@crouton-kit/crouter 0.3.33 → 0.3.34

package/dist/daemon/__tests__/predicate-eval.test.js

@@ -0,0 +1,109 @@
+// Regression for final-integrated-verdict Major #1: a predicate whose script
+// writes more than STDOUT_CAP_BYTES to stdout AND exits non-zero must be
+// RESCHEDULED (stay armed), never fired and never stuck running. Before the
+// fix, `finish()` in `src/daemon/predicate-eval.ts` checked `overflowed`
+// BEFORE the exit-code branch, so any verbose non-zero predicate got consumed
+// on its first poll. The fix gates the overflow check on `code === 0 &&
+// stdoutIsBody`. Drives the REAL `evaluateDuePredicates` — no child_process
+// mocking, a real subprocess is spawned.
+import { test, before, beforeEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode, closeDb, armTrigger, listTriggers } from '../../core/canvas/index.js';
+import { evaluateDuePredicates } from '../predicate-eval.js';
+let home;
+function node(id, cwd) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-predicate-eval-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+/** Poll a trigger's row (via listTriggers) until an evaluation has completed
+ *  (`last_exit` set) or the timeout elapses. Fire-and-forget evaluation
+ *  settles asynchronously off a real child process. */
+async function waitForEvalSettled(nodeId, timeoutMs = 5000) {
+    const start = Date.now();
+    for (;;) {
+        const rows = listTriggers({ node: nodeId });
+        if (rows.length > 0 && rows[0].last_exit !== null)
+            return;
+        if (Date.now() - start > timeoutMs)
+            throw new Error('timed out waiting for predicate evaluation to settle');
+        await new Promise((r) => setTimeout(r, 50));
+    }
+}
+test('a >16KiB-stdout, non-zero-exit predicate stays armed (rescheduled, not fired/stuck)', async () => {
+    const meta = createNode(node('target-1', home));
+    const trigger_id = 'trig-overflow-nonzero';
+    armTrigger({
+        trigger_id,
+        node_id: meta.node_id,
+        owner_id: meta.node_id,
+        action: 'msg',
+        action_mode: 'inbox_message',
+        trigger_type: 'when',
+        when_script: `node -e "process.stdout.write('x'.repeat(20000)); process.exit(1)"`,
+        eval_every: JSON.stringify({ every: '1m' }),
+        next_eval_at: new Date(Date.now() - 1000).toISOString(),
+        payload: { label: 'test' },
+    });
+    const outcomes = [];
+    evaluateDuePredicates(Date.now(), (o) => outcomes.push(o));
+    await waitForEvalSettled(meta.node_id);
+    // Nothing fired/canceled: onDone was never invoked for this trigger.
+    assert.equal(outcomes.length, 0);
+    // The trigger row still exists (still armed), rescheduled to idle with the
+    // non-zero exit recorded — not stuck 'running'.
+    const rows = listTriggers({ node: meta.node_id });
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].trigger_id, trigger_id);
+    assert.equal(rows[0].eval_state, 'idle');
+    assert.notEqual(rows[0].last_exit, 0);
+});
+test('sanity: a small-output exit-0 predicate fires and is consumed', async () => {
+    const meta = createNode(node('target-2', home));
+    const trigger_id = 'trig-fires-clean';
+    armTrigger({
+        trigger_id,
+        node_id: meta.node_id,
+        owner_id: meta.node_id,
+        action: 'msg',
+        action_mode: 'inbox_message',
+        trigger_type: 'when',
+        when_script: `echo ok`,
+        eval_every: JSON.stringify({ every: '1m' }),
+        next_eval_at: new Date(Date.now() - 1000).toISOString(),
+        payload: { label: 'test' },
+    });
+    const outcomes = [];
+    evaluateDuePredicates(Date.now(), (o) => outcomes.push(o));
+    const start = Date.now();
+    while (outcomes.length === 0 && Date.now() - start < 5000) {
+        await new Promise((r) => setTimeout(r, 50));
+    }
+    assert.equal(outcomes.length, 1);
+    assert.equal(outcomes[0].kind, 'fired');
+    // Consumed: the trigger row is gone.
+    assert.equal(listTriggers({ node: meta.node_id }).length, 0);
+});

package/dist/daemon/crtrd.js

@@ -50,13 +50,14 @@ import { writeFileSync, readFileSync, rmSync, existsSync, mkdirSync, statSync, }
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { crtrHome, nodeDir, jobDir } from '../core/canvas/paths.js';
-import { listNodes, getRow, getNode, dueWakes, consumeWake, advanceWake, listFocuses, closeFocusRow, } from '../core/canvas/index.js';
+import { listNodes, getRow, getNode, dueClockTriggers, consumeTrigger, advanceTrigger, listFocuses, closeFocusRow, pruneToLimit, } from '../core/canvas/index.js';
 import { transition } from '../core/runtime/lifecycle.js';
 import { isBusy } from '../core/runtime/busy.js';
 import { FAULT_QUIET_MS } from '../core/runtime/fault.js';
 import { logger } from '../core/log.js';
 export { FAULT_QUIET_MS };
 import { isPidAlive } from '../core/canvas/pid.js';
+import { reconcileBootLiveness } from '../core/canvas/boot.js';
 import { listLivePanes, tearDownNode } from '../core/runtime/placement.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { isBrokerLive } from '../core/runtime/model-swap.js';
@@ -66,6 +67,7 @@ import { wakeOriginFrom } from '../core/runtime/bearings.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { appendInbox, readInboxSince, readCursor } from '../core/feed/inbox.js';
 import { nextSlotAfter } from '../core/wake.js';
+import { evaluateDuePredicates, reapTimedOutPredicates, recoverStalePredicateLeases, predicateCapacity, } from './predicate-eval.js';
 /** Surface a vehicle that never booted.
  *
  *  `spawnChild` returns status="active" the instant the tmux window opens — it
@@ -87,6 +89,18 @@ async function surfaceBootFailure(meta) {
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
 const DEFAULT_INTERVAL_MS = 2000;
+// Count-based auto-prune of the canvas (pruneToLimit). The canvas grows
+// unbounded — the TTL `crtr canvas prune` is manual, so without this a long-lived
+// daemon's canvas accumulates thousands of terminal nodes, making every scan +
+// `canvas snapshot` expensive. Keep the AUTO_PRUNE_MAX most-recently-active nodes
+// (live nodes are NEVER deleted, so the real floor is max(AUTO_PRUNE_MAX,
+// liveCount)). It's a DB sweep, not per-tick work — throttled to PRUNE_INTERVAL_MS.
+const AUTO_PRUNE_MAX = 2000;
+const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
+// Last auto-prune wall-clock. -Infinity so the FIRST tick after start runs it
+// (the canvas may already be huge at boot); thereafter every PRUNE_INTERVAL_MS.
+// In-memory only — a daemon restart re-runs it once, which is harmless.
+let lastPruneAt = Number.NEGATIVE_INFINITY;
 const log = logger('crtrd');
 // How long a node's broker pid may be observed dead before the daemon revives
 // it. MUST exceed worst-case broker boot time: a refresh / crash-revive
@@ -116,13 +130,13 @@ const KILL_ESCALATE_MS = 20_000;
 // unhealthySince — a daemon restart resets them (worst case: one extra grace).
 const yieldStallSince = new Map();
 const yieldTermAt = new Map();
-// Wake-failure dedup latch (third pass): wakeup_ids we've already fail-loud
+// Trigger-failure dedup latch (third pass): trigger_ids we've already fail-loud
 // notified about, so a permanently-broken spawn-cron (or a quarantined recurrence)
 // notifies the armer ONCE and then stays quiet until the next success or cancel —
 // the unrotated, append-only inbox.jsonl must not be flooded (Min-9). In-memory
 // only, like unhealthySince; a daemon restart resets it (worst case: one repeat
 // notice). A successful spawn clears its entry so a future failure re-notifies.
-const notifiedWakeFailures = new Set();
+const notifiedTriggerFailures = new Set();
 /** Refresh-stall decision (§H refresh-authority; audit 2026-06-09, Bug 1 — node
  *  mq5v9hfa-74493d45 and siblings; stuck-refresh — parent mq7s5o93): a `node
  *  yield` / refresh records intent='refresh' and relies on the in-process
@@ -293,6 +307,11 @@ export function livenessVerdict(piPidAlive, deadFor) {
  *      revives it fresh. Fault recovery now runs in a separate pass: live,
  *      daemon-owned provider faults are retried by inbox nudge, while dead-pid
  *      crashes still fall through the ordinary resume path below.
+ *    • pid null + intent==='idle-release' → dormant by choice; its pid may have
+ *      just been cleared by boot reconciliation, but a null pid here is still
+ *      that chosen dormancy, not a stranded relaunch — leave it, the second pass
+ *      revives (resume) on the next unseen inbox entry (mirrors the dead-pid
+ *      idle-release case).
  *    • pid null + pi_session_id set (a relaunch in flight — reviveNode clears
  *      pi_pid right after launch) → leave through a boot grace; a healthy engine
  *      re-records its pid well within it. If the grace ELAPSES with still no pid,
@@ -345,6 +364,18 @@ async function handleNodeLiveness(row, now, revivedThisTick) {
             unhealthySince.delete(id); // row gone from meta — nothing to supervise
             return;
         }
+        // Dormant by choice: an idle-release node freed itself while dormant. Boot
+        // reconciliation may have just cleared its recorded pid to null, but a null
+        // pid here is still that chosen dormancy — NOT a stranded relaunch and NOT a
+        // failed boot. Honor it exactly like the dead-pid idle-release branch below:
+        // leave it idle; the second pass revives it (resume) the moment its inbox
+        // gains an unseen entry. Without this, boot reconciliation clearing the pid
+        // would drop this node into the boot-grace path and spuriously wake it after
+        // the grace with no work waiting.
+        if (row.intent === 'idle-release') {
+            unhealthySince.delete(id);
+            return;
+        }
         const since = unhealthySince.get(id);
         if (since === undefined) {
             unhealthySince.set(id, now); // start the boot grace clock
@@ -405,19 +436,20 @@ async function handleNodeLiveness(row, now, revivedThisTick) {
     reviveNode(id, { resume: true });
     revivedThisTick.add(id); // third-pass bare double-spawn guard (Maj-4)
 }
-/** Fail loud for a drifted/broken wake (design §6.6/Q5): wake the ARMER DIRECTLY
- *  via appendInbox — NOT pushUrgent, which fans to subscribersOf(owner), and a
- *  DETACHED spawn has no subscribers (so the armer would never be reached); the
- *  literal {from:null} is also a type error for pushUrgent. Deduped per wakeup_id
- *  (notify once, suppress until the next success/cancel via notifiedWakeFailures)
- *  so a broken spawn-cron can't flood the unrotated inbox.jsonl. Falls back to a
- *  loud daemon-log line when the owner no longer resolves to a node. */
-function failLoudWake(w, label, body) {
-    if (notifiedWakeFailures.has(w.wakeup_id))
+/** Fail loud for a drifted/broken trigger (design §6.6/Q5): wake the ARMER
+ *  DIRECTLY via appendInbox — NOT pushUrgent, which fans to subscribersOf(owner),
+ *  and a DETACHED spawn has no subscribers (so the armer would never be
+ *  reached); the literal {from:null} is also a type error for pushUrgent.
+ *  Deduped per trigger_id (notify once, suppress until the next success/cancel
+ *  via notifiedTriggerFailures) so a broken spawn-cron can't flood the
+ *  unrotated inbox.jsonl. Falls back to a loud daemon-log line when the owner
+ *  no longer resolves to a node. */
+function failLoudTrigger(t, label, body) {
+    if (notifiedTriggerFailures.has(t.trigger_id))
         return;
-    notifiedWakeFailures.add(w.wakeup_id);
-    if (getRow(w.owner_id) !== null) {
-        appendInbox(w.owner_id, {
+    notifiedTriggerFailures.add(t.trigger_id);
+    if (getRow(t.owner_id) !== null) {
+        appendInbox(t.owner_id, {
             from: null,
             tier: 'urgent',
             kind: 'urgent',
@@ -426,7 +458,63 @@ function failLoudWake(w, label, body) {
         });
     }
     else {
-        process.stderr.write(`[crtrd] wake ${w.wakeup_id} failed (owner ${w.owner_id} gone): ${body}\n`);
+        process.stderr.write(`[crtrd] trigger ${t.trigger_id} failed (owner ${t.owner_id} gone): ${body}\n`);
+    }
+}
+/** Notify the owner once for a settled (already-consumed) predicate outcome —
+ *  never deduped like failLoudTrigger, because the trigger is gone by the time
+ *  this fires so there is no repeat-notification risk to guard against. */
+function notifyOwnerUrgent(t, label, body) {
+    if (getRow(t.owner_id) !== null) {
+        appendInbox(t.owner_id, { from: null, tier: 'urgent', kind: 'urgent', label, data: { body } });
+    }
+    else {
+        process.stderr.write(`[crtrd] trigger ${t.trigger_id} notice undelivered (owner ${t.owner_id} gone): ${body}\n`);
+    }
+}
+/** Settle a predicate outcome onto the SAME enactment paths pass 3 uses
+ *  (appendInbox / spawnChild) — fresh_revive/deadline_message never reach here
+ *  (the command surface never pairs `--when` with those action_modes; see the
+ *  spec's valid flag matrix). stdout_overflow/target_gone are terminal
+ *  failures the trigger was already consumed for by predicate-eval.ts —  this
+ *  only sends the owner notice. */
+async function handlePredicateOutcome(outcome) {
+    const t = outcome.trigger;
+    if (outcome.kind === 'stdout_overflow') {
+        notifyOwnerUrgent(t, '⚠ predicate stdout too large', `Trigger ${t.trigger_id}'s predicate exceeded the 16 KiB stdout limit — the action was not delivered and the trigger has been canceled.`);
+        return;
+    }
+    if (outcome.kind === 'target_gone') {
+        notifyOwnerUrgent(t, '⚠ predicate target gone', `Trigger ${t.trigger_id}'s target no longer exists — the trigger has been canceled.`);
+        return;
+    }
+    // outcome.kind === 'fired'
+    if (t.action === 'msg' && t.action_mode === 'inbox_message') {
+        const p = t.payload;
+        const body = (p.body ?? outcome.stdout).trim();
+        if (body === '') {
+            notifyOwnerUrgent(t, '⚠ predicate fired with no message', `Trigger ${t.trigger_id}'s predicate exited 0 but produced no body (no supplied body, empty stdout) — nothing was delivered.`);
+            return;
+        }
+        if (t.node_id == null)
+            return; // integrity backstop only — armTrigger requires a target here
+        appendInbox(t.node_id, {
+            from: t.owner_id ?? null,
+            tier: p.tier ?? 'normal',
+            kind: 'message',
+            label: `⏰ predicate fired — ${p.label}`,
+            data: { body },
+        });
+    }
+    else if (t.action === 'new' && t.action_mode === 'node_birth') {
+        const recipe = t.payload;
+        try {
+            await spawnChild({ ...recipe, wakeOrigin: wakeOriginFrom(t) });
+        }
+        catch (err) {
+            failLoudTrigger(t, '⚠ deferred predicate spawn failed', `Deferred spawn (${recipe.kind} @ ${recipe.cwd}) failed after its predicate fired: ` +
+                `${err.message}\n\nRe-home (fix the cwd/parent) or re-arm the trigger.`);
+        }
     }
 }
 // How long a dead node's on-disk record must have been QUIET (no meta/telemetry
@@ -642,143 +730,142 @@ export async function superviseTick(now = Date.now()) {
             process.stderr.write(`[crtrd] error polling inbox ${row.node_id}: ${err.message}\n`);
         }
     }
-    // Third pass: FIRE DUE SCHEDULED WAKES (the wakeups engine, migration v7).
+    // Third pass: FIRE DUE CLOCK TRIGGERS (the triggers engine, migration v9).
     // Runs immediately AFTER the inbox second pass — the ordering is load-bearing
     // (design §6.4): a same-tick inbox revive runs cancelDeadlinesFor (inside
-    // reviveNode) BEFORE this pass's dueWakes query, so an event that wins a
-    // deadline deletes its row before it can fire. The pass-2 inbox loop above is
-    // otherwise untouched (design D3) — it stays the generic wake-on-message path
-    // that noted/deadline rely on; the only addition is the revivedThisTick.add
-    // observation that the bare branch below needs to avoid a double-spawn.
+    // reviveNode) BEFORE this pass's dueClockTriggers query, so an event that wins
+    // a deadline deletes its row before it can fire. The pass-2 inbox loop above
+    // is otherwise untouched (design D3) — it stays the generic wake-on-message
+    // path that inbox_message/deadline_message rely on; the only addition is the
+    // revivedThisTick.add observation that the fresh_revive branch below needs to
+    // avoid a double-spawn.
     // For each due row, in fire_at order, settle the row FIRST (advance-or-consume
-    // — crash-safety, design D4) THEN enact by kind, wrapped per-row so one bad
-    // wake never kills the tick.
+    // — crash-safety, design D4) THEN enact by action/action_mode, wrapped per-row
+    // so one bad trigger never kills the tick.
     const nowIso = new Date(now).toISOString();
     const nowDate = new Date(now);
     let due;
     try {
-        due = dueWakes(nowIso);
+        due = dueClockTriggers(nowIso);
     }
     catch (err) {
-        process.stderr.write(`[crtrd] dueWakes error: ${err.message}\n`);
+        process.stderr.write(`[crtrd] dueClockTriggers error: ${err.message}\n`);
         due = [];
     }
-    for (const w of due) {
+    for (const t of due) {
         try {
-            // 1. Advance-or-consume FIRST (design D4): settle the row's pending state
-            //    before ANY side effect, so a daemon crash mid-fire can never double-
-            //    fire (a double SPAWN is the worst case — structurally prevented here).
-            if (w.recur == null) {
-                consumeWake(w.wakeup_id);
+            // 1. Settle FIRST: crash-safety — advance/consume the trigger before
+            //    enacting it, so a crash between settle and enact never re-fires.
+            if (t.recur == null) {
+                consumeTrigger(t.trigger_id);
             }
             else {
                 let nextFire;
                 try {
-                    nextFire = nextSlotAfter(w.recur, nowDate);
+                    nextFire = nextSlotAfter(t.recur, nowDate);
                 }
                 catch (err) {
-                    // The recur is unparseable (parseCadence validates at arm time, so this
-                    // is a rare backstop — a corrupted/foreign row). Leaving a past-fire_at
-                    // row pending would re-qualify it EVERY tick (silent CPU spin, enact
-                    // never reached), so quarantine it (consume) + fail loud ONCE; never
-                    // re-query it each tick (Min-8).
-                    consumeWake(w.wakeup_id);
-                    failLoudWake(w, '⚠ recurrence quarantined', `Scheduled wake ${w.wakeup_id} has an unparseable recurrence and was removed: ` +
+                    consumeTrigger(t.trigger_id);
+                    failLoudTrigger(t, '⚠ recurrence quarantined', `Scheduled trigger ${t.trigger_id} has an unparseable recurrence and was removed: ` +
                         `${err.message}\n\nRe-arm it with a valid cadence.`);
                     continue;
                 }
-                advanceWake(w.wakeup_id, nextFire);
+                advanceTrigger(t.trigger_id, nextFire);
             }
-            // 2. Enact by kind.
-            if (w.kind === 'bare') {
-                // A bare wake leaves NO inbox entry, so pass 2 can never wake it — it
-                // must revive DIRECTLY with resume:false (re-reads roadmap; AC-N2).
-                const target = w.node_id == null ? null : getRow(w.node_id);
-                if (target === null)
-                    continue; // target gone (the FK cascade reaped it)
-                // Same-tick double-spawn guard (Maj-4): pass 1/2 (or an earlier bare row
-                // this pass) may have revived this node THIS tick — reviveNode clears
-                // pi_pid to NULL before the fresh pi re-records it, so the pi_pid==null
-                // liveness check below would falsely read "not live" and a second
-                // reviveNode would launch a SECOND pi on the same .jsonl (corruption).
-                // (Pane-existence is the WRONG guard — it would no-op a frozen-focus bare
-                // wake, which is pane-alive/pi-dead by design.)
+            // 2. Enact by action/action_mode.
+            if (t.action === 'msg' && t.action_mode === 'fresh_revive') {
+                const target = t.node_id == null ? null : getRow(t.node_id);
+                if (target === null) {
+                    notifyOwnerUrgent(t, '⚠ scheduled trigger target gone', `Trigger ${t.trigger_id}'s target no longer exists — no revive happened.`);
+                    continue;
+                }
                 if (revivedThisTick.has(target.node_id))
                     continue;
-                // pi live → no-op (AC-E3 bare): an already-awake node needs no revive.
                 if (target.pi_pid != null && isPidAlive(target.pi_pid))
                     continue;
                 process.stderr.write(`[crtrd] wake ${target.node_id} (bare alarm)\n`);
-                // wakeReason carries the timer provenance so the fresh-revive kickoff
-                // leads with a <crtr-wake> block (Invariant B/D: the node learns a clock,
-                // not an event, woke it) instead of a generic context-refresh framing.
-                reviveNode(target.node_id, { resume: false, wakeReason: wakeOriginFrom(w) });
+                reviveNode(target.node_id, { resume: false, wakeReason: wakeOriginFrom(t) });
                 revivedThisTick.add(target.node_id);
             }
-            else if (w.kind === 'noted') {
-                // Deliver the note; the UNMODIFIED pass 2 wakes the dormant target next
-                // tick (AC-N1), or its live in-process watcher delivers it (AC-E3 noted).
-                if (w.node_id == null)
+            else if (t.action === 'msg' && t.action_mode === 'inbox_message') {
+                if (t.node_id == null) {
+                    notifyOwnerUrgent(t, '⚠ scheduled trigger target gone', `Trigger ${t.trigger_id}'s target no longer exists — nothing was delivered.`);
                     continue;
-                const p = w.payload;
-                // Mark the delivery as a SCHEDULED wake (Invariant D): the woken node sees
-                // only the rendered digest (inbox inlines label/body, never arbitrary
-                // data keys), so the timer signal MUST ride the visible label — the same
-                // ⏰ family deadline uses — so a noted wake is distinguishable from a plain
-                // `node msg`, not indistinguishable from it.
-                appendInbox(w.node_id, {
-                    from: w.owner_id ?? null,
-                    tier: 'normal',
+                }
+                const p = t.payload;
+                appendInbox(t.node_id, {
+                    from: t.owner_id ?? null,
+                    tier: p.tier ?? 'normal',
                     kind: 'message',
                     label: `⏰ scheduled wake — ${p.label}`,
-                    data: { body: p.body },
+                    data: { body: p.body ?? '' },
                 });
             }
-            else if (w.kind === 'deadline') {
-                // Same delivery as noted but URGENT tier. The woken node sees only the
-                // RENDERED digest (inbox inlines label/body, NEVER arbitrary data keys),
-                // so the timeout signal MUST ride the visible label/body (Maj-8);
-                // data.timeout is a machine-readable mirror only. body is always non-
-                // empty (the surface supplies a default timeout note when none is
-                // authored, Maj-7). One-shot — already consumed in step 1.
-                if (w.node_id == null)
+            else if (t.action === 'msg' && t.action_mode === 'deadline_message') {
+                if (t.node_id == null) {
+                    notifyOwnerUrgent(t, '⚠ scheduled trigger target gone', `Trigger ${t.trigger_id}'s target no longer exists — nothing was delivered.`);
                     continue;
-                const p = w.payload;
-                appendInbox(w.node_id, {
-                    from: w.owner_id ?? null,
+                }
+                const p = t.payload;
+                appendInbox(t.node_id, {
+                    from: t.owner_id ?? null,
                     tier: 'urgent',
                     kind: 'message',
                     label: `⏰ deadline reached — ${p.label}`,
                     data: { body: p.body, timeout: true },
                 });
             }
-            else if (w.kind === 'spawn') {
-                // Re-derives LaunchSpec live (AC-W2); payload.parent is the non-null
-                // resolved armer id (T2/T7 guarantee it), so spawnChild never throws the
-                // "requires a calling node" error even for a --root recipe.
-                const recipe = w.payload;
+            else if (t.action === 'new' && t.action_mode === 'node_birth') {
+                const recipe = t.payload;
                 try {
-                    // Spread in the wake provenance at fire time (in-memory only; never the
-                    // stored recipe) so the born node's kickoff leads with a <crtr-wake>
-                    // block — it learns, by construction, that a timer birthed it (and, for
-                    // a spawn-cron, that it is one run of a standing job).
-                    await spawnChild({ ...recipe, wakeOrigin: wakeOriginFrom(w) });
-                    notifiedWakeFailures.delete(w.wakeup_id); // success clears the dedup latch
+                    await spawnChild({ ...recipe, wakeOrigin: wakeOriginFrom(t) });
+                    notifiedTriggerFailures.delete(t.trigger_id);
                 }
                 catch (err) {
-                    // Fail loud by waking the ARMER DIRECTLY (design §6.6/Q5). The row was
-                    // already settled in step 1, so this is never a hot retry loop; a
-                    // permanently-broken spawn-cron stays deduped-noisy until cancel.
-                    failLoudWake(w, '⚠ deferred spawn failed', `Deferred spawn (${recipe.kind} @ ${recipe.cwd}) failed: ` +
-                        `${err.message}\n\nRe-home (fix the cwd/parent) or re-arm the wake.`);
+                    failLoudTrigger(t, '⚠ deferred spawn failed', `Deferred spawn (${recipe.kind} @ ${recipe.cwd}) failed: ` +
+                        `${err.message}\n\nRe-home (fix the cwd/parent) or re-arm the trigger.`);
                 }
             }
         }
         catch (err) {
-            // One bad wake never kills the tick.
-            process.stderr.write(`[crtrd] error firing wake ${w.wakeup_id}: ${err.message}\n`);
+            process.stderr.write(`[crtrd] error firing trigger ${t.trigger_id}: ${err.message}\n`);
         }
     }
+    // Pass 3a: recover stale predicate leases stranded by a PRIOR daemon
+    // instance (crash/restart mid-evaluation) — BEFORE 3b/3c, so a row a dead
+    // daemon left `eval_state='running'` forever can rejoin the idle pool
+    // instead of being wedged out of duePredicateTriggers' idle-only filter
+    // (spec §Daemon-behavior step 1, acceptance criterion 9: survives restart).
+    try {
+        recoverStalePredicateLeases(now, predicateCapacity());
+    }
+    catch (err) {
+        process.stderr.write(`[crtrd] recoverStalePredicateLeases error: ${err.message}\n`);
+    }
+    // Pass 3b: wall-clock predicate timeouts — reap regardless of eval_state,
+    // BEFORE selecting fresh evaluations (so a timed-out row can never also be
+    // evaluated this same tick — consumeTrigger removes it from the due query).
+    try {
+        reapTimedOutPredicates(now, (t) => {
+            notifyOwnerUrgent(t, '⚠ predicate timed out', `Trigger ${t.trigger_id}'s wall-clock timeout was reached before its predicate ever fired — it has been canceled.`);
+        });
+    }
+    catch (err) {
+        process.stderr.write(`[crtrd] reapTimedOutPredicates error: ${err.message}\n`);
+    }
+    // Pass 3c: kick off due predicate evaluations. Fire-and-forget — settlement
+    // happens async via onDone, decoupled from this tick (never awaited; a slow/
+    // hung predicate must never block supervision, spec §Predicate triggers).
+    try {
+        evaluateDuePredicates(now, (outcome) => {
+            handlePredicateOutcome(outcome).catch((err) => {
+                process.stderr.write(`[crtrd] predicate outcome error: ${err.message}\n`);
+            });
+        });
+    }
+    catch (err) {
+        process.stderr.write(`[crtrd] evaluateDuePredicates error: ${err.message}\n`);
+    }
     // Fourth pass: reap the leftover placement of long-dead nodes (Bug 3), then
     // sweep focus rows whose pane died outside the sanctioned teardown paths
     // (Bug 5). Reap first so the GC also catches any focus row a reaped pane
@@ -786,6 +873,25 @@ export async function superviseTick(now = Date.now()) {
     // re-anchored.
     reapDeadResidue(now);
     gcStaleFocuses();
+    // Fifth pass: count-based auto-prune, throttled to once per PRUNE_INTERVAL_MS
+    // (NOT every 2s tick — it's a full-canvas DB sweep). Keeps the AUTO_PRUNE_MAX
+    // most-recently-active nodes; live nodes are never deleted (pruneToLimit's
+    // floor is max(AUTO_PRUNE_MAX, liveCount)). Wrapped so a sweep failure never
+    // crashes the tick; the tick is already serialized (recursive setTimeout), so
+    // this runs sequentially within it.
+    if (now - lastPruneAt >= PRUNE_INTERVAL_MS) {
+        lastPruneAt = now;
+        try {
+            const before = listNodes().length;
+            const { pruned } = pruneToLimit({ maxNodes: AUTO_PRUNE_MAX });
+            if (pruned.length > 0) {
+                process.stderr.write(`[crtrd] auto-prune: removed ${pruned.length} nodes (kept ${before - pruned.length})\n`);
+            }
+        }
+        catch (err) {
+            process.stderr.write(`[crtrd] auto-prune error: ${err.message}\n`);
+        }
+    }
 }
 /** Start the supervisor loop.
  *
@@ -802,6 +908,19 @@ export function runDaemon(opts = {}) {
         process.exit(0);
     }
     const interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
+    // Once, before the first tick ever inspects a single `pi_pid`: detect a boot
+    // change (a host reboot, or a sandbox/VM destroy+recreate — canvas.db is
+    // durable and survives either, but every `pi_pid` it carries is a raw OS pid
+    // from the process table THAT reset) and clear every stale pid up front. This
+    // must run before the tick loop, not lazily inside reviveNode: the daemon's
+    // OWN liveness poll (handleNodeLiveness) treats `isPidAlive(pid) === true` as
+    // "leave it, nothing to revive" and never calls reviveNode at all — a
+    // pid-reuse collision on the first post-boot tick would silently no-op
+    // forever with no revive attempt to even hit reviveNode's own reconcile call.
+    const { changed, cleared } = reconcileBootLiveness();
+    if (changed) {
+        process.stderr.write(`[crtrd] boot change detected — cleared ${cleared.length} stale pi_pid(s) recorded before this boot\n`);
+    }
     writePidfile();
     log.info(`started (pid ${process.pid}, interval ${interval}ms)`);
     let running = true;

package/dist/daemon/predicate-eval.d.ts

@@ -0,0 +1,52 @@
+import { type Trigger } from '../core/canvas/index.js';
+export declare const STDOUT_CAP_BYTES: number;
+export declare const STDERR_TAIL_BYTES: number;
+export interface PredicateCapacity {
+    maxCanvas: number;
+    maxPerOwner: number;
+    evalTimeoutMs: number;
+}
+/** Read fresh each pass (not cached at module load) so a test/operator can
+ *  tune it via env without a daemon restart mid-run. */
+export declare function predicateCapacity(): PredicateCapacity;
+/** One id per daemon PROCESS instance — distinguishes THIS process's own
+ *  in-flight leases from a stale 'running' row a prior (crashed/restarted)
+ *  daemon left behind (spec §Lease / in-flight contract, daemon-restart
+ *  recovery). Generated once per process; tests that want deterministic
+ *  recovery behavior can ignore it (recovery only special-cases OWN leases). */
+export declare const daemonInstanceId: `${string}-${string}-${string}-${string}-${string}`;
+export type PredicateOutcome = {
+    kind: 'fired';
+    trigger: Trigger;
+    stdout: string;
+} | {
+    kind: 'stdout_overflow';
+    trigger: Trigger;
+} | {
+    kind: 'target_gone';
+    trigger: Trigger;
+};
+/** Recover stale in-flight rows left by a PRIOR daemon instance (crash/
+ *  restart): a still-alive process group past its own eval timeout is killed +
+ *  recorded as a timeout; a dead pid resets straight to idle with no
+ *  diagnostics (spec: "if not alive, the row is reset to idle and eligible for
+ *  the next evaluation slot"). Rows this SAME instance owns are left alone —
+ *  they are genuinely in flight, not stale. */
+export declare function recoverStalePredicateLeases(now: number, config: PredicateCapacity): void;
+/** Wall-clock `timeout_at` reap — independent of eval_state/next_eval_at.
+ *  Kills any in-flight process group for a timed-out row, consumes it, and
+ *  invokes `onTimeout` once per row so the caller can send the owner urgent
+ *  notice (spec: "consume and notify owner"). Call BEFORE
+ *  evaluateDuePredicates each tick so a timed-out row can never also be
+ *  freshly evaluated in the same tick (consumeTrigger removes it from the due
+ *  query). */
+export declare function reapTimedOutPredicates(now: number, onTimeout: (t: Trigger) => void): void;
+/** Pass 3c: select due idle predicates (deterministic order from the DAO),
+ *  enforce capacity in-memory (seeded from the current running-row snapshot),
+ *  and kick off evaluations — NEVER awaited. `onDone` fires per trigger,
+ *  whenever it settles (possibly after this call returns). Rows over capacity,
+ *  or whose owner is at its per-owner cap, are left untouched (idle,
+ *  next_eval_at unchanged) and are retried next tick. A `msg` trigger whose
+ *  target no longer exists is reaped here (consumed + `target_gone`) instead
+ *  of being spawned against a dangling id. */
+export declare function evaluateDuePredicates(now: number, onDone: (o: PredicateOutcome) => void): void;