@north-light/crouter 0.3.173 → 0.3.175

package/dist/daemon/manage.js

@@ -61,7 +61,6 @@ export const DAEMON_ENV_STRIP_KEYS = [
     // suspected poison vectors.
     'CRTR_BROKER_ENGINE',
     'CRTR_PI_BINARY',
-    'CRTR_FAULT_RETRY_PROBE',
     // Generic Node.js env poisoning (a stray dev/debug flag from the restarting
     // shell).
     'NODE_OPTIONS',

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -0,0 +1,50 @@
+import { type NodeRow } from '../../core/canvas/index.js';
+import type { FleetRegistry } from '../../core/runtime/fleet.js';
+export interface DetachedWorkLifecycle {
+    acceptsDetachedWork(): boolean;
+    registerDetached(work: Promise<void>): void;
+}
+export interface BrokerSupervisionContext {
+    fleet: FleetRegistry;
+    lifecycle: DetachedWorkLifecycle;
+}
+export declare function brokerThresholdsForDaemon(): {
+    warning: number;
+    automaticReviveCap: number;
+};
+export declare const YIELD_STALL_GRACE_MS: number;
+export declare const WEDGE_QUIET_MS: number;
+export declare const WEDGE_CPU_MAX_PERCENT = 2;
+export declare function unattendedParkMsForDaemon(): number;
+export type WedgeVerdict = 'leave' | 'pending' | 'wedged';
+export declare function yieldStallVerdict(piPidAlive: boolean | null, intent: NodeRow['intent'], busy: boolean, stalledFor: number | null): 'leave' | 'pending' | 'kill';
+export declare function wedgeVerdict(input: {
+    busy: boolean;
+    quietForMs: number | null;
+    cpuPercent: number | null;
+}): WedgeVerdict;
+export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
+export declare function treeHasDescendants(psOutput: string, rootPid: number): boolean | null;
+export declare class BrokerSupervisionReconciler {
+    private readonly yieldStallSince;
+    private readonly yieldTermAt;
+    private readonly wedgeNotifiedAt;
+    private readonly fatalFaultNotifiedAt;
+    private readonly unattendedSince;
+    private knownAuthMtimeMs;
+    private lastOverCapWarnAt;
+    private lastCapacityLogAt;
+    run(now: number, ctx: BrokerSupervisionContext): Promise<{
+        warning: number;
+        automaticReviveCap: number;
+    }>;
+    private handleUnattendedParking;
+    private warnOverCapInTmux;
+    private handleYieldStall;
+    private readTreeSample;
+    private handleWedgeDetection;
+    private handleFatalFault;
+    private handleAuthReload;
+    hasBrokerCapacity(max: number, fleet: FleetRegistry): boolean;
+    hasStartupRecoveryCapacity(fleet: FleetRegistry): boolean;
+}

package/dist/daemon/reconcilers/broker-supervision.js

@@ -0,0 +1,549 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { getRow, getNode, subscribersOf } from '../../core/canvas/index.js';
+import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
+import { fullName } from '../../core/canvas/labels.js';
+import { recordedPidLiveness } from '../../core/canvas/pid.js';
+import { transition } from '../../core/runtime/lifecycle.js';
+import { isBusy, busySince } from '../../core/runtime/busy.js';
+import { readFault, recordFault } from '../../core/runtime/fault.js';
+import { nextFaultRetry } from '../../core/runtime/fault-recovery.js';
+import { fanDoctrineWake } from '../../core/runtime/close.js';
+import { headlessBrokerHost } from '../../core/runtime/host.js';
+import { reloadAuthLive } from '../../core/runtime/auth-reload.js';
+import { readConfig } from '../../core/config.js';
+import { emitEvent } from '../../core/events/emit.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
+import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
+import { focusOf } from '../../core/runtime/placement.js';
+const execFileAsync = promisify(execFile);
+function configuredPositiveInteger(name, fallback) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === '')
+        return fallback;
+    const n = Number(raw);
+    return Number.isSafeInteger(n) && n >= 1 ? n : fallback;
+}
+export function brokerThresholdsForDaemon() {
+    const configured = readConfig('user').brokerThresholds;
+    const automaticReviveCap = configuredPositiveInteger('CRTR_MAX_LIVE_BROKERS', configured.automaticReviveCap);
+    const warning = configuredPositiveInteger('CRTR_WARN_LIVE_BROKERS', configured.warning);
+    return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
+}
+export const YIELD_STALL_GRACE_MS = 3 * 60_000;
+const KILL_ESCALATE_MS = 20_000;
+export const WEDGE_QUIET_MS = 20 * 60_000;
+export const WEDGE_CPU_MAX_PERCENT = 2;
+const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
+const CAPACITY_LOG_THROTTLE_MS = 30_000;
+const DEFAULT_UNATTENDED_PARK_MS = 15 * 60_000;
+export function unattendedParkMsForDaemon() {
+    const raw = process.env['CRTR_TEST_UNATTENDED_PARK_MS'];
+    if (raw === undefined)
+        return DEFAULT_UNATTENDED_PARK_MS;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_UNATTENDED_PARK_MS;
+}
+export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
+    if (piPidAlive !== true)
+        return 'leave';
+    if (intent !== 'refresh')
+        return 'leave';
+    if (busy)
+        return 'leave';
+    if (stalledFor === null || stalledFor < YIELD_STALL_GRACE_MS)
+        return 'pending';
+    return 'kill';
+}
+export function wedgeVerdict(input) {
+    if (!input.busy)
+        return 'leave';
+    if (input.quietForMs === null || input.quietForMs < WEDGE_QUIET_MS)
+        return 'leave';
+    if (input.cpuPercent === null || input.cpuPercent > WEDGE_CPU_MAX_PERCENT)
+        return 'pending';
+    return 'wedged';
+}
+function parsePsTree(psOutput) {
+    const byPid = new Map();
+    const childrenOf = new Map();
+    for (const line of psOutput.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed === '')
+            continue;
+        const parts = trimmed.split(/\s+/);
+        if (parts.length < 3)
+            continue;
+        const pid = Number(parts[0]);
+        const ppid = Number(parts[1]);
+        const pcpu = Number(parts[2]);
+        if (!Number.isFinite(pid) || !Number.isFinite(ppid) || !Number.isFinite(pcpu))
+            continue;
+        byPid.set(pid, pcpu);
+        const siblings = childrenOf.get(ppid);
+        if (siblings === undefined)
+            childrenOf.set(ppid, [pid]);
+        else
+            siblings.push(pid);
+    }
+    return { byPid, childrenOf };
+}
+export function sumTreeCpu(psOutput, rootPid) {
+    const { byPid, childrenOf } = parsePsTree(psOutput);
+    if (!byPid.has(rootPid))
+        return null;
+    let total = 0;
+    const stack = [rootPid];
+    const seen = new Set();
+    while (stack.length > 0) {
+        const pid = stack.pop();
+        if (seen.has(pid))
+            continue;
+        seen.add(pid);
+        total += byPid.get(pid) ?? 0;
+        const kids = childrenOf.get(pid);
+        if (kids !== undefined)
+            stack.push(...kids);
+    }
+    return total;
+}
+export function treeHasDescendants(psOutput, rootPid) {
+    const { byPid, childrenOf } = parsePsTree(psOutput);
+    if (!byPid.has(rootPid))
+        return null;
+    return (childrenOf.get(rootPid) ?? []).length > 0;
+}
+function piCredentialPaths() {
+    const env = process.env['PI_CODING_AGENT_DIR'];
+    const agentDir = env !== undefined && env !== '' ? env : join(homedir(), '.pi', 'agent');
+    return [
+        join(agentDir, 'auth.json'),
+        join(agentDir, 'anthropic-subscriptions.json'),
+        join(agentDir, 'openai-codex-subscriptions.json'),
+    ];
+}
+export class BrokerSupervisionReconciler {
+    yieldStallSince = new Map();
+    yieldTermAt = new Map();
+    wedgeNotifiedAt = new Map();
+    fatalFaultNotifiedAt = new Map();
+    unattendedSince = new Map();
+    knownAuthMtimeMs = null;
+    lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
+    lastCapacityLogAt = Number.NEGATIVE_INFINITY;
+    async run(now, ctx) {
+        await this.handleAuthReload(now, ctx.fleet);
+        const thresholds = brokerThresholdsForDaemon();
+        if (ctx.fleet.size() >= thresholds.warning && ctx.lifecycle.acceptsDetachedWork()) {
+            const warning = operationIdContext.fresh(() => this.warnOverCapInTmux(ctx.fleet.size(), thresholds.warning, thresholds.automaticReviveCap));
+            ctx.lifecycle.registerDetached(warning);
+        }
+        for (const [id, entry] of Array.from(ctx.fleet.entries())) {
+            await operationIdContext.fresh(async () => {
+                try {
+                    const row = getRow(id);
+                    if (row === null || (row.status !== 'active' && row.status !== 'idle')) {
+                        this.unattendedSince.delete(id);
+                        return;
+                    }
+                    this.handleYieldStall(row, entry.pid, now);
+                    await this.handleWedgeDetection(id, entry.pid, row.pi_pid_identity, now);
+                    this.handleFatalFault(id);
+                    this.handleUnattendedParking(id, getNode(id), entry.pid, now);
+                }
+                catch (err) {
+                    this.unattendedSince.delete(id);
+                    emitEvent({
+                        level: 'error',
+                        event: 'broker.supervision.failed',
+                        ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
+                        error: err,
+                    });
+                }
+            });
+        }
+        for (const id of this.unattendedSince.keys()) {
+            if (!ctx.fleet.has(id))
+                this.unattendedSince.delete(id);
+        }
+        return thresholds;
+    }
+    handleUnattendedParking(id, row, livePid, now) {
+        if (row === null
+            || row.pi_session_id == null
+            || row.pi_pid !== livePid
+            || row.status === 'done'
+            || row.status === 'canceled'
+            || row.status === 'dead'
+            || row.intent !== null
+            || isBusy(id)
+            || activeBackgroundBashJobs(contextDir(id)).length > 0
+            || focusOf(id) !== null) {
+            this.unattendedSince.delete(id);
+            return;
+        }
+        const fault = readFault(id);
+        const activeAutoProviderRetry = fault !== null
+            && fault.retry.disposition === 'auto'
+            && fault.retry.by === 'daemon'
+            && (fault.kind === 'connection' || fault.kind === 'rate-limit' || fault.kind === 'overloaded')
+            && (fault.retry.nextAt !== undefined || nextFaultRetry(fault, now) !== null);
+        if (activeAutoProviderRetry
+            || readInboxSince(id, readCursor(id)).some((entry) => entry.tier !== 'deferred')) {
+            this.unattendedSince.delete(id);
+            return;
+        }
+        const since = this.unattendedSince.get(id);
+        if (since === undefined) {
+            this.unattendedSince.set(id, now);
+            return;
+        }
+        if (now - since < unattendedParkMsForDaemon())
+            return;
+        this.unattendedSince.delete(id);
+        transition(id, 'release');
+        headlessBrokerHost.teardown(id);
+    }
+    async warnOverCapInTmux(count, warning, max) {
+        const now = Date.now();
+        if (now - this.lastOverCapWarnAt < OVER_CAP_WARN_THROTTLE_MS)
+            return;
+        this.lastOverCapWarnAt = now;
+        emitEvent({
+            level: 'warn',
+            event: 'broker.capacity.warning',
+            fields: { live_count: count, warning_threshold: warning, hard_cap: max },
+        });
+        const msg = `⚠ crtrd: ${count} live brokers (warning ${warning}; hard cap ${max}) — possible broker leak. ps -ax | grep broker-cli.js`;
+        try {
+            const clients = await execFileAsync('tmux', ['list-clients', '-F', '#{client_name}'], {
+                encoding: 'utf8',
+                timeout: 2000,
+            });
+            if (typeof clients.stdout !== 'string')
+                return;
+            await Promise.allSettled(clients.stdout.split('\n').map(async (client) => {
+                if (client === '')
+                    return;
+                try {
+                    await execFileAsync('tmux', ['display-message', '-d', '10000', '-c', client, msg], {
+                        encoding: 'utf8',
+                        timeout: 2000,
+                    });
+                }
+                catch {
+                    try {
+                        await execFileAsync('tmux', ['display-message', '-c', client, msg], {
+                            encoding: 'utf8',
+                            timeout: 2000,
+                        });
+                    }
+                    catch {
+                        /* no display channel for this client */
+                    }
+                }
+            }));
+        }
+        catch {
+            /* no tmux server — the canonical event above still records the condition */
+        }
+    }
+    handleYieldStall(row, pid, now) {
+        const id = row.node_id;
+        if (row.intent !== 'refresh' || isBusy(id)) {
+            this.yieldStallSince.delete(id);
+            this.yieldTermAt.delete(id);
+            return;
+        }
+        const since = this.yieldStallSince.get(id);
+        if (since === undefined) {
+            this.yieldStallSince.set(id, now);
+            return;
+        }
+        if (yieldStallVerdict(true, row.intent, false, now - since) !== 'kill')
+            return;
+        if (row.pi_pid_identity == null || recordedPidLiveness(pid, row.pi_pid_identity) !== 'alive')
+            return;
+        const termed = this.yieldTermAt.get(id);
+        if (termed === undefined) {
+            emitEvent({
+                level: 'warn',
+                event: 'broker.yield_stall.sigterm',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                fields: {
+                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                    pid,
+                    elapsed_ms: now - since,
+                    grace_ms: YIELD_STALL_GRACE_MS,
+                },
+            });
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch {
+                /* already gone */
+            }
+            this.yieldTermAt.set(id, now);
+        }
+        else if (now - termed >= KILL_ESCALATE_MS) {
+            emitEvent({
+                level: 'warn',
+                event: 'broker.yield_stall.sigkill',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                fields: {
+                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                    pid,
+                    elapsed_ms: now - termed,
+                    grace_ms: KILL_ESCALATE_MS,
+                    stall_elapsed_ms: now - since,
+                },
+            });
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    }
+    async readTreeSample(pid) {
+        try {
+            const { stdout } = await execFileAsync('ps', ['-ax', '-o', 'pid=,ppid=,pcpu='], {
+                encoding: 'utf8',
+                timeout: 2000,
+            });
+            if (typeof stdout !== 'string')
+                return null;
+            const cpuPercent = sumTreeCpu(stdout, pid);
+            const hasDescendants = treeHasDescendants(stdout, pid);
+            if (cpuPercent === null || hasDescendants === null)
+                return null;
+            return { cpuPercent, hasDescendants };
+        }
+        catch {
+            return null;
+        }
+    }
+    async handleWedgeDetection(id, pid, expectedIdentity, now) {
+        if (!isBusy(id)) {
+            this.wedgeNotifiedAt.delete(id);
+            return;
+        }
+        const since = busySince(id);
+        const quietForMs = since === null ? null : now - since;
+        const sample = quietForMs !== null && quietForMs >= WEDGE_QUIET_MS ? await this.readTreeSample(pid) : null;
+        const cpuPercent = sample?.cpuPercent ?? null;
+        if (wedgeVerdict({ busy: true, quietForMs, cpuPercent }) !== 'wedged')
+            return;
+        if (since !== null && this.wedgeNotifiedAt.get(id) === since)
+            return;
+        if (sample?.hasDescendants === false && (expectedIdentity == null || recordedPidLiveness(pid, expectedIdentity) !== 'alive'))
+            return;
+        if (since !== null)
+            this.wedgeNotifiedAt.set(id, since);
+        const meta = getNode(id);
+        const name = meta !== null ? fullName(meta) : id;
+        const minutes = Math.round((quietForMs ?? WEDGE_QUIET_MS) / 60_000);
+        const hasDescendants = sample?.hasDescendants ?? true;
+        let label;
+        if (hasDescendants) {
+            label =
+                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
+                    `${minutes}+ minutes and its process is near-idle. It will NOT recover on its own — read ` +
+                    `\`crtr memory read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this ` +
+                    `node) so its turn can resume with no lost context.`;
+        }
+        else {
+            label =
+                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
+                    `${minutes}+ minutes, its process is near-idle, AND it has no subprocess to kill (the engine ` +
+                    `itself stalled). Kicking it now: SIGTERM to the broker — the daemon will resume a cleanly ` +
+                    `aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`;
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch {
+                /* already gone — its ChildProcess exit event still owns recovery */
+            }
+        }
+        emitEvent({
+            level: 'error',
+            event: 'broker.wedge.detected',
+            ...(isSafeNodeId(id) ? { node_id: id } : {}),
+            fields: {
+                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                pid,
+                quiet_ms: quietForMs,
+                cpu_percent: cpuPercent,
+                has_descendants: hasDescendants,
+                kicked: !hasDescendants,
+            },
+        });
+        try {
+            recordFault(id, {
+                link: 'daemon→node',
+                op: 'engine wedge',
+                kind: 'wedged',
+                retry: { disposition: 'manual' },
+                message: label,
+            });
+        }
+        catch {
+            /* best-effort — the doctrine wake below is the load-bearing notice */
+        }
+        try {
+            fanDoctrineWake(id, subscribersOf(id), label, {
+                reason: 'child-wedged',
+                child: id,
+                quiet_ms: quietForMs,
+                cpu_percent: cpuPercent,
+                kicked: !hasDescendants,
+            });
+        }
+        catch {
+            /* best-effort, mirrors every other fan-out in this file */
+        }
+    }
+    handleFatalFault(id) {
+        const fault = readFault(id);
+        if (fault === null) {
+            this.fatalFaultNotifiedAt.delete(id);
+            return;
+        }
+        if (fault.retry.disposition !== 'fatal' || fault.link !== 'pi→provider')
+            return;
+        if (this.fatalFaultNotifiedAt.get(id) === fault.since)
+            return;
+        this.fatalFaultNotifiedAt.set(id, fault.since);
+        const meta = getNode(id);
+        const name = meta !== null ? fullName(meta) : id;
+        const isAuth = fault.kind === 'auth';
+        const firstLine = (fault.message.split('\n')[0] ?? '').slice(0, 200);
+        const terminalOverflow = fault.kind === 'context-overflow';
+        const label = terminalOverflow
+            ? `Child failed — ${name} (${id}) exceeded its model context window and is now dead. ` +
+                `Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${firstLine}`
+            : `Child hit a fatal provider fault — ${name} (${id}) got a non-retryable ${fault.kind} error and will NOT recover on its own; ` +
+                `it stays alive but every wake re-fails until the fault clears. ` +
+                (isAuth
+                    ? `Its provider credential is dead — re-authenticate (\`/login\`, or re-auth crtr); the child recovers on its next wake once the auth reloads. `
+                    : ``) +
+                `Error: ${firstLine}`;
+        if (terminalOverflow) {
+            try {
+                transition(id, 'crash');
+                headlessBrokerHost.teardown(id);
+            }
+            catch {
+                /* the terminal notice remains useful if teardown raced the broker exit */
+            }
+        }
+        emitEvent({
+            level: 'error',
+            event: 'fault.fatal.fanout',
+            ...(isSafeNodeId(id) ? { node_id: id } : {}),
+            fields: {
+                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                kind: fault.kind,
+                link: fault.link,
+                terminal_overflow: terminalOverflow,
+            },
+        });
+        try {
+            fanDoctrineWake(id, subscribersOf(id), label, {
+                reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
+                child: id,
+                kind: fault.kind,
+                message: firstLine,
+            });
+        }
+        catch {
+            /* best-effort, mirrors every other fan-out in this file */
+        }
+    }
+    async handleAuthReload(now, fleet) {
+        void now;
+        let mtimeMs = 0;
+        for (const path of piCredentialPaths()) {
+            try {
+                mtimeMs = Math.max(mtimeMs, statSync(path).mtimeMs);
+            }
+            catch {
+                /* not written yet — nothing to observe for this file */
+            }
+        }
+        if (mtimeMs === 0)
+            return;
+        if (this.knownAuthMtimeMs === null) {
+            this.knownAuthMtimeMs = mtimeMs;
+            return;
+        }
+        if (mtimeMs === this.knownAuthMtimeMs)
+            return;
+        this.knownAuthMtimeMs = mtimeMs;
+        await operationIdContext.fresh(async () => {
+            try {
+                const live = Array.from(fleet.entries(), ([id]) => id);
+                if (live.length === 0)
+                    return;
+                const results = await Promise.allSettled(live.map(async (id) => {
+                    try {
+                        await reloadAuthLive(id);
+                    }
+                    catch (err) {
+                        emitEvent({
+                            level: 'error',
+                            event: 'auth.reload.broker_failed',
+                            ...(isSafeNodeId(id) ? { node_id: id } : { fields: { broker_id: id } }),
+                            error: err,
+                        });
+                        throw err;
+                    }
+                }));
+                const ok = results.filter((r) => r.status === 'fulfilled').length;
+                emitEvent({
+                    level: 'info',
+                    event: 'auth.reload.completed',
+                    outcome: ok === live.length ? 'succeeded' : 'failed',
+                    fields: {
+                        broker_count: live.length,
+                        succeeded_count: ok,
+                        failed_count: live.length - ok,
+                    },
+                });
+            }
+            catch (err) {
+                emitEvent({ level: 'error', event: 'auth.reload.failed', error: err });
+            }
+        });
+    }
+    hasBrokerCapacity(max, fleet) {
+        if (fleet.size() < max)
+            return true;
+        const now = Date.now();
+        if (now - this.lastCapacityLogAt >= CAPACITY_LOG_THROTTLE_MS) {
+            this.lastCapacityLogAt = now;
+            emitEvent({
+                level: 'warn',
+                event: 'broker.capacity.revive_deferred',
+                fields: { live_count: fleet.size(), hard_cap: max },
+            });
+        }
+        return false;
+    }
+    hasStartupRecoveryCapacity(fleet) {
+        const { automaticReviveCap } = brokerThresholdsForDaemon();
+        if (fleet.size() < automaticReviveCap)
+            return true;
+        emitEvent({
+            level: 'warn',
+            event: 'daemon.recovery_sweep.capacity_deferred',
+            fields: { live_count: fleet.size() },
+        });
+        return false;
+    }
+}

package/dist/daemon/reconcilers/cron-lane.d.ts

@@ -0,0 +1,10 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export interface CronLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+    /** P3.4's capacity authority, bound to the thresholds returned by the live
+     * supervision pass for this same tick. */
+    hasBrokerCapacity(): boolean;
+}
+export declare class CronLaneReconciler {
+    run(now: number, ctx: CronLaneContext): void;
+}

package/dist/daemon/reconcilers/cron-lane.js

@@ -0,0 +1,32 @@
+import { emitEvent } from '../../core/events/emit.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { recoverStaleCronLeases, runDueCrons } from '../cron-run.js';
+export class CronLaneReconciler {
+    run(now, ctx) {
+        // Recover stale leases before admitting due work. Every settlement remains
+        // detached from the serial tick but is registered for teardown drain.
+        operationIdContext.fresh(() => {
+            try {
+                recoverStaleCronLeases(now, {
+                    register: (settlement) => ctx.lifecycle.registerDetached(settlement),
+                });
+            }
+            catch (err) {
+                emitEvent({ level: 'error', event: 'cron.lease_recovery.failed', error: err });
+            }
+        });
+        if (!ctx.lifecycle.acceptsDetachedWork())
+            return;
+        try {
+            runDueCrons(now, {
+                register: (settlement) => ctx.lifecycle.registerDetached(settlement),
+                // A due run that would launch or revive a node stays due until P3.4's
+                // capacity authority admits it.
+                hasBrokerCapacity: ctx.hasBrokerCapacity,
+            });
+        }
+        catch (err) {
+            emitEvent({ level: 'error', event: 'cron.run.failed', error: err });
+        }
+    }
+}

package/dist/daemon/reconcilers/dormant-inbox.d.ts

@@ -0,0 +1,18 @@
+import { type NodeRow } from '../../core/canvas/index.js';
+import type { FleetRegistry } from '../../core/runtime/fleet.js';
+export interface ControllerDeathContext {
+    rows: readonly NodeRow[];
+}
+export interface DormantInboxContext extends ControllerDeathContext {
+    fleet: FleetRegistry;
+    /** P3.4's capacity authority, bound to the thresholds returned by the live
+     * supervision pass for this same tick. */
+    hasBrokerCapacity(): boolean;
+}
+export declare class ControllerDeathReconciler {
+    run(_now: number, ctx: ControllerDeathContext): void;
+}
+export declare class DormantInboxReconciler {
+    private readonly relaunchState;
+    run(now: number, ctx: DormantInboxContext): void;
+}