@north-light/crouter 0.3.196 → 0.3.198

package/dist/daemon/api/handlers/inbox.js

@@ -7,10 +7,12 @@ import { basename, resolve, join } from 'node:path';
 import { ApiError } from '../../../api/index.js';
 import { assetRoot } from '../../../core/asset-root.js';
 import { pageManifestPath, reviewPath } from '../../../core/human/convention.js';
+import { parsePage } from '../../../core/human/page.js';
 import { renderPageHtml } from '../../../core/human/page-render.js';
 import { ticketsRoot } from '../../../core/human/root.js';
 import { scanInbox, scanPageHistory } from '../../../core/human/scan.js';
 import { readPageTicket, readTicketResult, validatePageTicketResponses, writePageProgress, } from '../../../core/human/tickets.js';
+import { describePageAnswer } from '../../../core/human/answer.js';
 import { readConfig } from '../../../core/config.js';
 import { cancelHumanTicket, resolvePageTicket } from '../../human/finish.js';
 import { filterTerminalReviewTickets } from '../../../core/review/ticket-filter.js';
@@ -80,6 +82,8 @@ function pageSlotToDTO(slot) {
         dto.id = slot.id;
     if (slot.unvalidated === true)
         dto.unvalidated = true;
+    if (slot.display === true)
+        dto.display = true;
     return dto;
 }
 function pageManifestToDTO(manifest) {
@@ -102,6 +106,8 @@ function pageManifestToDTO(manifest) {
             source.askedBy = manifest.source.askedBy;
         if (manifest.source.blockedSince !== undefined)
             source.blockedSince = manifest.source.blockedSince;
+        if (manifest.source.profileName !== undefined)
+            source.profileName = manifest.source.profileName;
         if (manifest.source.nodeId !== undefined)
             source.nodeId = manifest.source.nodeId;
         if (Object.keys(source).length > 0)
@@ -163,7 +169,7 @@ function isSlotValidationError(err) {
 // GET /v1/human/inbox — enumerate
 // ===========================================================================
 function handleList() {
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     const allItems = scanInbox(productKinds);
     const filtered = filterTerminalReviewTickets(allItems);
     const tickets = filtered.map((item) => {
@@ -210,7 +216,7 @@ function handleHistory(ctx) {
     if (!nodeId || typeof nodeId !== 'string') {
         throw new ApiError(400, 'invalid_request', 'history requires a node_id query param');
     }
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     const history = scanPageHistory(nodeId, productKinds);
     const canonicalRoot = realpathSync(ticketsRoot());
     const tickets = history.map((item) => {
@@ -230,6 +236,8 @@ function handleHistory(ctx) {
         };
         if (item.subtitle !== '')
             dto.subtitle = item.subtitle;
+        if (item.answerDigest !== undefined)
+            dto.answer_digest = item.answerDigest;
         return dto;
     });
     return { status: 200, body: { tickets } };
@@ -245,7 +253,7 @@ function handleGetPage(ctx) {
     if (resolved.kind === 'review') {
         throw new ApiError(409, 'ticket_kind_unsupported', 'review tickets have no page read operation');
     }
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     let ticket;
     try {
         ticket = readPageTicket(resolved.dir, productKinds);
@@ -287,7 +295,7 @@ async function handleRespond(ctx) {
     if (result?.kind === 'canceled') {
         throw new ApiError(409, 'ticket_canceled', 'canceled tickets cannot be answered');
     }
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     try {
         validatePageTicketResponses(resolved.dir, request.responses, productKinds);
     }
@@ -330,7 +338,7 @@ function handleProgress(ctx) {
     if (result !== null && result.kind !== 'canceled') {
         throw new ApiError(409, 'ticket_already_resolved', 'ticket was already resolved');
     }
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     try {
         writePageProgress(resolved.dir, request.responses, productKinds);
         return { status: 200, body: {} };
@@ -390,7 +398,14 @@ function handleGetResponse(ctx) {
     if (result.kind !== 'page') {
         throw new ApiError(409, 'ticket_kind_mismatch', 'unexpected result kind');
     }
-    return { status: 200, body: result };
+    const productKinds = readConfig('user').page_components;
+    try {
+        const manifest = parsePage(resolved.dir, productKinds);
+        return { status: 200, body: { ...result, answer: describePageAnswer(manifest, result.responses, { completedAt: result.completedAt, productKinds }) } };
+    }
+    catch {
+        throw new ApiError(500, 'internal', 'the ticket answer could not be read');
+    }
 }
 // ===========================================================================
 // GET /v1/human/inbox/:ticket_id/render — the page's HTML payload
@@ -403,7 +418,7 @@ function handleRenderPage(ctx) {
     if (resolved.kind === 'review') {
         throw new ApiError(409, 'ticket_kind_unsupported', 'review tickets have no page render operation');
     }
-    const productKinds = readConfig('user').page_components ?? [];
+    const productKinds = readConfig('user').page_components;
     // Addressable for pending, resolved, and canceled tickets alike — the same
     // read rule as the detail route: a page stays readable after it resolves.
     let ticket;

package/dist/daemon/cron-run.js

@@ -163,6 +163,16 @@ function resolveLiveProfile(c) {
         return null;
     }
 }
+function resolveLiveProfileName(c) {
+    if (c.profile == null)
+        return undefined;
+    try {
+        return loadProfileManifest(c.profile).manifest.name;
+    }
+    catch {
+        return undefined;
+    }
+}
 // ---------------------------------------------------------------------------
 // Delivery sinks
 // ---------------------------------------------------------------------------
@@ -223,10 +233,14 @@ function deliverHumanSink(c, stdout) {
     // half-built `nfy-*` directory behind.
     let prepared;
     try {
+        const profileName = resolveLiveProfileName(c);
         prepared = preparePage({
             sourceFile: synthesized.path,
-            dialect: 'md',
-            source: { sessionName: `cron ${c.name} (${c.cron_id})` },
+            dialect: 'html',
+            source: {
+                sessionName: `cron ${c.name} (${c.cron_id})`,
+                ...(profileName === undefined ? {} : { profileName }),
+            },
             productKinds: readConfig('user').page_components,
         });
     }

package/dist/daemon/crtrd.js

@@ -8,7 +8,7 @@
 // The fleet registry's entry IS the node's liveness — no pid probe, no grace
 // clock. A broker's real `exit` event enqueues an exit-policy job on the
 // daemon's serial work lane (never inline on the Node event callback), where
-// classifyDeadNode — one pure 9-row policy table over durable row state —
+// classifyDeadNode — one pure 8-row policy table over durable row state —
 // decides forget / dormant / respawn / boot-failure. The startup recovery
 // sweep classifies boot-time dead rows through the SAME table, so exit
 // recovery and startup recovery can never diverge. Every broker's argv is

package/dist/daemon/fleet.d.ts

@@ -10,12 +10,16 @@ import type { HostHandle } from '../core/runtime/host.js';
  *  seeing a silent `dead`. */
 export declare function surfaceBootFailure(meta: NodeMeta): Promise<void>;
 /** Whether a dead relaunch should resume the saved session strictly, or retry
- *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies
- *  before session_start must retry AS a cycle — a strict reopen only restores
- *  the transcript at an idle prompt, it cannot restart the dead engine turn.
- *  A dirty interrupted BUSY turn also requests a cycle; a broker-certified
- *  clean abort is handled explicitly by classifyDeadNode before this fallback. */
-export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null, interruptedTurn?: boolean): boolean;
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null): boolean;
 export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'respawn-cycle' | 'respawn-resume' | 'boot-failure';
 /** The narrow durable state the policy table reads. Structural (a Pick, not
  *  NodeMeta itself) so tests fabricate table rows directly. */
@@ -23,10 +27,18 @@ export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' |
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
- *  Evaluated in table order; `busy` is the on-disk busy marker. A clean-abort
- *  certificate is written by the broker only after Pi persisted its aborted
- *  entry; without it, a set busy marker means a dirty mid-turn crash. */
-export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean, cleanAbort?: boolean): DeadNodeAction;
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure. */
+export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean): DeadNodeAction;
 /** An exit with uptime at or above this resets the consecutive-failure
  *  counter before classification; a shorter-lived exit increments it. */
 export declare const HEALTHY_UPTIME_MS = 60000;

package/dist/daemon/fleet.js

@@ -51,21 +51,33 @@ async function surfaceRecoveryFailure(meta, error) {
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
 /** Whether a dead relaunch should resume the saved session strictly, or retry
- *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies
- *  before session_start must retry AS a cycle — a strict reopen only restores
- *  the transcript at an idle prompt, it cannot restart the dead engine turn.
- *  A dirty interrupted BUSY turn also requests a cycle; a broker-certified
- *  clean abort is handled explicitly by classifyDeadNode before this fallback. */
-export function retryResumeMode(meta, interruptedTurn = false) {
-    return meta?.cycle_pending !== true && !interruptedTurn;
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export function retryResumeMode(meta) {
+    return meta?.cycle_pending !== true;
 }
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
- *  Evaluated in table order; `busy` is the on-disk busy marker. A clean-abort
- *  certificate is written by the broker only after Pi persisted its aborted
- *  entry; without it, a set busy marker means a dirty mid-turn crash. */
-export function classifyDeadNode(row, busy, cleanAbort = false) {
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure. */
+export function classifyDeadNode(row, busy) {
     if (row === null)
         return 'forget'; // row 1: row deleted
     if (row.status === 'done' || row.status === 'canceled' || row.status === 'dead')
@@ -74,15 +86,13 @@ export function classifyDeadNode(row, busy, cleanAbort = false) {
         return 'respawn-fresh'; // row 3
     if (row.intent === 'idle-release')
         return 'dormant'; // row 4
-    if (cleanAbort && row.pi_session_id != null)
-        return 'respawn-resume'; // row 5: broker-certified interrupted turn
-    if (busy)
-        return 'respawn-cycle'; // row 6: dirty interrupted turn
     if (row.pi_session_id != null)
-        return retryResumeMode(row, false) ? 'respawn-resume' : 'respawn-cycle'; // row 7
-    if (row.fork_from != null && row.pi_session_id == null)
-        return 'respawn-fresh'; // row 8: bounded ordinary fork-birth retry
-    return 'boot-failure'; // row 9
+        return retryResumeMode(row) ? 'respawn-resume' : 'respawn-cycle'; // row 5: any saved session
+    if (busy)
+        return 'respawn-fresh'; // row 6: died mid-turn before a session was ever recorded
+    if (row.fork_from != null)
+        return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
+    return 'boot-failure'; // row 8
 }
 // ---------------------------------------------------------------------------
 // Respawn throttle (replaces the stranded-relaunch counters, event-driven)
@@ -248,8 +258,12 @@ export class DaemonFleet {
     }
     async #applyPolicy(nodeId, origin) {
         const meta = getNode(nodeId);
-        const cleanAbort = hasCleanAbort(nodeId);
-        const action = classifyDeadNode(meta, isBusy(nodeId), cleanAbort);
+        // Two durable witnesses mean the dead broker had a turn in flight. A dirty
+        // death leaves the busy marker behind; a bounded graceful abort clears busy
+        // as the run settles, then writes the clean-abort certificate. Both need the
+        // same recovery: resume the saved transcript and re-drive the stopped turn.
+        const interruptedTurn = isBusy(nodeId) || hasCleanAbort(nodeId);
+        const action = classifyDeadNode(meta, interruptedTurn);
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
@@ -271,12 +285,12 @@ export class DaemonFleet {
             case 'respawn-fresh':
             case 'respawn-cycle':
             case 'respawn-resume':
-                await this.#respawn(nodeId, meta, action, origin, cleanAbort);
+                await this.#respawn(nodeId, meta, action, origin, interruptedTurn);
                 break;
         }
         return action;
     }
-    async #respawn(nodeId, meta, action, origin, cleanAbort) {
+    async #respawn(nodeId, meta, action, origin, interruptedTurn) {
         const state = this.#throttle.get(nodeId) ?? { failures: 0 };
         if (state.failures >= MAX_RESPAWN_ATTEMPTS) {
             await this.#terminalize(nodeId, meta, {
@@ -327,7 +341,12 @@ export class DaemonFleet {
         try {
             reviveNode(nodeId, {
                 resume: action === 'respawn-resume',
-                wakeReason: cleanAbort ? 'runtime-restart-abort' : undefined,
+                // A resumed session whose turn was interrupted comes back parked at an
+                // idle prompt with the dead turn unfinished. The continuation re-drives
+                // it in place, so the conversation continues instead of being rebuilt
+                // from disk on a fresh branch. Only a true resume can carry it; a cycle
+                // or fresh relaunch gets its own kickoff.
+                wakeReason: action === 'respawn-resume' && interruptedTurn ? 'runtime-restart-abort' : undefined,
                 // Replacing a dead broker instance is recovery, not a wake: nothing
                 // external arrived for this node, so an armed deadline survives the
                 // relaunch instead of being consumed by it.

package/dist/daemon/human/finish.d.ts

@@ -1,3 +1,4 @@
+import type { ProductPageComponents } from '../../types.js';
 import type { TicketResult } from '../../core/human/types.js';
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
@@ -5,7 +6,7 @@ import type { TicketResult } from '../../core/human/types.js';
  * node-addressed resolve route and the ticket-id-addressed inbox respond route —
  * finishes a page here, so an answer always reaches the node that asked.
  */
-export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: string[]): Promise<TicketResult>;
+export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: ProductPageComponents): Promise<TicketResult>;
 /** Cancel a ticket with the store's first-writer-wins publication. */
 export declare function cancelHumanTicket(nodeId: string, opts: {
     reason?: string;

package/dist/daemon/human/finish.js

@@ -1,36 +1,45 @@
 import { join } from 'node:path';
 import { ApiError } from '../../api/index.js';
-import { getNode, subscribersOf } from '../../core/canvas/canvas.js';
+import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
+import { readConfig } from '../../core/config.js';
 import { ticketDir } from '../../core/human/root.js';
+import { parsePage } from '../../core/human/page.js';
 import { cancelTicket, projectReviewOutput, readTicketResult, takeoverAndCompletePage, } from '../../core/human/tickets.js';
+import { describePageAnswer } from '../../core/human/answer.js';
+import { renderAnswerText } from '../../core/human/answer-text.js';
 import { responsePath } from '../../core/human/convention.js';
 import { readJsonOrNull } from '../../core/fs-utils.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
-/**
- * The answer a page's asking node wakes with. Slot responses are small and
- * typed, so they are inlined as compact JSON rather than left behind the path:
- * the node reads its answers out of its own report. An acknowledgement carries
- * no responses at all and reads as one line saying the human saw the page.
- * Interim rendering — the designed answer view is phase 5.
- */
-function renderPageAnswer(result, resultPath) {
-    const entries = Object.entries(result.responses);
-    const lines = [];
-    if (entries.length === 0) {
-        lines.push('The human read the page and dismissed it. No slot responses came back, so the acknowledgement is the whole answer.');
+/** A corrupt manifest must not strand the asking node: the raw response remains its escape hatch. */
+function renderCorruptPageAnswer(result, resultPath) {
+    return [
+        'The page manifest could not be read, so the raw response is provided.',
+        '',
+        JSON.stringify(result.responses),
+        '',
+        `Response record: ${resultPath}`,
+    ].join('\n');
+}
+function pageTitle(dir) {
+    try {
+        return parsePage(dir, readConfig('user').page_components).title;
+    }
+    catch {
+        return undefined;
+    }
+}
+function renderPageAnswer(dir, result, resultPath) {
+    const productKinds = readConfig('user').page_components;
+    let manifest;
+    try {
+        manifest = parsePage(dir, productKinds);
     }
-    else {
-        lines.push(`The human answered ${entries.length} slot${entries.length === 1 ? '' : 's'}:`, '');
-        for (const [slotId, response] of entries)
-            lines.push(`${slotId}: ${JSON.stringify(response)}`);
-        const summary = result.summary.trim();
-        if (summary !== '')
-            lines.push('', summary);
+    catch {
+        return renderCorruptPageAnswer(result, resultPath);
     }
-    lines.push('', `Response metadata (slot ids, typed responses, timestamp): ${resultPath}`);
-    return lines.join('\n');
+    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt, productKinds }), resultPath);
 }
 function deliveryFailed(error) {
     // A canonical final is committed inside its own write boundary and can never
@@ -96,12 +105,20 @@ export async function deliverTerminalResult(nodeId) {
     if (result === null)
         return false;
     projectReviewOutput(dir);
-    const node = getNode(nodeId);
+    // The ROW, not `getNode`: a ticket directory IS the bridge's node directory,
+    // so a bridge whose row has been pruned still answers `getNode` from its
+    // surviving meta.json — with no status at all, which passed every guard below
+    // and then threw out of `transition` on every sweep, re-fanning the
+    // cancellation notice each time. No row means nothing left to deliver to.
+    const node = getRow(nodeId);
     if (node === null || node.status === 'dead' || node.status === 'canceled' || (node.status === 'done' && node.final_report !== null)) {
         return true;
     }
     if (result.kind === 'canceled') {
-        const note = result.reason !== undefined && result.reason !== '' ? ` — ${result.reason}` : '';
+        const title = pageTitle(dir);
+        const reason = result.reason !== undefined && result.reason !== '' ? result.reason : 'no reason was given';
+        const subject = title === undefined ? `human interaction ${nodeId} canceled — no answer is coming` : `human interaction ${nodeId} — “${title}” canceled, no answer is coming`;
+        const body = title === undefined ? `The human interaction ${nodeId} was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.` : `The page “${title}” was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.`;
         // One failing subscriber must not silence the rest, and the bridge stays
         // live until every notice lands: a partial fanout leaves the ticket for the
         // next resolve/cancel attempt or the daemon-start sweep to replay. A
@@ -114,10 +131,10 @@ export async function deliverTerminalResult(nodeId) {
             try {
                 appendInbox(subscriber.node_id, {
                     from: nodeId,
-                    tier: 'deferred',
+                    tier: 'normal',
                     kind: 'message',
-                    label: `human interaction ${nodeId} canceled — no answer is coming${note}`,
-                    data: { body: `The human interaction ${nodeId} was canceled${note}. No response will arrive.` },
+                    label: subject,
+                    data: { body },
                 });
             }
             catch {
@@ -130,7 +147,7 @@ export async function deliverTerminalResult(nodeId) {
         return true;
     }
     if (result.kind === 'page') {
-        await pushFinal(nodeId, renderPageAnswer(result, responsePath(dir)));
+        await pushFinal(nodeId, renderPageAnswer(dir, result, responsePath(dir)));
     }
     return true;
 }

package/dist/daemon/human/sweep.js

@@ -1,6 +1,6 @@
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { getNode } from '../../core/canvas/canvas.js';
+import { getRow } from '../../core/canvas/canvas.js';
 import { getReviewByBridge } from '../../core/review/store.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { ticketsRoot } from '../../core/human/root.js';
@@ -27,7 +27,9 @@ export async function reconcileUndeliveredTickets() {
             // finisher retries only when its winning operation is explicitly repeated.
             if (getReviewByBridge(entry) !== null)
                 continue;
-            const bridge = getNode(entry);
+            // The ROW is what carries status; `getNode` would answer from a pruned
+            // bridge's surviving meta.json with no status at all.
+            const bridge = getRow(entry);
             if (bridge === null || isTerminalBridge(bridge.status))
                 continue;
             if (await deliverTerminalResult(entry))

package/dist/daemon/reconcilers/broker-supervision.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { getRow, getNode, subscribersOf } from '../../core/canvas/index.js';
+import { getRow, getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
 import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { recordedPidLiveness } from '../../core/canvas/pid.js';
@@ -20,7 +20,7 @@ import { operationIdContext } from '../../core/events/operation-id.js';
 import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
     const raw = process.env[name];
@@ -174,6 +174,14 @@ export class BrokerSupervisionReconciler {
         return thresholds;
     }
     handleUnattendedParking(id, row, livePid, now) {
+        // An unclaimed warm-pool spare is not a conversation: the booted broker it
+        // holds IS its whole value, and nobody is meant to be attending it. Its
+        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
+        // parking one here would empty the pool every 15 minutes.
+        if (isWarmSpare(id)) {
+            this.unattendedSince.delete(id);
+            return;
+        }
         if (row === null
             || row.pi_session_id == null
             || row.pi_pid !== livePid
@@ -206,12 +214,7 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        const liveObligation = hasLiveObligation(id);
-        // A resident with nothing left to wake it has completed its conversation:
-        // terminalize it so history retention can eventually prune it. A resident
-        // still awaiting a child/controller/human/deadline/output stays wakeable, as does
-        // every terminal node (whose own stop guard owns semantic completion).
-        transition(id, row.lifecycle === 'resident' && !liveObligation ? 'finish' : 'release');
+        transition(id, parkEvent(id, row.lifecycle));
         headlessBrokerHost.teardown(id);
     }
     async warnOverCapInTmux(count, warning, max) {

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -7,7 +7,7 @@ import { appendControllerDeathNotice, readCursor, readInboxSince, } from '../../
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../core/runtime/revive.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { parkEvent } from './live-obligation.js';
 // Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
 // livelock shape as the stranded-relaunch case, but on the separate pass that
 // resumes a dormant idle-released node when its inbox gains an unseen entry.
@@ -80,11 +80,16 @@ export class DormantInboxReconciler {
                     if (!entries.some((entry) => entry.tier !== 'deferred')) {
                         this.relaunchState.delete(id);
                         const meta = getNode(id);
-                        // An idle resident with no wake-worthy inbox entry still needs
-                        // lifecycle settlement. Once nothing live remains, this is completed
-                        // history rather than a permanently protected idle row.
-                        if (meta?.lifecycle === 'resident' && !hasLiveObligation(id)) {
-                            transition(id, 'finish');
+                        // An idle row with no wake-worthy inbox entry still needs the same
+                        // lifecycle settlement the live park clock applies: once nothing
+                        // live remains, this is history rather than a permanently protected
+                        // idle row. The row is already parked, so only a terminalizing
+                        // verdict is worth writing. Unclaimed warm-pool spares never reach
+                        // here — `listNodes` hides them from `ctx.rows`.
+                        if (meta !== null) {
+                            const event = parkEvent(id, meta.lifecycle);
+                            if (event !== 'release')
+                                transition(id, event);
                         }
                         return;
                     }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -1,2 +1,22 @@
-/** Durable work that requires a resident to remain automatically wakeable. */
+import { type Lifecycle } from '../../core/canvas/index.js';
+/** Durable work that requires a node to remain automatically wakeable. */
 export declare function hasLiveObligation(nodeId: string): boolean;
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): 'release' | 'finish' | 'cancel';

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,7 +1,8 @@
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
 import { countTickets } from '../../core/canvas/attention.js';
+import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
-/** Durable work that requires a resident to remain automatically wakeable. */
+/** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
     return hasActiveLiveSubscription(nodeId)
         || hasLiveMessageWait(nodeId)
@@ -9,3 +10,30 @@ export function hasLiveObligation(nodeId) {
         || countTickets(nodeId) > 0
         || readOutputRequest(nodeId).state !== 'absent';
 }
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export function parkEvent(nodeId, lifecycle) {
+    if (hasLiveObligation(nodeId))
+        return 'release';
+    if (readInboxSince(nodeId, readCursor(nodeId)).length > 0)
+        return 'release';
+    if (lifecycle === 'resident')
+        return 'finish';
+    return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
+}

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -4,7 +4,12 @@ export declare const DEAD_REAP_GRACE_MS: number;
 export declare class StorageMaintenanceReconciler {
     private lastPruneAt;
     private lastSpareSweepAt;
+    private lastGhostSweepAt;
     run(now: number): void;
+    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
+     * focused, or closed — every one of those resolves the node through meta.json —
+     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
+    private reapGhostRows;
     /** Milliseconds since meta/telemetry was last written. Inbox activity is
      * deliberately excluded: children can keep writing a dead manager's inbox. */
     private msSinceDiskActivity;