIfEmpty handles the teardown; when it fires we
+            // 0) A node with no substantive assistant output is a useless shell — don't
+            //    park it as a canceled husk; reap it outright (engine + viewer + row +
+            //    dir). reapIfEmpty handles the teardown; when it fires we
             //    skip the cancel transition + resume notice (the node is gone) but still
             //    fan the "child gone" wake out to surviving managers below.
             if (!reapIfEmpty(id)) {

package/dist/core/runtime/stop-guard.js

@@ -23,7 +23,7 @@
 //                      manual cleanup.
 //   • otherwise      → a TERMINAL node with nothing live to wait for and no
 //                      final pushed. Re-prompt it to finish or escalate.
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, getNode, contextDir } from '../canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCronWake, getNode, contextDir } from '../canvas/index.js';
 import { activeBackgroundBashJobs } from '../bash-jobs.js';
 import { formatCard, formatStructuredOutputReprompt, STALL_REPROMPT } from '../../shared/generated-context.js';
 import { readOutputRequest } from './structured-output.js';
@@ -41,12 +41,12 @@ function formatInvalidStructuredOutputReprompt(error) {
         `After resolving the file, retry with \`crtr push result\` (or \`crtr push result --decline "<reason>" --code <token>\` when the schema cannot be honestly satisfied). ` +
         `If this is unexpected, escalate to the user using \`crtr human send\`.`);
 }
-/** The wake sources that legitimize a terminal node's dormancy: a pending
- * cancel-on-wake deadline, an active subscription to a live publisher, an
- * explicit live controller wait, or a live background bash job whose completion
- * sends an inbox message. Parentage alone is deliberately absent. */
+/** The wake sources that legitimize a terminal node's dormancy: a pending cron
+ * wake, an active subscription to a live publisher, an explicit live controller
+ * wait, or a live background bash job whose completion sends an inbox message.
+ * Parentage alone is deliberately absent. */
 function wakeCapableWait(nodeId, backgroundJobsRunning) {
-    if (hasPendingCancelOnWakeCron(nodeId))
+    if (hasPendingCronWake(nodeId))
         return 'scheduled';
     if (hasActiveLiveSubscription(nodeId)
         || hasLiveMessageWait(nodeId)