@north-light/crouter 0.3.173 → 0.3.174

package/dist/daemon/crtrd.js

@@ -43,33 +43,22 @@
 //   scoped by CRTR_PIDFILE in managed deployments and crtrHome()/crtrd.pid
 //   otherwise. Shutdown quiesces admitted work, removes only this invocation's
 //   mirror, and then releases its exact claim.
-import { writeFileSync, readFileSync, rmSync, mkdirSync, statSync, } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { homedir } from 'node:os';
-import { execFile } from 'node:child_process';
+import { writeFileSync, readFileSync, rmSync, mkdirSync, } from 'node:fs';
+import { dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { promisify } from 'node:util';
-import { crtrHome, nodeDir, jobDir, isSafeNodeId } from '../core/canvas/paths.js';
-import { listNodes, getRow, getNode, migrateLegacyPidIdentities, listFocuses, closeFocusRow, pruneToLimit, subscribersOf, } from '../core/canvas/index.js';
-import { fullName } from '../core/canvas/labels.js';
-import { transition } from '../core/runtime/lifecycle.js';
-import { isBusy, busySince } from '../core/runtime/busy.js';
-import { FAULT_QUIET_MS, readFault, recordFault } from '../core/runtime/fault.js';
-import { fanDoctrineWake } from '../core/runtime/close.js';
+import { crtrHome, isSafeNodeId } from '../core/canvas/paths.js';
+import { listNodes, migrateLegacyPidIdentities, } from '../core/canvas/index.js';
 import { createApiServer } from './api/server.js';
 import { reconcileUndeliveredTickets } from './human/sweep.js';
 import { sweepReviews } from './review/sweep.js';
-// Lean pidfile/liveness helpers now live in `pidfile.ts` (db-free, so the CLI
-// daemon front door can import them without reaching openDb). Imported here for
-// internal use and re-exported below to preserve the historical crtrd.ts
-// surface (tests, `commands/sys/daemon.ts`).
 import { pidfilePath } from './pidfile.js';
-export { readPidfile, isDaemonRunning } from './pidfile.js';
 import { rendererWarning } from '../core/runtime/package-health.js';
 import { DEFAULT_INTERVAL_MS } from './supervise-cadence.js';
-import { readConfig } from '../core/config.js';
-export { FAULT_QUIET_MS };
-import { captureLivenessSnapshot, capturePidCommand, captureTeardownSnapshot, isPidAlive, killProcessTreePids, recordedPidLiveness, } from '../core/canvas/pid.js';
+import { BrokerSupervisionReconciler } from './reconcilers/broker-supervision.js';
+import { ControllerDeathReconciler, DormantInboxReconciler } from './reconcilers/dormant-inbox.js';
+import { CronLaneReconciler } from './reconcilers/cron-lane.js';
+import { StorageMaintenanceReconciler } from './reconcilers/storage-maintenance.js';
+import { captureLivenessSnapshot, capturePidCommand, captureTeardownSnapshot, isPidAlive, killProcessTreePids, } from '../core/canvas/pid.js';
 import { bindFleet, boundFleet } from '../core/runtime/fleet.js';
 import { bindDaemonControl, clearDaemonControl } from './control.js';
 import { spawnDaemon } from './manage.js';
@@ -77,114 +66,12 @@ import { reconcileAndMigrateBoot } from '../core/canvas/boot.js';
 import { resolveInstallId } from '../core/canvas/install-id.js';
 import { setInstallId } from '../core/runtime/nodes.js';
 import { claimDaemonOwnership, releaseDaemonOwnership } from '../core/canvas/daemon-owner.js';
-import { listLivePanes, tearDownNode } from '../core/runtime/placement.js';
-import { reviveNode } from '../core/runtime/revive.js';
 import { prewarmRecentRecipes, reapStaleSpares } from '../core/runtime/warm-pool.js';
-import { headlessBrokerHost } from '../core/runtime/host.js';
-import { reloadAuthLive } from '../core/runtime/auth-reload.js';
-import { DaemonFleet, retryResumeMode } from './fleet.js';
-export { retryResumeMode };
-import { appendControllerDeathNotice, readInboxSince, readCursor, } from '../core/feed/inbox.js';
+import { DaemonFleet } from './fleet.js';
 import { migrateLegacyInboxIdentities } from '../core/feed/inbox-migrate.js';
 import { emitEvent } from '../core/events/emit.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { bindDaemonEventSource } from '../core/events/source.js';
-import { recoverStaleCronLeases, runDueCrons } from './cron-run.js';
-// Perf (freeze diagnosis, 2026-07-12): every `ps`/`tmux` shell-out on the
-// reconcile tick used to go through `spawnSync`, which blocks the WHOLE event
-// loop for the life of the child process. With a large fleet of brokers (100+
-// observed), these synchronous spawns stacked up and froze the daemon solid —
-// no other tick, inbox poll, or IPC could run while one was blocked on
-// `posix_spawn`. `execFileAsync` (promisified `execFile`) runs the child via
-// libuv without blocking the main thread; every call site below that used to
-// `spawnSync` now awaits this instead, with identical inputs/outputs (same
-// `encoding`/`timeout`, same decisions made from stdout) — only the blocking
-// behavior changes.
-const execFileAsync = promisify(execFile);
-// Count-based auto-prune of the canvas (pruneToLimit). The canvas grows
-// unbounded — the TTL `crtr canvas prune` is manual, so without this a long-lived
-// daemon's canvas accumulates thousands of terminal nodes, making every scan +
-// `canvas snapshot` expensive. Keep the AUTO_PRUNE_MAX most-recently-active nodes
-// (live nodes are NEVER deleted, so the real floor is max(AUTO_PRUNE_MAX,
-// liveCount)). It's a DB sweep, not per-tick work — throttled to PRUNE_INTERVAL_MS.
-const AUTO_PRUNE_MAX = 2000;
-const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
-// Last auto-prune wall-clock. -Infinity so the FIRST tick after start runs it
-// (the canvas may already be huge at boot); thereafter every PRUNE_INTERVAL_MS.
-// In-memory only — a daemon restart re-runs it once, which is harmless.
-let lastPruneAt = Number.NEGATIVE_INFINITY;
-// Warm-pool GC (reapStaleSpares). Unclaimed spares are hidden from every
-// listing, so NOTHING else collects them: the recovery sweep never resumes one
-// (a daemon handover therefore leaves its broker dead and its row parked
-// forever) and the count-based prune cannot even see it. Each carries a
-// ~150-300 MB resident broker, so the pool must collect its own garbage. Not
-// per-tick work — the sweep pid-probes each spare, so it is throttled.
-const SPARE_SWEEP_INTERVAL_MS = 60 * 1000;
-let lastSpareSweepAt = Number.NEGATIVE_INFINITY;
-// Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
-// livelock shape as the stranded-relaunch case above, but on the SEPARATE
-// pass-2 path that resumes a dormant idle-released node the instant its inbox
-// gains an unseen entry. That path called reviveNode() unconditionally every
-// poll with no grace, no backoff, and no attempt cap.
-//
-// ROUND 1 keyed the retry counter on row-state residency (pid liveness),
-// cleared the instant the pid-alive branch observed a live engine. That
-// caught a broker that never boots at all — but the RECURRING incident's
-// actual failure is TURN-level, not launch-level: the revive succeeds (broker
-// launches, records a pid — clearing the round-1 counter), the turn then
-// faults against the provider, the engine exits with the inbox CURSOR
-// UNADVANCED, the node re-enters idle/idle-release, pass-2 sees the same
-// unseen entries again, and — because the counter was just cleared by the
-// transiently-alive engine — starts over at attempt 1/6 every single cycle.
-// crtrd.err showed exactly this: hundreds of `attempt 1/6` lines, never
-// `2/6`, interleaved with `fatal-fault <id> (other, pi→provider)`.
-//
-// ROUND 2 fix: key the counter on INBOX-CURSOR PROGRESS, not row-state
-// residency or pid liveness. `readCursor(id)` is recorded as the state's
-// baseline the first time a stuck delivery is observed; a transiently-alive
-// engine does NOT reset it (nothing clears this state on liveness — the
-// fleet's exit-policy jobs never touch it). Only a different exact cursor identity on
-// the NEXT observation — proof the wake delivered something — resets the
-// counter (via `cursorChanged` below); an unchanged identity is the SAME stuck
-// delivery and increments/backs off exactly like the stranded-relaunch path.
-const IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS = 6;
-const IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS = 10 * 60_000; // 10 minutes
-// Backoff base for the idle-release retry ladder (kept at the value the old
-// boot-grace clock supplied, so the ladder's math is unchanged).
-const IDLE_RELEASE_RELAUNCH_BASE_MS = 20_000;
-const idleReleaseRelaunchState = new Map();
-function idleReleaseRelaunchBackoffMs(attempts) {
-    return Math.min(IDLE_RELEASE_RELAUNCH_BASE_MS * 2 ** attempts, IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS);
-}
-/** Cleared ONLY when the node row itself is gone, or once the counter gives
- *  up and terminalizes the node — NEVER on a transiently-alive engine (that
- *  was round 1's bug) and never on a bare idle-release status flap (the
- *  fault-recovery cycle flaps status EVERY episode, so clearing on that would
- *  reproduce the exact same livelock one level up). */
-function clearIdleReleaseRelaunchState(id) {
-    idleReleaseRelaunchState.delete(id);
-}
-// ---------------------------------------------------------------------------
-// Broker-pressure thresholds bound daemon-initiated revives only. Explicit
-// `node lifecycle revive` and `surface node focus` calls bypass this daemon sweep.
-// User config is the durable host policy; environment variables are explicit
-// process-level overrides for managed deployments.
-function configuredPositiveInteger(name, fallback) {
-    const raw = process.env[name];
-    if (raw === undefined || raw === '')
-        return fallback;
-    const n = Number(raw);
-    return Number.isSafeInteger(n) && n >= 1 ? n : fallback;
-}
-export function brokerThresholdsForDaemon() {
-    const configured = readConfig('user').brokerThresholds;
-    const automaticReviveCap = configuredPositiveInteger('CRTR_MAX_LIVE_BROKERS', configured.automaticReviveCap);
-    const warning = configuredPositiveInteger('CRTR_WARN_LIVE_BROKERS', configured.warning);
-    // Independent environment overrides can invert the configured pair. Clamp
-    // the warning to the cap so broker pressure is always visible before revive
-    // deferral begins.
-    return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
-}
 // A broker DECLARES its owning canvas in argv at spawn (host.ts launch:
 // `broker-cli.js --canvas-home <home> --epoch <id> <nodeId>`), so ownership is
 // an exact match on this daemon's own canvas home — no path inference. An
@@ -355,18 +242,11 @@ export async function runStartupRecoverySweep(fleet) {
         emitEvent({ level: 'error', event: 'daemon.recovery_sweep.failed', error: err });
         return;
     }
-    const thresholds = brokerThresholdsForDaemon();
     for (const row of rows) {
         if (row.kind === 'human')
             continue; // human bridge rows — never broker-hosted
-        if (fleet.size() >= thresholds.automaticReviveCap) {
-            emitEvent({
-                level: 'warn',
-                event: 'daemon.recovery_sweep.capacity_deferred',
-                fields: { live_count: fleet.size() },
-            });
+        if (!brokerSupervision.hasStartupRecoveryCapacity(fleet))
             break;
-        }
         await operationIdContext.fresh(async () => {
             try {
                 await fleet.recoverDeadNode(row.node_id);
@@ -386,830 +266,6 @@ export async function runStartupRecoverySweep(fleet) {
         });
     }
 }
-// Broker-pressure warnings are surfaced at the lower threshold so a growing
-// census is visible before automatic revives are deferred. A canonical event
-// records the condition and a throttled tmux notice reaches attached clients.
-const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
-let lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
-async function warnOverCapInTmux(count, warning, max) {
-    const now = Date.now();
-    if (now - lastOverCapWarnAt < OVER_CAP_WARN_THROTTLE_MS)
-        return;
-    lastOverCapWarnAt = now;
-    emitEvent({
-        level: 'warn',
-        event: 'broker.capacity.warning',
-        fields: { live_count: count, warning_threshold: warning, hard_cap: max },
-    });
-    const msg = `⚠ crtrd: ${count} live brokers (warning ${warning}; hard cap ${max}) — possible broker leak. ps -ax | grep broker-cli.js`;
-    try {
-        const clients = await execFileAsync('tmux', ['list-clients', '-F', '#{client_name}'], {
-            encoding: 'utf8',
-            timeout: 2000,
-        });
-        if (typeof clients.stdout !== 'string')
-            return;
-        // Fan out per-client notification — each client's primary-then-fallback
-        // display-message sequence still runs in order, but N stale clients no
-        // longer serialize into ~4s × N of teardown-owned latency.
-        await Promise.allSettled(clients.stdout.split('\n').map(async (client) => {
-            if (client === '')
-                return;
-            // -d 10000 holds the message for 10s (tmux ≥3.2); if this tmux
-            // predates -d, fall back to the default display-time rather than not
-            // warning.
-            try {
-                await execFileAsync('tmux', ['display-message', '-d', '10000', '-c', client, msg], {
-                    encoding: 'utf8',
-                    timeout: 2000,
-                });
-            }
-            catch {
-                try {
-                    await execFileAsync('tmux', ['display-message', '-c', client, msg], {
-                        encoding: 'utf8',
-                        timeout: 2000,
-                    });
-                }
-                catch {
-                    /* both display-message variants failed for this client — skip it */
-                }
-            }
-        }));
-    }
-    catch {
-        /* no tmux server — the canonical event above still records the condition */
-    }
-}
-// Throttle for the canonical "at capacity" event: without it, every deferred
-// revive on every 2s poll would flood the daemon event stream as badly as the
-// livelock this cap exists to prevent.
-const CAPACITY_LOG_THROTTLE_MS = 30_000;
-let lastCapacityLogAt = Number.NEGATIVE_INFINITY;
-/** Capacity for a TICK-initiated launch (pass-2 inbox wakes + due crons whose
- *  run launches or revives a node): the live count is EXACTLY the fleet size
- *  (design D-7) — every live broker is a fleet entry, no census or row inference. Checked BEFORE
- *  any attempt/backoff state is mutated at each call site, so a capacity-
- *  deferred revive costs a node NOTHING against its retry budget — it's
- *  retried plainly next poll once capacity frees up. Exit-driven 1:1 respawns
- *  are cap-exempt by construction: the dying broker freed its slot at exit. */
-function hasBrokerCapacity(max) {
-    if (boundFleet().size() < max)
-        return true;
-    const now = Date.now();
-    if (now - lastCapacityLogAt >= CAPACITY_LOG_THROTTLE_MS) {
-        lastCapacityLogAt = now;
-        emitEvent({
-            level: 'warn',
-            event: 'broker.capacity.revive_deferred',
-            fields: { live_count: boundFleet().size(), hard_cap: max },
-        });
-    }
-    return false;
-}
-// §H refresh-authority grace: how long a node may sit with intent='refresh', its
-// turn OVER (busy marker absent) and its engine still ALIVE before the daemon
-// concludes the refresh stalled and force-kills the engine. The healthy window is
-// seconds: a sound stophook calls shutdown() the instant the refresh turn ends;
-// the resulting broker exit is classified as respawn-fresh. Minutes of this
-// live-fleet state means the engine never exited — either shutdown hung
-// (observed at ~200k-token contexts) OR a STALE in-process stophook (pi
-// extensions never reload, so a days-old resident carries an old hook that
-// ignores intent='refresh' at stop) never called shutdown at all. Nothing else
-// will emit the exit event, so the daemon is the authority: kill the engine here
-// and let its exit-policy job revive fresh.
-export const YIELD_STALL_GRACE_MS = 3 * 60_000;
-// After a yield-stall SIGTERM, how long the pi gets to die gracefully before
-// escalating to SIGKILL (a pi hung at context overflow may not run handlers).
-const KILL_ESCALATE_MS = 20_000;
-// Per-node yield-stall clocks (audit 2026-06-09, Bug 1). In-memory — a daemon
-// restart resets them (worst case: one extra grace).
-const yieldStallSince = new Map();
-const yieldTermAt = new Map();
-/** Refresh-stall decision (§H refresh-authority; audit 2026-06-09, Bug 1 — node
- *  mq5v9hfa-74493d45 and siblings; stuck-refresh — parent mq7s5o93): a `node
- *  yield` / refresh records intent='refresh' and relies on the in-process
- *  stophook to call shutdown at stop, but the engine can be left ALIVE — either
- *  it HANGS instead of exiting (very large contexts) or a STALE stophook (pi
- *  extensions never reload) ignores intent='refresh' entirely and never calls
- *  shutdown. Either way: engine alive, turn over, intent pending forever. The
- *  daemon only revives DEAD engines, so without this verdict the node is
- *  permanently stuck (no revive, no wake). Pure core, mirroring wedgeVerdict;
- *  the kill side effects live in handleYieldStall.
- *
- *  'kill' ONLY when ALL of: engine alive, intent='refresh', the turn is over
- *  (busy marker absent — a node may legitimately keep working for many minutes
- *  after running `node yield` mid-turn, and a working engine must never be
- *  killed), and the state has persisted past YIELD_STALL_GRACE_MS. */
-export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
-    if (piPidAlive !== true)
-        return 'leave';
-    if (intent !== 'refresh')
-        return 'leave';
-    if (busy)
-        return 'leave';
-    if (stalledFor === null || stalledFor < YIELD_STALL_GRACE_MS)
-        return 'pending';
-    return 'kill';
-}
-/** Enact a refresh-stall (§H refresh-authority): clock the stalled state, then
- *  SIGTERM the hung engine (escalating to SIGKILL if it survives
- *  KILL_ESCALATE_MS — an engine hung at context overflow, or a stale hook that
- *  never wired shutdown, may never run its handlers, so a graceful frame can't be
- *  trusted; the signal escalation is what guarantees the engine actually dies).
- *  Once the engine is dead the ORDINARY machinery finishes the job: the kill
- *  lands as a real exit event whose policy job classifies intent='refresh' as
- *  respawn-fresh, i.e. the fresh roadmap-revive the yield asked for. Safe
- *  against a graceful shutdown racing us: markCleanExitDone no-ops while intent
- *  is pending, so a dying engine can't mis-finalize the node. */
-function handleYieldStall(row, pid, now) {
-    const id = row.node_id;
-    if (row.intent !== 'refresh' || isBusy(id)) {
-        yieldStallSince.delete(id);
-        yieldTermAt.delete(id);
-        return;
-    }
-    const since = yieldStallSince.get(id);
-    if (since === undefined) {
-        yieldStallSince.set(id, now);
-        return;
-    }
-    if (yieldStallVerdict(true, row.intent, false, now - since) !== 'kill')
-        return;
-    // The tick snapshot is observation data, not signal authorization: recheck
-    // immediately before acting so PID reuse during a long tick cannot target a
-    // process that never belonged to this node.
-    if (row.pi_pid_identity == null || recordedPidLiveness(pid, row.pi_pid_identity) !== 'alive')
-        return;
-    const termed = yieldTermAt.get(id);
-    if (termed === undefined) {
-        emitEvent({
-            level: 'warn',
-            event: 'broker.yield_stall.sigterm',
-            ...(isSafeNodeId(id) ? { node_id: id } : {}),
-            fields: {
-                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                pid,
-                elapsed_ms: now - since,
-                grace_ms: YIELD_STALL_GRACE_MS,
-            },
-        });
-        try {
-            process.kill(pid, 'SIGTERM');
-        }
-        catch {
-            /* already gone */
-        }
-        yieldTermAt.set(id, now);
-    }
-    else if (now - termed >= KILL_ESCALATE_MS) {
-        emitEvent({
-            level: 'warn',
-            event: 'broker.yield_stall.sigkill',
-            ...(isSafeNodeId(id) ? { node_id: id } : {}),
-            fields: {
-                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                pid,
-                elapsed_ms: now - termed,
-                grace_ms: KILL_ESCALATE_MS,
-                stall_elapsed_ms: now - since,
-            },
-        });
-        try {
-            process.kill(pid, 'SIGKILL');
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Wedge detection (issue #110): a broker whose pid is alive but whose engine is
-// frozen MID-TURN (a runaway subprocess, a hung stream) is invisible to every
-// other guarantee — the pid-alive branch above returns early, yield-stall only
-// fires on intent='refresh', and provider-fault recovery needs a completed
-// ERROR turn. A node in this state never pushes, so its parent waits forever
-// with no wake and no recorded fault marker — there's just silence.
-//
-// Detection always NOTIFIES (fans a doctrine wake + records a `daemon→node`/
-// 'wedged' fault so the node shows ⌘ “wedged · needs you” on canvas graph
-// views). Recovery
-// then branches on whether the broker's process TREE has a descendant:
-//   • descendants present → a runaway SUBPROCESS is the likely cause; the
-//     daemon does NOT touch the engine — kill the subprocess (not the node);
-//     see `crtr memory read wedged-child-on-runaway-bash`.
-//   • no descendants (the broker pid stands alone — e.g. the engine itself
-//     stalled after a model_change, with nothing to kill) → the daemon
-//     performs the ONLY remaining remediation itself: SIGTERM the broker, the
-//     same on-demand kick `node lifecycle revive --now` does — the SIGTERM
-//     gives Pi a bounded chance to persist an aborted turn, then the exit-policy
-//     job either resumes that certified session with a continuation or starts
-//     the existing dirty recovery cycle.
-//
-// Two corroborating signals, both generous, so a routine long-running bash/
-// build/test tool call is never mistaken for a wedge:
-//   1. quietForMs — ms since the busy marker's mtime last moved. canvas-
-//      stophook re-touches that marker (`touchBusy`) on every engine-level sign
-//      of life within a turn: a tool starting/streaming/ending, a streamed
-//      assistant token, or the turn ending. A tool that is actively streaming
-//      output, or a turn producing tokens, keeps this at ~0 no matter how long
-//      the OVERALL turn runs. Only a turn with NO observed engine event at all
-//      for WEDGE_QUIET_MS is even a candidate.
-//   2. cpuPercent — the broker's WHOLE PROCESS TREE (the broker pid + every
-//      descendant), summed, sampled ONLY once a node is already a time-based
-//      candidate (never every tick — the `ps` shell-out is cheap but pointless
-//      on a healthy node). Sampling the tree, not just the broker pid, matters
-//      because the broker often sits idle awaiting a CHILD subprocess (bash,
-//      a build, a test run) that is the one actually burning CPU — sampling
-//      the broker alone would read that as 0% and false-fire on a perfectly
-//      healthy long-running tool call. A pi process (or any descendant)
-//      genuinely computing shows non-trivial tree CPU and is exonerated even
-//      past the quiet grace; a pi merely awaiting a subprocess or a stalled
-//      I/O call — wedged OR legitimately blocked on something equally silent —
-//      reads ~0% across the whole tree, matching the filed issue's own
-//      evidence (pid alive, 0% CPU, session file not advancing). A failed/
-//      unreadable CPU sample is treated as UNKNOWN, never as “low” — the
-//      verdict stays 'pending' rather than risk a false fire on an unreadable
-//      signal.
-//
-//      ACCEPTED residual: a legitimate subprocess blocked on silent I/O (e.g. a
-//      20-minute download emitting no output, a long `sleep`) reads ~0% tree
-//      CPU and is indistinguishable from a real wedge at the OS level — no CPU
-//      signal can tell a hung child from an I/O-blocked one. This is accepted:
-//      that case still HAS a descendant, so the daemon only notifies (never
-//      kills) — the cost of the rare false positive is one doctrine wake, and
-//      20+ minutes of total silence with near-zero tree CPU is itself worth
-//      surfacing either way. Only the no-descendants branch ever acts, and
-//      SIGTERM preserves durable context: a settled abort resumes with a
-//      continuation, while an unconfirmed abort takes the existing fresh cycle.
-//      A false positive therefore costs at most one unnecessary recovery, not
-//      lost work.
-// ---------------------------------------------------------------------------
-// Generous: routine long tool calls settle well under this; only a turn with
-// zero observed engine progress for 20+ minutes is even a wedge CANDIDATE.
-export const WEDGE_QUIET_MS = 20 * 60_000;
-// CPU% ceiling for the corroborating sample, taken once quietForMs already
-// clears the grace above. Small but nonzero — tolerates measurement noise
-// without accepting a process that's visibly still doing work.
-export const WEDGE_CPU_MAX_PERCENT = 2;
-/** Pure wedge decision — mirrors yieldStallVerdict: a total
- *  function of the observed signals, no clock or process access of its own.
- *  `busy` false — the turn already ended (however it routed) — is never a
- *  wedge, regardless of how stale the marker looks. `quietForMs` null means
- *  the heartbeat marker couldn't be read (treated as “not enough evidence”, not
- *  “wedged”). `cpuPercent` null (sample failed/unavailable) or above the
- *  ceiling — EITHER keeps the verdict at 'pending' (keep watching next tick)
- *  rather than firing on an unconfirmed or contradicted signal. */
-export function wedgeVerdict(input) {
-    if (!input.busy)
-        return 'leave';
-    if (input.quietForMs === null || input.quietForMs < WEDGE_QUIET_MS)
-        return 'leave';
-    if (input.cpuPercent === null || input.cpuPercent > WEDGE_CPU_MAX_PERCENT)
-        return 'pending';
-    return 'wedged';
-}
-/** Notified-episode dedup (one notice per wedge, per §Detection-not-repeat-fire):
- *  keyed on node id → the busy-marker mtime we already notified for. The marker
- *  only advances on genuine engine progress (a heartbeat) or a fresh turn
- *  starting, so a stale wedge that later recovers (or a brand-new turn) always
- *  carries a DIFFERENT mtime and is free to notify again. In-memory only, like
- *  every other daemon dedup latch here — a restart re-arms it (worst case: one
- *  repeat notice), which is the same tradeoff as the daemon's other in-memory dedup latches. */
-const wedgeNotifiedAt = new Map();
-/** Fatal-provider-fault notify latch (issue #94), keyed on node id → the
- *  `fault.since` we already fanned a wake for. A fatal fault (dead OAuth grant,
- *  bad key, protocol) has NO retry consumer, so an errored turn just leaves the
- *  node `active` with a live-but-dormant broker and, until now, woke nobody —
- *  the manager waiting on it hung and later scheduled wakes silently re-failed.
- *  Deduped on `fault.since` so one episode fans exactly one wake; a later
- *  episode (fresh `since`) or a cleared fault re-arms. In-memory like every
- *  other latch here. */
-const fatalFaultNotifiedAt = new Map();
-/** Pure: sum CPU% across a process's entire tree (itself + every descendant).
- *  Parses `ps -ax -o pid=,ppid=,pcpu=` output, builds a ppid→children map, and
- *  DFS's from `rootPid` collecting root + all descendants; malformed/blank
- *  lines are skipped. Returns `null` if `rootPid` never appears in the output
- *  (can't measure at all — treated as UNKNOWN by wedgeVerdict, never as
- *  “low”) or the output has no parsable rows. Exported for direct unit testing
- *  — no process access of its own, mirroring wedgeVerdict's purity. */
-function parsePsTree(psOutput) {
-    const byPid = new Map(); // pid → pcpu
-    const childrenOf = new Map(); // ppid → child pids
-    for (const line of psOutput.split('\n')) {
-        const trimmed = line.trim();
-        if (trimmed === '')
-            continue;
-        const parts = trimmed.split(/\s+/);
-        if (parts.length < 3)
-            continue;
-        const pid = Number(parts[0]);
-        const ppid = Number(parts[1]);
-        const pcpu = Number(parts[2]);
-        if (!Number.isFinite(pid) || !Number.isFinite(ppid) || !Number.isFinite(pcpu))
-            continue;
-        byPid.set(pid, pcpu);
-        const siblings = childrenOf.get(ppid);
-        if (siblings === undefined)
-            childrenOf.set(ppid, [pid]);
-        else
-            siblings.push(pid);
-    }
-    return { byPid, childrenOf };
-}
-export function sumTreeCpu(psOutput, rootPid) {
-    const { byPid, childrenOf } = parsePsTree(psOutput);
-    if (!byPid.has(rootPid))
-        return null;
-    let total = 0;
-    const stack = [rootPid];
-    const seen = new Set();
-    while (stack.length > 0) {
-        const pid = stack.pop();
-        if (seen.has(pid))
-            continue; // guard against a malformed/cyclic ps snapshot
-        seen.add(pid);
-        total += byPid.get(pid) ?? 0;
-        const kids = childrenOf.get(pid);
-        if (kids !== undefined)
-            stack.push(...kids);
-    }
-    return total;
-}
-/** Pure (issue #119): does `rootPid` have ANY descendant in this ps snapshot
- *  — a runaway subprocess to kill — or does the broker stand ALONE in its own
- *  tree (nothing to kill; the engine itself stalled)? Shares `parsePsTree`
- *  with `sumTreeCpu` so the two facts the wedge remediation needs come from
- *  one `ps` sample. Null when `rootPid` isn't in the sample at all (can't
- *  tell — same "unknown, never treated as a fact" stance `sumTreeCpu` takes on
- *  a missing root). Exported for direct unit testing. */
-export function treeHasDescendants(psOutput, rootPid) {
-    const { byPid, childrenOf } = parsePsTree(psOutput);
-    if (!byPid.has(rootPid))
-        return null;
-    return (childrenOf.get(rootPid) ?? []).length > 0;
-}
-/** Sample the broker's WHOLE PROCESS TREE — the broker pid plus every
- *  descendant — via ONE `ps` shell-out, yielding both signals the wedge path
- *  needs: the summed tree CPU% (corroborates the heartbeat silence) and
- *  whether the tree has any descendant at all (issue #119 — decides whether
- *  remediation is "kill the subprocess" or "kick the broker"). Null on ANY
- *  failure (the shell-out itself failing, `ps` missing, or the root pid
- *  absent/output unparseable) — wedgeVerdict treats a null cpuPercent exactly
- *  like “too high”, so a broken probe can only ever suppress a false fire,
- *  never cause one; a null sample also means handleWedgeDetection never
- *  attempts the SIGTERM kick on unconfirmed information. */
-async function readTreeSample(pid) {
-    try {
-        const { stdout } = await execFileAsync('ps', ['-ax', '-o', 'pid=,ppid=,pcpu='], {
-            encoding: 'utf8',
-            timeout: 2000,
-        });
-        if (typeof stdout !== 'string')
-            return null;
-        const cpuPercent = sumTreeCpu(stdout, pid);
-        const hasDescendants = treeHasDescendants(stdout, pid);
-        if (cpuPercent === null || hasDescendants === null)
-            return null;
-        return { cpuPercent, hasDescendants };
-    }
-    catch {
-        return null;
-    }
-}
-/** Enact wedge detection for a LIVE, busy node (called from the tick's
- *  live-fleet pass, alongside handleYieldStall — the two never
- *  overlap in practice: yield-stall requires the turn OVER, wedge requires it
- *  mid-flight). Reads the heartbeat + samples CPU only when already past the
- *  time grace, fans one doctrine wake + records one `daemon→node` fault per
- *  episode, and never touches the engine itself. */
-async function handleWedgeDetection(id, pid, expectedIdentity, now) {
-    if (!isBusy(id)) {
-        wedgeNotifiedAt.delete(id); // turn ended (however it routed) — next turn starts a fresh episode
-        return;
-    }
-    const since = busySince(id);
-    const quietForMs = since === null ? null : now - since;
-    const sample = quietForMs !== null && quietForMs >= WEDGE_QUIET_MS ? await readTreeSample(pid) : null;
-    const cpuPercent = sample?.cpuPercent ?? null;
-    const verdict = wedgeVerdict({ busy: true, quietForMs, cpuPercent });
-    if (verdict !== 'wedged')
-        return;
-    if (since !== null && wedgeNotifiedAt.get(id) === since)
-        return; // already notified THIS episode
-    // readTreeSample is intentionally not signal authorization: confirm the
-    // launch identity again at the destructive boundary after its async probe.
-    if (sample?.hasDescendants === false
-        && (expectedIdentity == null || recordedPidLiveness(pid, expectedIdentity) !== 'alive'))
-        return;
-    if (since !== null)
-        wedgeNotifiedAt.set(id, since);
-    const meta = getNode(id);
-    const name = meta !== null ? fullName(meta) : id;
-    const minutes = Math.round((quietForMs ?? WEDGE_QUIET_MS) / 60_000);
-    // A null sample can't reach here — wedgeVerdict only fires 'wedged' on a
-    // confirmed near-zero cpuPercent, which requires a non-null sample — so
-    // `sample.hasDescendants` is always defined at this point; the `?? true`
-    // is a type-level fallback only, biased toward the SAFER branch (notify,
-    // don't SIGTERM) if that invariant is ever violated.
-    const hasDescendants = sample?.hasDescendants ?? true;
-    let label;
-    if (hasDescendants) {
-        // A runaway subprocess is the likely cause — the daemon does not touch the
-        // engine; the sanctioned recovery is manual (issue #110).
-        label =
-            `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                `${minutes}+ minutes and its process is near-idle. It will NOT recover on its own — read ` +
-                `\`crtr memory read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this ` +
-                `node) so its turn can resume with no lost context.`;
-    }
-    else {
-        // No descendant to kill — the engine itself stalled (e.g. mid model_change)
-        // with nothing a human could kill. The daemon performs the same kick
-        // `node lifecycle revive --now` does on demand: SIGTERM the broker. The
-        // exit-policy job resumes with a continuation if Pi certifies the abort;
-        // otherwise it starts the existing dirty recovery cycle (issue #119).
-        label =
-            `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                `${minutes}+ minutes, its process is near-idle, AND it has no subprocess to kill (the engine ` +
-                `itself stalled). Kicking it now: SIGTERM to the broker — the daemon will resume a cleanly ` +
-                `aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`;
-        try {
-            process.kill(pid, 'SIGTERM');
-        }
-        catch {
-            /* already gone — its ChildProcess exit event still owns recovery */
-        }
-    }
-    emitEvent({
-        level: 'error',
-        event: 'broker.wedge.detected',
-        ...(isSafeNodeId(id) ? { node_id: id } : {}),
-        fields: {
-            ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-            pid,
-            quiet_ms: quietForMs,
-            cpu_percent: cpuPercent,
-            has_descendants: hasDescendants,
-            kicked: !hasDescendants,
-        },
-    });
-    try {
-        recordFault(id, {
-            link: 'daemon→node',
-            op: 'engine wedge',
-            kind: 'wedged',
-            retry: { disposition: 'manual' },
-            message: label,
-        });
-    }
-    catch {
-        /* best-effort — the doctrine wake below is the load-bearing notice */
-    }
-    try {
-        fanDoctrineWake(id, subscribersOf(id), label, {
-            reason: 'child-wedged',
-            child: id,
-            quiet_ms: quietForMs,
-            cpu_percent: cpuPercent,
-            kicked: !hasDescendants,
-        });
-    }
-    catch {
-        /* best-effort, mirrors every other fan-out in this file */
-    }
-}
-/** Enact a fatal-provider-fault outcome for a LIVE node (issue #94; called
- *  from the tick's live-fleet pass). Fatal authentication and
- *  protocol faults remain parked because re-authentication or a correction can
- *  make the next wake viable. A context-window overflow cannot become viable
- *  while its oversized session remains selected, so it is crashed and its broker
- *  is torn down before the parent is notified. */
-function handleFatalFault(id, now) {
-    void now;
-    const fault = readFault(id);
-    if (fault === null) {
-        fatalFaultNotifiedAt.delete(id); // fault cleared — next episode re-arms
-        return;
-    }
-    if (fault.retry.disposition !== 'fatal' || fault.link !== 'pi→provider')
-        return;
-    if (fatalFaultNotifiedAt.get(id) === fault.since)
-        return; // already fanned THIS episode
-    fatalFaultNotifiedAt.set(id, fault.since);
-    const meta = getNode(id);
-    const name = meta !== null ? fullName(meta) : id;
-    const isAuth = fault.kind === 'auth';
-    const firstLine = (fault.message.split('\n')[0] ?? '').slice(0, 200);
-    const terminalOverflow = fault.kind === 'context-overflow';
-    const label = terminalOverflow
-        ? `Child failed — ${name} (${id}) exceeded its model context window and is now dead. ` +
-            `Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${firstLine}`
-        : `Child hit a fatal provider fault — ${name} (${id}) got a non-retryable ${fault.kind} error and will NOT recover on its own; ` +
-            `it stays alive but every wake re-fails until the fault clears. ` +
-            (isAuth
-                ? `Its provider credential is dead — re-authenticate (\`/login\`, or re-auth crtr); the child recovers on its next wake once the auth reloads. `
-                : ``) +
-            `Error: ${firstLine}`;
-    if (terminalOverflow) {
-        try {
-            transition(id, 'crash');
-            headlessBrokerHost.teardown(id);
-        }
-        catch {
-            /* the terminal notice remains useful if teardown raced the broker exit */
-        }
-    }
-    emitEvent({
-        level: 'error',
-        event: 'fault.fatal.fanout',
-        ...(isSafeNodeId(id) ? { node_id: id } : {}),
-        fields: {
-            ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-            kind: fault.kind,
-            link: fault.link,
-            terminal_overflow: terminalOverflow,
-        },
-    });
-    try {
-        fanDoctrineWake(id, subscribersOf(id), label, {
-            reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
-            child: id,
-            kind: fault.kind,
-            message: firstLine,
-        });
-    }
-    catch {
-        /* best-effort, mirrors every other fan-out in this file */
-    }
-}
-// ---------------------------------------------------------------------------
-// Auth-reload fan (one /login → every live broker follows)
-// ---------------------------------------------------------------------------
-/** The credential files every broker reads: pi's shared `auth.json` plus the managed
- *  providers' subscription pools, which own the anthropic / openai-codex credentials
- *  outright (see `PoolCredentialStore`) — a managed login touches ONLY a pool file, so
- *  watching auth.json alone would miss it. VENDORED from pi `config.getAuthPath()` (=
- *  `<agentDir>/auth.json`) the same way spawn.ts vendors the sessions root: a ROOT import
- *  of pi's `getAgentDir` would eager-load the heavy pi SDK index, so we mirror its
- *  resolution — `PI_CODING_AGENT_DIR` env, else `~/.pi/agent`. Re-sync on a pi SDK bump
- *  that moves auth.json. */
-function piCredentialPaths() {
-    const env = process.env['PI_CODING_AGENT_DIR'];
-    const agentDir = env !== undefined && env !== '' ? env : join(homedir(), '.pi', 'agent');
-    return [
-        join(agentDir, 'auth.json'),
-        join(agentDir, 'anthropic-subscriptions.json'),
-        join(agentDir, 'openai-codex-subscriptions.json'),
-    ];
-}
-// Last-observed credential mtime, for the daemon's change-watch. Lazily seeded on
-// the first poll that sees the file (so daemon start never fans a spurious
-// reload), then updated on every detected change. In-memory only — a daemon
-// restart re-seeds from the current file, so at most one missed change spans the
-// restart gap (re-login during a ~1s restart), which a human just redoes.
-let knownAuthMtimeMs = null;
-/** Watch the shared auth.json mtime and, on a change, fan a live `reload_auth`
- *  to every live broker so one `/login` propagates across the whole canvas. The
- *  broker that performed the login already self-reloaded; re-reloading it is
- *  harmless (authStorage.reload() is idempotent), so we don't exclude it.
- *
- *  Rides the existing ~2s poll, so several rapid writes from one login collapse
- *  to a single observed mtime change → a single fan. Each broker is reloaded
- *  under its own try/catch (Promise.allSettled): a broker mid-shutdown or whose
- *  socket refuses connect is logged and skipped, never aborting the others. */
-async function handleAuthReload(now) {
-    // The newest mtime across the credential files: any one of them changing moves it forward,
-    // and a file that does not exist yet simply contributes nothing.
-    let mtimeMs = 0;
-    for (const path of piCredentialPaths()) {
-        try {
-            mtimeMs = Math.max(mtimeMs, statSync(path).mtimeMs);
-        }
-        catch {
-            /* not written yet — nothing to observe for this file */
-        }
-    }
-    if (mtimeMs === 0)
-        return; // never logged in — nothing to watch
-    if (knownAuthMtimeMs === null) {
-        knownAuthMtimeMs = mtimeMs; // seed on first sight; never fan on daemon start
-        return;
-    }
-    if (mtimeMs === knownAuthMtimeMs)
-        return;
-    knownAuthMtimeMs = mtimeMs;
-    await operationIdContext.fresh(async () => {
-        try {
-            // Every fleet entry IS a live broker (design D-1) — no row scan, no pid
-            // probe. Enumerated only when auth actually changed (the rare path).
-            const live = Array.from(boundFleet().entries(), ([id]) => id);
-            if (live.length === 0)
-                return;
-            const results = await Promise.allSettled(live.map(async (id) => {
-                try {
-                    await reloadAuthLive(id);
-                }
-                catch (err) {
-                    emitEvent({
-                        level: 'error',
-                        event: 'auth.reload.broker_failed',
-                        ...(isSafeNodeId(id) ? { node_id: id } : { fields: { broker_id: id } }),
-                        error: err,
-                    });
-                    throw err;
-                }
-            }));
-            const ok = results.filter((r) => r.status === 'fulfilled').length;
-            emitEvent({
-                level: 'info',
-                event: 'auth.reload.completed',
-                outcome: ok === live.length ? 'succeeded' : 'failed',
-                fields: {
-                    broker_count: live.length,
-                    succeeded_count: ok,
-                    failed_count: live.length - ok,
-                },
-            });
-        }
-        catch (err) {
-            emitEvent({ level: 'error', event: 'auth.reload.failed', error: err });
-        }
-    });
-}
-// retryResumeMode moved to ./fleet.js (the cycle-vs-resume arbiter inside
-// classifyDeadNode); re-exported above for the historical crtrd.ts surface.
-// How long a dead node's on-disk record must have been QUIET (no meta/telemetry
-// write) before its leftover placement is reaped. A fresh crash keeps its pane
-// around this long so a human can read the corpse; a long-dead node's orphaned
-// pane is torn down on sight.
-export const DEAD_REAP_GRACE_MS = 10 * 60_000;
-/** ms since the node's durable record was last written (meta.json / job/
- *  telemetry.json mtimes — the files every live cycle touches). Infinity when
- *  neither exists: no disk evidence reads as ancient, not fresh. Deliberately
- *  NOT inbox.jsonl — children keep appending to a dead manager's inbox, which
- *  must not hold its corpse un-reapable forever. */
-function msSinceDiskActivity(nodeId, now) {
-    let latest = 0;
-    for (const p of [join(nodeDir(nodeId), 'meta.json'), join(jobDir(nodeId), 'telemetry.json')]) {
-        try {
-            const m = statSync(p).mtimeMs;
-            if (m > latest)
-                latest = m;
-        }
-        catch {
-            /* absent — contributes nothing */
-        }
-    }
-    return latest === 0 ? Number.POSITIVE_INFINITY : now - latest;
-}
-/** Reap the leftover PLACEMENT of long-dead nodes (audit 2026-06-09, Bug 3 —
- *  node mq3l84it-40f6e8ac, a dead resident whose orphaned pane + focus row sat
- *  untouched for ~36h). The daemon supervises only active|idle rows, so a node
- *  that lands `dead` while still holding a pane is invisible to every pass and
- *  its residue leaks forever.
- *
- *  Deliberate REAP-not-REVIVE decision: a dead node is NOT auto-revived. `dead`
- *  means crashed — auto-resurrecting a crashed RESIDENT (a human conversation)
- *  would pop dead chats back open unbidden, and the daemon's contract is to
- *  supervise live nodes, not to undo terminal states. A dead resident's wake
- *  sources remain the human ones (`node message send --tier critical`, focus, `canvas
- *  revive`), all of which still work after this reap. What we DO reclaim is the
- *  physical residue: kill the orphaned pane, drop the focus row, null the
- *  LOCATION (tearDownNode). The node row, its edges, and all on-disk state stay
- *  intact, so a later manual revive keeps its full graph — the leak was the
- *  pane/focus/presence, not the row. Grace: only after DEAD_REAP_GRACE_MS of
- *  disk quiet, so a just-crashed pane survives long enough to be inspected. */
-function reapDeadResidue(now) {
-    let rows;
-    try {
-        rows = listNodes({ status: ['dead'] });
-    }
-    catch (err) {
-        operationIdContext.fresh(() => {
-            emitEvent({ level: 'error', event: 'residue.reap_scan.failed', error: err });
-        });
-        return;
-    }
-    for (const row of rows) {
-        if (row.pane == null && row.window == null && row.tmux_session == null)
-            continue;
-        try {
-            if (msSinceDiskActivity(row.node_id, now) < DEAD_REAP_GRACE_MS)
-                continue;
-        }
-        catch (err) {
-            operationIdContext.fresh(() => {
-                emitEvent({
-                    level: 'error',
-                    event: 'residue.reap.failed',
-                    ...(isSafeNodeId(row.node_id) ? { node_id: row.node_id } : {}),
-                    error: err,
-                    fields: {
-                        ...(isSafeNodeId(row.node_id) ? {} : { affected_node_id: row.node_id }),
-                        pane: row.pane,
-                        window: row.window,
-                        tmux_session: row.tmux_session,
-                    },
-                });
-            });
-            continue;
-        }
-        operationIdContext.fresh(() => {
-            try {
-                emitEvent({
-                    level: 'info',
-                    event: 'residue.reaped',
-                    ...(isSafeNodeId(row.node_id) ? { node_id: row.node_id } : {}),
-                    fields: {
-                        ...(isSafeNodeId(row.node_id) ? {} : { affected_node_id: row.node_id }),
-                        pane: row.pane,
-                        window: row.window,
-                        tmux_session: row.tmux_session,
-                    },
-                });
-                tearDownNode(row.node_id);
-            }
-            catch (err) {
-                emitEvent({
-                    level: 'error',
-                    event: 'residue.reap.failed',
-                    ...(isSafeNodeId(row.node_id) ? { node_id: row.node_id } : {}),
-                    error: err,
-                    fields: {
-                        ...(isSafeNodeId(row.node_id) ? {} : { affected_node_id: row.node_id }),
-                        pane: row.pane,
-                        window: row.window,
-                        tmux_session: row.tmux_session,
-                    },
-                });
-            }
-        });
-    }
-}
-/** GC stale focus rows (audit 2026-06-09, Bug 5): nothing else deletes a focuses
- *  row when its pane dies outside the sanctioned teardown paths (a user
- *  kill-pane, a tmux server restart, a crashed swap), so dead-pane rows
- *  accumulate forever — the audit found 15 of 21 rows pointing at gone panes,
- *  and a stale row both misreports the node's on-screen viewer and blocks its
- *  node from being adopted into a fresh viewport (UNIQUE node_id). Sweep them here: one
- *  batched `list-panes -a` probe (never a per-row display-message), deleting
- *  rows whose recorded pane no longer exists. A pane-less row (a bridge/unplaced
- *  viewport) has nothing to verify and is left alone. On a FAILED probe (tmux
- *  unreachable — daemon racing a server restart) we skip the sweep entirely:
- *  "can't tell" must never mass-delete every viewport. */
-function gcStaleFocuses() {
-    let rows;
-    try {
-        rows = listFocuses();
-    }
-    catch (err) {
-        operationIdContext.fresh(() => {
-            emitEvent({ level: 'error', event: 'focus.gc.failed', error: err });
-        });
-        return;
-    }
-    if (rows.length === 0)
-        return;
-    let live;
-    try {
-        live = listLivePanes();
-    }
-    catch (err) {
-        operationIdContext.fresh(() => {
-            emitEvent({ level: 'error', event: 'focus.gc.failed', error: err });
-        });
-        return;
-    }
-    if (live === null)
-        return; // probe failed — never GC on "can't tell"
-    for (const f of rows) {
-        if (f.pane === null || live.has(f.pane))
-            continue;
-        const removed = operationIdContext.fresh(() => {
-            try {
-                emitEvent({
-                    level: 'info',
-                    event: 'focus.gc.removed',
-                    ...(isSafeNodeId(f.node_id) ? { node_id: f.node_id } : {}),
-                    fields: {
-                        focus_id: f.focus_id,
-                        focus_node_id: f.node_id,
-                        pane: f.pane,
-                    },
-                });
-                closeFocusRow(f.focus_id);
-                return true;
-            }
-            catch (err) {
-                emitEvent({ level: 'error', event: 'focus.gc.failed', error: err });
-                return false;
-            }
-        });
-        if (!removed)
-            return;
-    }
-}
 // ---------------------------------------------------------------------------
 // Pidfile
 // ---------------------------------------------------------------------------
@@ -1245,25 +301,23 @@ function removeOwnedPidfileMirror(pid) {
         throw error;
     }
 }
-// isPidAlive now lives in canvas/pid.ts (the one shared signal-0 probe at the
-// lowest layer, so canvas/, runtime/, AND daemon/ all import it down). Re-
-// exported here to preserve the public surface consumed by commands/sys/daemon.ts
-// and the grace-clock test.
-export { isPidAlive };
 const directTickLifecycle = {
     acceptsDetachedWork: () => true,
     registerDetached: (work) => {
         void work.catch(() => { });
     },
 };
+const brokerSupervision = new BrokerSupervisionReconciler();
+const controllerDeath = new ControllerDeathReconciler();
+const dormantInbox = new DormantInboxReconciler();
+const cronLane = new CronLaneReconciler();
+const storageMaintenance = new StorageMaintenanceReconciler();
 /** Supervision tick over the daemon's current live set. */
 export async function superviseTick(now = Date.now(), lifecycle = directTickLifecycle) {
     const fleet = boundFleet();
-    // Auth-reload fan FIRST, independent of node supervision: a change to the
-    // shared auth.json propagates a live credential reload to every broker. Kept
-    // ahead of the listNodes guard below so a transient list error in the
-    // supervision passes never skips an auth fan (it does its own enumeration).
-    await handleAuthReload(now);
+    // Auth reload must precede the row-list guard: it is fleet-wide and does not
+    // depend on a successful canvas scan.
+    const thresholds = await brokerSupervision.run(now, { fleet, lifecycle });
     let rows;
     try {
         rows = listNodes({ status: ['active', 'idle'] });
@@ -1272,285 +326,15 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
         emitEvent({ level: 'error', event: 'canvas.node_list.failed', error: err });
         return;
     }
-    // kind:'human' rows are NOT broker-hosted agent nodes — they are bookkeeping
-    // rows for the `crtr human` bridge. crtrd delivers their terminal ticket result
-    // with pushFinal when the person responds from crouter's inbox, or when `human cancel`
-    // publishes a cancellation. They never launch a broker or record a `pi_session_id`, so the dead-node policy
-    // table would read every one as a never-booted broker (row 8) and crash it
-    // with surfaceBootFailure — exactly the regression where a headless
-    // orchestrator's `human ask` nodes all died at boot. The daemon must never
-    // supervise them: drop them from every row-driven pass here (the startup
-    // recovery sweep filters them identically).
-    rows = rows.filter((r) => r.kind !== 'human');
-    // Broker-pressure thresholds gate this tick's daemon-initiated launches; the
-    // live count is EXACTLY the fleet size (design D-7) — every live broker is a
-    // fleet entry, no census, no row inference.
-    const thresholds = brokerThresholdsForDaemon();
-    // The warning stays detached so tmux cannot hold the supervision tick. Its
-    // promise is registered synchronously for invocation teardown.
-    if (fleet.size() >= thresholds.warning && lifecycle.acceptsDetachedWork()) {
-        const warning = operationIdContext.fresh(() => warnOverCapInTmux(fleet.size(), thresholds.warning, thresholds.automaticReviveCap));
-        lifecycle.registerDetached(warning);
-    }
-    // First pass: LIVE-fleet checks. Every fleet entry IS a live broker (design
-    // D-1) — no pid probe, no grace clock. Dead-node recovery does NOT run here:
-    // a broker's real exit event already enqueued an exit-policy job on the
-    // serial work lane (fleet.onChildExit → classifyDeadNode), so by the time a
-    // tick runs, every dead node has been classified. This pass inspects only
-    // the conditions an exit event can never surface on a LIVE engine: a stalled
-    // refresh (handleYieldStall), a wedged mid-turn engine (handleWedgeDetection),
-    // and a parked fatal provider fault (handleFatalFault).
-    for (const [id, entry] of Array.from(fleet.entries())) {
-        await operationIdContext.fresh(async () => {
-            try {
-                const row = getRow(id);
-                if (row === null || (row.status !== 'active' && row.status !== 'idle'))
-                    return;
-                handleYieldStall(row, entry.pid, now);
-                await handleWedgeDetection(id, entry.pid, row.pi_pid_identity, now);
-                handleFatalFault(id, now);
-            }
-            catch (err) {
-                // One bad node must never kill the loop.
-                emitEvent({
-                    level: 'error',
-                    event: 'broker.supervision.failed',
-                    ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                    error: err,
-                });
-            }
-        });
-    }
-    // Settle every wait whose controller has ended, independent of the waiter's
-    // current status. Active and focused terminal nodes own a live inbox watcher;
-    // idle-released nodes are revived by the second pass below for this same row.
-    for (const row of rows) {
-        const current = getRow(row.node_id);
-        const controllerId = current?.waiting_for;
-        if (controllerId === null || controllerId === undefined)
-            continue;
-        // Read-gate before the write boundary: only a dead controller warrants a
-        // notice, and the vast majority of live waits would otherwise open a
-        // write-lock transaction every tick just to no-op. settleDeadMessageWait
-        // re-checks liveness inside the transaction, so this gate cannot misfire.
-        const controller = getRow(controllerId);
-        if (controller !== null && (controller.status === 'active' || controller.status === 'idle'))
-            continue;
-        operationIdContext.fresh(() => {
-            appendControllerDeathNotice(row.node_id, controllerId);
-        });
-    }
-    // Second pass: revive idle-released nodes whose inbox has unseen entries.
-    // The in-process inbox-watcher dies with pi, so the daemon owns wake-on-message
-    // for dormant nodes. readCursor is the exact entry identity the watcher
-    // persisted before exit; later physical entries are undelivered work.
-    //
-    // Backoff + attempt cap is keyed on CURSOR IDENTITY (2026-07-10 incident,
-    // round 2 — see the idleReleaseRelaunchState doc above for the full failure-
-    // mode writeup): a node whose delivery keeps failing — whether the broker
-    // never boots, OR it boots and then faults its turn before changing the
-    // cursor — used to be relaunched here every poll (round 1) or every fault-
-    // recovery cycle (round 1's fix, still exploitable), forever. The counter now
-    // resets only when readCursor(id) differs from the prior exact identity —
-    // proof the wake accomplished something — never on a bare status flap or a
-    // transiently-alive engine.
-    // Capacity-checked too, so a burst of due idle-release wakes can't stampede
-    // past the live-broker cap either.
-    for (const row of rows) {
-        const id = row.node_id;
-        let r;
-        try {
-            // Re-read the ROW for fresh runtime (the first pass may have mutated it);
-            // no meta needed — status/intent live in the row.
-            r = getRow(id);
-            if (r === null) {
-                clearIdleReleaseRelaunchState(id); // node gone — nothing left to track
-                continue;
-            }
-            // NOT idle-release right now (e.g. mid fault-recovery, briefly active) —
-            // leave idleReleaseRelaunchState UNTOUCHED. Clearing here would let the
-            // fault-recovery cycle (idle-release → briefly alive → fault → idle-
-            // release again) reset the counter every episode — the exact round-2 bug.
-            if (r.status !== 'idle' || r.intent !== 'idle-release')
-                continue;
-            // The in-process inbox-watcher only owns delivery while the engine is LIVE.
-            // A released node's broker is DEAD (it freed itself while dormant), so it
-            // has no watcher and the daemon must wake it. A fleet entry IS the live
-            // engine (design D-1) — no pid probe, no identity check. Same no-clear
-            // rule as above — a transiently-alive engine proves nothing about a
-            // cursor identity change.
-            if (fleet.has(id))
-                continue;
-        }
-        catch (err) {
-            operationIdContext.fresh(() => {
-                emitEvent({
-                    level: 'error',
-                    event: 'inbox.poll.failed',
-                    ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                    error: err,
-                });
-            });
-            continue;
-        }
-        operationIdContext.fresh(() => {
-            try {
-                const cursorNow = readCursor(id);
-                const entries = readInboxSince(id, cursorNow);
-                // #341: deferred entries never wake an idle node — by contract they ride
-                // the target's next NATURAL cycle (any other wake reason), not a revive
-                // this pass triggers on their own account. A deferred-only unseen set is
-                // therefore identical to "nothing unseen" for wake-worthiness: no revive,
-                // and no stuck-relaunch episode to track (there is nothing this pass is
-                // even attempting). The entries themselves are untouched — still past the
-                // cursor, still on disk — so a later revive for any OTHER reason (a
-                // non-deferred entry landing, or an explicit revive) delivers them via the
-                // live watcher's normal flush, same as `entries.length === 0` below.
-                const wakeWorthy = entries.filter((e) => e.tier !== 'deferred');
-                if (wakeWorthy.length === 0) {
-                    clearIdleReleaseRelaunchState(id); // fully delivered, or only deferred entries remain — no stuck episode to track
-                    return;
-                }
-                const prior = idleReleaseRelaunchState.get(id);
-                // An exact cursor identity change since the LAST observation (or no prior
-                // episode at all) is the ONLY thing allowed to reset the counter.
-                const cursorChanged = prior === undefined || prior.cursor !== cursorNow;
-                const attempts = cursorChanged ? 0 : prior.attempts;
-                if (attempts >= IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS) {
-                    clearIdleReleaseRelaunchState(id);
-                    const meta = getNode(id);
-                    emitEvent({
-                        level: 'warn',
-                        event: 'broker.idle_release.exhausted',
-                        ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                        fields: {
-                            ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                            attempts,
-                            max_attempts: IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS,
-                        },
-                    });
-                    transition(id, 'crash');
-                    if (meta !== null) {
-                        try {
-                            fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(meta)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
-                                `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
-                                `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
-                        }
-                        catch {
-                            /* best-effort, mirrors every other fan-out in this file */
-                        }
-                    }
-                    return;
-                }
-                const lastAttempt = cursorChanged ? undefined : prior?.lastAttempt;
-                const backoff = idleReleaseRelaunchBackoffMs(attempts);
-                if (lastAttempt !== undefined && now - lastAttempt < backoff)
-                    return; // backing off before the next attempt
-                if (!hasBrokerCapacity(thresholds.automaticReviveCap))
-                    return; // deferred, not attempted — costs no retry budget
-                idleReleaseRelaunchState.set(id, { cursor: cursorNow, attempts: attempts + 1, lastAttempt: now });
-                emitEvent({
-                    level: 'info',
-                    event: 'broker.revive.idle_release',
-                    ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                    attempt: attempts + 1,
-                    fields: {
-                        ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                        attempts: attempts + 1,
-                        max_attempts: IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS,
-                    },
-                });
-                reviveNode(id, { resume: true });
-            }
-            catch (err) {
-                emitEvent({
-                    level: 'error',
-                    event: 'inbox.poll.failed',
-                    ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                    error: err,
-                });
-            }
-        });
-    }
-    // Third pass: recover stale cron run leases stranded by a prior daemon
-    // instance, then kick off every due cron. Runs stay detached from the tick
-    // and registered for graceful-teardown drain.
-    operationIdContext.fresh(() => {
-        try {
-            recoverStaleCronLeases(now, { register: (settlement) => lifecycle.registerDetached(settlement) });
-        }
-        catch (err) {
-            emitEvent({ level: 'error', event: 'cron.lease_recovery.failed', error: err });
-        }
-    });
-    if (lifecycle.acceptsDetachedWork()) {
-        try {
-            runDueCrons(now, {
-                register: (settlement) => lifecycle.registerDetached(settlement),
-                // Fleet safety: a due run that would launch or revive a node waits for
-                // a free slot instead of stampeding the host; it stays due meanwhile.
-                hasBrokerCapacity: () => hasBrokerCapacity(thresholds.automaticReviveCap),
-            });
-        }
-        catch (err) {
-            emitEvent({ level: 'error', event: 'cron.run.failed', error: err });
-        }
-    }
-    // Fourth pass: reap the leftover placement of long-dead nodes (Bug 3), then
-    // sweep focus rows whose pane died outside the sanctioned teardown paths
-    // (Bug 5). Reap first so the GC also catches any focus row a reaped pane
-    // strands; last overall so neither races a focus a same-tick revive just
-    // re-anchored.
-    reapDeadResidue(now);
-    gcStaleFocuses();
-    // Fifth pass: count-based auto-prune, throttled to once per PRUNE_INTERVAL_MS
-    // (NOT every 2s tick — it's a full-canvas DB sweep). Keeps the AUTO_PRUNE_MAX
-    // most-recently-active nodes; live nodes are never deleted (pruneToLimit's
-    // floor is max(AUTO_PRUNE_MAX, liveCount)). Wrapped so a sweep failure never
-    // crashes the tick; the tick is already serialized (serial work lane), so
-    // this runs sequentially within it.
-    if (now - lastPruneAt >= PRUNE_INTERVAL_MS) {
-        lastPruneAt = now;
-        operationIdContext.fresh(() => {
-            try {
-                const before = listNodes().length;
-                const { pruned } = pruneToLimit({ maxNodes: AUTO_PRUNE_MAX });
-                if (pruned.length > 0) {
-                    emitEvent({
-                        level: 'info',
-                        event: 'canvas.auto_prune.completed',
-                        outcome: 'succeeded',
-                        fields: {
-                            before_count: before,
-                            kept_count: before - pruned.length,
-                            pruned_count: pruned.length,
-                        },
-                    });
-                }
-            }
-            catch (err) {
-                emitEvent({ level: 'error', event: 'canvas.auto_prune.failed', error: err });
-            }
-        });
-    }
-    // Sixth pass: warm-pool GC. Collects spares whose broker is gone (every
-    // handover kills them and nothing resumes a spare) and spares nobody claimed
-    // inside their TTL — including the ones stranded when a runtime install
-    // re-keyed the pool. Throttled; never throws.
-    if (now - lastSpareSweepAt >= SPARE_SWEEP_INTERVAL_MS) {
-        lastSpareSweepAt = now;
-        operationIdContext.fresh(() => {
-            const reaped = reapStaleSpares();
-            if (reaped.length > 0) {
-                emitEvent({
-                    level: 'info',
-                    event: 'warm_pool.spares_reaped',
-                    outcome: 'succeeded',
-                    fields: { reaped_count: reaped.length },
-                });
-            }
-        });
-    }
+    // Human bridge rows have no broker engine and participate in none of the
+    // recurring row-driven reconciler passes. Startup recovery applies the same
+    // classification boundary.
+    rows = rows.filter((row) => row.kind !== 'human');
+    const hasBrokerCapacity = () => brokerSupervision.hasBrokerCapacity(thresholds.automaticReviveCap, fleet);
+    controllerDeath.run(now, { rows });
+    dormantInbox.run(now, { rows, fleet, hasBrokerCapacity });
+    cronLane.run(now, { lifecycle, hasBrokerCapacity });
+    storageMaintenance.run(now);
 }
 /** Start the supervisor loop after winning the authoritative canvas claim.
  *