@north-light/crouter 0.3.167 → 0.3.169

package/dist/commands/sys/daemon.js

@@ -85,6 +85,7 @@ const daemonRestart = defineLeaf({
         outputKind: 'object',
         effects: [
             'The daemon acknowledges immediately, then after a short grace tears its whole broker fleet down, releases its claim, spawns a successor on the runtime generation currently selected, and exits.',
+            'Each torn-down broker hands its foreground bash commands to the file-backed background job system; they keep running and report completion by urgent inbox message.',
             'Every node it tore down — including the caller — is resumed by the successor through the ordinary startup recovery sweep.',
             'The calling process is killed as part of that teardown, AFTER this result is returned.',
         ],

package/dist/core/__tests__/broker-fork-seam.test.js

@@ -34,7 +34,6 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createAgentSessionServices, createAgentSessionFromServices, SessionManager, VERSION, } from '../runtime/broker-sdk.js';
-import { CANVAS_EXTENSIONS } from '../runtime/launch.js';
 import { buildBrokerSession } from '../runtime/broker.js';
 // M-9 (broker.ts fault-and-die model gate): buildBrokerSession with no cfg.model
 // now calls the REAL SDK's modelRegistry.getAvailable() and faults if it's empty
@@ -83,7 +82,7 @@ test('D2 broker fork branch: buildBrokerSession(cfg.forkFrom) yields a NEW id +
     //    if broker.ts:~1106 reverts to that throw, this rejects and the test goes RED.
     const cfg = {
         cwd: dir,
-        extensionPaths: [...CANVAS_EXTENSIONS, C3_EXT],
+        extensionPaths: [C3_EXT],
         forkFrom: srcFile,
         model: 'c3prov/c3model',
     };

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -84,7 +84,7 @@ function cfg(cwd, extra = {}) {
 test('C3 — services path registers an extension model provider; the broker session gets it', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3-'));
     try {
-        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model' }));
+        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model' }));
         try {
             // The extension's provider was registered into the SERVICES model runtime (this
             // is the registerProvider step plain createAgentSession skips).
@@ -107,7 +107,7 @@ test('C3 — services path registers an extension model provider; the broker ses
 test('C3b — broker splits model thinking suffix before SDK registry lookup', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3b-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model:high' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model:high' }));
         try {
             assert.equal(session.model?.id, 'c3model', 'C3b: suffixed model specs resolve by model id instead of falling back to SDK default');
         }
@@ -420,7 +420,7 @@ test('C5 — isLeadingEngineCommand against a REAL session (registered extension
     // proven against a plain object shaped like the real accessors.
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c5-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             assert.equal(isLeadingEngineCommand('/devcmd', session), true, 'a real registered extension command matches');
             assert.equal(isLeadingEngineCommand('/devcmd extra args', session), true, 'space-separated still matches against a real session');
@@ -744,7 +744,7 @@ test('Major 6 (broker half) — engineLeadingCommandTokens degrades to empty per
 test('Major 6 (broker half) — engineLeadingCommandTokens against a REAL session enumerates the real registered extension command', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-m6-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             const tokens = engineLeadingCommandTokens(session);
             assert.ok(tokens.includes('devcmd'), 'the real registered extension command name is present in the enumeration');

package/dist/core/__tests__/revive.test.js

@@ -35,6 +35,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn, spawnSync } from 'node:child_process';
 import { createNode, getNode, subscribe, updateNode, clearPid } from '../canvas/canvas.js';
 import { armFollowUpWork } from '../canvas/human-work-outbox.js';
+import { armCron, hasPendingCancelOnWakeCron } from '../canvas/crons.js';
 import { readInboxSince } from '../feed/inbox.js';
 import { closeDb } from '../canvas/db.js';
 import { buildPiArgv, CANVAS_EXTENSIONS } from '../runtime/launch.js';
@@ -346,6 +347,53 @@ test('reviveNode PROCEEDS when the node has NO fleet entry — cycle counter bum
         await h.dispose();
     }
 });
+// ---------------------------------------------------------------------------
+// BUG LOCKED — a recovery relaunch must not eat the node's armed deadline.
+// A node armed `crtr node wait deadline` and dormed; its broker then exited and
+// the daemon respawned it (fleet.#respawn → reviveNode). reviveNode used to
+// cancel every cancel-on-wake cron unconditionally, so the deadline vanished
+// with nothing having woken the node and the wait could never settle. A wake
+// (inbox delivery, attach, explicit revive) still consumes it.
+// ---------------------------------------------------------------------------
+function armDeadline(anchor, cronId) {
+    armCron({
+        cron_id: cronId,
+        name: `deadline:${anchor}`,
+        created_by: anchor,
+        command: 'true',
+        fire_at: new Date(Date.now() + 3_600_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: anchor,
+        cancel_on_wake: true,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 300,
+        overlap: 'skip',
+        on_output: 'on-failure',
+        sink: '',
+        tier: 'normal',
+    });
+}
+test('a recovery relaunch keeps the armed deadline; a wake revive consumes it', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-deadline' });
+    try {
+        const recovered = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
+        armDeadline(recovered, 'cron-recovery');
+        reviveNode(recovered, { resume: true, recovery: true });
+        assert.equal(hasPendingCancelOnWakeCron(recovered), true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
+        const woken = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
+        armDeadline(woken, 'cron-wake');
+        reviveNode(woken, { resume: true });
+        assert.equal(hasPendingCancelOnWakeCron(woken), false, 'a wake revive won the race and cancels the deadline');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode fresh-fallback clears the stale session identity (Major-3: no phantom stranded-relaunch)', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-freshfb' });
     try {

package/dist/core/bash-jobs.d.ts

@@ -4,7 +4,9 @@ export interface BashJobPaths {
     cmdSh: string;
     jobLog: string;
     jobExit: string;
+    jobRun: string;
     jobBg: string;
+    jobDone: string;
     /** Process-group id of the job's detached supervisor, written at spawn. It is
      * what makes a job stoppable from outside the agent that started it (the
      * Inspector's cancel) — without it on disk, only the agent's own handoff
@@ -42,25 +44,22 @@ export interface BashJobStatus {
     logPath: string;
 }
 /** Every live backgrounded bash job for this node — job.bg present, job.exit
- * absent — whether handed off by the menu or auto-backgrounded at the valve's
- * deadline. Read-only; never mutates. Distinct from (and shares no code path
- * with) the foreground-only `runningBashJobs` above: that scanner deliberately
- * EXCLUDES job.bg, this one REQUIRES it, so reusing one for the other would
- * corrupt foreground-admission semantics. Skips malformed/partially-written
+ * absent — whether handed off by the menu, the valve deadline, or broker
+ * termination. Read-only; never mutates. Skips malformed/partially-written
  * directories. Returns oldest-first by startedAtMs. */
 export declare function activeBackgroundBashJobs(contextDir: string): BashJobStatus[];
-/** The start time (ms epoch) of the OLDEST still-foreground bash command for
+export type BackgroundBashJobResult = 'backgrounded' | 'already-backgrounded' | 'finished' | 'missing';
+/** Atomically hand one foreground job to its detached supervisor. The rename
+ * is the ownership decision: exactly one caller can move job.run to job.bg,
+ * while the supervisor races to move the same source to job.done. */
+export declare function backgroundBashJob(paths: BashJobPaths): BackgroundBashJobResult;
+/** The start time (ms epoch) of the oldest still-foreground bash command for
  * this node, or undefined when none is running. This is the authoritative
- * source for the attach viewer's R4 "background it" footer hint: it reads the
- * exact same on-disk contract the valve writes (a job directory exists with
- * no job.bg and no job.exit while the command is running in the foreground,
- * and the valve deletes the directory the moment the command finishes or is
- * aborted — see canvas-bash-valve.ts), so a fresh or reconnected attach (which
- * has no memory of a broker-relayed tool-execution event) sees exactly what's
- * really running, and a viewer never needs its own call-id tracking that could
- * go stale across a broker/session replacement. */
+ * source for the attach viewer's background hint: a fresh or reconnected
+ * attach reads the same job.run state that backgrounding and completion race
+ * to claim, without viewer-local call tracking that can go stale. */
 export declare function oldestRunningBashJobStartedAtMs(contextDir: string): number | undefined;
-/** Request immediate handoff for every bash command still waiting on pi. The
- * valve observes job.bg within one poll, resolves the tool call, and leaves its
- * detached supervisor to notify the node when the real command exits. */
+/** Request immediate handoff for every bash command still waiting on pi. Only
+ * the caller that wins the job.run → job.bg rename reports the job as handed
+ * off; another backgrounder or the foreground-completion path may win the race. */
 export declare function backgroundRunningBashJobs(contextDir: string): BashJobPaths[];

package/dist/core/bash-jobs.js

@@ -1,9 +1,9 @@
-// File-backed control plane for bash commands that have been handed off by the
-// canvas bash valve. The valve starts every command in one of these directories;
-// the prefix menu requests backgrounding by creating job.bg. Keeping that signal
-// on disk means the command can outlive its pi process and still report its exit.
+// File-backed control plane for bash commands started by the canvas bash valve.
+// Every foreground command owns job.run; backgrounding atomically renames it to
+// job.bg, while foreground completion renames it to job.done. The detached
+// supervisor can therefore outlive pi and still decide whether to report exit.
 import { randomBytes } from 'node:crypto';
-import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync, writeFileSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 export function bashJobsDir(contextDir) {
     return join(contextDir, 'jobs');
@@ -16,7 +16,9 @@ export function bashJobPaths(contextDir, jobId) {
         cmdSh: join(dir, 'cmd.sh'),
         jobLog: join(dir, 'job.log'),
         jobExit: join(dir, 'job.exit'),
+        jobRun: join(dir, 'job.run'),
         jobBg: join(dir, 'job.bg'),
+        jobDone: join(dir, 'job.done'),
         jobPgid: join(dir, 'job.pgid'),
     };
 }
@@ -94,11 +96,8 @@ export function formatBashElapsed(ms) {
     return `${hours}h ${String(minutes).padStart(2, '0')}m`;
 }
 /** Every live backgrounded bash job for this node — job.bg present, job.exit
- * absent — whether handed off by the menu or auto-backgrounded at the valve's
- * deadline. Read-only; never mutates. Distinct from (and shares no code path
- * with) the foreground-only `runningBashJobs` above: that scanner deliberately
- * EXCLUDES job.bg, this one REQUIRES it, so reusing one for the other would
- * corrupt foreground-admission semantics. Skips malformed/partially-written
+ * absent — whether handed off by the menu, the valve deadline, or broker
+ * termination. Read-only; never mutates. Skips malformed/partially-written
  * directories. Returns oldest-first by startedAtMs. */
 export function activeBackgroundBashJobs(contextDir) {
     let entries;
@@ -127,9 +126,27 @@ export function activeBackgroundBashJobs(contextDir) {
     }
     return jobs.sort((a, b) => a.startedAtMs - b.startedAtMs);
 }
-/** Every still-foreground bash command for this node. A completed command has
- * job.exit; an already-backgrounded one has job.bg and must not be selected a
- * second time. Invalid or concurrently-removed directories are ignored. */
+/** Atomically hand one foreground job to its detached supervisor. The rename
+ * is the ownership decision: exactly one caller can move job.run to job.bg,
+ * while the supervisor races to move the same source to job.done. */
+export function backgroundBashJob(paths) {
+    try {
+        renameSync(paths.jobRun, paths.jobBg);
+        return 'backgrounded';
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+        if (existsSync(paths.jobBg))
+            return 'already-backgrounded';
+        if (existsSync(paths.jobDone))
+            return 'finished';
+        return 'missing';
+    }
+}
+/** Every still-foreground bash command for this node. job.run is the sole live
+ * foreground state; a handoff or foreground completion atomically removes it.
+ * Invalid or concurrently-removed directories are ignored. */
 function runningBashJobs(contextDir) {
     let entries;
     try {
@@ -140,21 +157,16 @@ function runningBashJobs(contextDir) {
     }
     return entries.flatMap((jobId) => {
         const paths = bashJobPaths(contextDir, jobId);
-        return existsSync(paths.cmdSh) && existsSync(paths.jobLog) && !existsSync(paths.jobExit) && !existsSync(paths.jobBg)
+        return existsSync(paths.cmdSh) && existsSync(paths.jobLog) && existsSync(paths.jobRun)
             ? [paths]
             : [];
     });
 }
-/** The start time (ms epoch) of the OLDEST still-foreground bash command for
+/** The start time (ms epoch) of the oldest still-foreground bash command for
  * this node, or undefined when none is running. This is the authoritative
- * source for the attach viewer's R4 "background it" footer hint: it reads the
- * exact same on-disk contract the valve writes (a job directory exists with
- * no job.bg and no job.exit while the command is running in the foreground,
- * and the valve deletes the directory the moment the command finishes or is
- * aborted — see canvas-bash-valve.ts), so a fresh or reconnected attach (which
- * has no memory of a broker-relayed tool-execution event) sees exactly what's
- * really running, and a viewer never needs its own call-id tracking that could
- * go stale across a broker/session replacement. */
+ * source for the attach viewer's background hint: a fresh or reconnected
+ * attach reads the same job.run state that backgrounding and completion race
+ * to claim, without viewer-local call tracking that can go stale. */
 export function oldestRunningBashJobStartedAtMs(contextDir) {
     let oldest;
     for (const paths of runningBashJobs(contextDir)) {
@@ -166,25 +178,14 @@ export function oldestRunningBashJobStartedAtMs(contextDir) {
     }
     return oldest;
 }
-/** Request immediate handoff for every bash command still waiting on pi. The
- * valve observes job.bg within one poll, resolves the tool call, and leaves its
- * detached supervisor to notify the node when the real command exits. */
+/** Request immediate handoff for every bash command still waiting on pi. Only
+ * the caller that wins the job.run → job.bg rename reports the job as handed
+ * off; another backgrounder or the foreground-completion path may win the race. */
 export function backgroundRunningBashJobs(contextDir) {
     const backgrounded = [];
     for (const paths of runningBashJobs(contextDir)) {
-        try {
-            // A job may exit or be claimed by another prefix press between the scan
-            // and this write. Recheck the two terminal/control files so that stale
-            // candidates never masquerade as a successful handoff.
-            if (existsSync(paths.jobExit) || existsSync(paths.jobBg))
-                continue;
-            writeFileSync(paths.jobBg, '');
+        if (backgroundBashJob(paths) === 'backgrounded')
             backgrounded.push(paths);
-        }
-        catch {
-            // The valve owns cleanup; a concurrently removed directory is simply no
-            // longer a running command to hand off.
-        }
     }
     return backgrounded;
 }

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -102,6 +102,31 @@ test('dashboardRowsAllFromSource shows a node watched through its live broker',
     const rows = await dashboardRowsAllFromSource(source);
     assert.equal(rows[0]?.viewed, true);
 });
+test('enrichRowsFromSource serializes a full dashboard source read', async () => {
+    const nodeRows = ['a', 'b', 'c'].map(row);
+    let inFlight = 0;
+    let maxInFlight = 0;
+    const source = {
+        getNode: async (id) => {
+            inFlight++;
+            maxInFlight = Math.max(maxInFlight, inFlight);
+            await new Promise((resolve) => setImmediate(resolve));
+            inFlight--;
+            return meta(id);
+        },
+        getRow: async () => null,
+        listNodes: async () => nodeRows,
+        subscriptionsOf: async () => [],
+        subscribersOf: async () => [],
+        view: async () => [],
+        ticketCountsForView: async () => ({}),
+        hasActiveLiveSubscription: async () => false,
+    };
+    const rows = await dashboardRowsAllFromSource(source);
+    await enrichRowsFromSource(source, rows);
+    assert.equal(maxInFlight, 1);
+    assert.deepEqual(rows.map((entry) => entry.name), ['a', 'b', 'c']);
+});
 let home;
 let localCwd;
 let sessionFile;

package/dist/core/canvas/crons.d.ts

@@ -160,8 +160,9 @@ export declare function setCronLastOutputHash(cron_id: string, hash: string): vo
  *  terminal node that stopped without finishing. */
 export declare function hasPendingCancelOnWakeCron(anchor_node: string): boolean;
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
- *  Two seams call it: reviveNode on every revive-for-any-reason (the wake won
- *  the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
+ *  Two seams call it: reviveNode on a WAKE — every revive except a recovery
+ *  relaunch, which only replaces a dead broker instance and leaves the wait
+ *  open (the wake won the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
  *  with the node, so its deadline must not fire against a finalized or closed
  *  row). Standing declarative crons are untouched — only cancel-on-wake rows.
  *  Kills any in-flight

package/dist/core/canvas/crons.js

@@ -219,8 +219,9 @@ export function hasPendingCancelOnWakeCron(anchor_node) {
         .get(anchor_node) !== undefined);
 }
 /** DELETE every cancel-on-wake cron anchored to this node — the deadline rule.
- *  Two seams call it: reviveNode on every revive-for-any-reason (the wake won
- *  the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
+ *  Two seams call it: reviveNode on a WAKE — every revive except a recovery
+ *  relaunch, which only replaces a dead broker instance and leaves the wait
+ *  open (the wake won the race), and the `finish`/`cancel` lifecycle transitions (the wait ended
  *  with the node, so its deadline must not fire against a finalized or closed
  *  row). Standing declarative crons are untouched — only cancel-on-wake rows.
  *  Kills any in-flight

package/dist/core/canvas/pid.d.ts

@@ -1,17 +1,8 @@
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export declare function isPidAlive(pid: number | null | undefined): boolean;
 /** THE single precision-aware identity compare, used EVERYWHERE two
  *  `composeIdentity` fingerprints are compared (this module's own

package/dist/core/canvas/pid.js

@@ -10,46 +10,31 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readKernelBootId } from './boot-id.js';
-/** Is `pid` a ZOMBIE (exited, awaiting reap by its parent)? `kill(pid, 0)`
- *  reports a zombie as a perfectly normal alive process — its PID is still
- *  occupied in the process table — so callers relying on that signal-0 probe
- *  alone (see `isPidAlive`) misread a dead broker as alive forever whenever
- *  its spawning process never reaps it (crouton-labs zombie-broker bug: the
- *  front door's foreground attach session parks its OWN event loop for the
- *  whole session — see `bootRoot` in runtime/boot-root.ts — so it can't process
- *  the SIGCHLD that would otherwise reap its detached broker child in real
- *  time). `ps -o stat=` reports a leading `Z` for a zombie on BOTH BSD ps
- *  (macOS) and procps-ng (Linux), so one portable probe covers both platforms
- *  without a Linux-only `/proc` special case. Best-effort: any probe failure
- *  (spawn error, no matching row, non-zero exit) reads as NOT a zombie —
- *  fail-open, matching this module's other guards; a probe failure must never
- *  be misread as proof of death (a live pid IS alive; only a positive `Z`
- *  read says otherwise). */
-function isZombie(pid) {
+/** Classify the current `ps` row for a pid. BSD ps and procps-ng both report a
+ *  leading `Z` for zombies and exit silently with empty output when no process
+ *  matches. Only a probe that could not run is unknown; that is the sole
+ *  fail-open result. */
+function psProcessState(pid) {
     try {
         const r = spawnSync('ps', ['-o', 'stat=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000 });
-        if (r.status !== 0 || typeof r.stdout !== 'string')
-            return false;
-        return r.stdout.trim().charAt(0) === 'Z';
+        if (r.error != null || r.signal != null || typeof r.stdout !== 'string')
+            return 'unknown';
+        if (typeof r.stderr === 'string' && r.stderr.trim() !== '')
+            return 'unknown';
+        const stat = r.stdout.trim();
+        if (stat === '')
+            return 'gone';
+        return stat.charAt(0) === 'Z' ? 'zombie' : 'live';
     }
     catch {
-        return false;
+        return 'unknown';
     }
 }
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export function isPidAlive(pid) {
     if (pid == null)
         return false;
@@ -59,7 +44,8 @@ export function isPidAlive(pid) {
     catch (e) {
         return e.code === 'EPERM';
     }
-    return !isZombie(pid);
+    const state = psProcessState(pid);
+    return state !== 'zombie' && state !== 'gone';
 }
 /** Matches the kernel `boot_id` UUID shape (`/proc/sys/kernel/random/boot_id`),
  *  used to tell a NEW-format identity base (a per-boot UUID) apart from a

package/dist/core/canvas/render-source.js

@@ -430,14 +430,18 @@ export async function enrichRowsFromSource(source, rows, asks) {
         return;
     const remote = source instanceof RemoteCanvasSource;
     const askMap = asks ?? {};
-    await Promise.all(todo.map(async (row) => {
+    // A full dashboard may contain thousands of rows. Keep source reads serial:
+    // ApiCanvasSource turns each into a unix-socket request, and an unbounded
+    // Promise.all can overflow crtrd's accept backlog then spuriously trigger
+    // the client's cold-daemon path even though the daemon is still running.
+    for (const row of todo) {
         const meta = await source.getNode(row.node_id);
         if (meta !== null)
             row.name = fullName(meta);
         row.ctx_tokens = remote ? 0 : (readNodeTelemetry(row.node_id).tokens_in ?? 0);
         row.asks = askMap[row.node_id] ?? 0;
         row.enriched = true;
-    }));
+    }
 }
 /** goal (initial-prompt.md) and session parts are local disk reads — suppressed
  *  to undefined for a remote source. */

package/dist/core/runtime/revive-all.js

@@ -95,7 +95,9 @@ export function reviveAll() {
     const result = { revived: [], failed: [] };
     for (const meta of listDisconnected()) {
         try {
-            reviveNode(meta.node_id, { resume: true });
+            // Reconnecting a disconnected broker is recovery, not a wake — a node
+            // waiting on an armed deadline keeps it across the sweep.
+            reviveNode(meta.node_id, { resume: true, recovery: true });
             result.revived.push(meta.node_id);
         }
         catch (err) {

package/dist/core/runtime/revive.d.ts

@@ -49,10 +49,17 @@ export interface ReviveResult {
 /** Relaunch `nodeId`'s broker engine from its persisted recipe and update canvas
  *  meta. Opens no viewer (engine-only).
  *
+ *  `recovery: true` marks a launch that only replaces a broker instance which
+ *  died or was torn down — the daemon's respawn after a broker exit, and the
+ *  `reviveAll` sweep over disconnected nodes. Nothing external arrived for the
+ *  node, so such a launch is NOT a wake and does not consume the node's armed
+ *  deadline (see the cancelCronsOnWake call below).
+ *
  *  Throws if the node does not exist. All other failures propagate as-is —
  *  callers (daemon, command) decide how to handle.
  */
 export declare function reviveNode(nodeId: string, opts: {
     resume: boolean;
     wakeReason?: ReviveWakeReason;
+    recovery?: boolean;
 }): ReviveResult;

package/dist/core/runtime/revive.js

@@ -92,6 +92,12 @@ function isUnstartedBirth(nodeId) {
 /** Relaunch `nodeId`'s broker engine from its persisted recipe and update canvas
  *  meta. Opens no viewer (engine-only).
  *
+ *  `recovery: true` marks a launch that only replaces a broker instance which
+ *  died or was torn down — the daemon's respawn after a broker exit, and the
+ *  `reviveAll` sweep over disconnected nodes. Nothing external arrived for the
+ *  node, so such a launch is NOT a wake and does not consume the node's armed
+ *  deadline (see the cancelCronsOnWake call below).
+ *
  *  Throws if the node does not exist. All other failures propagate as-is —
  *  callers (daemon, command) decide how to handle.
  */
@@ -309,9 +315,15 @@ export function reviveNode(nodeId, opts) {
     // unchecked result, is what scopes a later diagnostic read to this attempt.
     clearFault(nodeId);
     const bootFault = beginBootFaultAttempt(nodeId);
-    // A cron armed --cancel-on-wake belongs to the dormancy being left, so any
-    // revive of its anchor deletes it.
-    cancelCronsOnWake(nodeId);
+    // A cron armed --cancel-on-wake belongs to the dormancy being left, so a WAKE
+    // of its anchor deletes it — an inbox delivery, an attach, an explicit
+    // revive. A recovery relaunch is not a wake: the broker instance died or was
+    // torn down and the daemon is putting the same waiting node back on its feet,
+    // with nothing external having arrived. The wait the deadline bounds is still
+    // open, so the deadline survives — the same rule lifecycle.ts applies to the
+    // `crash` transition (a deadline MUST survive instance death).
+    if (opts.recovery !== true)
+        cancelCronsOnWake(nodeId);
     let launched;
     try {
         launched = headlessBrokerHost.launch(nodeId, inv, {

package/dist/daemon/fleet.js

@@ -352,6 +352,10 @@ export class DaemonFleet {
             reviveNode(nodeId, {
                 resume: action === 'respawn-resume',
                 wakeReason: cleanAbort ? 'runtime-restart-abort' : undefined,
+                // Replacing a dead broker instance is recovery, not a wake: nothing
+                // external arrived for this node, so an armed deadline survives the
+                // relaunch instead of being consumed by it.
+                recovery: true,
             });
         }
         catch (err) {