@crouton-kit/crouter 0.3.62 → 0.3.64

package/dist/core/__tests__/full/broker-crash-teardown.test.js

@@ -72,14 +72,28 @@ test('CRASH → grace-revive RESUME (one-writer), then clean teardown on close',
     // --- Items 4 + 6: kill the broker out from under the daemon (a crash). Drive a
     //     FIXED clock so the grace window is exercised deterministically. ---
     process.kill(oldPid, 'SIGKILL');
+    // ONE-WRITER: the old engine pid is dead BEFORE any revive can launch. Assert
+    // this via the waitFor alone — a raw isPidAlive RE-CHECK immediately after
+    // would re-probe the same numeric pid a moment later, and on a heavily
+    // forking CI runner (test-concurrency=4 x full-tier broker spawns) the OS can
+    // recycle a just-freed low pid to an unrelated fresh process inside that gap,
+    // reporting "alive" for a pid that never resurrected (proven by a real
+    // Actions run: crouter-development/prove-ci-fixes-in-actions). The waitFor's
+    // successful resolution already IS the proof of deadness at this point.
     await h.waitFor(() => !isPidAlive(oldPid), { label: 'crashed broker pid is dead' });
-    // ONE-WRITER: the old engine pid is dead BEFORE any revive can launch.
-    assert.equal(isPidAlive(oldPid), false, 'crashed pid dead before the daemon revives');
     const NOW = 5_000_000;
     await h.tick(NOW); // pid dead, intent null → handleBrokerLiveness → handleLiveWindow marks pending
     assert.equal(h.bootCount(id), boots, 'inside the grace window → NOT yet revived');
     await h.tick(NOW + REVIVE_GRACE_MS + 1); // grace elapsed → reviveNode(resume:true)
-    const boot2 = await h.awaitBoot(id, { minCount: boots + 1 });
+    // This is the file's SECOND real broker boot (crash-revive), on an
+    // oversubscribed CI runner sharing the host with the other full-tier files'
+    // own broker spawns. Locally this boot lands in ~16s total for the whole
+    // test; real Actions runs proved the harness's normal 30s awaitBoot default
+    // insufficient, and on a genuinely noisy runner even 60s (measured: one real
+    // run's boot took ~65–75s) — crouter-development/prove-ci-fixes-in-actions.
+    // Give it a wide, still-bounded ceiling rather than tuning down the shared
+    // harness default for every other (cheaper, single-boot) full-tier test.
+    const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 120_000 });
     assert.equal(boot2.resuming, true, 'grace-revive RESUMES the saved .jsonl');
     const newPid = h.node(id).pi_pid;
     assert.ok(newPid != null && isPidAlive(newPid), 'the revived broker pid is alive');

package/dist/core/__tests__/helpers/harness.js

@@ -415,14 +415,32 @@ export async function createHarness(opts = {}) {
             const minCount = o.minCount ?? 1;
             const bootsPath = join(nodeDir(nodeId), 'fake-pi.boots.jsonl');
             const errPath = join(nodeDir(nodeId), 'fake-pi.error');
-            const lines = await waitFor(() => {
-                const ls = readLines(bootsPath);
-                return ls.length >= minCount ? ls : null;
-            }, {
-                timeoutMs: o.timeoutMs ?? 30_000,
-                label: `fake-pi boot >= ${minCount} for ${nodeId}` +
-                    (existsSync(errPath) ? ` (error file: ${readFileSync(errPath, 'utf8')})` : ''),
-            });
+            let lines;
+            try {
+                lines = await waitFor(() => {
+                    const ls = readLines(bootsPath);
+                    return ls.length >= minCount ? ls : null;
+                }, {
+                    timeoutMs: o.timeoutMs ?? 30_000,
+                    label: `fake-pi boot >= ${minCount} for ${nodeId}` +
+                        (existsSync(errPath) ? ` (error file: ${readFileSync(errPath, 'utf8')})` : ''),
+                });
+            }
+            catch (err) {
+                // Failure-path-only diagnostic: an intermittent, Linux-CI-only hang
+                // here (recorded-pid-reuse fooling the daemon's revive liveness gate)
+                // was invisible for three CI iterations because the timeout error
+                // alone doesn't say WHY the boot never happened. Dump the node row's
+                // recorded liveness fields plus the current boot count so a future
+                // failing run on Actions is self-explaining from the log alone.
+                closeDb();
+                const n = getNode(nodeId);
+                process.stderr.write(`[awaitBoot] timeout for ${nodeId}: pi_pid=${n?.pi_pid ?? 'null'} ` +
+                    `pi_pid_identity=${n?.pi_pid_identity ?? 'null'} status=${n?.status ?? 'null'} ` +
+                    `intent=${n?.intent ?? 'null'} pi_session_id=${n?.pi_session_id ?? 'null'} ` +
+                    `bootCount=${bootCount(nodeId)} minCount=${minCount}\n`);
+                throw err;
+            }
             const boot = JSON.parse(lines[lines.length - 1]);
             if (typeof boot.pid === 'number')
                 pidsToKill.add(boot.pid);

package/dist/core/canvas/pid.d.ts

@@ -13,6 +13,20 @@
  *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
  *  back on its own. */
 export declare function isPidAlive(pid: number | null | undefined): boolean;
+/** Like `isPidAlive`, but guards a RECORDED node pid against PID REUSE using the
+ *  launch-time identity baseline (`pi_pid_identity`, captured by `recordPid`).
+ *  On a heavily-forking host — esp. Linux, where low pids recycle fast — a
+ *  broker's recorded pid can be reused by an unrelated process after the broker
+ *  dies; a bare `isPidAlive` then reports the STRANGER as "our broker alive",
+ *  wedging every daemon supervise/revive decision (the daemon never revives a
+ *  row that looks alive; `reviveNode`'s double-launch guard never relaunches).
+ *  Returns false the instant the pid's CURRENT identity is POSITIVELY known to
+ *  differ from `expectedIdentity` (the recycle case). Fail-open everywhere else
+ *  — no baseline (legacy row / capture failed at launch), `ps` probe failure, or
+ *  a pid present-but-unreadable — exactly matching `captureTeardownSnapshot`'s
+ *  discipline: a MISMATCH is the ONLY thing that reads dead, never an absence of
+ *  evidence. */
+export declare function isRecordedPidAlive(pid: number | null | undefined, expectedIdentity: string | null | undefined): boolean;
 /** SIGTERM a process GROUP by pid (the negative-pid convention) — best-effort,
  *  swallowing ESRCH (already gone). Shared by triggers.ts (cancel-time reap of
  *  an in-flight predicate evaluation) and daemon/predicate-eval.ts (per-eval

package/dist/core/canvas/pid.js

@@ -60,6 +60,32 @@ export function isPidAlive(pid) {
     }
     return !isZombie(pid);
 }
+/** Like `isPidAlive`, but guards a RECORDED node pid against PID REUSE using the
+ *  launch-time identity baseline (`pi_pid_identity`, captured by `recordPid`).
+ *  On a heavily-forking host — esp. Linux, where low pids recycle fast — a
+ *  broker's recorded pid can be reused by an unrelated process after the broker
+ *  dies; a bare `isPidAlive` then reports the STRANGER as "our broker alive",
+ *  wedging every daemon supervise/revive decision (the daemon never revives a
+ *  row that looks alive; `reviveNode`'s double-launch guard never relaunches).
+ *  Returns false the instant the pid's CURRENT identity is POSITIVELY known to
+ *  differ from `expectedIdentity` (the recycle case). Fail-open everywhere else
+ *  — no baseline (legacy row / capture failed at launch), `ps` probe failure, or
+ *  a pid present-but-unreadable — exactly matching `captureTeardownSnapshot`'s
+ *  discipline: a MISMATCH is the ONLY thing that reads dead, never an absence of
+ *  evidence. */
+export function isRecordedPidAlive(pid, expectedIdentity) {
+    if (!isPidAlive(pid))
+        return false; // gone/zombie → dead (unchanged path)
+    if (expectedIdentity == null)
+        return true; // no baseline → trust isPidAlive (legacy behavior)
+    const current = capturePidIdentities([pid]);
+    if (current == null)
+        return true; // probe itself failed → fail-open
+    const actual = current.get(pid);
+    if (actual === undefined)
+        return true; // present but no identity row (race) → fail-open
+    return actual === expectedIdentity; // different identity → REUSED → dead
+}
 /** SIGTERM a process GROUP by pid (the negative-pid convention) — best-effort,
  *  swallowing ESRCH (already gone). Shared by triggers.ts (cancel-time reap of
  *  an in-flight predicate evaluation) and daemon/predicate-eval.ts (per-eval

package/dist/core/runtime/revive.js

@@ -29,7 +29,7 @@ import { fanDoctrineWake } from './close.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { headlessBrokerHost } from './host.js';
-import { isPidAlive } from '../canvas/pid.js';
+import { isRecordedPidAlive } from '../canvas/pid.js';
 import { reconcileBootLiveness } from '../canvas/boot.js';
 import { clearFault } from './fault.js';
 import { clearInjectedDocs } from '../substrate/injected-store.js';
@@ -89,11 +89,14 @@ export function reviveNode(nodeId, opts) {
     // actually matters, so it's safe to call on every revive regardless of
     // entry point (daemon tick, or a direct/manual `node lifecycle revive`).
     reconcileBootLiveness();
-    // Double-revive guard: the broker's isAlive IS isPidAlive(pi_pid), so a node
-    // whose broker pid is still running was already revived by another path —
-    // re-launching would put a SECOND broker on the same session file. No-op.
+    // Double-revive guard: the broker's isAlive is identity-aware liveness on
+    // pi_pid, so a node whose broker pid is still running (and CONFIRMED to
+    // still be that same broker, not a reused pid) was already revived by
+    // another path — re-launching would put a SECOND broker on the same
+    // session file. No-op. A bare isPidAlive would misread a reused pid (heavy
+    // forking, esp. Linux) as "still alive" and skip the relaunch forever.
     const live = getNode(nodeId) ?? meta;
-    if (isPidAlive(live.pi_pid)) {
+    if (isRecordedPidAlive(live.pi_pid, live.pi_pid_identity)) {
         return {
             window: null,
             session: live.tmux_session ?? null,

package/dist/core/substrate/render.js

@@ -430,7 +430,8 @@ const MEMORY_USAGE_GUIDANCE = 'When your task matches a knowledge doc or prefere
     "will make without it, so doing the relevant work without consulting it defeats the doc's " +
     'whole purpose. ' +
     'Before saving any memory, check for an existing doc that already covers it — update that ' +
-    'doc rather than creating a duplicate; delete memories that turn out to be wrong. ' +
+    'doc rather than creating a duplicate, rewriting it as if for the first time instead of ' +
+    'appending the new truth beneath the old; delete memories that turn out to be wrong. ' +
     "Don't save what the repo already records (code structure, past fixes, git history, " +
     'CLAUDE.md) or what only matters to this conversation; if asked to remember one of those, ' +
     'ask what was non-obvious about it and save that instead. Docs auto-surfaced in ' +

package/dist/daemon/crtrd.js

@@ -64,7 +64,7 @@ import { FAULT_QUIET_MS, readFault, recordFault } from '../core/runtime/fault.js
 import { fanDoctrineWake } from '../core/runtime/close.js';
 import { logger } from '../core/log.js';
 export { FAULT_QUIET_MS };
-import { isPidAlive } from '../core/canvas/pid.js';
+import { isPidAlive, isRecordedPidAlive } from '../core/canvas/pid.js';
 import { reconcileBootLiveness } from '../core/canvas/boot.js';
 import { listLivePanes, tearDownNode } from '../core/runtime/placement.js';
 import { reviveNode } from '../core/runtime/revive.js';
@@ -704,7 +704,15 @@ async function handleNodeLiveness(row, now, revivedThisTick) {
     // enforce §H: handleYieldStall no-ops unless this node yielded (intent=refresh),
     // its turn is over, and the engine never exited — past the grace it kills the
     // engine so the dead-pid refresh branch below revives it fresh.
-    if (pid != null && isPidAlive(pid)) {
+    //
+    // Liveness here is IDENTITY-aware, not a bare isPidAlive: on a heavily-
+    // forking host (esp. Linux, where low pids recycle fast) a just-dead
+    // broker's pid can be reused by an unrelated process before this tick
+    // runs, and a bare isPidAlive would report the STRANGER as "our broker
+    // alive" — clearing the grace clock forever and wedging revive (the
+    // recorded-pid-reuse hang). isRecordedPidAlive guards against that with
+    // the launch-time identity baseline (`row.pi_pid_identity`).
+    if (pid != null && isRecordedPidAlive(pid, row.pi_pid_identity)) {
         unhealthySince.delete(id);
         clearStrandedRelaunchState(id); // a live engine means the stranding resolved
         handleYieldStall(row, pid, now);
@@ -1149,8 +1157,10 @@ export async function superviseTick(now = Date.now()) {
             // The in-process inbox-watcher only owns delivery while the engine is LIVE.
             // A released node's broker is DEAD (it freed itself while dormant), so it
             // has no watcher and the daemon must wake it. Gate the skip on engine
-            // liveness alone — viewer panes are irrelevant here.
-            if (r.pi_pid != null && isPidAlive(r.pi_pid))
+            // liveness alone — viewer panes are irrelevant here. Identity-aware: a
+            // bare isPidAlive would misread a reused pid as "still alive" and skip
+            // the revive forever, stranding the node on its unseen inbox entry.
+            if (r.pi_pid != null && isRecordedPidAlive(r.pi_pid, r.pi_pid_identity))
                 continue;
             const entries = readInboxSince(row.node_id, readCursor(row.node_id));
             if (entries.length > 0) {
@@ -1214,7 +1224,9 @@ export async function superviseTick(now = Date.now()) {
                 }
                 if (revivedThisTick.has(target.node_id))
                     continue;
-                if (target.pi_pid != null && isPidAlive(target.pi_pid))
+                // Identity-aware: a bare isPidAlive would misread a reused pid as
+                // "still alive" and skip the wake, stranding the scheduled trigger.
+                if (target.pi_pid != null && isRecordedPidAlive(target.pi_pid, target.pi_pid_identity))
                     continue;
                 process.stderr.write(`[crtrd] wake ${target.node_id} (bare alarm)\n`);
                 reviveNode(target.node_id, { resume: false, wakeReason: wakeOriginFrom(t) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouton-kit/crouter",
-  "version": "0.3.62",
+  "version": "0.3.64",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",