beatrina 0.8.7 → 0.9.43

package/host/settings.mjs

@@ -13,10 +13,10 @@
 //   · An administrator's setting is NOT IN THIS FILE'S VOCABULARY AT ALL. It is
 //     rejected on read and refused on write, always — never "env wins if
 //     present", because that only guarantees anything when the env IS set, and
-//     a deployment that never set CARMAR_ROOT is still one where a user must
+//     a deployment that never set BEATRINA_ROOT is still one where a user must
 //     not invent one.
 //
-// The tempting alternative — one layered getter handed to carmarDeployment()
+// The tempting alternative — one layered getter handed to beatrinaDeployment()
 // and the AI policy — is deliberately NOT built here either. It would put every
 // administrator variable one argument-passing mistake away from being
 // file-settable. Those read process.env directly; only the user-writable call
@@ -32,6 +32,7 @@ import fs from "node:fs";
 
 import path from "node:path";
 import { appId, ensureUserDir, privateModeHeld } from "./user-dirs.mjs";
+import { envReader, mirrorEnv, setEnvName } from "./env-names.mjs";
 
 export const SETTINGS_VERSION = 1;
 
@@ -46,12 +47,19 @@ export const SETTINGS_VERSION = 1;
 export const SETTINGS = Object.freeze([
   // Connection loss is not permission to discard the R workspace. Timed
   // shutdown is opt-in; 0 retains an attached session until an explicit Quit.
-  { key: "linger_seconds", env: "CARMAR_LINGER", kind: "number", default: 0, min: 0, max: 86400, effect: "live", label: "Keep R running after all pages disconnect" },
-  { key: "history_enabled", env: "CARMAR_NO_HISTORY", kind: "bool", default: true, effect: "live", inverted: true, label: "Remember console history between sessions" },
-  { key: "analyze_budget_s", env: "CARMAR_ANALYZE_BUDGET", kind: "number", default: 3, min: 0, max: 60, effect: "next_launch", label: "Code-intelligence time budget" },
-  { key: "quarto_path", env: "CARMAR_QUARTO", kind: "path", default: "", effect: "live", label: "Quarto binary" },
-  { key: "rscript_path", env: "CARMAR_RSCRIPT", kind: "path", default: "", effect: "restart_r", label: "R binary" },
-  { key: "port", env: "CARMAR_PORT", kind: "number", default: 4747, min: 1024, max: 65535, effect: "next_launch", label: "Preferred port" },
+  { key: "linger_seconds", env: "BEATRINA_LINGER", kind: "number", default: 0, min: 0, max: 86400, effect: "live", label: "Keep R running after all pages disconnect" },
+  { key: "history_enabled", env: "BEATRINA_NO_HISTORY", kind: "bool", default: true, effect: "live", inverted: true, label: "Remember console history between sessions" },
+  { key: "analyze_budget_s", env: "BEATRINA_ANALYZE_BUDGET", kind: "number", default: 3, min: 0, max: 60, effect: "next_launch", label: "Code-intelligence time budget" },
+  { key: "quarto_path", env: "BEATRINA_QUARTO", kind: "path", default: "", effect: "live", label: "Quarto binary" },
+  { key: "rscript_path", env: "BEATRINA_RSCRIPT", kind: "path", default: "", effect: "restart_r", label: "R binary" },
+  { key: "port", env: "BEATRINA_PORT", kind: "number", default: 4747, min: 1024, max: 65535, effect: "next_launch", label: "Preferred port" },
+  // WHO IS WRITING. Machine scope, beside console history and the AI store,
+  // and deliberately NOT localStorage: every file:// page shares one origin,
+  // so a name kept there would be readable by any local HTML the user opens
+  // and would not follow them to a served page either. With no kernel there
+  // is no name, which is consistent — with no kernel there is no comment
+  // store to attribute anything in.
+  { key: "person_name", env: "BEATRINA_NAME", kind: "text", max: 120, default: "", effect: "live", label: "Your name" },
 ]);
 
 /**
@@ -60,37 +68,63 @@ export const SETTINGS = Object.freeze([
  * the refusal structural rather than a lookup someone can forget.
  */
 export const SETTINGS_ADMIN = Object.freeze([
-  "CARMAR_MANAGED_CONFIG",
-  "CARMAR_ROOT", "CARMAR_LOG", "CARMAR_LOG_AI_TEXT",
-  "CARMAR_CRAN_MIRROR",
-  "CARMAR_AI_LOCAL_ONLY", "CARMAR_AI_POLICY", "CARMAR_AI_PROVIDERS",
-  "CARMAR_BIND", "CARMAR_HOSTS", "CARMAR_ORIGINS", "CARMAR_REQUIRE_ORIGIN",
-  "CARMAR_TRUST_PROXY", "CARMAR_USER_HEADER", "CARMAR_TRUSTED_PROXY",
-  "CARMAR_ALLOW_UNAUTHENTICATED", "CARMAR_PORT_STRICT",
-  "CARMAR_UPDATE_FEED", "CARMAR_UPDATE_MIRROR", "CARMAR_UPDATE_OFFLINE_DIR",
-  "CARMAR_UPDATE_MANAGED",
+  "BEATRINA_MANAGED_CONFIG",
+  "BEATRINA_ROOT", "BEATRINA_LOG", "BEATRINA_LOG_AI_TEXT",
+  "BEATRINA_CRAN_MIRROR",
+  "BEATRINA_AI_LOCAL_ONLY", "BEATRINA_AI_POLICY", "BEATRINA_AI_PROVIDERS",
+  "BEATRINA_BIND", "BEATRINA_HOSTS", "BEATRINA_ORIGINS", "BEATRINA_REQUIRE_ORIGIN",
+  "BEATRINA_TRUST_PROXY", "BEATRINA_USER_HEADER", "BEATRINA_TRUSTED_PROXY",
+  "BEATRINA_ALLOW_UNAUTHENTICATED", "BEATRINA_PORT_STRICT",
+  "BEATRINA_UPDATE_FEED", "BEATRINA_UPDATE_MIRROR", "BEATRINA_UPDATE_OFFLINE_DIR",
+  "BEATRINA_UPDATE_MANAGED",
 ]);
 
-export const MANAGED_SETTINGS_SCHEMA = "carmar-managed-settings-v1";
+export const MANAGED_SETTINGS_SCHEMA = "beatrina-managed-settings-v1";
 export const MANAGED_SETTINGS_ENV = Object.freeze([...new Set([
   ...SETTINGS.map((s) => s.env),
-  ...SETTINGS_ADMIN.filter((n) => n !== "CARMAR_MANAGED_CONFIG"),
+  ...SETTINGS_ADMIN.filter((n) => n !== "BEATRINA_MANAGED_CONFIG"),
   "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
 ])]);
 
+// An administrator's file written for Beatrina 0.8.x: its schema string and
+// its keys spell the old product name. Both are read; `managedRead` reports
+// the values under the current names, and nothing writes the old ones.
+// beatrina-names: keep-start
+const LEGACY_MANAGED_SETTINGS_SCHEMA = "carmar-managed-settings-v1";
+const LEGACY_MANAGED_KEY = /^CARMAR_/;
+// beatrina-names: keep-end
+// A key is reported as itself when the vocabulary knows it, else under its current spelling.
+const currentKey = (k) => (MANAGED_SETTINGS_ENV.includes(k) ? k : k.replace(LEGACY_MANAGED_KEY, "BEATRINA_"));
+
 export const settingsEntry = (key) => SETTINGS.find((s) => s.key === key) || null;
 
-const sysEnv = (name, unset = "") => (process.env[name] == null ? unset : String(process.env[name]));
+// Dual-read (host/env-names.mjs): every `env:` name in SETTINGS is answered
+// under its older spelling too; the page (lib/settings/kernel-pane.js) keys its
+// admin rows on the same names, in the same spelling.
+const sysEnv = envReader(process.env);
 
 // ── managed configuration ───────────────────────────────────────────────────
 
-export function managedDefaultPath(env = sysEnv, platform = process.platform) {
-  if (platform === "darwin") return "/Library/Application Support/CarmaR/managed-settings.json";
+/** The places an administrator's file is looked for on this platform, the current one first. */
+export function managedDefaultPaths(env = sysEnv, platform = process.platform) {
+  if (platform === "darwin") {
+    return ["/Library/Application Support/Beatrina/managed-settings.json",
+      "/Library/Application Support/CarmaR/managed-settings.json"];   // beatrina-names: keep — a file deployed for 0.8.x
+  }
   if (platform === "win32") {
     const base = String(env("ProgramData", "")).trim() || "C:/ProgramData";
-    return path.join(base, "CarmaR", "managed-settings.json");
+    return [path.join(base, "Beatrina", "managed-settings.json"),
+      path.join(base, "CarmaR", "managed-settings.json")];   // beatrina-names: keep — a file deployed for 0.8.x
   }
-  return "/etc/carmar/managed-settings.json";
+  return ["/etc/beatrina/managed-settings.json",
+    "/etc/carmar/managed-settings.json"];   // beatrina-names: keep — a file deployed for 0.8.x
+}
+
+/** The administrator's file: the current path, unless only the older one exists. */
+export function managedDefaultPath(env = sysEnv, platform = process.platform) {
+  const [current, ...older] = managedDefaultPaths(env, platform);
+  if (fs.existsSync(current)) return current;
+  return older.find((p) => p !== current && fs.existsSync(p)) || current;
 }
 
 /**
@@ -120,12 +154,12 @@ export function managedProtected(file, platform = process.platform) {
 export function managedRead(file, { required = false, protection = managedProtected } = {}) {
   const empty = { status: "missing", path: file, values: {}, errors: [] };
   if (!fs.existsSync(file)) {
-    if (required) return { ...empty, status: "invalid", errors: ["CARMAR_MANAGED_CONFIG names a file that does not exist."] };
+    if (required) return { ...empty, status: "invalid", errors: ["BEATRINA_MANAGED_CONFIG names a file that does not exist."] };
     return empty;
   }
   if (protection(file) !== true) {
     return { ...empty, status: "insecure",
-      errors: ["The managed settings file is writable by the current account, is a symlink, or is not administrator-owned; CarmaR refused it."] };
+      errors: ["The managed settings file is writable by the current account, is a symlink, or is not administrator-owned; Beatrina refused it."] };
   }
   let size = NaN;
   try { size = fs.statSync(file).size; } catch { size = NaN; }
@@ -138,12 +172,12 @@ export function managedRead(file, { required = false, protection = managedProtec
   const rootNames = plain ? Object.keys(raw) : null;
   const settingsPlain = plain && raw.settings && typeof raw.settings === "object" && !Array.isArray(raw.settings);
   if (!rootNames || rootNames.length !== 2 || !rootNames.includes("schema") || !rootNames.includes("settings")
-      || raw.schema !== MANAGED_SETTINGS_SCHEMA || !settingsPlain) {
+      || ![MANAGED_SETTINGS_SCHEMA, LEGACY_MANAGED_SETTINGS_SCHEMA].includes(raw.schema) || !settingsPlain) {
     return { ...empty, status: "invalid",
       errors: [`The managed settings file must use schema ${MANAGED_SETTINGS_SCHEMA} with one settings object.`] };
   }
   const keys = Object.keys(raw.settings);
-  const unknown = keys.filter((k) => !MANAGED_SETTINGS_ENV.includes(k));
+  const unknown = keys.filter((k) => !MANAGED_SETTINGS_ENV.includes(currentKey(k)));
   const bad = keys.filter((k) => {
     const v = raw.settings[k];
     return !(typeof v === "string" && v.length > 0 && !/[\r\n\t]/.test(v));
@@ -153,7 +187,7 @@ export function managedRead(file, { required = false, protection = managedProtec
   if (bad.length) errors.push(`Managed settings must be non-empty single-line strings: ${bad.join(", ")}.`);
   if (errors.length) return { ...empty, status: "invalid", errors };
   const values = {};
-  for (const k of keys) values[k] = raw.settings[k];
+  for (const k of keys) values[currentKey(k)] = raw.settings[k];
   return { status: "ok", path: file, values, errors: [] };
 }
 
@@ -162,11 +196,13 @@ export function managedRead(file, { required = false, protection = managedProtec
  * every subsystem that follows resolves under the ordinary env-wins rule.
  */
 export function managedEnvironment({ env = sysEnv, file = null, protection = managedProtected, apply = true } = {}) {
-  const explicit = String(env("CARMAR_MANAGED_CONFIG", "")).trim();
+  const explicit = String(env("BEATRINA_MANAGED_CONFIG", "")).trim();
   const target = file || (explicit || managedDefaultPath(env));
   const result = managedRead(target, { required: Boolean(explicit), protection });
   if (apply && result.status === "ok") {
-    for (const [k, v] of Object.entries(result.values)) process.env[k] = v;
+    // Under BOTH spellings: a managed value must be what every reader sees,
+    // whichever prefix it asks for.
+    for (const [k, v] of Object.entries(result.values)) setEnvName(process.env, k, v);
   }
   return result;
 }
@@ -215,6 +251,18 @@ export function validateSetting(key, value) {
     if (entry.max != null && value > entry.max) return { ok: false, reason: `must be at most ${entry.max}` };
     return { ok: true, value: Number(value) };
   }
+  if (entry.kind === "text") {
+    if (typeof value !== "string") return { ok: false, reason: "must be a string" };
+    const text = value.trim();
+    const cap = entry.max == null ? 200 : entry.max;
+    if (text.length > cap) return { ok: false, reason: `must be at most ${cap} characters` };
+    // A control character is not a typo here: this value is written into
+    // JSON-lines logs (a comment's author), and a newline in one of those
+    // forges a record. `ai-audit` strips them for the same reason; a setting
+    // can refuse instead, because a person typed it and can be told.
+    if (/[\u0000-\u001f\u007f]/.test(text)) return { ok: false, reason: "must not contain control characters" };
+    return { ok: true, value: text };
+  }
   // path
   if (typeof value !== "string") return { ok: false, reason: "must be a string" };
   // An empty path means "use the ladder" — a legitimate value, not a missing
@@ -247,7 +295,7 @@ export function readSettingsFile(file = settingsPath()) {
     return { ...empty, status: "invalid", error: "The settings file could not be read as JSON." };
   }
   if (Math.trunc(Number(raw.version || 0)) !== SETTINGS_VERSION) {
-    return { ...empty, status: "invalid", error: "The settings file is a version this CarmaR does not know." };
+    return { ...empty, status: "invalid", error: "The settings file is a version this Beatrina does not know." };
   }
   const block = raw.settings == null ? {} : raw.settings;
   if (typeof block !== "object" || Array.isArray(block)) {
@@ -298,7 +346,7 @@ export function resolveSettings({ env = sysEnv, file = null } = {}) {
     if (fromEnv) {
       source = "env";
       if (s.kind === "bool") {
-        // CARMAR_NO_HISTORY is a NEGATIVE flag — any value means "off" — while
+        // BEATRINA_NO_HISTORY is a NEGATIVE flag — any value means "off" — while
         // the file and the UI hold the positive. Translating happens here, once.
         value = s.inverted ? false : true;
       } else if (s.kind === "number") {
@@ -330,10 +378,10 @@ export const settingsValue = (resolved, key) => (resolved.settings[key] ? resolv
 export function settingsChildEnv(resolved) {
   const out = {};
   const q = settingsValue(resolved, "quarto_path");
-  if (typeof q === "string" && q.length) out.CARMAR_QUARTO = q;
+  if (typeof q === "string" && q.length) out.BEATRINA_QUARTO = q;
   const b = settingsValue(resolved, "analyze_budget_s");
-  if (typeof b === "number") out.CARMAR_ANALYZE_BUDGET = String(b);
-  return out;
+  if (typeof b === "number") out.BEATRINA_ANALYZE_BUDGET = String(b);
+  return mirrorEnv(out);   // a child that still reads BEATRINA_QUARTO sees it
 }
 
 /**
@@ -359,7 +407,7 @@ export function createSettings({ env = sysEnv, applyManaged = true } = {}) {
     /** Which R the worker, the analyzer and every job child should run. */
     rscriptPreference() {
       const chosen = api.value("rscript_path");
-      return typeof chosen === "string" && chosen.length ? chosen : String(env("CARMAR_RSCRIPT", ""));
+      return typeof chosen === "string" && chosen.length ? chosen : String(env("BEATRINA_RSCRIPT", ""));
     },
     /**
      * The idle clock. The same safe default applies locally and behind a proxy:

package/host/update-record.mjs

@@ -8,12 +8,13 @@
 // puts `update_available` on /health and on the ready frame only when the recorded version is newer
 // than the build that is running, and the page says it (lib/info-pane.js, lib/doctor.js).
 //
-// CARMAR_NO_UPDATE_CHECK=1 or BEATRINA_NO_UPDATE_CHECK=1 turns the reading off as well as the asking
+// BEATRINA_NO_UPDATE_CHECK=1 (or its older spelling) turns the reading off as well as the asking
 // (the battery runner sets the first), so no test kernel reports a version some real run recorded.
 
 import fs from "node:fs";
 import path from "node:path";
 import { rUserDir } from "./user-dirs.mjs";
+import { readEnv } from "./env-names.mjs";
 
 /** -1, 0, 1 for semver-shaped versions; a pre-release sorts before its release; nonsense compares equal. */
 export function compareVersions(a, b) {
@@ -38,7 +39,7 @@ export function updateRecordFile(app) {
 
 /** The check is off: nothing is asked and nothing is read. */
 export function updateCheckOff(env = process.env) {
-  return env.BEATRINA_NO_UPDATE_CHECK === "1" || env.CARMAR_NO_UPDATE_CHECK === "1";
+  return readEnv(env, "NO_UPDATE_CHECK") === "1";
 }
 
 /**

package/host/user-dirs.mjs

@@ -7,7 +7,7 @@
 //   data     the console history, the appearance carry, the document journal,
 //            the AI conversation store
 //
-// serve.R reaches them through `tools::R_user_dir("carmar", which)`, and every
+// serve.R reaches them through `tools::R_user_dir("beatrina", which)`, and every
 // suite in the battery relocates them for a test by setting `R_USER_CONFIG_DIR`
 // / `R_USER_DATA_DIR` — the variables R itself honours. So the host cannot
 // invent its own layout: a JavaScript supervisor writing to `~/.beatrix` would
@@ -20,21 +20,30 @@
 // leaving one arm out is how the next store to need it quietly grows a second
 // layout.
 
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { envReader } from "./env-names.mjs";
 
-const envOf = (name) => (process.env[name] == null ? "" : String(process.env[name]));
+const envOf = envReader(process.env);   // dual-read: BEATRINA_STATE or its older spelling (host/env-names.mjs)
 
 /**
  * Which R package's folders this host keeps its data, settings and caches in.
  *
- * "carmar" unless BEATRIX_APP_ID names another: the `beatrina` command sets
- * it to "beatrina" (tools/npm/bin/beatrina.mjs), so a Beatrina installed
- * beside CarmaR keeps its OWN settings, AI key, console history, document
- * history, plugins and caches instead of reading and writing CarmaR's. The
- * kernel runtime directory (~/.carmar/run) is deliberately NOT keyed on it:
- * it is how the Sessions pane and the MCP bridge find every running kernel.
+ * "beatrina" unless BEATRIX_APP_ID names another (the suites do). Every door
+ * of the product — the `beatrina` command, the pip package, the R package, a
+ * bare `node host/main.mjs` — therefore lands in the same folders.
+ * beatrina-names: keep-start — the OTHER product is named here on purpose. It is
+ * the whole subject of the sentence, and renaming it left this comment saying
+ * that Beatrina does not read Beatrina's own folders.
+ * The other product's folders (`R/carmar`, CarmaR's own, frozen at 0.8.6) are
+ * never read, moved or written: a Beatrina installed beside CarmaR keeps its OWN
+ * settings, AI key, console history, document history, plugins and caches.
+ * beatrina-names: keep-end
+ * The kernel runtime directory (~/.beatrina/run, host/runtime-dir.mjs) is
+ * deliberately NOT keyed on it: it is how the Sessions pane and the MCP bridge
+ * find every running kernel.
  * A value that is not an R package name is refused, loudly — a typo must not
  * quietly become a third data folder.
  *
@@ -43,7 +52,7 @@ const envOf = (name) => (process.env[name] == null ? "" : String(process.env[nam
  */
 export function appId(env = envOf) {
   const id = String(env("BEATRIX_APP_ID") || "").trim();
-  if (!id) return "carmar";
+  if (!id) return "beatrina";
   if (!/^[A-Za-z][A-Za-z0-9.]*[A-Za-z0-9]$/.test(id)) {
     throw new Error(`BEATRIX_APP_ID must be an R package name (letters, digits and dots); it is ${JSON.stringify(id)}.`);
   }
@@ -53,28 +62,31 @@ export function appId(env = envOf) {
 /**
  * `tools::R_user_dir(package, which)`.
  *
- * @param {string} pkg          the package name ("carmar")
+ * @param {string} pkg          the package name ("beatrina")
  * @param {"data"|"config"|"cache"} which
+ * @param {(name: string) => string} [env]  an env reader, for callers that
+ *   inject one (the plugin store's layer paths are computed per request, and
+ *   its suites relocate them with R_USER_DATA_DIR). Defaults to this module's.
  * @returns {string} an absolute directory path (NOT created)
  */
-export function rUserDir(pkg, which = "data") {
+export function rUserDir(pkg, which = "data", env = envOf) {
   const home = os.homedir();
   const windows = process.platform === "win32";
   const darwin = process.platform === "darwin";
   let base = "";
   if (which === "data") {
-    base = envOf("R_USER_DATA_DIR") || envOf("XDG_DATA_HOME")
-      || (windows ? path.join(envOf("APPDATA"), "R", "data")
+    base = env("R_USER_DATA_DIR") || env("XDG_DATA_HOME")
+      || (windows ? path.join(env("APPDATA"), "R", "data")
         : darwin ? path.join(home, "Library", "Application Support", "org.R-project.R")
           : path.join(home, ".local", "share"));
   } else if (which === "config") {
-    base = envOf("R_USER_CONFIG_DIR") || envOf("XDG_CONFIG_HOME")
-      || (windows ? path.join(envOf("APPDATA"), "R", "config")
+    base = env("R_USER_CONFIG_DIR") || env("XDG_CONFIG_HOME")
+      || (windows ? path.join(env("APPDATA"), "R", "config")
         : darwin ? path.join(home, "Library", "Preferences", "org.R-project.R")
           : path.join(home, ".config"));
   } else {
-    base = envOf("R_USER_CACHE_DIR") || envOf("XDG_CACHE_HOME")
-      || (windows ? path.join(envOf("LOCALAPPDATA"), "R", "cache")
+    base = env("R_USER_CACHE_DIR") || env("XDG_CACHE_HOME")
+      || (windows ? path.join(env("LOCALAPPDATA"), "R", "cache")
         : darwin ? path.join(home, "Library", "Caches", "org.R-project.R")
           : path.join(home, ".cache"));
   }
@@ -94,7 +106,7 @@ export function ensureUserDir(pkg, which) {
  * variable is unset.
  */
 export function stateDir() {
-  return envOf("CARMAR_STATE") || rUserDir(appId(), "data");
+  return envOf("BEATRINA_STATE") || rUserDir(appId(), "data");
 }
 
 /**
@@ -115,3 +127,33 @@ export function privateModeHeld(file, platform = process.platform) {
   if (platform === "win32") return true;
   return (fs.statSync(file).mode & 0o777) === 0o600;
 }
+
+/**
+ * Replace `file` with `text`, privately and atomically.
+ *
+ * A sibling is written 0600, checked (`privateModeHeld`), and renamed over the
+ * file — so an interrupted write leaves the PREVIOUS file intact rather than a
+ * half-written one, and no reader ever sees the file mid-write. The AI store's
+ * rule (host/planes/ai-store.mjs), lifted here for the small per-user records
+ * that are rewritten whole: the recent-documents list first. The directory is
+ * created on the way; a failure at any step throws with that step's sentence
+ * and takes the sibling with it. No fsync: safe against the process dying,
+ * not the machine.
+ *
+ * @param {string} file  absolute path of the record
+ * @param {string} text  its whole new content
+ */
+export function writePrivateAtomic(file, text) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const temp = path.join(dir, `.${path.basename(file)}.${process.pid}-${crypto.randomBytes(6).toString("hex")}`);
+  try {
+    fs.writeFileSync(temp, Buffer.from(String(text), "utf8"), { mode: 0o600 });
+    fs.chmodSync(temp, 0o600);
+    if (!privateModeHeld(temp)) throw new Error(`could not make ${path.basename(file)} private (0600)`);
+    fs.renameSync(temp, file);
+  } catch (e) {
+    try { fs.unlinkSync(temp); } catch { /* never written, or already renamed into place */ }
+    throw e;
+  }
+}

package/host/which.mjs

@@ -0,0 +1,39 @@
+// which.mjs — find an executable on PATH, synchronously, with no shell.
+//
+// `Sys.which()` for the host. Lifted out of planes/update.mjs the day a second
+// plane (planes/choose.mjs, the OS file panel) needed the same answer, so the
+// two cannot drift on what "on PATH" means. Nothing here spawns anything: a
+// candidate is a file the current user may execute, found by walking PATH in
+// order, exactly as the shell would resolve the bare name.
+//
+// Windows resolves a bare name through PATHEXT (`powershell` → `powershell.exe`),
+// so a name without an extension is tried with each of those too; a name that
+// already carries one is tried as given first.
+
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * @param {string} name  a bare command name ("osascript", "powershell.exe")
+ * @param {Record<string,string|undefined>} [env]  the environment whose PATH is walked
+ * @returns {string} the first executable found, or "" when there is none
+ */
+export function whichSync(name, env = process.env) {
+  if (typeof name !== "string" || !name) return "";
+  const dirs = String(env.PATH || env.Path || "").split(path.delimiter).filter(Boolean);
+  const exts = process.platform === "win32" && !path.extname(name)
+    ? ["", ...String(env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean)]
+    : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const cand = path.join(dir, name + ext);
+      try {
+        fs.accessSync(cand, fs.constants.X_OK);
+        if (fs.statSync(cand).isFile()) return cand;
+      } catch { /* not here; the next candidate */ }
+    }
+  }
+  return "";
+}
+
+export default whichSync;

package/host/windows-runtime.mjs

@@ -21,7 +21,7 @@
 //     processx ships exactly that program, `interrupt.exe <pid> c`
 //     (processx/src/tools/interrupt.c: FreeConsole → AttachConsole(pid) →
 //     ignore Ctrl+C itself → GenerateConsoleCtrlEvent(CTRL_C_EVENT, 0)), and
-//     processx is already a dependency of the carmar package, so the helper is
+//     processx is already a dependency of the beatrina package, so the helper is
 //     on every machine that installed it. For the event to reach the worker
 //     and not the host, the worker needs a console of its own: it is spawned
 //     with `windowsHide` (CREATE_NO_WINDOW), the flag processx uses too.
@@ -38,6 +38,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { readEnv } from "./env-names.mjs";
 
 const defaultFs = {
   exists: (p) => { try { return fs.existsSync(p); } catch { return false; } },
@@ -104,7 +105,8 @@ export function detectRterm(rscript, io = defaultFs) {
 export const RTERM_INTERACTIVE_ARGS = Object.freeze(["--ess", "--no-echo", "--no-save", "--no-restore", "--no-site-file"]);
 
 /**
- * Where processx's `interrupt.exe` is. `CARMAR_WIN_INTERRUPT` first (the R
+ * Where processx's `interrupt.exe` is. `BEATRINA_WIN_INTERRUPT` (or the old
+ * `BEATRINA_WIN_INTERRUPT`) first (the R
  * launcher sets it from `system.file(package = "processx")`, which knows every
  * library path), then a helper shipped beside the host, then the libraries a
  * default install writes to: the R installation's own, R_LIBS_USER, and
@@ -115,7 +117,8 @@ export function findInterruptTool({ env = process.env, rscript = "", hostRoot =
   const w = path.win32;
   const tail = ["processx", "bin", "x64", "interrupt.exe"];
   const cands = [];
-  if (env.CARMAR_WIN_INTERRUPT) cands.push(env.CARMAR_WIN_INTERRUPT);
+  const told = readEnv(env, "WIN_INTERRUPT");
+  if (told) cands.push(told);
   if (hostRoot) cands.push(w.join(hostRoot, "bin", "interrupt.exe"));
   if (rscript) cands.push(w.join(w.dirname(w.dirname(rscript)), "library", ...tail));
   if (env.R_HOME) cands.push(w.join(env.R_HOME, "library", ...tail));

package/host/worker-plane.mjs

@@ -46,7 +46,8 @@ export const WORKER_DEADLINES = Object.freeze({
   package_help: WORKER_DEADLINE_FAST, project_status: WORKER_DEADLINE_FAST, rm: WORKER_DEADLINE_FAST,
   debug_breaks: WORKER_DEADLINE_FAST, files: WORKER_DEADLINE_FAST, mkdir: WORKER_DEADLINE_FAST,
   renamepath: WORKER_DEADLINE_FAST, sniff: WORKER_DEADLINE_FAST,
-  view: WORKER_DEADLINE_SLOW, colstats: WORKER_DEADLINE_SLOW, import: WORKER_DEADLINE_SLOW,
+  view: WORKER_DEADLINE_SLOW, colstats: WORKER_DEADLINE_SLOW, column_values: WORKER_DEADLINE_SLOW,
+  import: WORKER_DEADLINE_SLOW,
   format: WORKER_DEADLINE_SLOW, doctor: WORKER_DEADLINE_SLOW, readfile: WORKER_DEADLINE_SLOW,
   writefile: WORKER_DEADLINE_SLOW, writefiles_atomic: WORKER_DEADLINE_SLOW,
   copypath: WORKER_DEADLINE_SLOW, deletepath: WORKER_DEADLINE_SLOW, revealpath: WORKER_DEADLINE_SLOW,
@@ -331,10 +332,29 @@ export class WorkerPlane extends EventEmitter {
     this.gaveUp = false;
     this.notice = null;
     this.resumePending = keepTokenOk(resume) ? resume : null;
-    await this.start();
+    try { await this.start(); } catch (e) { this.refuseStart(e); throw e; }
   }
 
-  /** A token for the next ready worker (a handoff successor's CARMAR_RESUME_TOKEN). */
+  /**
+   * A start that could not happen, said to every page instead of left as a spinner. Restart R used
+   * to reject into server.mjs's audit line and nothing else, so the page waited for a ready that
+   * would never come. A payload that drifted under this session (host/payload.mjs) lands here too,
+   * and its sentence already names the door out ("Restart into").
+   */
+  refuseStart(e) {
+    const drift = e && e.code === "BEATRINA_PAYLOAD_DRIFT";
+    this.recovering = false;
+    this.gaveUp = true;
+    const message = drift ? e.message
+      : `${this.label} would not start: ${e && e.message ? e.message : e}. Beatrina is still running — the notebook, `
+        + "your text and Save all work. Restart to try again.";
+    this.audit(drift ? "worker-start-refused" : "worker-start-failed", { detail: e && e.message ? e.message : String(e) });
+    this.notice = enc({ type: "worker-died", engine: this.name, recovering: false, terminal: true,
+      attempts: this.restartAttempts, message, reason: drift ? "payload-drift" : "start-failed" });
+    this.emit("broadcast", this.notice);
+  }
+
+  /** A token for the next ready worker (a handoff successor's BEATRINA_RESUME_TOKEN). */
   setResumePending(token) { this.resumePending = keepTokenOk(token) ? token : null; }
 
   /**
@@ -500,12 +520,12 @@ export class WorkerPlane extends EventEmitter {
       try { this.engine.debugCommand(action, expr); } catch { /* the exit event reports it */ }
       return undefined;
     }
-    const line = { continue: "c", over: "n", into: "s", out: "f", where: ".carmar_debug_where()",
-      abort: 'invokeRestart("carmar_abort_cell")', eval: scalarChr(cmd.expr) ? cmd.expr : null }[action] ?? null;
+    const line = { continue: "c", over: "n", into: "s", out: "f", where: ".beatrina_debug_where()",
+      abort: 'invokeRestart("beatrina_abort_cell")', eval: scalarChr(cmd.expr) ? cmd.expr : null }[action] ?? null;
     if (line == null || /[\n\r]/.test(line) || line.length > 4000) return err("bad debug command");
     this.audit("debug_cmd", { action });
     try { this.engine.console(line); } catch { /* the exit event reports it */ }
-    if (["over", "into", "out"].includes(action)) { try { this.engine.console(".carmar_debug_where()"); } catch { /* same */ } }
+    if (["over", "into", "out"].includes(action)) { try { this.engine.console(".beatrina_debug_where()"); } catch { /* same */ } }
     return undefined;
   }
 
@@ -651,6 +671,14 @@ export class WorkerPlane extends EventEmitter {
     let started = null;
     try { started = this.start(); } catch (e) { this.audit("worker-respawn-failed", { attempt, detail: e.message }); }
     if (!started) return;
+    // start() is async: a factory or spawnPlan throwing rejects its promise.
+    // Keep recovery's bounded retry loop alive instead of terminating Node
+    // with an unhandled rejection when an installation moves mid-session.
+    started.catch((e) => {
+      this.audit("worker-respawn-failed", { attempt, detail: e.message });
+      // Retrying cannot un-replace the files: say so now rather than after six attempts.
+      if (e && e.code === "BEATRINA_PAYLOAD_DRIFT") this.refuseStart(e);
+    });
     this.audit("worker-respawn", { attempt });
     this.emit("broadcast", enc({ type: "worker-restarting", engine: this.name, attempt }));
   }

package/host/ws.mjs

@@ -1,7 +1,7 @@
 // ws.mjs — a WebSocket SERVER, RFC 6455, over Node's http upgrade event.
 //
 // Node ships a WebSocket client (>= 22) and no server, and the host has no
-// dependencies by decision (tools/mcp/carmar-mcp.mjs and test/fixtures/
+// dependencies by decision (tools/mcp/beatrina-mcp.mjs and test/fixtures/
 // ws-origin.mjs set the precedent: a few hundred lines of protocol beat a
 // package the security review must then read). What this implements is the
 // subset a notebook page uses: text frames, masked client → unmasked server,
@@ -29,6 +29,8 @@ const MAX_MESSAGE_BYTES = 16 * 1024 * 1024;
  * @property {(code?: number, reason?: string) => void} close
  * @property {(fn: (text: string) => void) => void} onMessage
  * @property {(fn: () => void) => void} onClose
+ * @property {() => boolean} ping        a protocol ping (opcode 9); the peer's network stack answers it
+ * @property {(fn: () => void) => void} onPong   called for each pong the peer sends back
  * @property {import("node:http").IncomingMessage} request  the upgrade request, kept —
  *   the gate's reasoning is recomputed from it (socket_class in serve.R)
  * @property {boolean} open
@@ -74,6 +76,7 @@ function wrap(raw, request, head) {
   let open = true;
   let closeSent = false;
   const messageHandlers = [];
+  const pongHandlers = [];
   const closeHandlers = [];
 
   const finish = () => {
@@ -138,7 +141,9 @@ function wrap(raw, request, head) {
         return;
       }
       if (opcode === 0x9) { sendFrame(0xa, payload); continue; }   // ping → pong
-      if (opcode === 0xa) continue;                                 // pong: a reply to nothing we sent
+      // A pong answers the reaper's ping (server.mjs): the peer's network stack sent it, so the
+      // transport is alive even when the page's own thread is busy or throttled and sends nothing.
+      if (opcode === 0xa) { for (const fn of pongHandlers) fn(); continue; }
       if (opcode === 0x1 || opcode === 0x2) {
         if (partial) return closeWith(1002, "interleaved message");
         partial = { opcode, chunks: [payload], bytes: payload.length };
@@ -169,6 +174,8 @@ function wrap(raw, request, head) {
     close: (code = 1000, reason = "") => closeWith(code, reason),
     onMessage: (fn) => { messageHandlers.push(fn); },
     onClose: (fn) => { closeHandlers.push(fn); },
+    ping: () => sendFrame(0x9, Buffer.alloc(0)),
+    onPong: (fn) => { pongHandlers.push(fn); },
   };
 }