@north-light/crouter 0.3.303 → 0.3.305

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -4,20 +4,28 @@
 // (worktree-land.test.ts) only so the two run as two parallel files.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, existsSync, writeFileSync, chmodSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { mkdtempSync, mkdirSync, renameSync, rmSync, existsSync, writeFileSync, chmodSync, realpathSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../../git.js';
-import { createManagedWorktree, closeManagedWorktree } from '../../worktree.js';
+import { withExclusiveDirectoryLockAsync } from '../../exclusive-lock.js';
+import { createManagedWorktree, closeManagedWorktree, worktreeLockPathForCommonDir } from '../../worktree.js';
 import { reconcileManagedWorktree } from '../../worktree-sweep.js';
 import { createApiServer } from '../../../daemon/api/server.js';
+import { ManagedWorktreeSweepReconciler } from '../../../daemon/reconcilers/managed-worktree-sweep.js';
 import { apiSocketPath } from '../../canvas/paths.js';
-import { CrtrClient } from '../../../api/index.js';
+import { ApiError, CrtrClient } from '../../../api/index.js';
 import { createNode, getNode } from '../../canvas/canvas.js';
+import { headlessBrokerHost } from '../../runtime/host.js';
+import { reviveNode } from '../../runtime/revive.js';
+import { bindTestFleet } from '../helpers/fleet.js';
+import { resetFleetForTests } from '../../runtime/fleet.js';
 import { closeDb } from '../../canvas/db.js';
 let home;
 let remoteDir;
 let sourceDir;
+const scratchRoot = join(homedir(), '.crouter', 'canvas', 'scratch');
 function run(args, cwd) {
     const res = gitSync(args, cwd);
     if (res.status !== 0) {
@@ -42,7 +50,8 @@ before(() => {
     // `/var` → `/private/var` symlink, so the recorded managed-worktree path and
     // git's canonical `worktree list` output differ as strings while naming one
     // directory. Every path-ownership check must judge identity, not spelling.
-    home = mkdtempSync(join(tmpdir(), 'crtr-worktree-home-'));
+    mkdirSync(scratchRoot, { recursive: true });
+    home = mkdtempSync(join(scratchRoot, 'crtr-worktree-home-'));
     process.env['CRTR_HOME'] = home;
     // Bare "remote" wired up as origin so the test can prove landing NEVER pushes
     // to it (managed worktrees are based on and land onto local `main` only).
@@ -97,6 +106,104 @@ test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async (
     const swept = getNode(nodeId)?.managed_worktree;
     assert.deepEqual({ state: swept?.state, cleanup: swept?.cleanup }, { state: 'closed', cleanup: 'complete' });
 });
+test('a dead managed child keeps its open checkout through the sweep and revives there (#962)', async () => {
+    const repo = mkdtempSync(join(scratchRoot, 'crtr-worktree-962-'));
+    const nodeId = 'wt-sweep-dead-open';
+    const originalLaunch = headlessBrokerHost.launch;
+    try {
+        run(['init', '-b', 'main'], repo);
+        run(['config', 'user.email', 'test@example.com'], repo);
+        run(['config', 'user.name', 'Test'], repo);
+        writeFileSync(join(repo, 'README.md'), 'hello\n');
+        run(['add', '.'], repo);
+        run(['commit', '-m', 'init'], repo);
+        const wt = createManagedWorktree(repo, nodeId);
+        createNode(node(nodeId, { cwd: wt.path, status: 'dead', managed_worktree: wt }));
+        const reconciler = new ManagedWorktreeSweepReconciler();
+        let pass;
+        reconciler.run(Date.now(), {
+            lifecycle: {
+                acceptsDetachedWork: () => true,
+                registerDetached: (work) => { pass = work; },
+            },
+            fleet: { isClaimed: () => false },
+        });
+        await pass;
+        const afterSweep = getNode(nodeId);
+        assert.equal(afterSweep.managed_worktree?.state, 'open', 'a failed launch does not authorize disposal');
+        assert.equal(afterSweep.cwd, wt.path, 'the sweep leaves the durable launch cwd unchanged');
+        assert.ok(existsSync(wt.path), 'the isolated checkout remains available for recovery');
+        const testFleet = bindTestFleet();
+        const launchCwds = [];
+        headlessBrokerHost.launch = (id, _inv, options) => {
+            launchCwds.push(options.cwd);
+            const handle = { pid: process.pid, exited: new Promise(() => { }) };
+            testFleet.fleet.register(id, handle);
+            return handle;
+        };
+        const revived = await reviveNode(nodeId, { resume: false, capacity: 'freeze' });
+        assert.equal(revived.outcome, 'launched');
+        assert.deepEqual(launchCwds, [wt.path], 'a fresh revive launches in the retained managed checkout');
+        const closedId = 'wt-sweep-closed';
+        const closedWt = createManagedWorktree(repo, closedId);
+        createNode(node(closedId, { cwd: closedWt.path, status: 'done', managed_worktree: closedWt }));
+        closeManagedWorktree(closedId);
+        const cleanup = await reconcileManagedWorktree(closedId, { stillEligible: () => true });
+        assert.equal(cleanup.status, 'complete', 'a successful close is still physically cleaned after its engine exits');
+        assert.equal(getNode(closedId)?.cwd, repo, 'a successful close deliberately repoints future launch cwd to the repository root');
+        launchCwds.length = 0;
+        const closedRevive = await reviveNode(closedId, { resume: false, capacity: 'freeze' });
+        assert.equal(closedRevive.outcome, 'launched');
+        assert.deepEqual(launchCwds, [repo], 'a closed node still revives against the repository root');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        resetFleetForTests();
+        rmSync(repo, { recursive: true, force: true });
+    }
+});
+test('the sweep does not conclude a missing record while its branch survives in a moved repository', async () => {
+    const repo = mkdtempSync(join(scratchRoot, 'crtr-worktree-moved-root-'));
+    const movedRepo = join(scratchRoot, `crtr-worktree-moved-root-destination-${Date.now()}`);
+    const nodeId = 'wt-sweep-moved-root';
+    try {
+        run(['init', '-b', 'main'], repo);
+        run(['config', 'user.email', 'test@example.com'], repo);
+        run(['config', 'user.name', 'Test'], repo);
+        writeFileSync(join(repo, 'README.md'), 'hello\n');
+        run(['add', '.'], repo);
+        run(['commit', '-m', 'init'], repo);
+        const wt = createManagedWorktree(repo, nodeId);
+        createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+        run(['worktree', 'remove', wt.path], repo);
+        renameSync(repo, movedRepo);
+        const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+        assert.deepEqual(outcome.status === 'refused' ? outcome.reason : undefined, 'repo_unavailable');
+        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing recorded path cannot prove the worktree branch is gone');
+        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], movedRepo).status, 0, 'the moved repository still holds the managed branch');
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+        rmSync(movedRepo, { recursive: true, force: true });
+    }
+});
+test('the sweep retries containment when the base upstream advances', async () => {
+    const nodeId = 'wt-sweep-upstream-advance';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'delivered.txt'), 'delivered remotely\n');
+    run(['add', 'delivered.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'delivered work'], wt.path);
+    const refused = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(refused.status, 'refused');
+    const before = getNode(nodeId)?.managed_worktree?.sweep?.observed;
+    assert.ok(before, 'the initial refusal records the observation that caused backoff');
+    run(['push', 'origin', `${wt.branch}:main`], wt.path);
+    run(['fetch', 'origin'], sourceDir);
+    const completed = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(completed.status, 'complete', 'a newly contained branch is re-proved instead of remaining in backoff');
+    assert.equal(existsSync(wt.path), false, 'the newly contained checkout is removed');
+});
 test('the sweep refuses a managed checkout with uncommitted changes', async () => {
     const nodeId = 'wt-sweep-dirty';
     const wt = createManagedWorktree(sourceDir, nodeId);
@@ -297,6 +404,78 @@ test('autoDropCleanManagedWorktree refuses a worktree with real uncommitted chan
     assert.equal(result, null, 'real uncommitted changes must never be silently dropped');
     assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open');
 });
+test('async close returns the typed lock refusal before the client socket timeout (#1024)', async () => {
+    const nodeId = 'wt-async-close-busy';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const commonDir = realpathSync(join(sourceDir, gitSync(['rev-parse', '--git-common-dir'], sourceDir).stdout.trim()));
+    const lockModule = new URL('../../exclusive-lock.ts', import.meta.url).href;
+    const child = spawn(process.execPath, ['--import', 'tsx/esm', '--input-type=module', '--eval', `
+    const { withExclusiveDirectoryLockAsync } = await import(${JSON.stringify(lockModule)});
+    await withExclusiveDirectoryLockAsync(${JSON.stringify(worktreeLockPathForCommonDir(commonDir))}, async () => {
+      console.log('locked');
+      await new Promise((resolve) => setTimeout(resolve, 40_000));
+    });
+  `], { env: { ...process.env, CRTR_HOME: home }, stdio: ['ignore', 'pipe', 'pipe'] });
+    try {
+        await new Promise((resolve, reject) => {
+            let output = '';
+            child.stdout.on('data', (chunk) => { output += chunk; if (output.includes('locked'))
+                resolve(); });
+            child.once('error', reject);
+            child.once('exit', (code) => reject(new Error(`lock holder exited before acquiring the lock (${code})`)));
+        });
+        const server = createApiServer();
+        try {
+            await new Promise((resolve) => setTimeout(resolve, 25));
+            const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
+            const started = Date.now();
+            await assert.rejects(client.closeWorktree(nodeId), (error) => error instanceof ApiError && error.code === 'worktree_lock_timeout');
+            assert.ok(Date.now() - started < 30_000, 'the daemon must serialize the typed busy refusal before the 30s client timeout');
+        }
+        finally {
+            await server.close();
+        }
+    }
+    finally {
+        child.kill('SIGTERM');
+    }
+});
+test('async close yields while an async repository holder runs, keeping API requests responsive (#1024)', async () => {
+    const zeroId = 'wt-async-close-zero';
+    const committedId = 'wt-async-close-committed';
+    const zero = createManagedWorktree(sourceDir, zeroId);
+    const committed = createManagedWorktree(sourceDir, committedId);
+    createNode(node(zeroId, { cwd: zero.path, managed_worktree: zero }));
+    createNode(node(committedId, { cwd: committed.path, managed_worktree: committed }));
+    writeFileSync(join(committed.path, 'committed.txt'), 'work\n');
+    run(['add', 'committed.txt'], committed.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'work'], committed.path);
+    const commonDir = realpathSync(join(sourceDir, gitSync(['rev-parse', '--git-common-dir'], sourceDir).stdout.trim()));
+    let release;
+    const held = new Promise((resolve) => { release = resolve; });
+    const holder = withExclusiveDirectoryLockAsync(worktreeLockPathForCommonDir(commonDir), async () => { await held; });
+    await new Promise((resolve) => setTimeout(resolve, 25));
+    const server = createApiServer();
+    try {
+        await new Promise((resolve) => setTimeout(resolve, 25));
+        const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
+        const zeroClose = client.closeWorktree(zeroId);
+        const committedClose = client.closeWorktree(committedId);
+        const responsive = await Promise.race([client.listNodes().then(() => true), new Promise((resolve) => setTimeout(() => resolve(false), 250))]);
+        assert.equal(responsive, true, 'a waiting close must not block another daemon request');
+        release();
+        await holder;
+        const [zeroResult, committedResult] = await Promise.all([zeroClose, committedClose]);
+        assert.equal(zeroResult.landed_sha, zero.base_sha, 'the zero-commit close returns its actual result after the holder releases');
+        assert.equal(committedResult.landed_sha, gitSync(['rev-parse', 'HEAD'], committed.path).stdout.trim(), 'the committed close returns its actual landed result after the holder releases');
+    }
+    finally {
+        release();
+        await holder;
+        await server.close();
+    }
+});
 test('abandon preserves committed and dirty work, records its retained tip, and releases finalization', async () => {
     const nodeId = 'wt-abandon';
     const wt = createManagedWorktree(sourceDir, nodeId);

package/dist/core/__tests__/kickoff.test.js

@@ -62,6 +62,46 @@ test('drainBearings preserves the yield note until explicit boot confirmation',
     assert.equal(readYieldMessage(id), null, 'confirmation clear is idempotent');
     assert.equal(existsSync(yieldMessagePath(id)), false, 'confirmed handoff removes the note');
 });
+test('fresh kickoff keeps each inbox card directly before its own message', () => {
+    const id = 'ordered-cards';
+    const meta = createNode(node(id));
+    appendInbox(id, {
+        from: 'sender',
+        tier: 'normal',
+        kind: 'message',
+        label: 'FIRST-BODY',
+        data: { body: 'FIRST-BODY', cards: ['<runtime kind="test-card">FIRST-CARD</runtime>'] },
+    });
+    appendInbox(id, {
+        from: 'sender',
+        tier: 'normal',
+        kind: 'message',
+        label: 'SECOND-BODY',
+        data: { body: 'SECOND-BODY', cards: ['<runtime kind="test-card">SECOND-CARD</runtime>'] },
+    });
+    for (const body of ['GROUPED-BODY-1', 'GROUPED-BODY-2', 'GROUPED-BODY-3']) {
+        appendInbox(id, {
+            from: 'card-free-sender',
+            tier: 'normal',
+            kind: 'message',
+            label: body,
+            data: { body },
+        });
+    }
+    const kickoff = buildReviveKickoff(meta, drainBearings(meta));
+    const firstCard = kickoff.indexOf('FIRST-CARD');
+    const firstBody = kickoff.indexOf('FIRST-BODY');
+    const secondCard = kickoff.indexOf('SECOND-CARD');
+    const secondBody = kickoff.indexOf('SECOND-BODY');
+    assert.ok(firstCard >= 0 && firstCard < firstBody, 'the first card stays ahead of its own message');
+    assert.ok(firstBody < secondCard, 'the second card cannot leap ahead of the first message');
+    assert.ok(secondCard < secondBody, 'the second card stays ahead of its own message');
+    const groupedSections = kickoff.match(/<from id="card-free-sender">([\s\S]*?)<\/from>/g) ?? [];
+    assert.equal(groupedSections.length, 1, 'card-free entries from one sender remain one delivery');
+    for (const body of ['GROUPED-BODY-1', 'GROUPED-BODY-2', 'GROUPED-BODY-3']) {
+        assert.ok(groupedSections[0].includes(body), `${body} remains in the sender's single delivery`);
+    }
+});
 test('drainBearings leaves persona drift pending until the replacement context exists', () => {
     const oldPersona = { kind: 'developer', mode: 'base', lifecycle: 'terminal' };
     const meta = createNode(node('pending-persona', {

package/dist/core/__tests__/parse-argv-stdin-secret.test.js

@@ -23,6 +23,9 @@ const PROFILE_SET_SHAPED_PARAMS = [
     { kind: 'flag', name: 'name', type: 'string', required: true, constraint: 'var name' },
     { kind: 'stdin', name: 'value', required: true, constraint: 'value piped on stdin' },
 ];
+const STRING_FLAG_PARAMS = [
+    { kind: 'flag', name: 'arg', type: 'string', required: true, constraint: 'argument' },
+];
 test('a lone positional supplies the stdin body on a leaf declaring no positional param', async () => {
     const result = await parseArgv(YIELD_SHAPED_PARAMS, ['refresh against the original goal']);
     assert.equal(result['message'], 'refresh against the original goal');
@@ -42,6 +45,17 @@ test('allowPositional:false keeps a stdin-only leaf rejecting positionals by ari
         return true;
     });
 });
+test('a value bound with = may start with --', async () => {
+    const result = await parseArgv(STRING_FLAG_PARAMS, ['--arg=--help']);
+    assert.equal(result['arg'], '--help');
+});
+test('a separate flag value starting with -- is rejected as missing', async () => {
+    await assert.rejects(() => parseArgv(STRING_FLAG_PARAMS, ['--arg', '--help']), (err) => {
+        assert.equal(err.code, 'missing_parameter');
+        assert.equal(err.message, '--arg requires a value');
+        return true;
+    });
+});
 test('an extra positional on a stdin-bearing leaf is rejected without echoing it', async () => {
     const secret = 'SUPERSECRET_ARGV';
     await assert.rejects(() => parseArgv(PROFILE_SET_SHAPED_PARAMS, ['some-profile', secret, '--name', 'REVIEW_TOKEN']), (err) => {

package/dist/core/__tests__/seam/broker-attach-stream.test.js

@@ -161,3 +161,16 @@ test('G3 — a deliver whose prompt rejects acks ok:false and records deliver_fa
     assert.equal(okAck.type === 'ack' && okAck.ok, true, 'G3: an accepted prompt acks delivered:true');
     assert.equal(okAck.type === 'ack' ? okAck.detail : undefined, 'prompt');
 });
+// A message_end is only a broker/viewer relay. It must not depend on a daemon
+// read: a daemon outage after boot leaves tool results and the run settlement intact.
+test('G4 — a daemon read failure after boot does not interrupt a tool result or its settlement', async () => {
+    const c = await ctrl('g4-ctrl');
+    const pid = brokerPid();
+    await h.stopApiServer();
+    const token = tok('G4-TOOL-RESULT');
+    h.fakeCmd(id, { cmd: 'stream', text: token, updates: 0 });
+    await c.waitFrame((f) => f.type === 'tool_execution_end', 'G4 tool result relayed after the daemon server exits');
+    await c.waitFrame((f) => f.type === 'agent_settled', 'G4 run settles after the daemon server exits');
+    await delay(200);
+    assert.equal(isPidAlive(pid), true, 'G4: broker remains alive after relaying and settling the tool result');
+});

package/dist/core/__tests__/seam/broker-provider-retry.test.js

@@ -117,6 +117,31 @@ after(async () => {
 afterEach(() => {
     kit.closeAll();
 });
+test('a normalized 503 survives into a durable provider fault and re-drives the turn', { timeout: 30_000 }, async () => {
+    const parent = h.spawnRoot('structured provider failure parent');
+    seedPool('anthropic', false);
+    seedPool('openai-codex', false);
+    const child = await h.spawnHeadlessChild(parent, 'structured provider failure', { model: OPENAI_STRONG.spec });
+    await h.waitFor(() => agentStartCount(child) >= 1, { label: 'initial structured-failure fixture turn started' });
+    const baselineStarts = agentStartCount(child);
+    h.fakeCmd(child, {
+        cmd: 'stop',
+        reason: 'error',
+        errorMessage: 'Request failed',
+        providerFailure: { status: 503 },
+    });
+    const fault = await h.waitFor(() => {
+        const current = readFault(child);
+        return current?.kind === 'overloaded' && current.retry.disposition === 'auto' ? current : undefined;
+    }, { label: 'structured 503 published as an automatic provider fault' });
+    assert.equal(fault.providerError?.provider, OPENAI_STRONG.model.provider);
+    assert.equal(fault.providerError?.model, OPENAI_STRONG.model.id);
+    assert.equal(fault.providerError?.status, 503);
+    await h.waitFor(() => agentStartCount(child) >= baselineStarts + 1, {
+        label: 'structured 503 automatic recovery turn started',
+    });
+    await h.waitFor(() => readFault(child) === null, { label: 'successful recovery clears the structured provider fault' });
+});
 test('a managed-cooling terminal authors a rate-limit auto fault whose deadline drives exactly one broker re-drive', { timeout: 30_000 }, async () => {
     const parent = h.spawnRoot('cooling terminal parent');
     // The terminal fault path is pool-independent — the stophook classifies purely

package/dist/core/__tests__/seam/broker-startup-diagnostics.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/seam/broker-startup-diagnostics.test.js

@@ -0,0 +1,82 @@
+// Run with: npm run build && node --test --test-timeout=180000 dist/core/__tests__/seam/broker-startup-diagnostics.test.js
+//
+// A refused broker launch, a broker fatal emitted before session_start, and a
+// SIGKILL all surface through canonical diagnostics. broker.log remains raw
+// stdout/stderr residue, so a canonical fatal need not write anything there.
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { subscribe } from '../../canvas/canvas.js';
+import { resolveRef } from '../../canvas/history.js';
+import { readLogSnapshot } from '../../events/read.js';
+import { spawnChild } from '../../runtime/spawn.js';
+import { FAIL_BEFORE_SESSION_START } from '../fixtures/fake-engine.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+let h;
+let root;
+function eventsFor(nodeId) {
+    return readLogSnapshot({ nodeId }, false).items.flatMap((item) => item.kind === 'event' ? [item.envelope] : []);
+}
+function reportBody(entry) {
+    assert.ok(entry.ref, 'the boot-failure notification has a report reference');
+    const report = resolveRef(entry.ref);
+    assert.ok(report, 'the boot-failure notification report resolves');
+    return report.body;
+}
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-broker-startup-diagnostics' });
+    root = h.spawnRoot('broker startup diagnostics seam root');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+test('broker startup failures name canonical diagnostics, preserve launch errors, and report the observed exit status', { timeout: 60_000 }, async () => {
+    const refusedId = 'launch-refused';
+    const missingCwd = join(h.home, 'missing-cwd');
+    await assert.rejects(spawnChild({
+        kind: 'general',
+        cwd: missingCwd,
+        prompt: 'this launch must be refused by the operating system',
+        parent: root,
+        nodeId: refusedId,
+    }), (error) => {
+        const details = error.details;
+        assert.match(String(details?.next), new RegExp(`crtr sys logs --node ${refusedId}`));
+        return true;
+    });
+    const launchFailure = await h.waitFor(() => eventsFor(refusedId).find((event) => event.event === 'broker.launch.failed') ?? null, { label: 'canonical launch refusal' });
+    assert.match(launchFailure.error?.message ?? '', /ENOENT/, 'the canonical event preserves the operating-system launch error');
+    const refusedLog = join(h.home, 'nodes', refusedId, 'job', 'broker.log');
+    assert.equal(existsSync(refusedLog), true, 'the raw broker log exists for the refused launch');
+    assert.equal(readFileSync(refusedLog, 'utf8'), '', 'a launch refusal writes its diagnostic canonically, not as raw broker output');
+    const fatal = await spawnChild({
+        kind: 'general',
+        cwd: h.node(root).cwd,
+        prompt: `canonical fatal ${FAIL_BEFORE_SESSION_START}`,
+        parent: root,
+    });
+    const fatalId = fatal.node.node_id;
+    await h.awaitFleetExit(fatalId);
+    await h.tick();
+    const fatalEvent = eventsFor(fatalId).find((event) => event.event === 'broker.runtime.fatal');
+    assert.ok(fatalEvent, 'a pre-session broker fatal is available in canonical node diagnostics');
+    assert.match(fatalEvent.error?.message ?? '', /simulated pre-session_start boot failure/);
+    const fatalLog = join(h.home, 'nodes', fatalId, 'job', 'broker.log');
+    assert.equal(readFileSync(fatalLog, 'utf8'), '', 'a successfully emitted canonical fatal leaves raw broker.log empty');
+    const fatalNotice = h.inbox(root).find((entry) => entry.from === fatalId && entry.tier === 'urgent');
+    assert.ok(fatalNotice, 'the parent receives the fatal broker boot-failure notification');
+    assert.match(reportBody(fatalNotice), /code 1, signal null/);
+    assert.match(reportBody(fatalNotice), new RegExp(`crtr sys logs --node ${fatalId}`));
+    const exited = spawnSync(process.execPath, ['-e', ''], { stdio: 'ignore' });
+    assert.ok(exited.pid !== undefined, 'the fabricated boot failure has a recorded, dead pid');
+    const killedId = h.fabricateBrokerNode({ id: 'killed-before-session', parent: root, pi_pid: exited.pid });
+    subscribe(root, killedId, true);
+    await h.deliverExit(killedId, { code: null, signal: 'SIGKILL' });
+    await h.tick();
+    const killNotice = h.inbox(root).find((entry) => entry.from === killedId && entry.tier === 'urgent');
+    assert.ok(killNotice, 'the parent receives the SIGKILL boot-failure notification');
+    assert.match(reportBody(killNotice), /code null, signal SIGKILL/);
+});

package/dist/core/__tests__/seam/deadline-wake-delivery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/seam/deadline-wake-delivery.test.js

@@ -0,0 +1,138 @@
+// Run with: npm run build && node --test --test-timeout=180000 dist/core/__tests__/seam/deadline-wake-delivery.test.js
+//
+// Pins the compiled deadline command: self-cancel cleanup runs before its urgent
+// inbox wake, but a nonzero cleanup result cannot suppress that durable wake.
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { getCron } from '../../canvas/crons.js';
+import { ensureRootProfile } from '../../profiles/manifest.js';
+import { executeCron } from '../../../daemon/cron-run.js';
+import { createHeadlessHarness } from '../helpers/harness.js';
+let h;
+let root;
+let fakeBin;
+let journal;
+let argsPath;
+let bodyPath;
+let cancelCodePath;
+let sendCodePath;
+let savedPath;
+let savedProfileId;
+let profileId;
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function writeFakeFrontDoor() {
+    writeFileSync(join(fakeBin, 'crtr'), `#!/bin/sh
+journal=${shellQuote(journal)}
+args=${shellQuote(argsPath)}
+body=${shellQuote(bodyPath)}
+cancel_code=${shellQuote(cancelCodePath)}
+send_code=${shellQuote(sendCodePath)}
+
+if [ "$1" = cron ] && [ "$2" = cancel ]; then
+  printf '%s\\n' cancel >> "$journal"
+  ${shellQuote(process.execPath)} --input-type=module -e ${shellQuote(`import { cancelCron } from ${JSON.stringify(join(process.cwd(), 'dist', 'core', 'canvas', 'crons.js'))}; cancelCron(process.argv[1], { preserveRunningProcess: true });`)} "$3" || exit $?
+  code=$(cat "$cancel_code")
+  if [ "$code" -ne 0 ]; then
+    printf '%s\\n' 'cancel failed' >&2
+  fi
+  exit "$code"
+fi
+
+if [ "$1" = node ] && [ "$2" = message ]; then
+  printf '%s\\n' message >> "$journal"
+  printf '%s\\n' "$@" > "$args"
+  cat > "$body"
+  code=$(cat "$send_code")
+  if [ "$code" -ne 0 ]; then
+    printf '%s\\n' 'send failed' >&2
+    exit "$code"
+  fi
+  exec ${shellQuote(process.execPath)} ${shellQuote(join(process.cwd(), 'dist', 'cli.js'))} "$@" < "$body"
+fi
+
+printf '%s\\n' unexpected >> "$journal"
+exit 99
+`, { mode: 0o755 });
+    chmodSync(join(fakeBin, 'crtr'), 0o755);
+}
+async function armDeadline(body) {
+    const target = await h.spawnHeadlessChild(root, 'deadline target', { profile: profileId });
+    const armed = h.cli(target, ['--json', 'node', 'wait', 'deadline', body, '--until', '1m']);
+    assert.equal(armed.code, 0, `node wait deadline: ${armed.stderr}`);
+    const id = armed.json?.id;
+    assert.equal(typeof id, 'string', 'the compiled deadline CLI returns its cron id');
+    const cron = getCron(id);
+    assert.notEqual(cron, null, 'the compiled deadline CLI persisted its cron command');
+    return { target, cron: cron };
+}
+async function runDeadline(cancelCode, sendCode, body) {
+    writeFileSync(journal, '');
+    writeFileSync(argsPath, '');
+    writeFileSync(bodyPath, '');
+    writeFileSync(cancelCodePath, String(cancelCode));
+    writeFileSync(sendCodePath, String(sendCode));
+    const { target, cron } = await armDeadline(body);
+    process.env['PATH'] = `${fakeBin}:${savedPath ?? ''}`;
+    try {
+        const record = await executeCron(cron, { outOfBand: false });
+        return { target, record: record ?? null };
+    }
+    finally {
+        if (savedPath === undefined)
+            delete process.env['PATH'];
+        else
+            process.env['PATH'] = savedPath;
+    }
+}
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-deadline-wake' });
+    profileId = ensureRootProfile().profileId;
+    savedProfileId = process.env['CRTR_PROFILE_ID'];
+    process.env['CRTR_PROFILE_ID'] = profileId;
+    root = h.spawnRoot('deadline wake seam root');
+    fakeBin = mkdtempSync(join(tmpdir(), 'crtr-deadline-front-door-'));
+    journal = join(fakeBin, 'journal');
+    argsPath = join(fakeBin, 'args');
+    bodyPath = join(fakeBin, 'body');
+    cancelCodePath = join(fakeBin, 'cancel-code');
+    sendCodePath = join(fakeBin, 'send-code');
+    writeFakeFrontDoor();
+    savedPath = process.env['PATH'];
+});
+after(async () => {
+    if (savedPath === undefined)
+        delete process.env['PATH'];
+    else
+        process.env['PATH'] = savedPath;
+    if (savedProfileId === undefined)
+        delete process.env['CRTR_PROFILE_ID'];
+    else
+        process.env['CRTR_PROFILE_ID'] = savedProfileId;
+    rmSync(fakeBin, { recursive: true, force: true });
+    if (h !== undefined)
+        await h.dispose();
+});
+test('compiled deadline wakes once after cancel failure, retains cancel-first ordering, and propagates send failure', { timeout: 60_000 }, async () => {
+    const failedCancelBody = 'deadline wake after failed cancel\nbody remains intact';
+    const failedCancel = await runDeadline(2, 0, failedCancelBody);
+    assert.equal(failedCancel.record?.exit_code, 0, 'a successful send is the cron command result after failed cleanup');
+    assert.match(failedCancel.record?.stderr_head ?? '', /cancel failed/, 'cancel diagnostics remain on stderr');
+    assert.deepEqual(readFileSync(journal, 'utf8').trim().split('\n'), ['cancel', 'message'], 'cancel runs before exactly one message send');
+    assert.deepEqual(readFileSync(argsPath, 'utf8').trim().split('\n'), ['node', 'message', 'send', '--to', failedCancel.target, '--tier', 'urgent'], 'the generated urgent send receives its target and tier');
+    assert.equal(readFileSync(bodyPath, 'utf8'), `${failedCancelBody}\n`, 'the generated heredoc body reaches the front door byte-for-byte');
+    await h.awaitWake(failedCancel.target, { match: /deadline wake after failed cancel/ });
+    assert.ok(h.inbox(failedCancel.target).some((entry) => entry.tier === 'urgent' && entry.data?.['body'] === failedCancelBody), 'the successful send durably appends the urgent deadline message to the target inbox');
+    const successfulCancel = await runDeadline(0, 0, 'deadline wake after successful cancel');
+    assert.equal(successfulCancel.record?.exit_code, 0, 'the ordinary successful-cancel path still succeeds');
+    assert.deepEqual(readFileSync(journal, 'utf8').trim().split('\n'), ['cancel', 'message'], 'successful cleanup also precedes one message send');
+    await h.awaitWake(successfulCancel.target, { match: /deadline wake after successful cancel/ });
+    const failedSend = await runDeadline(2, 23, 'deadline send failure');
+    assert.equal(failedSend.record?.exit_code, 23, 'the final message-send status remains the cron failure status');
+    assert.match(failedSend.record?.stderr_head ?? '', /cancel failed[\s\S]*send failed/, 'both cleanup and send diagnostics remain visible');
+    assert.deepEqual(readFileSync(journal, 'utf8').trim().split('\n'), ['cancel', 'message'], 'a failed send is still attempted once after failed cleanup');
+});

package/dist/core/__tests__/seam/reopen-invalidated-worktree.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/seam/reopen-invalidated-worktree.test.js

@@ -0,0 +1,60 @@
+// Run with: npm run build && node --test --test-timeout=180000 dist/core/__tests__/seam/reopen-invalidated-worktree.test.js
+//
+// Regression for #1070 and #1064: a completed managed-worktree node loses its
+// session when the worktree closes. Atomic message reopen must start from the
+// retained final report and the new instruction, never replay its birth goal.
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHeadlessHarness } from '../helpers/harness.js';
+import { pushFinal } from '../../feed/feed.js';
+import { persistClosedWorktreeState } from '../../worktree.js';
+import { readGoal } from '../../runtime/kickoff.js';
+let h;
+before(async () => {
+    h = await createHeadlessHarness({ sessionPrefix: 'crtr-reopen-invalidated-worktree' });
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+test('atomic message reopen of a closed worktree starts fresh from the prior final and follow-up, not the birth goal', { timeout: 30_000 }, async () => {
+    const root = h.spawnRoot('reopen invalidated-worktree manager');
+    const originalGoal = 'ORIGINAL-MANDATE: do not replay this completed implementation task';
+    const followUp = 'FOLLOW-UP-MANDATE: inspect the completed work without changing it';
+    const child = await h.spawnHeadlessChild(root, originalGoal);
+    await pushFinal(child, 'COMPLETED-FINAL: the original implementation is complete');
+    const finalReport = h.node(child)?.final_report;
+    assert.ok(finalReport, 'the completed worker has a canonical final report');
+    const finalPath = join(h.home, 'nodes', child, 'reports', finalReport);
+    assert.equal(existsSync(finalPath), true, 'the canonical final exists before reopening');
+    persistClosedWorktreeState(child, {
+        state: 'open',
+        path: join(h.home, 'removed-worktree'),
+        branch: 'crtr/reopen-invalidated-worktree',
+        repo_root: process.cwd(),
+        base_ref: 'main',
+        base_sha: 'test',
+        created: new Date().toISOString(),
+    });
+    assert.equal(h.node(child)?.pi_session_file ?? null, null, 'closed worktree invalidates the old session coordinate');
+    const oldPid = h.node(child)?.pi_pid;
+    assert.ok(oldPid != null, 'the original broker is still live until its completed turn exits');
+    process.kill(oldPid, 'SIGKILL');
+    await h.awaitFleetExit(child);
+    const result = h.cli(root, ['node', 'message', 'send', '--to', child, '--reopen', followUp]);
+    assert.equal(result.code, 0, `atomic reopen message should succeed\n--stderr--\n${result.stderr}`);
+    const boot = await h.awaitBoot(child, { minCount: 2 });
+    assert.equal(boot.resuming, false, 'the cleared session forces a fresh broker boot');
+    assert.equal(boot.prompt?.includes(originalGoal), false, 'a completed node never replays its birth mandate');
+    const priorFinalIndex = boot.prompt?.indexOf('reopen-final-report') ?? -1;
+    const followUpIndex = boot.prompt?.indexOf(followUp) ?? -1;
+    assert.ok(priorFinalIndex >= 0 && boot.prompt?.includes(finalPath), 'the prior final report path is delivered as context');
+    assert.ok(followUpIndex >= 0, 'the new instruction is delivered in the fresh kickoff');
+    assert.ok(priorFinalIndex < followUpIndex, 'the prior final report context arrives before the new instruction');
+    assert.equal(readGoal(child)?.trim(), originalGoal, 'the birth goal remains on disk as historical data');
+    assert.equal(existsSync(finalPath), true, 'reopen does not delete the prior final report');
+    assert.equal(h.node(child)?.lifecycle, 'resident', 'atomic reopen restores resident lifecycle before the fresh broker starts');
+    assert.equal(h.node(child)?.final_report ?? null, null, 'atomic reopen clears only the live finalization latch');
+});