beatrina 0.8.6 → 0.9.43

package/failsafe/serve.R

@@ -19,17 +19,17 @@
 # before its event loop starts. The option guards this process's one re-entry.
 # Rscript writes a space in the script path as `~+~` when it builds R's
 # command line, and R decodes it only to open the file: commandArgs(FALSE)
-# still carries the encoded form. "CarmaR Helper.app" has a space, so its
+# still carries the encoded form. "Beatrina Helper.app" has a space, so its
 # kernel resolved `here` to a path that does not exist and died at source().
 # Decoded once, here, for every reader of --file= in this file.
-carmar_file_arg <- function() {
+beatrina_file_arg <- function() {
   gsub("~+~", " ", sub("^--file=", "",
     grep("^--file=", commandArgs(FALSE), value = TRUE)[1L]), fixed = TRUE)
 }
-if (!isTRUE(getOption("carmar.supervisor.parsed"))) {
-  supervisor_entry <- carmar_file_arg()
+if (!isTRUE(getOption("beatrina.supervisor.parsed"))) {
+  supervisor_entry <- beatrina_file_arg()
   supervisor_program <- parse(file = supervisor_entry, keep.source = FALSE)
-  options(carmar.supervisor.parsed = TRUE)
+  options(beatrina.supervisor.parsed = TRUE)
   eval(supervisor_program, envir = globalenv())
   quit(save = "no", status = 0L, runLast = FALSE)
 }
@@ -39,7 +39,7 @@ suppressPackageStartupMessages({
   library(jsonlite)
 })
 
-here <- dirname(normalizePath(carmar_file_arg()))
+here <- dirname(normalizePath(beatrina_file_arg()))
 source(file.path(here, "kernel.R"))
 source(file.path(here, "notebook-page.R"))
 source(file.path(here, "deployment.R"))
@@ -52,15 +52,20 @@ source(file.path(here, "settings.R"))
 # The file system: one body shared with the worker (docs/document-model-plan.md
 # D3). The supervisor answers the pure file ops itself so a Save never waits
 # behind a running cell; the worker keeps the same functions for the
-# transition flag CARMAR_FILE_OPS=worker.
+# transition flag BEATRINA_FILE_OPS=worker.
 source(file.path(here, "fileio.R"))
 source(file.path(here, "journal.R"))
 source(file.path(here, "ai-store.R"))
+# "Restart, keep variables": the supervisor never reads a kept workspace; it
+# only checks the token (keep_token_ok) and carries it to the next worker.
+source(file.path(here, "workspace-keep.R"))
+# Which documents this session has open — the session's record, not the page's.
+source(file.path(here, "session-documents.R"))
 
 # Apply an administrator-owned desktop policy before any subsystem reads its
 # environment. Invalid or user-writable policy fails closed at the shared
 # startup gate below; no partial values are applied.
-managed_config <- carmar_managed_environment()
+managed_config <- beatrina_managed_environment()
 
 # Before anything reads or writes a frame. The supervisor parses every browser
 # message and re-encodes every worker reply, so its own character locale
@@ -80,16 +85,16 @@ read_kernel_protocol <- function() {
   candidates <- c(file.path(here, "kernel-protocol"),
                   file.path(here, "..", "kernel.protocol"))
   hit <- candidates[file.exists(candidates)][1L]
-  if (!length(hit) || is.na(hit)) stop("CarmaR kernel protocol stamp is missing.")
+  if (!length(hit) || is.na(hit)) stop("Beatrina kernel protocol stamp is missing.")
   value <- suppressWarnings(as.integer(trimws(readLines(hit, warn = FALSE, n = 1L))))
   if (length(value) != 1L || is.na(value) || value < 1L) {
-    stop("CarmaR kernel protocol stamp is invalid.")
+    stop("Beatrina kernel protocol stamp is invalid.")
   }
   value
 }
-CARMAR_PROTOCOL_VERSION <- read_kernel_protocol()
+BEATRINA_PROTOCOL_VERSION <- read_kernel_protocol()
 read_kernel_build <- function() {
-  from_env <- trimws(Sys.getenv("CARMAR_KERNEL_BUILD", ""))
+  from_env <- trimws(Sys.getenv("BEATRINA_KERNEL_BUILD", ""))
   if (nzchar(from_env)) return(from_env)
   stamp <- file.path(here, "kernel-version")
   if (file.exists(stamp)) {
@@ -104,25 +109,25 @@ read_kernel_build <- function() {
   }
   "unknown"
 }
-CARMAR_KERNEL_BUILD <- read_kernel_build()
+BEATRINA_KERNEL_BUILD <- read_kernel_build()
 
-#' What CarmaR is INSTALLED as, right now — re-read on every call.
+#' What Beatrina is INSTALLED as, right now — re-read on every call.
 #'
-#' `CARMAR_KERNEL_BUILD` is what this process was started as. The bundle it
+#' `BEATRINA_KERNEL_BUILD` is what this process was started as. The bundle it
 #' lives in is swapped IN PLACE by an upgrade, so the stamp beside this file
 #' can name a newer (or, after a rollback, an older) build than the one
 #' running. Reading it fresh every time is what lets a session that predates
 #' an install say so — in /health, in the ready frame and in every heartbeat
 #' — instead of serving the old page in silence until someone quits it.
 #'
-#' When the build was dictated by CARMAR_KERNEL_BUILD (tests, the broker),
-#' the installed build is dictated the same way: CARMAR_INSTALLED_BUILD, or
+#' When the build was dictated by BEATRINA_KERNEL_BUILD (tests, the broker),
+#' the installed build is dictated the same way: BEATRINA_INSTALLED_BUILD, or
 #' the same value — a test kernel must never read "newer installed" off a
 #' source checkout's notebook.version.cjs.
 installed_build <- function() {
-  dictated <- trimws(Sys.getenv("CARMAR_KERNEL_BUILD", ""))
+  dictated <- trimws(Sys.getenv("BEATRINA_KERNEL_BUILD", ""))
   if (nzchar(dictated)) {
-    inst <- trimws(Sys.getenv("CARMAR_INSTALLED_BUILD", ""))
+    inst <- trimws(Sys.getenv("BEATRINA_INSTALLED_BUILD", ""))
     return(if (nzchar(inst)) inst else dictated)
   }
   stamp <- file.path(here, "kernel-version")
@@ -141,13 +146,13 @@ installed_build <- function() {
 # The build this kernel REPLACED, when it was started by a "Restart into"
 # handoff (session_handoff_spawn below). Told to /health for the first
 # minute and a half so the page that asked can recognise its successor.
-HANDOFF_FROM <- trimws(Sys.getenv("CARMAR_HANDOFF_FROM", ""))
+HANDOFF_FROM <- trimws(Sys.getenv("BEATRINA_HANDOFF_FROM", ""))
 
 # Where to listen. 127.0.0.1 unless an operator says otherwise, and saying
 # otherwise inverts the trust model — see spike/deployment.R, which owns that
 # decision and refuses the unsafe spellings of it outright.
 host <- local({
-  h <- trimws(Sys.getenv("CARMAR_BIND", "127.0.0.1"))
+  h <- trimws(Sys.getenv("BEATRINA_BIND", "127.0.0.1"))
   if (nzchar(h)) h else "127.0.0.1"
 })
 
@@ -157,7 +162,7 @@ host <- local({
 #' here. localStorage and sessionStorage are keyed by scheme://host:PORT, so a
 #' new port on every start is a new, empty storage on every start: the saved
 #' notebooks invisible, the chat history gone, the AI key asked for again. A
-#' user restarting the kernel three times has three separate CarmaRs and no way
+#' user restarting the kernel three times has three separate Beatrinas and no way
 #' to know why the last one forgot everything.
 #'
 #' A fixed loopback port is not a weaker position than a random one — the
@@ -172,7 +177,7 @@ port_taken <- function(p) {
     error = function(e) NULL))
   if (is.null(con)) FALSE else { close(con); TRUE }
 }
-# CARMAR_PORT is a PREFERENCE by default and a PROMISE when asked.
+# BEATRINA_PORT is a PREFERENCE by default and a PROMISE when asked.
 #
 # Moving to a random port when the wanted one is taken is right for a person
 # double-clicking the app: they get a session instead of an error, and the
@@ -181,23 +186,23 @@ port_taken <- function(p) {
 # is already written into a registry record and about to be handed to Caddy
 # as an upstream, so a kernel that quietly moves leaves BOTH pointing at
 # nothing and the reader gets a connection refused with no explanation
-# anywhere in the system. CARMAR_PORT_STRICT=1 turns the silent move into a
+# anywhere in the system. BEATRINA_PORT_STRICT=1 turns the silent move into a
 # refusal, which is the only honest answer when the caller cannot be told.
 port <- local({
-  wanted <- suppressWarnings(as.integer(Sys.getenv("CARMAR_PORT", "4747")))
+  wanted <- suppressWarnings(as.integer(Sys.getenv("BEATRINA_PORT", "4747")))
   if (is.na(wanted) || wanted < 1024L || wanted > 65535L) wanted <- 4747L
   if (!port_taken(wanted)) return(wanted)
   # A successor started by a handoff is spawned while its predecessor still
   # holds the port; it waits for the port to free rather than moving.
-  wait_s <- suppressWarnings(as.numeric(Sys.getenv("CARMAR_WAIT_PORT", "0")))
+  wait_s <- suppressWarnings(as.numeric(Sys.getenv("BEATRINA_WAIT_PORT", "0")))
   if (is.finite(wait_s) && wait_s > 0) {
     deadline <- Sys.time() + wait_s
     while (port_taken(wanted) && Sys.time() < deadline) Sys.sleep(0.25)  # a wait is a loop
     if (!port_taken(wanted)) return(wanted)
   }
-  if (identical(Sys.getenv("CARMAR_PORT_STRICT", ""), "1")) {
-    message("CarmaR refuses to start: CARMAR_PORT=", wanted, " is already in use ",
-            "and CARMAR_PORT_STRICT=1 forbids moving to another port. Whoever ",
+  if (identical(Sys.getenv("BEATRINA_PORT_STRICT", ""), "1")) {
+    message("Beatrina refuses to start: BEATRINA_PORT=", wanted, " is already in use ",
+            "and BEATRINA_PORT_STRICT=1 forbids moving to another port. Whoever ",
             "chose this port is expecting to find the kernel on it.")
     quit(status = 2L, save = "no")
   }
@@ -207,27 +212,27 @@ port <- local({
 # The posture: bind, Origin allow-list, Host allow-list, and whether an
 # Origin-less client is a same-user native process or an unauthenticated
 # stranger. Computed once; every gate below reads a decided answer.
-deployment <- carmar_deployment(port)
+deployment <- beatrina_deployment(port)
 
 # The administrator's AI policy, read once. Its errors join the deployment's
 # in the same startup gate and for the same reason: a governance control that
 # silently failed to apply is worse than one that refuses to start, because
 # nobody finds out until the data has already gone to the wrong vendor.
-ai_policy <- carmar_ai_policy()
+ai_policy <- beatrina_ai_policy()
 
 # The plugin policy (spike/plugins.R): which kinds exist, whether the person
 # may install, which hosts a fetch may reach, where the administrator's set
 # is. Unlike the AI policy this one is enforcement — every fetch and every
 # write is the supervisor's — and it fails closed the same way: a policy
 # that names only junk refuses to start rather than permitting everything.
-plugin_policy <- carmar_plugin_policy()
+plugin_policy <- beatrina_plugin_policy()
 
 startup_errors <- c(managed_config$errors, deployment$errors, ai_policy$errors, plugin_policy$errors)
 if (length(startup_errors)) {
   # Refusing to start is the correct outcome. A server that binds to the
-  # network with the loopback trust model is not a degraded CarmaR, it is a
+  # network with the loopback trust model is not a degraded Beatrina, it is a
   # remote-execution service, and there is no safe way to serve it "for now".
-  for (msg in startup_errors) message("CarmaR refuses to start: ", msg)
+  for (msg in startup_errors) message("Beatrina refuses to start: ", msg)
   quit(status = 2L, save = "no")
 }
 
@@ -246,10 +251,10 @@ origins_ok <- deployment$origins
 hosts_ok <- deployment$hosts
 
 # Optional audit log — one JSON object per line, for deployments that must be
-# able to answer "what did this session do?". Off unless CARMAR_LOG is set,
+# able to answer "what did this session do?". Off unless BEATRINA_LOG is set,
 # because a notebook that silently records the user's code would be worse than
 # no logging at all.
-log_path <- Sys.getenv("CARMAR_LOG", "")
+log_path <- Sys.getenv("BEATRINA_LOG", "")
 # pandoc, found once and kept. Absent stays absent for the session — a
 # pandoc installed mid-session shows up after a restart, which is the same
 # rule R itself applies to a package installed under a running session.
@@ -278,28 +283,28 @@ audit <- function(event, ...) {
 # successful settings_set so a later read reports the value that is actually
 # in force, and `linger_s` / `HISTORY_ENABLED` below are the two the running
 # kernel can honour immediately (see each one's `effect`).
-settings_state <- carmar_settings_resolve()
-settings_value <- function(key) carmar_settings_value(settings_state, key)
+settings_state <- beatrina_settings_resolve()
+settings_value <- function(key) beatrina_settings_value(settings_state, key)
 audit("settings", detail = "startup", status = settings_state$file$status,
       keys = length(settings_state$file$values))
 
 # What every child inherits from the user's settings, and which R to run.
 # Defined here so the three spawn sites cannot drift: a setting that reaches
 # the worker but not the restarted worker is the worst kind of half-applied.
-settings_child_env <- function() carmar_settings_child_env(settings_state)
+settings_child_env <- function() beatrina_settings_child_env(settings_state)
 settings_rscript <- function() {
   chosen <- settings_value("rscript_path")
   detect_rscript(if (is.character(chosen) && nzchar(chosen)) chosen
-                 else Sys.getenv("CARMAR_RSCRIPT", ""))
+                 else Sys.getenv("BEATRINA_RSCRIPT", ""))
 }
 
-# The launcher's state dir (CARMAR_STATE) or the package's: where this
+# The launcher's state dir (BEATRINA_STATE) or the package's: where this
 # supervisor keeps the handoff log for a successor it spawns. Nothing of the
 # R session is ever written here — a worker starts fresh, always (see the
 # handoff section below).
 state_dir <- function() {
-  state <- Sys.getenv("CARMAR_STATE", "")
-  if (!nzchar(state)) state <- tools::R_user_dir("carmar", "data")
+  state <- Sys.getenv("BEATRINA_STATE", "")
+  if (!nzchar(state)) state <- tools::R_user_dir("beatrina", "data")
   state
 }
 start_execution_worker <- function() {
@@ -319,6 +324,17 @@ sockets$open <- list()
 # connects. Without replaying it, every page that opens later sits on
 # "connecting…" forever waiting for a frame that was broadcast to nobody.
 sockets$hello <- NULL
+# A kept workspace for the NEXT ready worker: set by `restart {resume}` or, in a
+# handoff successor, by BEATRINA_RESUME_TOKEN. Consumed once, on `ready`.
+sockets$resume_pending <- if (keep_token_ok(Sys.getenv("BEATRINA_RESUME_TOKEN")))
+  Sys.getenv("BEATRINA_RESUME_TOKEN") else NULL
+# The restore's report, kept for 120 s so a page that follows a handoff — and
+# connects after the restore finished — still hears what came back.
+sockets$resume_report <- NULL
+# The documents open in this session (spike/session-documents.R), as the pages
+# last reported them. A handoff successor starts with its predecessor's list.
+sockets$session_documents <- session_documents_decode(Sys.getenv("BEATRINA_SESSION_DOCUMENTS"))
+Sys.unsetenv("BEATRINA_SESSION_DOCUMENTS")
 sockets$worker_recovering <- FALSE
 sockets$worker_restart_attempts <- 0L
 sockets$worker_restart_after <- 0
@@ -349,7 +365,7 @@ sockets$terms <- new.env(parent = emptyenv())
 sockets$term_seq <- 0L
 # Connection lifetime and R lifetime are separate. By default a session that
 # has been attached survives closed tabs, browser suspension and lost links.
-# Positive CARMAR_LINGER / linger_seconds explicitly opts into idle shutdown.
+# Positive BEATRINA_LINGER / linger_seconds explicitly opts into idle shutdown.
 # A running task blocks that optional clock; reconnection resets it.
 # How long /health?hold=1 postpones an explicitly configured idle timeout.
 # Default retention does not depend on holds or their timing.
@@ -357,8 +373,8 @@ HOLD_GRACE_S <- 30
 # How long a kernel that has never been connected to waits for its browser
 # before an unopened launch is cleaned up. This is NOT a session idle timer:
 # the first connection or hold permanently cancels default boot cleanup.
-# Explicit CARMAR_LINGER=0 also disables unopened-launch cleanup for headless use.
-BOOT_GRACE_S <- as.numeric(Sys.getenv("CARMAR_BOOT_GRACE", "180"))
+# Explicit BEATRINA_LINGER=0 also disables unopened-launch cleanup for headless use.
+BOOT_GRACE_S <- as.numeric(Sys.getenv("BEATRINA_BOOT_GRACE", "180"))
 if (!is.finite(BOOT_GRACE_S) || BOOT_GRACE_S < 0) BOOT_GRACE_S <- 180
 # The same safe default applies locally and behind a proxy. Explicit user or
 # administrator settings remain authoritative, including an explicit zero.
@@ -382,7 +398,7 @@ linger_s <- resolve_linger()
 # Only a socket that has beaten at least once is ever reaped — a notebook built
 # before heartbeats exists on people's disks and must keep today's behaviour
 # rather than be disconnected while its reader is looking at it.
-socket_silence_s <- suppressWarnings(as.numeric(Sys.getenv("CARMAR_SOCKET_SILENCE", "90")))
+socket_silence_s <- suppressWarnings(as.numeric(Sys.getenv("BEATRINA_SOCKET_SILENCE", "90")))
 if (!length(socket_silence_s) || !is.finite(socket_silence_s)) socket_silence_s <- 90
 
 # ── the dispatched-command deadline, PER COMMAND CLASS ─────────────────────
@@ -444,7 +460,7 @@ WORKER_DEADLINES <- c(
 # Tests need the same branch in seconds rather than minutes. Only a test sets
 # it; the numbers above ARE the contract.
 worker_deadline_scale <- suppressWarnings(
-  as.numeric(Sys.getenv("CARMAR_WORKER_DEADLINE_SCALE", "1")))
+  as.numeric(Sys.getenv("BEATRINA_WORKER_DEADLINE_SCALE", "1")))
 if (!length(worker_deadline_scale) || !is.finite(worker_deadline_scale) ||
     worker_deadline_scale <= 0) worker_deadline_scale <- 1
 
@@ -456,14 +472,14 @@ if (!length(worker_deadline_scale) || !is.finite(worker_deadline_scale) ||
 # than an honest terminal state, because the attach plug is hidden while
 # recovering and the user cannot reach another session either.
 worker_respawn_max <- suppressWarnings(
-  as.integer(Sys.getenv("CARMAR_WORKER_RESPAWN_MAX", "10")))
+  as.integer(Sys.getenv("BEATRINA_WORKER_RESPAWN_MAX", "10")))
 if (!length(worker_respawn_max) || is.na(worker_respawn_max) ||
     worker_respawn_max < 1L) worker_respawn_max <- 10L
 
 # An agent's tool call parked on a page that then died. The page half is the
 # precise test — a rec no longer in `sockets$open` can never answer — and this
 # is the backstop for the case where the page is alive and simply never
-# replies. It matches the ceiling tools/mcp/carmar-mcp.mjs allows a caller to
+# replies. It matches the ceiling tools/mcp/beatrina-mcp.mjs allows a caller to
 # ask for (chunk_run's timeout_s caps at 3600), so the supervisor never gives
 # up on a call the agent is still legitimately waiting for.
 MCP_PENDING_MAX_S <- 3600
@@ -482,7 +498,7 @@ sockets$worker_queue <- list()
 # explicitly pairs one page in a loopback consent window; that LOCAL window
 # owns the socket and relays only messages from the exact approved origin.
 sockets$pairing_requests <- new.env(parent = emptyenv())
-# Consent belongs to this local CarmaR session, not to one popup document.
+# Consent belongs to this local Beatrina session, not to one popup document.
 # Once an origin is approved, a replacement bridge window for that exact
 # origin may reconnect without asking again. The environment disappears when
 # the kernel stops, so approval is still session-scoped.
@@ -520,7 +536,7 @@ sockets$boot_at <- Sys.time()
 
 `%||%` <- function(a, b) if (is.null(a)) b else a
 
-#' The page to serve at `/`: the built CarmaR notebook when there is one,
+#' The page to serve at `/`: the built Beatrina notebook when there is one,
 #' otherwise the bare spike page. The page is PINNED to this kernel's build
 #' (never the highest version present), `.beta.min` ignored so
 #' a debuggable build is served during development. The repo keeps builds in
@@ -531,7 +547,7 @@ notebook_page <- function() {
   # One implementation, in notebook-page.R, because tools/app/launch.sh has to
   # ask the same question at open time — the announcement below is computed
   # once at startup and goes stale the moment a new build lands.
-  page <- carmar_notebook_page(here, CARMAR_KERNEL_BUILD)
+  page <- beatrina_notebook_page(here, BEATRINA_KERNEL_BUILD)
   if (nzchar(page)) return(page)
   file.path(here, "index.html")
 }
@@ -543,7 +559,7 @@ notebook_page <- function() {
 #' does that by comparing ONE string — the boot time exactly as /health
 #' reports `started`, rendered by the same jsonlite call so the two can never
 #' differ in their digits. Served pages get it as
-#' `<meta name="carmar-session">`; a file page gets the same value in its
+#' `<meta name="beatrina-session">`; a file page gets the same value in its
 #' fragment from the launcher.
 session_stamp <- function() {
   as.character(toJSON(as.numeric(sockets$boot_at), auto_unbox = TRUE))
@@ -558,7 +574,7 @@ session_stamp <- function() {
 #' @param html the page's text.
 #' @return the page with the meta in it.
 stamp_session <- function(html) {
-  meta <- sprintf('<meta name="carmar-session" content="%s">', session_stamp())
+  meta <- sprintf('<meta name="beatrina-session" content="%s">', session_stamp())
   at <- regexpr("<head\\b[^>]*>", html, perl = TRUE)
   if (at < 0) at <- regexpr("<html\\b[^>]*>", html, perl = TRUE)
   if (at < 0) return(paste0(meta, html))
@@ -566,13 +582,13 @@ stamp_session <- function(html) {
   paste0(substr(html, 1L, cut), meta, substr(html, cut + 1L, nchar(html)))
 }
 
-#' Where the carmar-mcp stdio server lives on THIS machine, so the setup
+#' Where the beatrina-mcp stdio server lives on THIS machine, so the setup
 #' dialog can show a command that works verbatim. Repo layout first
 #' (tools/mcp beside spike/), then a distribution copy beside serve.R.
 #' Empty when neither exists — the dialog then shows a placeholder path.
 mcp_server_path <- function() {
-  for (p in c(file.path(here, "..", "tools", "mcp", "carmar-mcp.mjs"),
-              file.path(here, "mcp", "carmar-mcp.mjs"))) {
+  for (p in c(file.path(here, "..", "tools", "mcp", "beatrina-mcp.mjs"),
+              file.path(here, "mcp", "beatrina-mcp.mjs"))) {
     if (file.exists(p)) return(normalizePath(p))
   }
   ""
@@ -591,17 +607,17 @@ find_binary <- function(name, extra = character()) {
   ""
 }
 
-#' The Claude Code CLI, if this machine has one. CARMAR_CLAUDE_BIN overrides —
+#' The Claude Code CLI, if this machine has one. BEATRINA_CLAUDE_BIN overrides —
 #' that is also how tests substitute a deterministic stub.
 claude_bin <- function() {
-  override <- Sys.getenv("CARMAR_CLAUDE_BIN", "")
+  override <- Sys.getenv("BEATRINA_CLAUDE_BIN", "")
   if (nzchar(override) && file.exists(override)) return(override)
   find_binary("claude")
 }
 
-#' The Codex CLI, if this machine has one. CARMAR_CODEX_BIN overrides (tests).
+#' The Codex CLI, if this machine has one. BEATRINA_CODEX_BIN overrides (tests).
 codex_bin <- function() {
-  override <- Sys.getenv("CARMAR_CODEX_BIN", "")
+  override <- Sys.getenv("BEATRINA_CODEX_BIN", "")
   if (nzchar(override) && file.exists(override)) return(override)
   find_binary("codex")
 }
@@ -625,11 +641,11 @@ published_origin_valid <- function(origin) {
     grepl("^https?://[A-Za-z0-9._~-]+(:[0-9]{1,5})?$", origin)
 }
 
-# A native CarmaR launcher may start the kernel for one published page.  The
+# A native Beatrina launcher may start the kernel for one published page.  The
 # URL-scheme handoff is the user's consent gesture; carrying only the exact
 # origin into this process keeps the permission session-scoped and prevents a
 # second site from borrowing it.
-initial_published_origin <- Sys.getenv("CARMAR_PUBLISHED_ORIGIN", "")
+initial_published_origin <- Sys.getenv("BEATRINA_PUBLISHED_ORIGIN", "")
 if (published_origin_valid(initial_published_origin)) {
   sockets$published_approvals[[initial_published_origin]] <- TRUE
   audit("published-origin-authorized", origin = initial_published_origin,
@@ -654,8 +670,8 @@ if (published_origin_valid(initial_published_origin)) {
 # looking for one. Any HTML file the user opened could therefore sweep for a
 # kernel and send `exec` — the same shape as the Chrome extension deleted in
 # 0.38.0 ("no token and no page identity"), which is documented there as
-# unacceptable. A file page cannot hold a secret CarmaR never gave it, and
-# CarmaR never sees it open (CarmaR.app claims .qmd/.Rmd/.R/... but not
+# unacceptable. A file page cannot hold a secret Beatrina never gave it, and
+# Beatrina never sees it open (Beatrina.app claims .qmd/.Rmd/.R/... but not
 # .html, so a double-clicked notebook goes straight to the browser). What is
 # left is to ASK — once per session, on a local page that names what is
 # asking. Absent Origin (native same-user clients) is deliberately unchanged:
@@ -665,7 +681,7 @@ if (published_origin_valid(initial_published_origin)) {
 #' `sample()` draws from the Mersenne Twister, which is seeded from the clock
 #' and the pid and is trivially reconstructible — fine for shuffling a vector,
 #' not for a value that decides whether a page may run R. /dev/urandom is the
-#' OS CSPRNG on every platform CarmaR ships a kernel for except Windows, where
+#' OS CSPRNG on every platform Beatrina ships a kernel for except Windows, where
 #' the RNG fallback is documented rather than hidden.
 secure_token <- function(n = 32L) {
   alphabet <- c(letters, LETTERS, 0:9)
@@ -685,7 +701,7 @@ secure_token <- function(n = 32L) {
 
 FILE_ORIGIN <- "null"
 
-# A notebook page SERVED BY ANOTHER CarmaR KERNEL on this machine. When a
+# A notebook page SERVED BY ANOTHER Beatrina KERNEL on this machine. When a
 # page's own kernel dies the page stays open (it is HTML the browser already
 # holds) and can attach to a different session through the badge's plug icon;
 # it arrives here with the Origin of the kernel that served it,
@@ -705,7 +721,7 @@ local_origin <- function(origin) {
 # consent click, while a file page that merely found the port cannot.
 #
 # serve.R prints the exact file:// URL it expects to be opened, and that URL
-# is the one channel CarmaR controls: it already carries `#kernel=<port>`, so
+# is the one channel Beatrina controls: it already carries `#kernel=<port>`, so
 # it can carry a secret too. The page reads it out of its own fragment and
 # presents it on the WebSocket URL. A drive-by html file probing 4747..65535
 # can reach /health and learn a kernel is there, but it was never handed this,
@@ -723,12 +739,12 @@ local_origin <- function(origin) {
 # so the page can be told where to go BEFORE this process exits. Only the exact
 # shape secure_token() makes is accepted; anything else is minted afresh.
 FILE_LAUNCH_CAP <- local({
-  given <- Sys.getenv("CARMAR_FILE_LAUNCH_CAP", "")
-  Sys.unsetenv("CARMAR_FILE_LAUNCH_CAP")
+  given <- Sys.getenv("BEATRINA_FILE_LAUNCH_CAP", "")
+  Sys.unsetenv("BEATRINA_FILE_LAUNCH_CAP")
   if (grepl("^[A-Za-z0-9]{32}$", given)) given else secure_token(32L)
 })
 
-open_file_env <- Sys.getenv("CARMAR_OPEN_FILE", "")
+open_file_env <- Sys.getenv("BEATRINA_OPEN_FILE", "")
 sockets$pending_open <- if (nzchar(open_file_env)) open_file_env else NULL
 if (!is.null(sockets$pending_open)) audit("open-file-parked")
 
@@ -767,9 +783,9 @@ pairing_page <- function(origin, nonce = "") {
     '<meta name="viewport" content="width=device-width,initial-scale=1">',
     '<meta http-equiv="Content-Security-Policy" content="default-src \'none\'; ',
     "style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'\">",
-    '<title>', if (is_file) 'Allow this notebook file to use CarmaR?'
-               else if (is_local) 'Attach this notebook to this CarmaR session?'
-               else 'Allow this book to use CarmaR?', '</title><style>',
+    '<title>', if (is_file) 'Allow this notebook file to use Beatrina?'
+               else if (is_local) 'Attach this notebook to this Beatrina session?'
+               else 'Allow this book to use Beatrina?', '</title><style>',
     'body{font:16px/1.5 system-ui,sans-serif;max-width:42rem;margin:10vh auto;padding:0 1.25rem;color:#172033}',
     '.site{padding:.75rem 1rem;background:#f3f6fb;border-radius:.55rem;overflow-wrap:anywhere}',
     'button{border:0;border-radius:.5rem;background:#2357d9;color:white;padding:.7rem 1rem;font:inherit;font-weight:650;cursor:pointer}',
@@ -778,15 +794,15 @@ pairing_page <- function(origin, nonce = "") {
       paste0('<h1>Run this notebook file with your R?</h1>',
         '<p>A notebook opened from a file on this computer</p>',
         '<p class="site"><strong>a page opened from disk (file://)</strong></p>',
-        '<p>wants to use this CarmaR session. The code will run as your user ',
+        '<p>wants to use this Beatrina session. The code will run as your user ',
         'and can access your files and network. A page opened from a file ',
         'cannot be identified any more exactly than this, so approve it only ',
         'if you just opened a notebook of your own.</p>')
     else if (is_local)
       paste0('<h1>Attach this notebook to this R session?</h1>',
-        '<p>A CarmaR notebook page served at</p>',
+        '<p>A Beatrina notebook page served at</p>',
         '<p class="site"><strong>', html_escape(origin), '</strong></p>',
-        '<p>wants to use this CarmaR session instead of its own &mdash; usually ',
+        '<p>wants to use this Beatrina session instead of its own &mdash; usually ',
         'because the session that served it has stopped. It will be treated as ',
         'your notebook: its chunks run as your user, and it may open a terminal ',
         'and use your saved AI settings. Approve it only if you just asked a ',
@@ -794,14 +810,14 @@ pairing_page <- function(origin, nonce = "") {
     else
       paste0('<h1>Run this book with your R?</h1><p>The published site</p>',
         '<p class="site"><strong>', html_escape(origin), '</strong></p>',
-        '<p>wants to send R chunks to this CarmaR session on your computer. ',
+        '<p>wants to send R chunks to this Beatrina session on your computer. ',
         'The code will run as your user and can access your files and network.</p>'),
     '<form method="get" action="/pair/approve"><input type="hidden" name="challenge" value="',
     challenge, '"><button type="submit">',
     if (is_local) 'Attach for this session' else 'Allow for this session',
     '</button></form>',
     '<p><small>Nothing runs until you press a chunk\'s Run button. ',
-    'Approval disappears when this CarmaR session stops.</small></p></body></html>')
+    'Approval disappears when this Beatrina session stops.</small></p></body></html>')
 }
 
 pairing_bridge_page <- function(rec) {
@@ -813,10 +829,10 @@ pairing_bridge_page <- function(rec) {
     '<meta http-equiv="Content-Security-Policy" content="default-src \'none\'; ',
     "script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self' ws://127.0.0.1:",
     port, "; base-uri 'none'\">",
-    '<title>CarmaR connected</title><style>',
+    '<title>Beatrina connected</title><style>',
     'body{font:16px/1.5 system-ui,sans-serif;max-width:38rem;margin:10vh auto;padding:0 1.25rem;color:#172033}',
     '.site{overflow-wrap:anywhere;color:#2357d9}</style></head><body>',
-    '<h1>CarmaR is connected</h1><p>This session now runs chunks pressed on</p>',
+    '<h1>Beatrina is connected</h1><p>This session now runs chunks pressed on</p>',
     '<p class="site"><strong>', html_escape(rec$origin), '</strong></p>',
     '<p>The page connects by itself and closes this window; if it stays open, you can close it. ',
     'The approval lasts until this R session stops.</p><script>(function(){',
@@ -825,15 +841,15 @@ pairing_bridge_page <- function(rec) {
     'Object.assign({type,nonce,origin:target,port:', port, '},extra||{}),target)};',
     'addEventListener("message",event=>{const data=event.data||{};',
     'if(event.source!==window.opener||event.origin!==target||data.nonce!==nonce)return;',
-    'if(data.type==="carmar:bridge-attach"){const generation=++wsGeneration,old=ws;',
+    'if(data.type==="beatrina:bridge-attach"){const generation=++wsGeneration,old=ws;',
     'if(old){old.onmessage=old.onerror=old.onclose=null;try{old.close()}catch(e){}}',
     'ws=new WebSocket(socketUrl);const current=ws;',
-    'current.onmessage=message=>{if(generation===wsGeneration)tell("carmar:bridge-frame",{data:message.data})};',
-    'current.onerror=()=>{if(generation===wsGeneration)tell("carmar:bridge-error")};',
-    'current.onclose=()=>{if(generation===wsGeneration)tell("carmar:bridge-close")};return}',
-    'if(data.type==="carmar:bridge-send"&&ws&&ws.readyState===1)ws.send(data.data);',
-    'if(data.type==="carmar:bridge-close"&&ws)ws.close()});',
-    'tell("carmar:paired");})();</script></body></html>')
+    'current.onmessage=message=>{if(generation===wsGeneration)tell("beatrina:bridge-frame",{data:message.data})};',
+    'current.onerror=()=>{if(generation===wsGeneration)tell("beatrina:bridge-error")};',
+    'current.onclose=()=>{if(generation===wsGeneration)tell("beatrina:bridge-close")};return}',
+    'if(data.type==="beatrina:bridge-send"&&ws&&ws.readyState===1)ws.send(data.data);',
+    'if(data.type==="beatrina:bridge-close"&&ws)ws.close()});',
+    'tell("beatrina:paired");})();</script></body></html>')
 }
 
 pairing_approval_page <- function(challenge) {
@@ -860,14 +876,14 @@ pairing_done_page <- function(rec) {
     '<meta name="viewport" content="width=device-width,initial-scale=1">',
     '<meta http-equiv="Content-Security-Policy" content="default-src \'none\'; ',
     "style-src 'unsafe-inline'; base-uri 'none'\">",
-    '<title>CarmaR attached</title><style>',
+    '<title>Beatrina attached</title><style>',
     'body{font:16px/1.5 system-ui,sans-serif;max-width:38rem;margin:10vh auto;padding:0 1.25rem;color:#172033}',
     '.site{overflow-wrap:anywhere;color:#2357d9}</style></head><body>',
     '<h1>Attached</h1><p>The notebook</p>',
     '<p class="site"><strong>',
     if (identical(rec$origin, FILE_ORIGIN)) 'a page opened from disk (file://)' else html_escape(rec$origin),
     '</strong></p>',
-    '<p>may use this CarmaR session until it stops. It reconnects by itself within ',
+    '<p>may use this Beatrina session until it stops. It reconnects by itself within ',
     'a few seconds; you can close this window.</p></body></html>')
 }
 
@@ -899,7 +915,7 @@ host_ok <- function(req) {
 #'
 #' Native same-user clients (the app launcher, R, curl, the MCP bridge) do not
 #' send Origin or Sec-Fetch-Site and remain valid. Browsers do: a foreign page
-#' cannot stop a kernel or ask it to open a file, while CarmaR keeps the clean,
+#' cannot stop a kernel or ask it to open a file, while Beatrina keeps the clean,
 #' stable localhost URL users expect.
 control_rejection <- function(req, allow_file = FALSE, allow_approved = FALSE) {
   origin <- req$HTTP_ORIGIN %||% ""
@@ -970,14 +986,14 @@ socket_class <- function(req) {
 # returns quantiles, level counts and a histogram for ONE named column. It is
 # strictly narrower than the `view` beside it — same resolution, less surface,
 # no mutation — which is the bar a new entry has to clear, not "it is useful".
-#' The ports of CarmaR kernels that are actually answering right now.
+#' The ports of Beatrina kernels that are actually answering right now.
 #'
 #' Read from the runtime directory rather than remembered, so sessions started
 #' by the R package launcher count too — and health-checked, because a killed
 #' kernel leaves its file behind and a dead session must not hold a slot.
 live_session_ports <- function() {
-  dir <- Sys.getenv("CARMAR_RUNTIME_DIR",
-                    file.path(path.expand("~"), ".carmar", "run"))
+  dir <- Sys.getenv("BEATRINA_RUNTIME_DIR",
+                    file.path(path.expand("~"), ".beatrina", "run"))
   files <- list.files(dir, pattern = "^kernel-[0-9]+\\.json$", full.names = TRUE)
   ports <- suppressWarnings(as.integer(sub("^kernel-([0-9]+)\\.json$", "\\1", basename(files))))
   ports <- ports[!is.na(ports)]
@@ -1021,19 +1037,19 @@ start_sibling_session <- function() {
     if (!(candidate %in% used)) { chosen <- candidate; break }
   }
   if (is.na(chosen)) return(NULL)
-  # `chosen` is a PREFERENCE, not a promise. serve.R takes CARMAR_PORT only if
+  # `chosen` is a PREFERENCE, not a promise. serve.R takes BEATRINA_PORT only if
   # the port is still free when IT looks — between our probe and its start the
   # port can go, and it then falls back to a random one. Waiting for the exact
   # port we picked therefore reported failure for a session that had started
   # perfectly well, and left it orphaned. So: remember what was live before,
   # and accept whichever new port appears.
   before <- live_session_ports()
-  sib_log <- tryCatch(tempfile("carmar-session-", fileext = ".log"),
+  sib_log <- tryCatch(tempfile("beatrina-session-", fileext = ".log"),
                       error = function(e) nullfile())
   started <- tryCatch({
     processx::process$new(file.path(R.home("bin"), "Rscript"),
                           c(file.path(here, "serve.R")),
-                          env = c(Sys.getenv(), CARMAR_PORT = as.character(chosen)),
+                          env = c(Sys.getenv(), BEATRINA_PORT = as.character(chosen)),
                           # cleanup = FALSE or processx kills this child when
                           # `started` is garbage-collected, which is immediately:
                           # it is a local that dies with this function. The
@@ -1066,7 +1082,7 @@ start_sibling_session <- function() {
 
 # ── the AI key lives HERE, not in the browser ────────────────────────────────
 #
-# It used to sit in localStorage under `carmar-ai-key-kept`: in the browser's
+# It used to sit in localStorage under `beatrina-ai-key-kept`: in the browser's
 # storage for this origin, readable by anything that can run script in the page,
 # and one careless export away from being inside a notebook file. A provider key
 # is not notebook content — it is a machine credential — so it belongs where the
@@ -1078,6 +1094,8 @@ start_sibling_session <- function() {
 # Ops a declared MCP agent is refused outright: raw evaluation (it must go
 # through a visible chunk_run) and the user's credentials.
 AGENT_REFUSED <- c("exec", "interrupt", "force_stop", "restart", "session_upgrade", "session_restart", "debug_cmd", "ai-key",
+                   # A copy of every object in the session, written to disk.
+                   "suspend", "suspend_cancel",
                    # The user's AI conversations. An agent reading them would be
                    # reading every question the user has asked about their data,
                    # including the ones they asked about a different agent.
@@ -1123,8 +1141,8 @@ AGENT_REFUSED <- c("exec", "interrupt", "force_stop", "restart", "session_upgrad
 # for the same reason FORWARDED and ANALYZE_FORWARDED stay two.
 #
 # Only a notebook page qualifies. A native client is refused even though it
-# could read the 0600 file itself as this user: the point is not that CarmaR
-# can stop it, but that CarmaR does not hand the key over — so the promise
+# could read the 0600 file itself as this user: the point is not that Beatrina
+# can stop it, but that Beatrina does not hand the key over — so the promise
 # holds for every agent instead of only the polite ones. A published site is
 # refused because its reader approved it to RUN THE CHUNKS THEY PRESS, not to
 # collect a credential on the way past.
@@ -1155,10 +1173,10 @@ AI_AUDIT_FIELDS <- c("provider", "model", "lane", "tool", "chunk", "decision",
 # The prompt and the response themselves. OFF unless an administrator asks,
 # because a notebook that silently recorded everything its user typed at an AI
 # would be a worse thing to ship than no audit at all — the same judgement
-# CARMAR_LOG itself is off by default for. A compliance deployment turns it on
+# BEATRINA_LOG itself is off by default for. A compliance deployment turns it on
 # knowingly; a laptop never does.
 AI_AUDIT_TEXT_FIELDS <- c("prompt", "response")
-ai_audit_text <- identical(Sys.getenv("CARMAR_LOG_AI_TEXT", ""), "1")
+ai_audit_text <- identical(Sys.getenv("BEATRINA_LOG_AI_TEXT", ""), "1")
 
 # How many ai-* records the reviewer export may read back at once.
 AI_AUDIT_READ_MAX <- 5000L
@@ -1174,7 +1192,7 @@ ai_audit_scalar <- function(value, limit) {
 }
 
 ai_key_path <- function() {
-  dir <- tools::R_user_dir("carmar", "config")
+  dir <- tools::R_user_dir("beatrina", "config")
   dir.create(dir, recursive = TRUE, showWarnings = FALSE)
   file.path(dir, "ai-key")
 }
@@ -1221,7 +1239,7 @@ ai_key_write <- function(value) {
 # user directory and never in the notebook file, an export, or localStorage —
 # where any local page sharing the file:// origin could read the user's code.
 #
-# Off entirely with CARMAR_NO_HISTORY=1, because "record everything I type"
+# Off entirely with BEATRINA_NO_HISTORY=1, because "record everything I type"
 # must be refusable.
 HISTORY_MAX <- 2000L
 # Consulted INSIDE history_read()/history_add() per call, never captured at the
@@ -1230,7 +1248,7 @@ HISTORY_MAX <- 2000L
 HISTORY_ENABLED <- isTRUE(settings_value("history_enabled"))
 
 history_path <- function() {
-  dir <- tools::R_user_dir("carmar", "data")
+  dir <- tools::R_user_dir("beatrina", "data")
   dir.create(dir, recursive = TRUE, showWarnings = FALSE)
   file.path(dir, "console-history")
 }
@@ -1275,7 +1293,7 @@ history_add <- function(line) {
 
 # ── appearance, across the two origins the notebook is delivered from ────────
 #
-# CarmaR delivers the SAME notebook from a file:// page and from this kernel's
+# Beatrina delivers the SAME notebook from a file:// page and from this kernel's
 # own http://127.0.0.1:PORT, and browsers partition storage by origin — so a
 # theme chosen at one door is invisible at the other. That is not a theory: it
 # cost an afternoon on 2026-09-10, when an owner's Flat theme turned out to be
@@ -1298,41 +1316,41 @@ history_add <- function(line) {
 # local HTML file shares the file:// origin, so without it `prefs` is a
 # free-form key/value bag any of them could fill.
 #
-# The values travel as the STRINGS localStorage holds. carmar-chunk-custom is
+# The values travel as the STRINGS localStorage holds. beatrina-chunk-custom is
 # itself JSON; re-parsing it here would make the kernel a party to a format
 # only the page understands, and jsonlite would round its numbers on the way
 # back out — the frame-fidelity lesson, one store further in.
 #
-# Off entirely with CARMAR_NO_PREFS=1, for the same reason CARMAR_NO_HISTORY
+# Off entirely with BEATRINA_NO_PREFS=1, for the same reason BEATRINA_NO_HISTORY
 # exists: "keep a record of my choices on this machine" must be refusable. It
 # is also what keeps the TEST BATTERY out of the real store — unlike the
 # history, which only fills when somebody types, this publishes on every page
 # connect, so any suite that boots a real page would otherwise seed the user's
 # appearance with whatever its scratch page happened to hold. Set by
 # tools/run-test-suite.mjs for every suite it runs.
-PREFS_ENABLED <- !identical(Sys.getenv("CARMAR_NO_PREFS", ""), "1")
+PREFS_ENABLED <- !identical(Sys.getenv("BEATRINA_NO_PREFS", ""), "1")
 PREF_MAX_VALUE <- 4096L
 PREF_KEYS <- c(
-  "carmar-app-theme",        # lib/app-themes.js       standard/flat/plain/graphite/onyx
-  "carmar-editor-theme",     # lib/editor-themes.js    one of 37
-  "carmar-chunk-style",      # lib/chunk-style.js      the pre-7.8 key, kept in step
-  "carmar-chunk-style-v2",   # lib/chunk-style.js      the explicit choice
-  "carmar-chunk-custom",     # lib/chunk-style.js      the designer's token overrides
-  "carmar-writing-chunk",    # lib/writing-chunk.js    the Writing surface's own card
-  "carmar-run-style",        # lib/run-style.js
-  "carmar-table-style-v2",   # lib/table-render.js
-  "carmar-line-numbering",   # lib/line-numbering.js
-  "carmar-density",          # lib/density.js
-  "carmar-add-strip-v3",     # lib/add-strip.js
-  "carmar-soft-wrap",        # lib/soft-wrap.js
-  "carmar-content-width-v1", # src/notebook-entry.js   Standard / Wide / Full
-  "carmar-brand-v1",         # lib/brand.js            the organisation's accent
-  "carmar:rich-text",        # lib/rtf-editor.js
-  "carmar:latex-template"    # lib/latex-templates.js
+  "beatrina-app-theme",        # lib/app-themes.js       standard/flat/plain/graphite/onyx
+  "beatrina-editor-theme",     # lib/editor-themes.js    one of 37
+  "beatrina-chunk-style",      # lib/chunk-style.js      the pre-7.8 key, kept in step
+  "beatrina-chunk-style-v2",   # lib/chunk-style.js      the explicit choice
+  "beatrina-chunk-custom",     # lib/chunk-style.js      the designer's token overrides
+  "beatrina-writing-chunk",    # lib/writing-chunk.js    the Writing surface's own card
+  "beatrina-run-style",        # lib/run-style.js
+  "beatrina-table-style-v2",   # lib/table-render.js
+  "beatrina-line-numbering",   # lib/line-numbering.js
+  "beatrina-density",          # lib/density.js
+  "beatrina-add-strip-v3",     # lib/add-strip.js
+  "beatrina-soft-wrap",        # lib/soft-wrap.js
+  "beatrina-content-width-v1", # src/notebook-entry.js   Standard / Wide / Full
+  "beatrina-brand-v1",         # lib/brand.js            the organisation's accent
+  "beatrina:rich-text",        # lib/rtf-editor.js
+  "beatrina:latex-template"    # lib/latex-templates.js
 )
 
 prefs_path <- function() {
-  dir <- tools::R_user_dir("carmar", "data")
+  dir <- tools::R_user_dir("beatrina", "data")
   dir.create(dir, recursive = TRUE, showWarnings = FALSE)
   file.path(dir, "appearance.json")
 }
@@ -1368,7 +1386,7 @@ prefs_write <- function(values) {
   clean <- prefs_clean(values)
   path <- prefs_path()
   # Create, then lock, then write — the order the key and the history beside
-  # it use. A theme is not a secret; the point is that everything CarmaR puts
+  # it use. A theme is not a secret; the point is that everything Beatrina puts
   # in the user's data directory is the user's, and judging file by file which
   # ones are harmless is how one of them eventually gets it wrong.
   if (!file.exists(path) && !file.create(path)) return(FALSE)
@@ -1383,6 +1401,11 @@ FORWARDED <- c("env", "obj", "struct", "view", "colstats", "rm", "packages", "do
                "package_action", "package_help", "project_status", "project_action", "help", "wd",
                "parse", "complete", "files", "import", "readfile", "writefile", "writefiles_atomic",
                "hover", "format", "sniff",
+               # "Restart, keep variables", step one (spike/workspace-keep.R).
+               # Page-only in both senses: AGENT_REFUSED above, the class gate
+               # in handle_frame. Step two, `resume`, is deliberately NOT here —
+               # only the supervisor asks it, after a restart it performed.
+               "suspend",
                # The file tree's New Folder, Rename and Delete. These MUTATE
                # the filesystem, which is a wider door than the read-only ops
                # around them, so the bar they clear is stated rather than
@@ -1416,7 +1439,7 @@ FORWARDED <- c("env", "obj", "struct", "view", "colstats", "rm", "packages", "do
 # or reaches a process that cannot do it. Adding to EITHER list is a security
 # decision (CLAUDE.md, "FORWARDED in serve.R is an allow-list").
 # The third allow-list. These are answered by THIS process (fileio.R) and never
-# reach the worker's queue, unless CARMAR_FILE_OPS=worker asks for the old
+# reach the worker's queue, unless BEATRINA_FILE_OPS=worker asks for the old
 # routing. Kept apart from FORWARDED for the reason the first two are apart:
 # "may the browser ask for this?" and "which process answers?" are different
 # questions, and a file op's answer is "the one that is never busy".
@@ -1440,7 +1463,7 @@ SUPERVISOR_JOURNAL_OPS <- c("journal_open", "journal_append", "journal_checkpoin
 # a conversation holds the questions you asked about your data plus the chunk
 # sources those questions carried.
 SUPERVISOR_AI_OPS <- c("ai_list", "ai_read", "ai_write", "ai_delete", "ai_purge", "ai_keys")
-FILE_OPS_IN_WORKER <- identical(Sys.getenv("CARMAR_FILE_OPS", ""), "worker")
+FILE_OPS_IN_WORKER <- identical(Sys.getenv("BEATRINA_FILE_OPS", ""), "worker")
 # The worker's working directory, as it last reported it (ready, wd and done
 # frames). setwd() in a chunk moves it; a relative path from the page is
 # resolved against THIS, never against the supervisor's own cwd.
@@ -1550,8 +1573,8 @@ app <- list(
                               # unauthenticated and CORS-open on purpose.
                               r = paste(R.version$major, R.version$minor, sep = "."),
                               started = as.numeric(sockets$boot_at),
-                              protocol = CARMAR_PROTOCOL_VERSION,
-                              kernel_build = CARMAR_KERNEL_BUILD,
+                              protocol = BEATRINA_PROTOCOL_VERSION,
+                              kernel_build = BEATRINA_KERNEL_BUILD,
                               # What is installed beside this kernel NOW, and
                               # how many pages hold it — the two facts an
                               # upgrade needs from a running session.
@@ -1568,7 +1591,7 @@ app <- list(
                          auto_unbox = TRUE),
                   extra = list("Access-Control-Allow-Origin" = "*")))
     }
-    # The custom carmar:// handler calls this endpoint as a native same-user
+    # The custom beatrina:// handler calls this endpoint as a native same-user
     # client. Browser requests carry Origin/Sec-Fetch-Site and are refused by
     # control_rejection(), so visiting a site cannot silently grant itself R
     # execution. One launch authorizes one exact origin for this kernel only.
@@ -1595,7 +1618,7 @@ app <- list(
       nonce <- query_param(req$QUERY_STRING, "nonce")
       # FILE_ORIGIN is accepted HERE and only here. `published_origin_valid()`
       # stays strict (`^https?://…`) because it also guards
-      # /published/authorize and the CARMAR_PUBLISHED_ORIGIN seed — widening it
+      # /published/authorize and the BEATRINA_PUBLISHED_ORIGIN seed — widening it
       # would let an environment variable or a native launch silently
       # pre-approve every file on disk, which is the opposite of the point.
       if (!identical(origin, FILE_ORIGIN) && !published_origin_valid(origin)) {
@@ -1614,7 +1637,7 @@ app <- list(
       page <- pairing_approval_page(query_param(req$QUERY_STRING, "challenge"))
       if (is.null(page)) {
         audit("pair-rejected", detail = "missing or expired challenge")
-        return(resp(400L, "text/plain", "This CarmaR approval request has expired."))
+        return(resp(400L, "text/plain", "This Beatrina approval request has expired."))
       }
       return(resp(200L, "text/html", page))
     }
@@ -1625,12 +1648,12 @@ app <- list(
       blocked <- control_rejection(req, allow_file = TRUE)
       if (!is.null(blocked)) return(blocked)
       audit("shutdown")
-      message("CarmaR stopping: explicit Quit request.")
+      message("Beatrina stopping: explicit Quit request.")
       sockets$quit <- TRUE
       return(resp(200L, "application/json",
                   toJSON(list(ok = TRUE, stopping = TRUE), auto_unbox = TRUE)))
     }
-    # The native door of "Restart into the installed CarmaR" — the menu
+    # The native door of "Restart into the installed Beatrina" — the menu
     # helper's row and the upgrade script use it (launch.sh --restart). Gated
     # exactly like /shutdown; the page's own door is the session_upgrade op.
     if (identical(req$PATH_INFO, "/session/upgrade")) {
@@ -1678,7 +1701,7 @@ app <- list(
     # document reaches a kernel that is ALREADY RUNNING, and it is the reason
     # opening a file no longer costs an R session.
     #
-    # The other channel — CARMAR_OPEN_FILE in the supervisor's environment —
+    # The other channel — BEATRINA_OPEN_FILE in the supervisor's environment —
     # is read once at startup, so the only way to deliver a document through
     # it is to start a new process. That is precisely what the launcher used
     # to do: every double-click was a fresh supervisor, worker and analyzer,
@@ -1777,7 +1800,7 @@ app <- list(
       if (identical(method, "OPTIONS")) {
         return(resp(204L, "text/plain", "", extra = c(cors, list(
           "Access-Control-Allow-Methods" = "GET, PUT, OPTIONS",
-          "Access-Control-Allow-Headers" = "X-CarmaR-Cap, Content-Type, X-CarmaR-Expected-Bytes",
+          "Access-Control-Allow-Headers" = "X-Beatrina-Cap, Content-Type, X-Beatrina-Expected-Bytes",
           "Access-Control-Max-Age" = "60"))))
       }
       if (identical(method, "GET")) {
@@ -1795,7 +1818,7 @@ app <- list(
                                    "Content-Length" = as.character(length(bytes))), cors)))
       }
       if (identical(method, "PUT")) {
-        grant <- file_cap_take(req$HTTP_X_CARMAR_CAP %||% "", "write")
+        grant <- file_cap_take(req$HTTP_X_BEATRINA_CAP %||% "", "write")
         if (is.null(grant) || !within_root(grant$path)) {
           audit("files-refused", detail = "put")
           return(resp(403L, "text/plain", "no capability for that write", extra = cors))
@@ -1813,7 +1836,7 @@ app <- list(
         }
         expected <- NULL
         if (identical(grant$compare, "utf8-prefix-v1")) {
-          prefix <- req$HTTP_X_CARMAR_EXPECTED_BYTES %||% ""
+          prefix <- req$HTTP_X_BEATRINA_EXPECTED_BYTES %||% ""
           n <- suppressWarnings(as.numeric(prefix))
           if (!grepl("^[0-9]+$", prefix) || !is.finite(n) || n > length(body)) {
             return(resp(400L, "text/plain", "missing or invalid expected-content prefix", extra = cors))
@@ -1850,7 +1873,7 @@ app <- list(
     # the Rook environment belongs to the request that opened this socket and
     # cannot change under it.
     rec$class <- socket_class(ws$request)
-    # Who the reverse proxy says this is. "" on loopback, always — CarmaR has
+    # Who the reverse proxy says this is. "" on loopback, always — Beatrina has
     # no login of its own and must not grow one here: a header is an identity
     # only for as long as nobody but the proxy can reach the port, which is a
     # property of the deployment, not of this process.
@@ -1865,6 +1888,10 @@ app <- list(
     audit("socket-open", sockets = length(sockets$open), class = rec$class,
           user = rec$user)
     if (!is.null(sockets$hello)) try(ws$send(sockets$hello), silent = TRUE)
+    if (!is.null(sockets$resume_report) && isTRUE(rec$class %in% PAGE_ONLY_CLASSES)
+        && as.numeric(difftime(Sys.time(), sockets$resume_report$at, units = "secs")) < 120) {
+      try(ws$send(sockets$resume_report$payload), silent = TRUE)
+    }
     # …and the give-up, when there is one. A page that arrives after the
     # respawn ceiling has no ready frame coming and would otherwise sit on
     # "connecting…" forever with nothing on screen saying why.
@@ -1964,17 +1991,17 @@ target_page <- function() {
 # the CLI's stream-json lines back to the asking page verbatim, and that is
 # the whole exchange. Credentials are never read, stored, or proxied.
 #
-# The spawned session gets the carmar MCP tools, pinned to THIS kernel via a
+# The spawned session gets the beatrina MCP tools, pinned to THIS kernel via a
 # 0600 config file (never argv — argv is visible to every local user in ps),
 # and the document tools. The embedded Claude process is a document agent, not
 # a chatbot that prints a draft for the user to move by hand. Inserts and
 # replacements cross the page's revision/contract gateway and remain
 # provisional with Keep/Reject; runs use the ordinary visible chunk path.
 AGENT_CHAT_TOOLS <- paste(
-  "mcp__carmar__carmar_status", "mcp__carmar__notebook_read",
-  "mcp__carmar__chunk_read", "mcp__carmar__chunk_insert",
-  "mcp__carmar__chunk_update", "mcp__carmar__chunk_run",
-  "mcp__carmar__file_list", "mcp__carmar__file_read",
+  "mcp__beatrina__beatrina_status", "mcp__beatrina__notebook_read",
+  "mcp__beatrina__chunk_read", "mcp__beatrina__chunk_insert",
+  "mcp__beatrina__chunk_update", "mcp__beatrina__chunk_run",
+  "mcp__beatrina__file_list", "mcp__beatrina__file_read",
   sep = ",")
 MAX_CHATS <- 3L
 
@@ -2029,7 +2056,7 @@ chat_start <- function(rec, cmd) {
   server <- mcp_server_path()
   node <- find_binary("node")
   if (identical(client, "codex")) {
-    cfg <- tempfile("carmar-codex-")
+    cfg <- tempfile("beatrina-codex-")
     dir.create(cfg, mode = "0700")
     toml_str <- function(x) as.character(toJSON(x, auto_unbox = TRUE))
     args <- c("exec", "--json", "--ephemeral", "--skip-git-repo-check",
@@ -2044,9 +2071,9 @@ chat_start <- function(rec, cmd) {
     }
     if (!text_only && nzchar(server) && nzchar(node)) {
       args <- c(args,
-        "-c", paste0("mcp_servers.carmar.command=", toml_str(node)),
-        "-c", paste0("mcp_servers.carmar.args=[", toml_str(server), "]"),
-        "-c", paste0("mcp_servers.carmar.env={CARMAR_MCP_URL=", toml_str(paste0(origin_ok, "/")), "}"))
+        "-c", paste0("mcp_servers.beatrina.command=", toml_str(node)),
+        "-c", paste0("mcp_servers.beatrina.args=[", toml_str(server), "]"),
+        "-c", paste0("mcp_servers.beatrina.env={BEATRINA_MCP_URL=", toml_str(paste0(origin_ok, "/")), "}"))
     }
     args <- c(args, "-")                     # the prompt arrives on stdin
   } else {
@@ -2062,10 +2089,10 @@ chat_start <- function(rec, cmd) {
       args <- c(args, "--tools", "", "--mcp-config", '{"mcpServers":{}}',
                 "--strict-mcp-config", "--setting-sources", "")
     } else if (nzchar(server) && nzchar(node)) {
-      cfg <- tempfile("carmar-chat-", fileext = ".json")
-      writeLines(toJSON(list(mcpServers = list(carmar = list(
+      cfg <- tempfile("beatrina-chat-", fileext = ".json")
+      writeLines(toJSON(list(mcpServers = list(beatrina = list(
         command = node, args = I(server),
-        env = list(CARMAR_MCP_URL = paste0(origin_ok, "/"))
+        env = list(BEATRINA_MCP_URL = paste0(origin_ok, "/"))
       ))), auto_unbox = TRUE), cfg)
       Sys.chmod(cfg, mode = "0600")
       args <- c(args, "--mcp-config", cfg, "--strict-mcp-config",
@@ -2150,7 +2177,7 @@ pump_chats <- function() {
 #' Every kernel this user is running, from the runtime records, health-checked.
 #' @return An unnamed list of `list(port, url, title, pid, alive, this)`.
 session_list <- function() {
-  dir <- Sys.getenv("CARMAR_RUNTIME_DIR", file.path(path.expand("~"), ".carmar", "run"))
+  dir <- Sys.getenv("BEATRINA_RUNTIME_DIR", file.path(path.expand("~"), ".beatrina", "run"))
   files <- list.files(dir, pattern = "^kernel-[0-9]+\\.json$", full.names = TRUE)
   out <- lapply(files, function(f) {
     rec <- tryCatch(jsonlite::fromJSON(f, simplifyVector = TRUE), error = function(e) NULL)
@@ -2229,7 +2256,7 @@ r_versions <- function() {
 #     the MCP plane refuses, wearing a prompt.
 #
 # What the shell can do is what the user can do; this grants nothing new and
-# is audited like every other door. `CARMAR_NO_TERMINAL=1` removes it (a
+# is audited like every other door. `BEATRINA_NO_TERMINAL=1` removes it (a
 # deployment that must not offer a shell); Windows has no pty here and says so.
 MAX_TERMS <- 4L
 TERM_INPUT_MAX <- 65536L
@@ -2256,11 +2283,11 @@ term_open <- function(rec, cmd) {
     term_send(rec, "", event = "refused", error = why)
     invisible(NULL)
   }
-  if (identical(Sys.getenv("CARMAR_NO_TERMINAL"), "1")) {
-    return(refuse("The terminal is turned off on this kernel (CARMAR_NO_TERMINAL=1)."))
+  if (identical(Sys.getenv("BEATRINA_NO_TERMINAL"), "1")) {
+    return(refuse("The terminal is turned off on this kernel (BEATRINA_NO_TERMINAL=1)."))
   }
   if (.Platform$OS.type == "windows") {
-    return(refuse("The terminal needs a pty, which CarmaR does not provide on Windows yet."))
+    return(refuse("The terminal needs a pty, which Beatrina does not provide on Windows yet."))
   }
   mine <- Filter(function(t) identical(t$rec, rec), mget(ls(sockets$terms), envir = sockets$terms))
   if (length(mine) >= MAX_TERMS) {
@@ -2281,7 +2308,7 @@ term_open <- function(rec, cmd) {
                           env = c("current", TERM = "xterm-256color",
                                   COLORTERM = "truecolor",
                                   COLUMNS = as.character(cols), LINES = as.character(rows),
-                                  CARMAR_PORT = as.character(port))),
+                                  BEATRINA_PORT = as.character(port))),
     error = function(e) conditionMessage(e))
   if (is.character(proc)) return(refuse(paste("the shell could not start:", proc)))
   sockets$term_seq <- sockets$term_seq + 1L
@@ -2374,7 +2401,7 @@ JOB_LOG_CHARS <- 1000000L
 # handed the token, and short enough that a token in a stray log is dead by
 # the time anyone reads it. Tests shorten it.
 OUTPUT_CAP_TTL <- local({
-  given <- suppressWarnings(as.numeric(Sys.getenv("CARMAR_OUTPUT_CAP_TTL", "")))
+  given <- suppressWarnings(as.numeric(Sys.getenv("BEATRINA_OUTPUT_CAP_TTL", "")))
   if (is.finite(given) && given >= 1 && given <= 3600) given else 60
 })
 OUTPUT_CAP_MAX_BYTES <- 128 * 1024 * 1024
@@ -2412,7 +2439,7 @@ output_cap_sweep <- function() {
 # anything /health discloses; for PUT it travels in a header, never the query.
 FILE_CAP_TTL <- OUTPUT_CAP_TTL
 FILE_UPLOAD_MAX <- local({
-  given <- suppressWarnings(as.numeric(Sys.getenv("CARMAR_UPLOAD_MAX", "")))
+  given <- suppressWarnings(as.numeric(Sys.getenv("BEATRINA_UPLOAD_MAX", "")))
   if (is.finite(given) && given >= 1e6 && given <= 2e9) given else 64 * 1024 * 1024
 })
 sockets$file_caps <- list()
@@ -2549,7 +2576,7 @@ job_start <- function(rec, cmd) {
     # settings under both, so a quarto_path set in Settings reaches the render
     # while a job that names its own still wins.
     kernel_start(file.path(here, "job-run.R"), rscript = settings_rscript(),
-                 env_extra = c(settings_child_env(), spec$env, CARMAR_JOB_ID = id)),
+                 env_extra = c(settings_child_env(), spec$env, BEATRINA_JOB_ID = id)),
     error = function(e) conditionMessage(e))
   if (is.character(started)) {
     audit("job-start-failed", detail = started)
@@ -2563,7 +2590,7 @@ job_start <- function(rec, cmd) {
   job$task <- spec$task
   job$root <- spec$root
   job$target <- spec$target
-  identity_text <- spec$env["CARMAR_LATEX_IDENTITY"]
+  identity_text <- spec$env["BEATRINA_LATEX_IDENTITY"]
   job$identity <- if (!is.na(identity_text) && nzchar(identity_text)) fromJSON(identity_text, simplifyVector = FALSE) else NULL
   job$output <- NA_character_
   job$title <- job_title(spec)
@@ -2737,7 +2764,7 @@ update_runner_spec <- function(script, args = character(),
 }
 
 update_script_path <- function() {
-  script <- trimws(Sys.getenv("CARMAR_UPDATE_SCRIPT", ""))
+  script <- trimws(Sys.getenv("BEATRINA_UPDATE_SCRIPT", ""))
   if (!isTRUE(deployment$loopback) || !nzchar(script) || !file.exists(script)) return("")
   script <- normalizePath(script, winslash = "/", mustWork = TRUE)
   if (is.null(update_runner_spec(script))) return("")
@@ -2780,7 +2807,7 @@ update_job_busy <- function() {
 update_status_state <- function() {
   script <- update_script_path()
   if (!nzchar(script)) return(list(
-    supported = FALSE, state = "unavailable", current = CARMAR_KERNEL_BUILD,
+    supported = FALSE, state = "unavailable", current = BEATRINA_KERNEL_BUILD,
     offered = "", previous = "", busy = FALSE, action = "",
     can_check = FALSE, can_update = FALSE, can_defer = FALSE,
     can_rollback = FALSE,
@@ -2789,7 +2816,7 @@ update_status_state <- function() {
 
   busy <- update_job_busy()
   if (busy) return(list(
-    supported = TRUE, state = "checking", current = CARMAR_KERNEL_BUILD,
+    supported = TRUE, state = "checking", current = BEATRINA_KERNEL_BUILD,
     offered = "", previous = "", busy = TRUE, action = update_job$action,
     can_check = FALSE, can_update = FALSE, can_defer = FALSE,
     can_rollback = FALSE,
@@ -3072,7 +3099,7 @@ worker_deadline_check <- function() {
     sockets$worker_routes[[wire_id]] else NULL
   reason <- sprintf(
     paste("R did not answer `%s` within %d seconds. The session and its variables are",
-          "intact; only this request was abandoned. If it keeps happening, this CarmaR",
+          "intact; only this request was abandoned. If it keeps happening, this Beatrina",
           "may be newer than the R session it is talking to — restart R."),
     type, as.integer(round(limit)))
   audit("worker-deadline", detail = type, id = wire_id,
@@ -3092,7 +3119,7 @@ worker_deadline_check <- function() {
 # ── restart into the installed build ───────────────────────────────────────
 #
 # An upgrade swaps the bundle IN PLACE, so the kernel-version stamp beside
-# this script names the installed build while CARMAR_KERNEL_BUILD names the
+# this script names the installed build while BEATRINA_KERNEL_BUILD names the
 # one running. The two disagreeing is the one honest signal that a session
 # is stale, and this is the one door through it: start a SUCCESSOR
 # supervisor from the installed files on this same port, tell every page
@@ -3128,13 +3155,13 @@ handoff_refusal <- function(mode = "upgrade", force = FALSE) {
   refuse <- function(error, reason) list(error = error, reason = reason)
   installed <- installed_build()
   if (identical(installed, "unknown")) {
-    return(refuse("This kernel cannot tell which CarmaR is installed.", "unknown-install"))
+    return(refuse("This kernel cannot tell which Beatrina is installed.", "unknown-install"))
   }
-  if (identical(mode, "upgrade") && identical(installed, CARMAR_KERNEL_BUILD)) {
-    return(refuse(sprintf("This session already runs the installed CarmaR %s.", installed), "same-build"))
+  if (identical(mode, "upgrade") && identical(installed, BEATRINA_KERNEL_BUILD)) {
+    return(refuse(sprintf("This session already runs the installed Beatrina %s.", installed), "same-build"))
   }
-  if (!nzchar(carmar_notebook_page(here, installed))) {
-    return(refuse(sprintf("The installed CarmaR %s has no notebook page beside this kernel.", installed), "no-page"))
+  if (!nzchar(beatrina_notebook_page(here, installed))) {
+    return(refuse(sprintf("The installed Beatrina %s has no notebook page beside this kernel.", installed), "no-page"))
   }
   # Force never spawns a second successor for one port: an attempt that has
   # spawned owns the port until this process exits.
@@ -3153,7 +3180,7 @@ handoff_refusal <- function(mode = "upgrade", force = FALSE) {
 #' kernel, with this port and a capability minted here so it can be told
 #' to the page NOW and honoured by the successor later.
 handoff_page_url <- function(installed, cap) {
-  page_file <- normalizePath(carmar_notebook_page(here, installed))
+  page_file <- normalizePath(beatrina_notebook_page(here, installed))
   paste0("file://", utils::URLencode(page_file, reserved = FALSE),
          "#kernel=", port, "&pair=", cap)
 }
@@ -3166,9 +3193,11 @@ handoff_page_url <- function(installed, cap) {
 #' only ever mean "spawned, exiting".
 #' @param mode "upgrade" or "restart".
 #' @param force Kill a busy worker rather than refuse (restart only).
+#' @param resume A kept-workspace token (spike/workspace-keep.R) the successor's
+#'   first worker restores, or NULL for a fresh R.
 #' @return The reply the caller sends: ok/from/to/page/started/mode/force,
 #'   or ok = FALSE with error and reason.
-session_handoff_begin <- function(mode = "upgrade", force = FALSE) {
+session_handoff_begin <- function(mode = "upgrade", force = FALSE, resume = NULL) {
   mode <- if (identical(mode, "restart")) "restart" else "upgrade"
   force <- isTRUE(force) && identical(mode, "restart")
   audit_name <- if (identical(mode, "restart")) "session-restart" else "session-upgrade"
@@ -3181,18 +3210,20 @@ session_handoff_begin <- function(mode = "upgrade", force = FALSE) {
   cap <- secure_token(32L)
   page <- handoff_page_url(installed, cap)
   sockets$handoff <- list(to = installed, cap = cap, page = page,
-                          started = Sys.time(), mode = mode, force = force)
-  audit(audit_name, from = CARMAR_KERNEL_BUILD, to = installed, force = force)
+                          started = Sys.time(), mode = mode, force = force,
+                          resume = if (keep_token_ok(resume)) resume else NULL)
+  audit(audit_name, from = BEATRINA_KERNEL_BUILD, to = installed, force = force)
   # Every page learns where its successor's notebook is — over the gated
   # socket only; the capability never appears in /health. `started` is this
   # kernel's boot time: the page recognises its successor by a LATER one,
   # which is the only test that also works when the build does not change.
-  told <- toJSON(list(type = "session-upgrade", from = CARMAR_KERNEL_BUILD,
+  told <- toJSON(list(type = "session-upgrade", from = BEATRINA_KERNEL_BUILD,
                       to = installed, page = page, started = as.numeric(sockets$boot_at),
-                      mode = mode, force = force), auto_unbox = TRUE)
+                      mode = mode, force = force,
+                      keep = !is.null(sockets$handoff$resume)), auto_unbox = TRUE)
   lapply(page_recs(), function(r) try(r$ws$send(told), silent = TRUE))
   session_handoff_spawn()
-  list(ok = TRUE, from = CARMAR_KERNEL_BUILD, to = installed, page = page,
+  list(ok = TRUE, from = BEATRINA_KERNEL_BUILD, to = installed, page = page,
        started = as.numeric(sockets$boot_at), mode = mode, force = force)
 }
 
@@ -3216,15 +3247,18 @@ session_handoff_spawn <- function() {
   state <- state_dir()
   dir.create(state, recursive = TRUE, showWarnings = FALSE)
   env <- Sys.getenv()
-  env[["CARMAR_PORT"]] <- as.character(port)
-  env[["CARMAR_WAIT_PORT"]] <- "30"
+  env[["BEATRINA_PORT"]] <- as.character(port)
+  env[["BEATRINA_WAIT_PORT"]] <- "30"
   # A successor that quietly moved to a free port would leave the page
   # polling a dead one for 90 s; strict means it refuses and its log says why.
-  env[["CARMAR_PORT_STRICT"]] <- "1"
-  env[["CARMAR_FILE_LAUNCH_CAP"]] <- h$cap
-  env[["CARMAR_HANDOFF_FROM"]] <- CARMAR_KERNEL_BUILD
-  env[["CARMAR_SESSION_TITLE"]] <- runtime_record$title %||% ""
-  if (isTRUE(runtime_record$listen)) env[["CARMAR_LISTEN"]] <- "1"
+  env[["BEATRINA_PORT_STRICT"]] <- "1"
+  env[["BEATRINA_FILE_LAUNCH_CAP"]] <- h$cap
+  env[["BEATRINA_HANDOFF_FROM"]] <- BEATRINA_KERNEL_BUILD
+  env[["BEATRINA_SESSION_TITLE"]] <- runtime_record$title %||% ""
+  env[["BEATRINA_SESSION_DOCUMENTS"]] <- session_documents_encode(sockets$session_documents)
+  # Only a token travels, never a path; the successor re-checks it.
+  env[["BEATRINA_RESUME_TOKEN"]] <- h$resume %||% ""
+  if (isTRUE(runtime_record$listen)) env[["BEATRINA_LISTEN"]] <- "1"
   # The same R this supervisor runs on, and the serve.R beside THIS file —
   # which, after the in-place swap, is the installed build's.
   rscript <- file.path(R.home("bin"), "Rscript")
@@ -3233,7 +3267,7 @@ session_handoff_spawn <- function() {
     rscript, file.path(here, "serve.R"), env = env,
     stdout = log, stderr = "2>&1", cleanup = FALSE), error = function(e) NULL)
   if (is.null(started) || !started$is_alive()) {
-    return(handoff_abandon("The installed CarmaR could not be started."))
+    return(handoff_abandon("The installed Beatrina could not be started."))
   }
   audit("session-upgrade-spawned", to = h$to, pid = started$get_pid(), mode = h$mode %||% "upgrade")
   # Spawn first, kill second: the old worker's whole tree goes down only once
@@ -3480,6 +3514,32 @@ route_internal <- function(cmd, on_reply) {
   list(cmd = cmd, wire_id = wire_id)
 }
 
+#' Ask the fresh worker to restore a kept workspace, and tell every page what
+#' came back. Queued like any command, so a chunk run pressed meanwhile waits
+#' for the restore rather than racing it.
+#' @return Invisibly NULL.
+start_resume <- function() {
+  token <- sockets$resume_pending
+  sockets$resume_pending <- NULL
+  if (!keep_token_ok(token)) return(invisible(NULL))
+  audit("resume-start")
+  routed <- route_internal(list(type = "resume", token = token), on_reply = function(frame) {
+    if (scalar_chr(frame$cwd)) sockets$worker_wd <- frame$cwd
+    report <- list(type = "workspace_restored",
+                   restored = frame$restored %||% 0L,
+                   failed = frame$failed %||% list(), skipped = frame$skipped %||% list(),
+                   wd_missing = frame$wd_missing %||% NULL, error = frame$error %||% NULL)
+    payload <- toJSON(report, auto_unbox = TRUE, null = "null")
+    sockets$resume_report <- list(at = Sys.time(), payload = payload)
+    audit("resume-done", restored = report$restored, failed = length(report$failed),
+          error = !is.null(report$error))
+    pages <- Filter(function(r) isTRUE(r$class %in% PAGE_ONLY_CLASSES), page_recs())
+    lapply(pages, function(r) try(r$ws$send(payload), silent = TRUE))
+  })
+  enqueue_worker_command(routed$cmd, routed$wire_id)
+  invisible(NULL)
+}
+
 #' Tell every page, and REMEMBER it for the pages that are not here yet.
 #'
 #' `sockets$hello` exists because the worker announces itself once, long
@@ -3503,8 +3563,8 @@ recover_execution_worker <- function() {
     sockets$worker_restart_after <- 0
     sockets$hello <- NULL
     fail_worker_routes(if (isTRUE(sockets$force_stop_asked))
-      "R was force-stopped. Its variables and loaded packages are gone; CarmaR is starting a fresh R session."
-      else "The R worker stopped unexpectedly. Its session state was lost; CarmaR is starting a fresh R session.")
+      "R was force-stopped. Its variables and loaded packages are gone; Beatrina is starting a fresh R session."
+      else "The R worker stopped unexpectedly. Its session state was lost; Beatrina is starting a fresh R session.")
     rm(list = ls(sockets$running), envir = sockets$running)
     rm(list = ls(sockets$worker_routes), envir = sockets$worker_routes)
     sockets$worker_queue <- list()
@@ -3531,7 +3591,7 @@ recover_execution_worker <- function() {
     sockets$worker_gave_up <- TRUE
     sockets$worker_recovering <- FALSE
     reason <- sprintf(
-      paste("R would not start after %d attempts. CarmaR is still running — the notebook,",
+      paste("R would not start after %d attempts. Beatrina is still running — the notebook,",
             "your text and Save all work — but nothing can be run until R is fixed.",
             "A broken .Rprofile or a moved R installation is the usual cause; the kernel",
             "log beside this session has R's own message. Restart R to try again."),
@@ -3670,8 +3730,36 @@ handle_frame <- function(message, rec) {
     return(invisible(NULL))
   }
 
+  # The documents this session has open (spike/session-documents.R). Page-only
+  # in BOTH senses: the list is file paths, and a page that could not open a
+  # terminal must not be able to rewrite what the session reopens either.
+  # Replies nothing; the helper's label follows through the runtime record.
+  if (identical(cmd$type, "page-documents")) {
+    if (identical(rec$role, "page") && isTRUE(rec$class %in% PAGE_ONLY_CLASSES)) {
+      sockets$session_documents <- session_documents_clean(cmd$documents)
+      set_runtime_documents(sockets$session_documents)
+    }
+    return(invisible(NULL))
+  }
+
+  # A page asks what this session had open, to reopen it. `others` counts the
+  # OTHER pages attached: a page joining a session another window is showing
+  # must not open the same documents a second time (that window holds their
+  # history leases), so the page reopens only when it is alone.
+  if (identical(cmd$type, "session-documents")) {
+    if (!scalar_chr(cmd$id)) return(invisible(NULL))
+    allowed <- identical(rec$role, "page") && isTRUE(rec$class %in% PAGE_ONLY_CLASSES)
+    others <- Filter(function(r) !identical(r$ws, rec$ws), page_recs())
+    try(rec$ws$send(toJSON(list(
+      type = "session-documents", id = cmd$id,
+      documents = if (allowed) sockets$session_documents else list(),
+      others = length(others),
+      refused = !allowed), auto_unbox = TRUE)), silent = TRUE)
+    return(invisible(NULL))
+  }
+
   # ── the MCP plane ─────────────────────────────────────────────────────────
-  # A local agent (Claude Code / Codex via tools/mcp/carmar-mcp.mjs) connects
+  # A local agent (Claude Code / Codex via tools/mcp/beatrina-mcp.mjs) connects
   # through the same loopback/Origin/Host gates as a page, then DECLARES itself.
   # From then on it may only ASK (mcp-request, routed to the active notebook
   # window) and use the read-side FORWARDED ops; pages may only ANSWER.
@@ -3694,7 +3782,7 @@ handle_frame <- function(message, rec) {
     return(invisible(NULL))
   }
   if (identical(cmd$type, "open-request")) {
-    # The double-clicked document parked by the launcher (CARMAR_OPEN_FILE).
+    # The double-clicked document parked by the launcher (BEATRINA_OPEN_FILE).
     # Pages only — an agent must never consume it — and consume-once: the
     # first page to ask gets the path, everyone after gets "". An empty
     # string, not a JSON null, because jsonlite renders NULL as a truthy {}.
@@ -3719,7 +3807,7 @@ handle_frame <- function(message, rec) {
     audit("mcp-request", id = cmd$id, detail = cmd$tool)
     if (is.null(page)) {
       reply <- toJSON(list(type = "mcp-response", id = cmd$id, ok = FALSE,
-        error = "No CarmaR notebook window is connected to this kernel. Open the notebook first."),
+        error = "No Beatrina notebook window is connected to this kernel. Open the notebook first."),
         auto_unbox = TRUE)
       try(rec$ws$send(reply), silent = TRUE)
       return(invisible(NULL))
@@ -3778,7 +3866,7 @@ handle_frame <- function(message, rec) {
     else reply(versions = I(r_versions()), current = current_rscript())
     return(invisible(NULL))
   }
-  # "Restart into the installed CarmaR": the page's door. Page-only in both
+  # "Restart into the installed Beatrina": the page's door. Page-only in both
   # senses (AGENT_REFUSED has it too) — a session handoff is the person's
   # decision about their own session, never an agent's.
   if (cmd$type %in% c("session_upgrade", "session_restart") && identical(rec$role, "page")) {
@@ -3791,7 +3879,8 @@ handle_frame <- function(message, rec) {
       return(invisible(NULL))
     }
     reply(session_handoff_begin(mode = if (identical(cmd$type, "session_restart")) "restart" else "upgrade",
-                                force = isTRUE(cmd$force)))
+                                force = isTRUE(cmd$force),
+                                resume = if (keep_token_ok(cmd$resume)) cmd$resume else NULL))
     return(invisible(NULL))
   }
   # ── terminals ─────────────────────────────────────────────────────────────
@@ -4112,18 +4201,18 @@ handle_frame <- function(message, rec) {
         "term_close" = "Agents cannot close the user's terminal.",
         "session_list" = "Agents cannot list the user's sessions.",
         "r_versions" = "Agents cannot list or choose R installations.",
-        "session_upgrade" = "Agents cannot restart the user's session into another CarmaR.",
+        "session_upgrade" = "Agents cannot restart the user's session into another Beatrina.",
         "session_restart" = "Agents cannot restart the user's session.",
         # settings_GET is refused as firmly as the writes. Not because the
         # values are secret, but because handing back the confinement root,
         # the audit-log path and whether AI-text logging is on is a MAP OF THE
         # DEPLOYMENT'S CONTROLS, given to a process whose entire premise is
         # that it is not the user.
-        "settings_get" = "Agents cannot read CarmaR's settings.",
-        "settings_set" = "Agents cannot change CarmaR's settings.",
-        "settings_reset" = "Agents cannot reset CarmaR's settings.",
+        "settings_get" = "Agents cannot read Beatrina's settings.",
+        "settings_set" = "Agents cannot change Beatrina's settings.",
+        "settings_reset" = "Agents cannot reset Beatrina's settings.",
         "update_status" = "Agents cannot inspect desktop update state.",
-        "update_action" = "Agents cannot install, defer, or roll back CarmaR.",
+        "update_action" = "Agents cannot install, defer, or roll back Beatrina.",
         "project_action" = "Agents cannot install or restore project packages.",
         "job_open" = "Agents cannot open files on the user's desktop.",
         "Agents run code through notebook chunks (chunk_run), not raw exec.")
@@ -4163,6 +4252,25 @@ handle_frame <- function(message, rec) {
     return(invisible(NULL))
   }
 
+  # "Restart, keep variables": the save is a copy of the whole session, so it
+  # is page-only in BOTH senses, and its cancel interrupts only a save THIS
+  # page asked for — Interrupt's own gate matches exec routes, never this.
+  if (cmd$type %in% c("suspend", "suspend_cancel") && !isTRUE(rec$class %in% PAGE_ONLY_CLASSES)) {
+    if (scalar_chr(cmd$id)) try(rec$ws$send(toJSON(list(
+      type = cmd$type, id = cmd$id, error = "Only the local notebook page may keep the workspace."
+    ), auto_unbox = TRUE)), silent = TRUE)
+    audit("suspend-refused", reason = "class", class = rec$class %||% "unknown")
+    return(invisible(NULL))
+  }
+  if (identical(cmd$type, "suspend_cancel")) {
+    active <- sockets$worker_active
+    route <- if (!is.null(active)) sockets$worker_routes[[active]] else NULL
+    if (identical(sockets$worker_active_type, "suspend") && !is.null(route) && identical(route$rec, rec)) {
+      audit("suspend-cancel")
+      kernel_interrupt(k)
+    }
+    return(invisible(NULL))
+  }
   if (identical(cmd$type, "project_action") && !isTRUE(rec$class %in% PAGE_ONLY_CLASSES)) {
     if (scalar_chr(cmd$id)) try(rec$ws$send(toJSON(list(
       type = "project_action", id = cmd$id, ok = FALSE, reason = "class",
@@ -4274,7 +4382,7 @@ handle_frame <- function(message, rec) {
       # a gate that silently drops the line. reply_err is this handler's own
       # door back to the asking page and carries cmd$id, so the console can
       # attribute the refusal to the line it just sent.
-      reply_err("CarmaR could not deliver the answer to R. The question is still open; try again.")
+      reply_err("Beatrina could not deliver the answer to R. The question is still open; try again.")
       return(invisible(NULL))
     }
     sockets$input_waiting <- FALSE
@@ -4305,8 +4413,8 @@ handle_frame <- function(message, rec) {
     action <- if (scalar_chr(cmd$action)) cmd$action else ""
     line <- switch(action,
       continue = "c", over = "n", into = "s", out = "f",
-      where = ".carmar_debug_where()",
-      abort = 'invokeRestart("carmar_abort_cell")',
+      where = ".beatrina_debug_where()",
+      abort = 'invokeRestart("beatrina_abort_cell")',
       eval = if (scalar_chr(cmd$expr)) cmd$expr else NULL)
     if (is.null(line) || grepl("[\n\r]", line) || nchar(line) > 4000L) {
       reply_err("bad debug command")
@@ -4319,7 +4427,7 @@ handle_frame <- function(message, rec) {
     # end of the debuggable code the where line reaches the dispatch loop,
     # which ignores what it cannot parse — harmless by construction.
     if (action %in% c("over", "into", "out")) {
-      try(kernel_console(k, ".carmar_debug_where()"), silent = TRUE)
+      try(kernel_console(k, ".beatrina_debug_where()"), silent = TRUE)
     }
     return(invisible(NULL))
   }
@@ -4339,11 +4447,12 @@ handle_frame <- function(message, rec) {
   # hello is stale the moment the old worker dies; the new worker's ready frame
   # replaces it via pump() and reaches every open socket.
   if (identical(cmd$type, "restart")) {
-    audit("restart")
+    audit("restart", keep = keep_token_ok(cmd$resume))
     fail_worker_routes("R was restarted — this request was abandoned.")
     try(kernel_stop(k, grace = 1), silent = TRUE)
     k <<- start_execution_worker()
     sockets$hello <- NULL
+    sockets$resume_pending <- if (keep_token_ok(cmd$resume)) cmd$resume else NULL
     sockets$worker_recovering <- FALSE
     sockets$worker_restart_attempts <- 0L
     # An explicit Restart R is the ONE door out of a give-up: the user has
@@ -4398,12 +4507,12 @@ handle_frame <- function(message, rec) {
       return(invisible(NULL))
     }
     # ONE OF THE TWO DOORS THE SUPERVISOR ACTUALLY OWNS. A policy that permits
-    # no key-based provider means CarmaR does not keep a provider key at all:
+    # no key-based provider means Beatrina does not keep a provider key at all:
     # not handed out, not stored. The user can still paste one into the tab —
     # this is their own browser and no kernel can prevent that — but nothing
     # persists it for them and the attempt is in the audit log. The refusal
-    # covers `set` as much as `get`, because a key CarmaR holds under a
-    # local-only policy is a key CarmaR should never have accepted.
+    # covers `set` as much as `get`, because a key Beatrina holds under a
+    # local-only policy is a key Beatrina should never have accepted.
     if (isTRUE(ai_policy$set) && !isTRUE(ai_policy$allows_key)) {
       audit("ai-key-refused", reason = "policy", class = rec$class %||% "unknown")
       reply(error = ai_policy_reason(ai_policy), policy = TRUE)
@@ -4633,7 +4742,7 @@ handle_frame <- function(message, rec) {
     }
     # csl_place: the style beside the document, as a .bib sits beside a
     # .tex — what makes `csl: apa.csl` in the front matter render the same
-    # style with no CarmaR present. A dependent style's parent goes too, or
+    # style with no Beatrina present. A dependent style's parent goes too, or
     # pandoc would go looking for it. Never overwrites: a different file of
     # that name beside the document is the author's, and is reported.
     style <- csl_resolve(here, plugin_policy, cmd$name)
@@ -4661,7 +4770,7 @@ handle_frame <- function(message, rec) {
   # The AI conversation, into the audit stream. Fire-and-forget: there is no
   # reply, because a turn must never wait on its own logging, and a page that
   # could tell whether the write landed would be a probe for whether auditing
-  # is on. `audit()` is already a no-op without CARMAR_LOG, so an ordinary
+  # is on. `audit()` is already a no-op without BEATRINA_LOG, so an ordinary
   # laptop pays nothing here beyond the parse it already did.
   if (identical(cmd$type, "ai-audit")) {
     event <- ai_audit_scalar(cmd$event, 32L)
@@ -4690,7 +4799,7 @@ handle_frame <- function(message, rec) {
   # Reading the audit stream BACK, for the reviewer export.
   #
   # Page-only on the same grounds as the console history, and more so: with
-  # CARMAR_LOG_AI_TEXT on, these lines contain the prompts the user typed. A
+  # BEATRINA_LOG_AI_TEXT on, these lines contain the prompts the user typed. A
   # declared agent is refused (AGENT_REFUSED); a published origin and a native
   # client are refused by class.
   #
@@ -4760,7 +4869,7 @@ handle_frame <- function(message, rec) {
 
   # Appearance carried between the two origins the notebook is delivered from
   # (see PREF_KEYS). Page-only on the console-history rule exactly: this is the
-  # user's own machine state, kept for them because CarmaR put it out of reach
+  # user's own machine state, kept for them because Beatrina put it out of reach
   # of the origin they opened it at. A declared agent has no appearance.
   if (identical(cmd$type, "prefs")) {
     if (!scalar_chr(cmd$id)) return(invisible(NULL))
@@ -4806,7 +4915,7 @@ handle_frame <- function(message, rec) {
   # same reason as ai-key: the supervisor answers it itself.
   #
   # Page-only for the ai-key reason exactly: a native client could edit
-  # ~/.config/R/carmar/settings.json itself as this user, but CarmaR does not
+  # ~/.config/R/beatrina/settings.json itself as this user, but Beatrina does not
   # do it for it, so the promise holds for every client rather than only the
   # polite ones. A published origin is refused because its reader approved that
   # site to run the chunks they press, not to reconfigure their kernel.
@@ -4818,7 +4927,7 @@ handle_frame <- function(message, rec) {
       audit("settings-refused", reason = "class", detail = cmd$type,
             class = rec$class %||% "unknown")
       reply(ok = FALSE, reason = "class",
-            error = "Only the notebook page may read or change CarmaR's settings.")
+            error = "Only the notebook page may read or change Beatrina's settings.")
       return(invisible(NULL))
     }
     # An unauthenticated shared kernel has no "the user" whose home directory
@@ -4865,7 +4974,7 @@ handle_frame <- function(message, rec) {
       # because those are precisely the ones that can be honoured now, and
       # reporting a new linger while running on the old one is the lie the
       # whole `effect` field exists to prevent.
-      settings_state <<- carmar_settings_resolve()
+      settings_state <<- beatrina_settings_resolve()
       linger_s <<- resolve_linger()
       HISTORY_ENABLED <<- isTRUE(settings_value("history_enabled"))
       audit("settings", detail = "get", status = settings_state$file$status)
@@ -4874,8 +4983,8 @@ handle_frame <- function(message, rec) {
     }
 
     if (identical(cmd$type, "settings_reset")) {
-      unlink(carmar_settings_path())
-      settings_state <<- carmar_settings_resolve()
+      unlink(beatrina_settings_path())
+      settings_state <<- beatrina_settings_resolve()
       linger_s <<- resolve_linger()
       HISTORY_ENABLED <<- isTRUE(settings_value("history_enabled"))
       audit("settings", detail = "reset", ok = TRUE)
@@ -4915,7 +5024,7 @@ handle_frame <- function(message, rec) {
     if (is.null(cmd$value)) {
       values[[key]] <- NULL                       # unset: back to env/default
     } else {
-      verdict <- carmar_settings_validate(key, cmd$value)
+      verdict <- beatrina_settings_validate(key, cmd$value)
       if (!isTRUE(verdict$ok)) {
         # Refused, never coerced, and the file is NOT written — the ai-key
         # scar, where a payload of the wrong type fell through to "" and
@@ -4929,13 +5038,13 @@ handle_frame <- function(message, rec) {
       values[[key]] <- verdict$value
     }
 
-    if (!isTRUE(carmar_settings_write(values))) {
+    if (!isTRUE(beatrina_settings_write(values))) {
       audit("settings", detail = "set", key = key, ok = FALSE)
       reply(ok = FALSE, key = key, reason = "write",
             error = "The settings file could not be written.")
       return(invisible(NULL))
     }
-    settings_state <<- carmar_settings_resolve()
+    settings_state <<- beatrina_settings_resolve()
     applied <- FALSE
     if (identical(entry$effect, "live")) {
       if (identical(key, "linger_seconds")) {
@@ -5139,8 +5248,8 @@ pump <- function() {
     # Session-wide lifecycle frames have no owner and must reach every tab —
     # and no id to rewrite, so they forward exactly as the kernel wrote them.
     if (identical(e$type, "ready")) {
-      e$protocol <- CARMAR_PROTOCOL_VERSION
-      e$kernel_build <- CARMAR_KERNEL_BUILD
+      e$protocol <- BEATRINA_PROTOCOL_VERSION
+      e$kernel_build <- BEATRINA_KERNEL_BUILD
       e$installed_build <- installed_build()
       # session_upgrade is the SUPERVISOR's verb; it joins the worker's
       # vocabulary here so a page can tell, without probing, that this
@@ -5167,6 +5276,7 @@ pump <- function() {
     payload <- relay_frame(e)
     if (identical(e$type, "ready")) sockets$hello <- payload
     lapply(sockets$open, function(r) try(r$ws$send(payload), silent = TRUE))
+    if (identical(e$type, "ready") && !is.null(sockets$resume_pending)) start_resume()
     invisible(NULL)
   })
   invisible(NULL)
@@ -5186,7 +5296,7 @@ if (deployment$require_origin) {
   # first line. An operator who has bound to the network gets the posture
   # stated back to them, because the two spellings differ enormously and the
   # difference is invisible from the outside.
-  message("CarmaR listening on ", host, ":", port,
+  message("Beatrina listening on ", host, ":", port,
           " — strict: a client with no Origin is refused")
   message(if (deployment$trust_proxy)
             paste0("  identity: ", deployment$user_header, " from ",
@@ -5217,33 +5327,35 @@ file_url <- notebook_file_url(notebook_file, port, FILE_LAUNCH_CAP)
 
 #' Discovery for local agents — the Jupyter runtime-dir pattern.
 #'
-#' `tools/mcp/carmar-mcp.mjs` (the stdio server Claude Code / Codex spawn) has
+#' `tools/mcp/beatrina-mcp.mjs` (the stdio server Claude Code / Codex spawn) has
 #' no stdout to read the URL from, so the kernel writes one small file a local
-#' process owned by the SAME user can find: ~/.carmar/run/kernel-<port>.json,
+#' process owned by the SAME user can find: ~/.beatrina/run/kernel-<port>.json,
 #' mode 0600. This is discovery metadata, not a browser credential. A same-user
 #' local process was never outside the trust line — it could already exec
 #' anything. Removed on clean shutdown;
 #' consumers must health-check before trusting a file (kills leave litter).
-#' CARMAR_RUNTIME_DIR relocates it (tests use a scratch dir);
-#' CARMAR_NO_RUNTIME_FILE=1 turns it off.
+#' BEATRINA_RUNTIME_DIR relocates it (tests use a scratch dir);
+#' BEATRINA_NO_RUNTIME_FILE=1 turns it off.
 runtime_file <- ""
 runtime_record <- list(url = url, file = file_url, port = port, pid = Sys.getpid(),
                        started = format(Sys.time(), "%Y-%m-%dT%H:%M:%S%z"))
 # A successor started by a handoff keeps the session's name, so the menu
 # row does not flicker to "Untitled" between the two processes.
 local({
-  title <- Sys.getenv("CARMAR_SESSION_TITLE", "")
-  Sys.unsetenv("CARMAR_SESSION_TITLE")
+  title <- Sys.getenv("BEATRINA_SESSION_TITLE", "")
+  Sys.unsetenv("BEATRINA_SESSION_TITLE")
   title <- trimws(substr(gsub("[\"\\\\]", "'", gsub("[[:cntrl:]]", " ", title)), 1L, 120L))
   if (nzchar(title)) runtime_record$title <<- title
+  label <- session_documents_label(sockets$session_documents)
+  if (nzchar(label)) runtime_record$documents <<- label
 })
-# CARMAR_LISTEN=1 marks a kernel started headless for published pages (the
+# BEATRINA_LISTEN=1 marks a kernel started headless for published pages (the
 # menu's Listen for Web Pages, the keep-ready daemon). The menu helper shows
 # such a kernel as its Listen checkbox, not as a session row — there is no
 # document behind it to name. The mark is HOW IT STARTED, so the first page
 # that actually attaches clears it (see the upgrade handler): from then on it
 # is an ordinary session.
-if (identical(Sys.getenv("CARMAR_LISTEN"), "1")) runtime_record$listen <- TRUE
+if (identical(Sys.getenv("BEATRINA_LISTEN"), "1")) runtime_record$listen <- TRUE
 # The failsafe's session is listed by `beatrina status` and stopped by `beatrina stop` like any other:
 # the same app, a host name, the boot instant /health reports, and the document it opened.
 if (nzchar(FAILSAFE_REASON)) {
@@ -5280,6 +5392,19 @@ set_runtime_title <- function(title) {
   write_runtime()
 }
 
+#' The session's documents, as a label, into the runtime record.
+#'
+#' `documents` is what the menu helper shows in place of the notebook's
+#' generated name ("SezerProfiles.qmd", not "Mellow Yarrow 7Z6"). A flat
+#' string on purpose — helper-sessions.sh reads the record with a bounded sed.
+set_runtime_documents <- function(documents) {
+  label <- session_documents_label(documents)
+  if (identical(runtime_record$documents %||% "", label)) return(invisible(NULL))
+  if (nzchar(label)) runtime_record$documents <<- label
+  else runtime_record$documents <<- NULL
+  write_runtime()
+}
+
 #' A page attached: this kernel is now a session, not a bare listener.
 clear_runtime_listen <- function() {
   if (is.null(runtime_record$listen)) return(invisible(NULL))
@@ -5287,9 +5412,9 @@ clear_runtime_listen <- function() {
   write_runtime()
 }
 
-if (!identical(Sys.getenv("CARMAR_NO_RUNTIME_FILE"), "1")) {
-  runtime_dir <- Sys.getenv("CARMAR_RUNTIME_DIR",
-                            file.path(path.expand("~"), ".carmar", "run"))
+if (!identical(Sys.getenv("BEATRINA_NO_RUNTIME_FILE"), "1")) {
+  runtime_dir <- Sys.getenv("BEATRINA_RUNTIME_DIR",
+                            file.path(path.expand("~"), ".beatrina", "run"))
   made <- dir.exists(runtime_dir) ||
     dir.create(runtime_dir, recursive = TRUE, showWarnings = FALSE)
   if (made) {
@@ -5298,7 +5423,7 @@ if (!identical(Sys.getenv("CARMAR_NO_RUNTIME_FILE"), "1")) {
   }
 }
 
-audit("started", port = port, r = R.version.string, root = Sys.getenv("CARMAR_ROOT", ""))
+audit("started", port = port, r = R.version.string, root = Sys.getenv("BEATRINA_ROOT", ""))
 cat(toJSON(list(url = url, file = file_url), auto_unbox = TRUE), "\n")
 flush(stdout())
 
@@ -5379,7 +5504,7 @@ mcp_pending_sweep <- function() {
       as.numeric(difftime(now, entry$at, units = "secs")) >= MCP_PENDING_MAX_S
     if (!page_gone && !stale) next
     why <- if (page_gone)
-      "The CarmaR notebook window that was answering this request closed before it replied."
+      "The Beatrina notebook window that was answering this request closed before it replied."
       else sprintf("The notebook did not answer within %d seconds.",
                    as.integer(MCP_PENDING_MAX_S))
     audit("mcp-abandoned", id = id, reason = if (page_gone) "page closed" else "timeout")
@@ -5429,7 +5554,7 @@ linger_check <- function() {
   if (as.numeric(difftime(now, sockets$idle_since, units = "secs")) >= grace) {
     reason <- if (unopened_default) "unopened-launch" else "configured-idle-timeout"
     audit("linger-shutdown", grace = grace, reason = reason)
-    message(sprintf("CarmaR stopping: %s (grace %s seconds).", reason, grace))
+    message(sprintf("Beatrina stopping: %s (grace %s seconds).", reason, grace))
     sockets$quit <- TRUE
   }
   invisible(NULL)