@north-light/crouter 0.3.311 → 0.3.313

package/dist/commands/sys/config.js

@@ -1,8 +1,11 @@
 import { defineBranch, defineLeaf } from '../../core/command.js';
-import { readConfig, updateConfig, persistModelLadders, configPath as coreConfigPath } from '../../core/config.js';
+import { InvalidRawSettingsError, readConfig, readRawSettingsForTarget, replaceRawSettingsForTarget, updateConfig, persistModelLadders, configPath as coreConfigPath } from '../../core/config.js';
 import { usage, notFound } from '../../core/errors.js';
-import { scopeRoot, requireScopeRoot, listScopes } from '../../core/scope.js';
+import { requireScopeRoot } from '../../core/scope.js';
 import { resolveScope } from './shared.js';
+import { resolveProfileOperand } from '../../core/profiles/manifest.js';
+import { SettingsRevisionConflictError } from '../../core/scoped-state/settings.js';
+import { InputError } from '../../core/io.js';
 import { SCOPE_CONFIG_KEYS, USER_SETTINGS, findUserSetting } from '../../core/user-settings.js';
 // Config helpers (ported from commands/config.ts)
 const CONFIG_TOP_LEVEL_HELP = SCOPE_CONFIG_KEYS.join(', ');
@@ -90,6 +93,34 @@ function modelLadderPatch(key, rawValue) {
     }
     throw usage(`unsupported key path for set: ${key}`);
 }
+function rawSettingsTarget(input) {
+    const scope = input['scope'];
+    if (scope === 'project') {
+        throw usage('project settings remain a JSON file; use `crtr sys config set` or `crtr sys config path --scope project`.');
+    }
+    const profile = input['profile'];
+    if (scope === 'user') {
+        if (profile !== undefined)
+            throw usage('--profile is available only with --scope profile.');
+        return { scope: 'user' };
+    }
+    if (profile === undefined)
+        throw usage('--profile is required with --scope profile.');
+    return { scope: 'profile', profileId: resolveProfileOperand(profile).profileId };
+}
+function parseRawSettings(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new InputError({ error: 'invalid_request', message: 'stdin must be valid JSON', field: 'stdin', next: 'Pipe one complete JSON object on stdin.' });
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new InputError({ error: 'invalid_request', message: 'stdin must be a JSON object', field: 'stdin', next: 'Pipe one complete JSON object on stdin.' });
+    }
+    return value;
+}
 function setNestedValue(cfg, key, rawValue, value) {
     const parts = key.split('.');
     const topKey = parts[0];
@@ -193,7 +224,7 @@ const configSet = defineLeaf({
         name: 'sys config set',
         summary: 'write a config value by dotted key',
         params: [
-            { kind: 'positional', name: 'key', type: 'string', required: true, constraint: `Dotted key path. User-scope scalar settings: ${SCALAR_SETTING_HELP}. Also supported: working_gerunds and whip_messages (non-empty JSON string arrays), brokerThresholds.warning and brokerThresholds.automaticReviveCap (user scope; integer >= 1), lifecycle.unattendedParkMs (user scope; integer ms >= 1), modelLadders.defaultProvider, and modelLadders.<anthropic|openai>.<ultra|strong|medium|light>. Keybindings are edited only through sys settings. humanActions is an object map edited directly in ~/.crouter/config.json or <repo>/.crouter/config.json.` },
+            { kind: 'positional', name: 'key', type: 'string', required: true, constraint: `Dotted key path. User-scope scalar settings: ${SCALAR_SETTING_HELP}. Also supported: working_gerunds and whip_messages (non-empty JSON string arrays), brokerThresholds.warning and brokerThresholds.automaticReviveCap (user scope; integer >= 1), lifecycle.unattendedParkMs (user scope; integer ms >= 1), modelLadders.defaultProvider, and modelLadders.<anthropic|openai>.<ultra|strong|medium|light>. Keybindings are edited only through sys settings. For arbitrary raw user or profile documents, use sys config get-raw and set-raw.` },
             { kind: 'flag', name: 'value', type: 'string', required: true, constraint: 'value VALUE — string, required. working_gerunds and whip_messages accept JSON arrays; other values are stored as-is if quoted and coerced to number or boolean when unambiguous.' },
             { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'project'], required: false, constraint: 'Scope to write to. Default: user. Project scope is supported only for modelLadders.' },
         ],
@@ -202,7 +233,7 @@ const configSet = defineLeaf({
             { name: 'scope', type: 'string', required: true, constraint: 'Scope the value was written to.' },
         ],
         outputKind: 'object',
-        effects: ['Writes the updated value to config.json in the target scope.'],
+        effects: ['Writes the updated value through the target scope’s configuration storage.'],
     },
     run: async (input) => {
         const key = input['key'];
@@ -227,54 +258,96 @@ const configSet = defineLeaf({
         return { value: written, scope };
     },
 });
+const configGetRaw = defineLeaf({
+    name: 'get-raw',
+    description: 'read one raw SQL-backed settings document and revision',
+    whenToUse: 'you need the exact stored user or profile settings document before replacing it with set-raw.',
+    help: {
+        name: 'sys config get-raw',
+        summary: 'read one raw user or profile settings document',
+        params: [
+            { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'profile', 'project'], required: true, constraint: 'SQL-backed target: user or profile. project is rejected because its settings remain a JSON file.' },
+            { kind: 'flag', name: 'profile', type: 'string', required: false, constraint: 'Profile id or name to target. Required with --scope profile; rejected with --scope user or project.' },
+        ],
+        output: [
+            { name: 'revision', type: 'string', required: true, constraint: 'Opaque revision token for set-raw. absent means the settings row does not exist.' },
+            { name: 'settings', type: 'object | null', required: true, constraint: 'Exact stored settings document, or null when no row exists.' },
+        ],
+        outputKind: 'object',
+        effects: ['None. Read-only.'],
+    },
+    run: async (input) => readRawSettingsForTarget(rawSettingsTarget(input)),
+});
+const configSetRaw = defineLeaf({
+    name: 'set-raw',
+    description: 'replace one raw SQL-backed settings document at a revision',
+    whenToUse: 'you have a complete user or profile settings document from get-raw and must replace it without losing a concurrent change.',
+    help: {
+        name: 'sys config set-raw',
+        summary: 'atomically replace one raw user or profile settings document',
+        params: [
+            { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'profile', 'project'], required: true, constraint: 'SQL-backed target: user or profile. project is rejected because its settings remain a JSON file.' },
+            { kind: 'flag', name: 'profile', type: 'string', required: false, constraint: 'Profile id or name to target. Required with --scope profile; rejected with --scope user or project.' },
+            { kind: 'flag', name: 'if-revision', type: 'string', required: true, constraint: 'Revision returned by get-raw. Required; use absent only when get-raw reported no settings row.' },
+            { kind: 'stdin', name: 'settings', required: true, allowPositional: false, constraint: 'One complete JSON object. It replaces the document exactly; values are not normalized or merged.' },
+        ],
+        output: [
+            { name: 'revision', type: 'string', required: true, constraint: 'Revision token of the stored document after this operation.' },
+            { name: 'changed', type: 'boolean', required: true, constraint: 'Whether the stored document changed.' },
+        ],
+        outputKind: 'object',
+        effects: ['Atomically replaces the SQL-backed settings document only when --if-revision matches its current revision.'],
+    },
+    run: async (input) => {
+        const target = rawSettingsTarget(input);
+        const settings = parseRawSettings(input['settings']);
+        try {
+            return replaceRawSettingsForTarget(target, settings, input['ifRevision']);
+        }
+        catch (error) {
+            if (error instanceof SettingsRevisionConflictError) {
+                throw new InputError({ error: 'settings_revision_conflict', message: 'settings changed since the supplied revision', field: 'if_revision', next: 'Run `crtr sys config get-raw` again, reapply the intended transformation, and retry with its revision.' });
+            }
+            if (error instanceof InvalidRawSettingsError) {
+                throw new InputError({ error: 'invalid_settings', message: error.message, field: 'stdin', next: 'Correct the document so crouter can merge it into resolved settings, then retry with a fresh revision.' });
+            }
+            throw error;
+        }
+    },
+});
 const configPath = defineLeaf({
     name: 'path',
-    description: 'print path(s) to config.json',
-    whenToUse: 'you need the absolute path to a user or project config.json for inspection or backup.',
+    description: 'print the project config.json path',
+    whenToUse: 'you need the project config.json path for inspection or backup. User and profile settings use get-raw and set-raw instead.',
     help: {
         name: 'sys config path',
-        summary: 'print absolute path(s) to config.json',
+        summary: 'print the project config.json path',
         params: [
-            { kind: 'flag', name: 'scope', type: 'enum', choices: ['user', 'project', 'all'], required: false, constraint: 'Scope to show paths for. Default: all.' },
+            { kind: 'flag', name: 'scope', type: 'enum', choices: ['project', 'user', 'profile'], required: false, constraint: 'Project is the only path-backed settings scope. user and profile are rejected because they use SQL-backed get-raw and set-raw. Default: project.' },
         ],
         output: [
-            { name: 'paths', type: 'object[]', required: true, constraint: 'Each: {scope, path}. Only includes scopes that have a config file.' },
+            { name: 'paths', type: 'object[]', required: true, constraint: 'One {scope: "project", path} entry when the current project has a config file; otherwise empty.' },
         ],
         outputKind: 'object',
         effects: ['None. Read-only.'],
     },
     run: async (input) => {
-        const scopeArg = input['scope'];
-        // Resolve 'all' or undefined → all writable scopes
-        let scopes;
-        if (scopeArg === undefined || scopeArg === 'all') {
-            scopes = listScopes(undefined);
-        }
-        else {
-            scopes = listScopes(scopeArg);
+        const scope = input['scope'];
+        if (scope === 'user' || scope === 'profile') {
+            throw usage(`${scope} settings are SQL-backed; use \`crtr sys config get-raw --scope ${scope}\` instead.`);
         }
-        const paths = scopes
-            .map((s) => {
-            const root = scopeRoot(s);
-            if (!root)
-                return null;
-            const p = coreConfigPath(s);
-            if (!p)
-                return null;
-            return { scope: s, path: p };
-        })
-            .filter((x) => x !== null);
-        return { paths };
+        const path = coreConfigPath('project');
+        return { paths: path === null ? [] : [{ scope: 'project', path }] };
     },
 });
 export const configBranch = defineBranch({
     name: 'config',
     description: 'read and write configuration',
-    whenToUse: 'inspecting crtr settings, changing supported scalar values, or locating config.json. Keybinding changes belong in sys settings.',
+    whenToUse: 'inspecting crtr settings, changing supported scalar values, replacing complete raw user or profile settings documents, or locating a project config.json. Keybinding changes belong in sys settings.',
     help: {
         name: 'sys config',
-        summary: 'read and write crtr configuration, including model ladders; edit humanActions maps directly in ~/.crouter/config.json or <repo>/.crouter/config.json',
-        model: 'Configuration resolves through ordered scopes. Reads can resolve the effective value, writes target one writable scope, and path inspection reveals the backing files without reading values.',
+        summary: 'read and write crtr configuration, including model ladders and raw SQL-backed user/profile settings',
+        model: 'get and set resolve individual settings. get-raw and set-raw read and replace complete user or profile documents with a revision precondition. path applies only to project config.json.',
     },
-    children: [configGet, configSet, configPath],
+    children: [configGet, configSet, configGetRaw, configSetRaw, configPath],
 });

package/dist/commands/sys/daemon.d.ts

@@ -1,2 +1,4 @@
 import type { BranchDef } from '../../core/command.js';
 export declare const daemonBranch: BranchDef;
+/** The daemon-only `sys` subtree used before scoped user state is available. */
+export declare function registerDaemonControlSys(): BranchDef;

package/dist/commands/sys/daemon.js

@@ -8,9 +8,12 @@
 // This subtree starts, checks, and stops the daemon process.
 import { defineLeaf, defineBranch } from '../../core/command.js';
 import { InputError } from '../../core/io.js';
-import { probeDaemonServing, spawnDaemon, stopDaemonProcess, sweepStrayDaemons } from '../../daemon/manage.js';
+import { parseDurationMs } from '../../core/wake.js';
+import { DaemonNotPreparedError, probeDaemonHealth, spawnDaemon, stopDaemonProcess, sweepStrayDaemons } from '../../daemon/manage.js';
 import { isDaemonRunning, readPidfile, isPidAlive } from '../../daemon/pidfile.js';
 import { cliClient } from '../api-client.js';
+import { CrtrClient } from '../../api/index.js';
+import { defineSysBranch } from './branch.js';
 // daemon start
 const daemonStart = defineLeaf({
     name: 'start',
@@ -19,7 +22,9 @@ const daemonStart = defineLeaf({
     help: {
         name: 'sys daemon start',
         summary: 'start the crtrd supervisor daemon in the background (no-op only if its Unix API socket serves)',
-        params: [],
+        params: [
+            { kind: 'flag', name: 'prepare', type: 'bool', required: false, constraint: 'Hold normal daemon work after storage preparation until `sys daemon admit`; omit for ordinary startup.' },
+        ],
         output: [
             { name: 'started', type: 'boolean', required: true, constraint: 'True when a new daemon process was spawned; false when one was already running.' },
             { name: 'pid', type: 'number', required: false, constraint: 'PID of the newly spawned daemon.' },
@@ -27,6 +32,7 @@ const daemonStart = defineLeaf({
             { name: 'running', type: 'boolean', required: false, constraint: 'True only when a live pidfile owner does not serve its Unix API socket.' },
             { name: 'serving', type: 'boolean', required: false, constraint: 'False only when a live pidfile owner does not answer /healthz.' },
             { name: 'probe_error', type: 'string', required: false, constraint: 'The final /healthz probe failure when a live owner missed readiness.' },
+            { name: 'startup_phase', type: 'string', required: false, constraint: 'The observed daemon phase when it was reachable.' },
         ],
         outputKind: 'object',
         effects: [
@@ -34,9 +40,116 @@ const daemonStart = defineLeaf({
             'Writes a pidfile at CRTR_PIDFILE if set, otherwise crtrHome()/crtrd.pid.'
         ],
     },
+    run: async (input) => {
+        try {
+            const result = await spawnDaemon({ targetPhase: input.prepare === true ? 'prepared' : 'ready' });
+            return result;
+        }
+        catch (error) {
+            if (error instanceof DaemonNotPreparedError) {
+                throw new InputError({
+                    error: 'daemon_not_prepared',
+                    message: error.message,
+                    next: 'Stop the live daemon, then start a new one with `crtr sys daemon start --prepare` before setup.',
+                });
+            }
+            throw error;
+        }
+    },
+});
+// daemon await / admit
+const DAEMON_AWAIT_POLL_MS = 100;
+async function awaitDaemonPhase(phase, timeoutMs) {
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutMs;
+    let lastPhase = 'initializing';
+    let lastObservation = 'the daemon socket was not reachable';
+    while (Date.now() < deadline) {
+        try {
+            const health = await probeDaemonHealth(Math.min(1_000, Math.max(1, deadline - Date.now())));
+            lastPhase = health.startup_phase;
+            lastObservation = health.startup_blocked ?? `daemon is ${health.startup_phase}`;
+            if (health.startup_phase === 'blocked') {
+                throw new InputError({
+                    error: 'startup_blocked',
+                    message: health.startup_blocked ?? 'daemon startup is blocked',
+                    received: health.startup_phase,
+                    field: 'phase',
+                    next: 'Repair the reported blocker paths with `crtr sys migrate`, then retry the await.',
+                });
+            }
+            if (health.startup_phase === phase)
+                return { startup_phase: phase, waited_ms: Date.now() - startedAt };
+            if (phase === 'prepared' && health.startup_phase === 'ready') {
+                throw new InputError({
+                    error: 'await_missed_phase',
+                    message: 'daemon is already ready and cannot return to prepared in this process',
+                    received: health.startup_phase,
+                    field: 'phase',
+                    next: 'Start a new daemon with `crtr sys daemon start --prepare` before awaiting prepared.',
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof InputError)
+                throw error;
+            lastObservation = error instanceof Error ? error.message : String(error);
+        }
+        await new Promise((resolve) => setTimeout(resolve, Math.min(DAEMON_AWAIT_POLL_MS, Math.max(0, deadline - Date.now()))));
+    }
+    throw new InputError({
+        error: 'await_timeout',
+        message: `daemon did not reach ${phase} within ${timeoutMs}ms (last phase: ${lastPhase}; last observation: ${lastObservation})`,
+        received: lastPhase,
+        field: 'phase',
+        next: 'Inspect `crtr sys daemon status` and resolve any reported startup blocker before retrying.',
+    });
+}
+const daemonAwait = defineLeaf({
+    name: 'await',
+    description: 'wait for a daemon startup phase',
+    whenToUse: 'a caller started or was given a daemon that must reach prepared or ready before its next step.',
+    help: {
+        name: 'sys daemon await',
+        summary: 'wait for the running daemon to report one startup phase',
+        params: [
+            { kind: 'flag', name: 'phase', type: 'enum', choices: ['prepared', 'ready'], required: true, constraint: 'The phase that permits the caller’s next step.' },
+            { kind: 'flag', name: 'timeout', type: 'string', required: false, default: '5m', constraint: 'Maximum wait as a positive duration such as 90s, 5m, or 1h30m.' },
+        ],
+        output: [
+            { name: 'startup_phase', type: 'string', required: true, constraint: 'The requested phase.' },
+            { name: 'waited_ms', type: 'number', required: true, constraint: 'Elapsed wall-clock time before the phase was observed.' },
+        ],
+        outputKind: 'object',
+        effects: ['Read-only: polls /healthz until the requested phase is observed or the caller-bounded timeout expires.'],
+    },
+    run: async (input) => {
+        const rawTimeout = input.timeout;
+        const timeoutMs = parseDurationMs(rawTimeout);
+        if (timeoutMs === null || timeoutMs <= 0) {
+            throw new InputError({ error: 'invalid_duration', message: `not a positive duration: ${rawTimeout}`, received: rawTimeout, field: 'timeout', next: 'Use a positive duration such as 90s, 5m, or 1h30m.' });
+        }
+        return awaitDaemonPhase(input.phase, timeoutMs);
+    },
+});
+const daemonAdmit = defineLeaf({
+    name: 'admit',
+    description: 'admit normal work after daemon preparation',
+    whenToUse: 'the caller has completed its setup against a prepared daemon and is ready for normal daemon work to start.',
+    help: {
+        name: 'sys daemon admit',
+        summary: 'ask a prepared daemon to start normal services',
+        params: [],
+        output: [
+            { name: 'admitted', type: 'boolean', required: true, constraint: 'True only when this request began admission.' },
+            { name: 'already_admitted', type: 'boolean', required: true, constraint: 'True when admission had already begun or completed.' },
+            { name: 'startup_phase', type: 'string', required: true, constraint: 'The phase after admission settles.' },
+        ],
+        outputKind: 'object',
+        effects: ['Starts normal daemon services when the daemon is prepared.'],
+    },
     run: async (_input) => {
-        const result = await spawnDaemon();
-        return result;
+        return await CrtrClient.forLocalSocket({ autostart: false }).admitDaemon();
     },
 });
 // daemon status
@@ -53,6 +166,7 @@ const daemonStatus = defineLeaf({
             { name: 'serving', type: 'boolean', required: false, constraint: 'True when the live daemon answers /healthz; false when one probe does not.' },
             { name: 'pid', type: 'number', required: false, constraint: 'PID of the running daemon.' },
             { name: 'probe_error', type: 'string', required: false, constraint: 'The failed /healthz observation when the live owner did not answer.' },
+            { name: 'startup_phase', type: 'string', required: false, constraint: 'The observed daemon startup phase when the socket answered.' },
         ],
         outputKind: 'object',
         effects: ['Read-only: reads the pidfile, probes the pid, and requests /healthz without autostart.'],
@@ -63,8 +177,13 @@ const daemonStatus = defineLeaf({
         if (!running)
             return { running: false };
         try {
-            await probeDaemonServing();
-            return { running: true, serving: true, pid };
+            const health = await probeDaemonHealth();
+            return {
+                running: true,
+                serving: health.ok,
+                pid,
+                ...(health.startup_phase === undefined ? {} : { startup_phase: health.startup_phase }),
+            };
         }
         catch (error) {
             return { running: true, serving: false, pid, probe_error: error.message };
@@ -186,5 +305,9 @@ export const daemonBranch = defineBranch({
         summary: 'manage the crtrd canvas supervisor daemon',
         model: 'crtrd is a thin background daemon that polls active+idle nodes and acts on window exit: crashed windows become dead; refresh-yield windows get a fresh respawn. It holds no orchestration logic — just process supervision. These are operator/dev self-management, not something a normal agent turn needs to check. Picking up a newly installed runtime generation is `restart` (a handover the daemon performs on itself); `stop` is the terminal one, and it kills the caller along with the rest of the fleet.',
     },
-    children: [daemonStart, daemonRestart, daemonStatus, daemonStop],
+    children: [daemonStart, daemonAwait, daemonAdmit, daemonRestart, daemonStatus, daemonStop],
 });
+/** The daemon-only `sys` subtree used before scoped user state is available. */
+export function registerDaemonControlSys() {
+    return defineSysBranch([daemonBranch]);
+}

package/dist/commands/sys/doctor.js

@@ -8,9 +8,7 @@ import { scopeRoot, listScopes, marketplacesDir, pluginsDir } from '../../core/s
 import { readMarketplaceManifest, readPluginManifest } from '../../core/manifest.js';
 import { pathExists, listDirs, removePath } from '../../core/fs-utils.js';
 import { lsRemote } from '../../core/git.js';
-import { isPidAlive } from '../../core/canvas/pid.js';
 import { cliClient } from '../api-client.js';
-import { readFault } from '../../core/runtime/fault.js';
 import { detectNerdFont, nerdFontInstallCommand, NERD_FONT_SELECT_HINT } from '../../core/runtime/nerd-font.js';
 import { detectPackageManager } from './setup-core.js';
 import { validateEffectiveCommandPlugins } from '../../core/command-plugins/discovery.js';
@@ -406,22 +404,14 @@ async function generationChecks(label, lookup, allowAbsent) {
     }
     return results;
 }
-/** Local copy of `render.ts`'s `activeFaultForDisplay` overlay: a stale
- *  daemon-owned auto-retry provider fault is hidden once the broker pid is gone;
- *  manual/client faults stay visible. Inlined here (rather than imported from
- *  `core/canvas/render.ts`) because that module's runtime graph reaches
- *  `core/canvas/canvas.ts` — which a pure-client CLI leaf must not pull in. */
-function activeFaultForDisplay(node, fault) {
-    if (fault === null)
-        return null;
-    if (fault.link === 'pi→provider' && fault.retry.by === 'daemon' && fault.retry.disposition === 'auto' && !isPidAlive(node.pi_pid))
-        return null;
-    return fault;
-}
+/** One failing check per node parked on an active fault. The fault is the
+ *  daemon's projection on the node summary — the stale-provider overlay (a
+ *  daemon-owned auto retry whose broker pid is gone) is already applied there,
+ *  so this leaf needs no local read. */
 async function runFaultChecks() {
     const results = [];
     for (const node of await cliClient().listNodes()) {
-        const fault = activeFaultForDisplay(node, readFault(node.node_id));
+        const fault = node.fault ?? null;
         if (fault === null)
             continue;
         const name = `fault:${node.node_id}:${fault.link}`;

package/dist/commands/sys/migrate.js

@@ -2,8 +2,9 @@
 // Journaled canvas-db migrations remain in the database's ordered chain.
 import { defineLeaf } from '../../core/command.js';
 import { general, usage } from '../../core/errors.js';
+import { resolve } from 'node:path';
 import { pathExists } from '../../core/fs-utils.js';
-import { runForcedOnDiskMigrations } from '../../migrations/activation.js';
+import { cliClient, rethrowAsCliError } from '../api-client.js';
 export const sysMigrateLeaf = defineLeaf({
     name: 'migrate',
     description: 'converge every profile manifest and writable memory store to the current on-disk format',
@@ -26,16 +27,17 @@ export const sysMigrateLeaf = defineLeaf({
             { name: 'discovery_roots', type: 'object[]', required: true, constraint: 'The frontier searched: {reason, root, boundary, detail?}. reason is user, profile, profile-project, cwd-ancestor, descendant, node, plugin, builtin, or explicit-dir; boundary is store, ancestors, descendants, plugins, or nodes.' },
             { name: 'discovered_stores', type: 'object[]', required: true, constraint: 'One row per physical store: {store, scope, namespace, mount_status, writable, reasons, targets, docs}. reasons holds every way the store was reached; targets the target ids that mount it; docs its parseable document count.' },
             { name: 'discovered_targets', type: 'object[]', required: true, constraint: 'One row per resolution view: {id, kind, origin, cwd, profile_id, node_id, stores}. stores lists store keys in that target\'s precedence order.' },
-            { name: 'node_metadata', type: 'object', required: true, constraint: '{available, nodes, error?} — whether cwd/profile metadata was readable from every durable meta.json whose node store holds documents. Missing or corrupt metadata blocks corpus writes.' },
             { name: 'repository_namespaces', type: 'object[]', required: true, constraint: 'Repository-root namespace decisions this run makes: {repository_root, repository_key, declaration_path, namespace, source, action}. A nested store inherits this declaration; its reported effective prefix is not a declaration.' },
             { name: 'store_prefixes', type: 'object[]', required: true, constraint: 'Effective prefix facts for each project store: {store_root, owner_dir, repository_root, owner_relative_path, old_prefix, old_rule, effective_prefix, nested_declaration_action, front_door_action}. A nonempty owner_relative_path always reports front_door_action `none`; a nested effective_prefix is derived, not a declaration.' },
             { name: 'renames', type: 'object[]', required: true, constraint: 'Canonical identity changes: {store_root, path, from, to}.' },
             { name: 'references', type: 'object[]', required: true, constraint: 'Rewritten pointers at a changed identity: {store_root, path, kind, from, to}, kind link or memory-read.' },
             { name: 'dryRun', type: 'boolean', required: true, constraint: 'True when nothing was written (preview only).' },
+            { name: 'resumed', type: 'boolean', required: true, constraint: 'True only when this repair resumed the blocked daemon startup.' },
+            { name: 'resume_error', type: 'string', required: false, constraint: 'Present when corpus repair succeeded but normal daemon startup then failed.' },
         ],
         outputKind: 'object',
         effects: [
-            'Rewrites old-format `profile.json` manifests in place (atomic, under the same per-profile lock `profile project add/remove` take). A manifest whose structure cannot be converted fails the whole run — no project setting is ever guessed.',
+            'The daemon that owns this canvas runs the migration. Rewrites old-format `profile.json` manifests in place (atomic, under the same per-profile lock `profile project add/remove` take). A manifest whose structure cannot be converted fails the whole run — no project setting is ever guessed.',
             'Rewrites old-format memory documents in place (atomic per-file writes) across every writable discovered store: profiles, profile-owned projects, this directory\'s ancestors, nested descendant stores, installed plugin stores, and node stores. Builtin docs are package-owned and never touched.',
             'Applies corpus-wide identity changes in two ordered phases across every writable store, after the global plan comes back blocker-free; a post-write pass re-reads the corpus from disk and verifies it.',
             'Under --dry-run: read-only, writes nothing.',
@@ -43,7 +45,7 @@ export const sysMigrateLeaf = defineLeaf({
     },
     run: async (input) => {
         const dryRun = input.dryRun === true;
-        const explicitDirs = input['dir'] ?? [];
+        const explicitDirs = (input['dir'] ?? []).map((dir) => resolve(dir));
         const missingDirs = explicitDirs.filter((dir) => !pathExists(dir));
         if (missingDirs.length > 0) {
             throw usage(`--dir path does not exist: ${missingDirs.join(', ')}`, {
@@ -52,91 +54,18 @@ export const sysMigrateLeaf = defineLeaf({
                 next: 'Pass the project directory that contains `.crouter/`, or omit --dir to migrate the discovered frontier only.',
             });
         }
-        const result = await runForcedOnDiskMigrations({ dryRun, explicitDirs });
-        const { applied, changed, discovery, skipped, snapshots } = result;
-        const blockers = result.blockers.map((blocker) => ({
-            kind: blocker.kind,
-            message: blocker.message,
-            ...(blocker.storeRoot === undefined ? {} : { store: blocker.storeRoot }),
-            ...(blocker.targetId === undefined ? {} : { target: blocker.targetId }),
-            ...(blocker.path === undefined ? {} : { path: blocker.path }),
-            ...(blocker.name === undefined ? {} : { name: blocker.name }),
-            ...(blocker.paths === undefined ? {} : { paths: blocker.paths }),
-        }));
-        // One report body, whether the run converged or blocked: a blocked planner
-        // stays as inspectable as a successful one, and the failure payload adds only
-        // the phase and the write inventory that a success cannot have.
-        const report = {
-            profiles: result.profiles,
-            stores: discovery.stores.length,
-            changed,
-            applied,
-            skipped,
-            blockers,
-            discovery_roots: discovery.roots.map((row) => ({
-                reason: row.reason,
-                root: row.root,
-                boundary: row.boundary,
-                ...(row.detail === undefined ? {} : { detail: row.detail }),
-            })),
-            discovered_stores: discovery.stores.map((store) => ({
-                store: store.key,
-                scope: store.descriptor.scope,
-                namespace: store.descriptor.namespace,
-                mount_status: store.descriptor.mountStatus,
-                writable: store.writable,
-                reasons: [...new Set(store.discovery.map((row) => row.reason))],
-                targets: store.targets,
-                docs: snapshots.get(store.key)?.docs.length ?? 0,
-            })),
-            discovered_targets: discovery.targets.map((target) => ({
-                id: target.id,
-                kind: target.kind,
-                origin: target.origin,
-                cwd: target.target.cwd,
-                profile_id: target.target.profileId,
-                node_id: target.target.nodeId,
-                stores: target.storeKeys,
-            })),
-            node_metadata: discovery.nodeMetadata,
-            repository_namespaces: result.repositories.map((row) => ({
-                repository_root: row.repositoryRoot,
-                repository_key: row.repositoryKey,
-                declaration_path: row.declarationPath,
-                namespace: row.namespace,
-                source: row.source,
-                action: row.action,
-            })),
-            store_prefixes: result.storePrefixes.map((row) => ({
-                store_root: row.storeRoot,
-                owner_dir: row.ownerDir,
-                repository_root: row.repositoryRoot,
-                owner_relative_path: row.ownerRelativePath,
-                old_prefix: row.oldPrefix,
-                old_rule: row.oldRule,
-                effective_prefix: row.effectivePrefix,
-                nested_declaration_action: row.nestedDeclarationAction,
-                front_door_action: row.frontDoorAction,
-            })),
-            renames: result.renames.map((row) => ({ store_root: row.storeRoot, path: row.path, from: row.from, to: row.to })),
-            references: result.references.map((row) => ({
-                store_root: row.storeRoot,
-                path: row.path,
-                kind: row.kind,
-                from: row.from,
-                to: row.to,
-            })),
-            dryRun,
-        };
-        if (result.blocked) {
-            const earlier = applied.filter((row) => row.lane !== 'corpus').flatMap((row) => row.files);
-            const corpusPhase = result.corpusPhase;
-            const wrote = {
-                profile_manifests: result.wrote.profileManifests,
-                documents: result.wrote.documents,
-                corpus_consumers: result.wrote.corpusConsumers,
-                corpus_identities: result.wrote.corpusIdentities,
-            };
+        let report;
+        try {
+            report = await cliClient().migrateState({ dry_run: dryRun, dirs: explicitDirs });
+        }
+        catch (error) {
+            rethrowAsCliError(error);
+        }
+        if (report.blocked) {
+            const blockers = report.blockers;
+            const earlier = report.applied.filter((row) => row.lane !== 'corpus').flatMap((row) => row.files);
+            const corpusPhase = report.corpus_phase;
+            const wrote = report.wrote;
             const wroteSummary = dryRun
                 ? '— this was a --dry-run; nothing was written'
                 : corpusPhase === 'written'
@@ -145,7 +74,7 @@ export const sysMigrateLeaf = defineLeaf({
                         ? `before any corpus write — the corpus is unchanged, but ${earlier.length} earlier manifest/document rewrite(s) are already on disk`
                         : '— nothing was written';
             throw general(`corpus migration ${corpusPhase === 'written' ? 'verification failed with' : 'blocked by'} ${blockers.length} finding(s) ${wroteSummary}`, {
-                received: { ...report, corpus_phase: corpusPhase, wrote },
+                received: report,
                 next: corpusPhase === 'written'
                     ? 'Resolve every verification finding against the files listed in received.wrote.corpus_identities and .corpus_consumers, then re-run `crtr sys migrate` — the lane converges from file truth.'
                     : 'Resolve every blocker, then re-run `crtr sys migrate` — the earlier lanes are convergent and re-running them is a no-op.',
@@ -153,9 +82,9 @@ export const sysMigrateLeaf = defineLeaf({
         }
         return {
             ...report,
-            follow_up: skipped.length > 0
+            follow_up: report.skipped.length > 0
                 ? 'Some files could not be parsed and were left untouched — fix each named file, then re-run `crtr sys migrate`.'
-                : changed === 0
+                : report.changed === 0
                     ? 'State already current — nothing to rewrite.'
                     : dryRun
                         ? 'Preview only — re-run without --dry-run to write these changes.'

package/dist/commands/sys/setup-settings-runner.js

@@ -1,10 +1,12 @@
 import { ModelRegistry, ModelRuntime } from '@earendil-works/pi-coding-agent';
 import { join } from 'node:path';
-import { defaultAgentDir } from '../../clients/attach/config.js';
+import { piAgentDir } from '../../core/runtime/package-health.js';
 import { PoolCredentialStore } from '../../core/pool-credential-store.js';
+import { initializeFreshScopedStore } from '../../core/scoped-state/migrate.js';
 import { runTuiPage, } from '../../core/tui/page-host.js';
 export async function runSetupSettingsProcess(createSurface, interceptCancel) {
-    const agentDir = defaultAgentDir();
+    const agentDir = piAgentDir();
+    initializeFreshScopedStore({ kind: 'provider', root: agentDir });
     const runtime = await ModelRuntime.create({
         credentials: new PoolCredentialStore(join(agentDir, "auth.json")),
         modelsPath: join(agentDir, "models.json"),

package/dist/commands/sys.js

@@ -1,5 +1,5 @@
 // `crtr sys` subtree: configuration, diagnostics, and self-management.
-import { defineBranch } from '../core/command.js';
+import { defineSysBranch } from './sys/branch.js';
 import { configBranch } from './sys/config.js';
 import { daemonBranch } from './sys/daemon.js';
 import { sysDoctorLeaf } from './sys/doctor.js';
@@ -14,18 +14,5 @@ import { sysSyncBranch } from './sys/sync.js';
 import { sysMigrateLeaf } from './sys/migrate.js';
 import { sysUpdateLeaf, sysVersionLeaf } from './sys/update.js';
 export function registerSys() {
-    return defineBranch({
-        name: 'sys',
-        rootEntry: {
-            concept: 'crtr configuration, diagnostics, and self-management',
-            desc: 'settings, config, setup, doctor, context, sync, migrate, update, version, feedback, logs, support, daemon',
-            useWhen: 'managing the crtr installation, inspecting diagnostics, or operating the crtrd supervisor process',
-        },
-        help: {
-            name: 'sys',
-            summary: 'crtr system configuration, settings, diagnostics, and self-management',
-            model: 'Configuration and settings own durable behavior; diagnostics and support observe it. Setup, migration, sync, and update change installed or generated state, while daemon control owns the supervisor lifecycle.',
-        },
-        children: [sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, contextBranch, sysFeedbackLeaf, sysLogsLeaf, sysWorktreesLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysMigrateLeaf, sysSyncBranch, daemonBranch],
-    });
+    return defineSysBranch([sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, contextBranch, sysFeedbackLeaf, sysLogsLeaf, sysWorktreesLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysMigrateLeaf, sysSyncBranch, daemonBranch]);
 }