@north-light/crouter 0.3.197 → 0.3.198

package/dist/daemon/fleet.js

@@ -51,21 +51,33 @@ async function surfaceRecoveryFailure(meta, error) {
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
 /** Whether a dead relaunch should resume the saved session strictly, or retry
- *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies
- *  before session_start must retry AS a cycle — a strict reopen only restores
- *  the transcript at an idle prompt, it cannot restart the dead engine turn.
- *  A dirty interrupted BUSY turn also requests a cycle; a broker-certified
- *  clean abort is handled explicitly by classifyDeadNode before this fallback. */
-export function retryResumeMode(meta, interruptedTurn = false) {
-    return meta?.cycle_pending !== true && !interruptedTurn;
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export function retryResumeMode(meta) {
+    return meta?.cycle_pending !== true;
 }
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
- *  Evaluated in table order; `busy` is the on-disk busy marker. A clean-abort
- *  certificate is written by the broker only after Pi persisted its aborted
- *  entry; without it, a set busy marker means a dirty mid-turn crash. */
-export function classifyDeadNode(row, busy, cleanAbort = false) {
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure. */
+export function classifyDeadNode(row, busy) {
     if (row === null)
         return 'forget'; // row 1: row deleted
     if (row.status === 'done' || row.status === 'canceled' || row.status === 'dead')
@@ -74,15 +86,13 @@ export function classifyDeadNode(row, busy, cleanAbort = false) {
         return 'respawn-fresh'; // row 3
     if (row.intent === 'idle-release')
         return 'dormant'; // row 4
-    if (cleanAbort && row.pi_session_id != null)
-        return 'respawn-resume'; // row 5: broker-certified interrupted turn
-    if (busy)
-        return 'respawn-cycle'; // row 6: dirty interrupted turn
     if (row.pi_session_id != null)
-        return retryResumeMode(row, false) ? 'respawn-resume' : 'respawn-cycle'; // row 7
-    if (row.fork_from != null && row.pi_session_id == null)
-        return 'respawn-fresh'; // row 8: bounded ordinary fork-birth retry
-    return 'boot-failure'; // row 9
+        return retryResumeMode(row) ? 'respawn-resume' : 'respawn-cycle'; // row 5: any saved session
+    if (busy)
+        return 'respawn-fresh'; // row 6: died mid-turn before a session was ever recorded
+    if (row.fork_from != null)
+        return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
+    return 'boot-failure'; // row 8
 }
 // ---------------------------------------------------------------------------
 // Respawn throttle (replaces the stranded-relaunch counters, event-driven)
@@ -248,8 +258,12 @@ export class DaemonFleet {
     }
     async #applyPolicy(nodeId, origin) {
         const meta = getNode(nodeId);
-        const cleanAbort = hasCleanAbort(nodeId);
-        const action = classifyDeadNode(meta, isBusy(nodeId), cleanAbort);
+        // Two durable witnesses mean the dead broker had a turn in flight. A dirty
+        // death leaves the busy marker behind; a bounded graceful abort clears busy
+        // as the run settles, then writes the clean-abort certificate. Both need the
+        // same recovery: resume the saved transcript and re-drive the stopped turn.
+        const interruptedTurn = isBusy(nodeId) || hasCleanAbort(nodeId);
+        const action = classifyDeadNode(meta, interruptedTurn);
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
@@ -271,12 +285,12 @@ export class DaemonFleet {
             case 'respawn-fresh':
             case 'respawn-cycle':
             case 'respawn-resume':
-                await this.#respawn(nodeId, meta, action, origin, cleanAbort);
+                await this.#respawn(nodeId, meta, action, origin, interruptedTurn);
                 break;
         }
         return action;
     }
-    async #respawn(nodeId, meta, action, origin, cleanAbort) {
+    async #respawn(nodeId, meta, action, origin, interruptedTurn) {
         const state = this.#throttle.get(nodeId) ?? { failures: 0 };
         if (state.failures >= MAX_RESPAWN_ATTEMPTS) {
             await this.#terminalize(nodeId, meta, {
@@ -327,7 +341,12 @@ export class DaemonFleet {
         try {
             reviveNode(nodeId, {
                 resume: action === 'respawn-resume',
-                wakeReason: cleanAbort ? 'runtime-restart-abort' : undefined,
+                // A resumed session whose turn was interrupted comes back parked at an
+                // idle prompt with the dead turn unfinished. The continuation re-drives
+                // it in place, so the conversation continues instead of being rebuilt
+                // from disk on a fresh branch. Only a true resume can carry it; a cycle
+                // or fresh relaunch gets its own kickoff.
+                wakeReason: action === 'respawn-resume' && interruptedTurn ? 'runtime-restart-abort' : undefined,
                 // Replacing a dead broker instance is recovery, not a wake: nothing
                 // external arrived for this node, so an armed deadline survives the
                 // relaunch instead of being consumed by it.

package/dist/daemon/human/finish.d.ts

@@ -1,3 +1,4 @@
+import type { ProductPageComponents } from '../../types.js';
 import type { TicketResult } from '../../core/human/types.js';
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
@@ -5,7 +6,7 @@ import type { TicketResult } from '../../core/human/types.js';
  * node-addressed resolve route and the ticket-id-addressed inbox respond route —
  * finishes a page here, so an answer always reaches the node that asked.
  */
-export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: string[]): Promise<TicketResult>;
+export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: ProductPageComponents): Promise<TicketResult>;
 /** Cancel a ticket with the store's first-writer-wins publication. */
 export declare function cancelHumanTicket(nodeId: string, opts: {
     reason?: string;

package/dist/daemon/human/finish.js

@@ -1,36 +1,45 @@
 import { join } from 'node:path';
 import { ApiError } from '../../api/index.js';
-import { getNode, subscribersOf } from '../../core/canvas/canvas.js';
+import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
+import { readConfig } from '../../core/config.js';
 import { ticketDir } from '../../core/human/root.js';
+import { parsePage } from '../../core/human/page.js';
 import { cancelTicket, projectReviewOutput, readTicketResult, takeoverAndCompletePage, } from '../../core/human/tickets.js';
+import { describePageAnswer } from '../../core/human/answer.js';
+import { renderAnswerText } from '../../core/human/answer-text.js';
 import { responsePath } from '../../core/human/convention.js';
 import { readJsonOrNull } from '../../core/fs-utils.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
-/**
- * The answer a page's asking node wakes with. Slot responses are small and
- * typed, so they are inlined as compact JSON rather than left behind the path:
- * the node reads its answers out of its own report. An acknowledgement carries
- * no responses at all and reads as one line saying the human saw the page.
- * Interim rendering — the designed answer view is phase 5.
- */
-function renderPageAnswer(result, resultPath) {
-    const entries = Object.entries(result.responses);
-    const lines = [];
-    if (entries.length === 0) {
-        lines.push('The human read the page and dismissed it. No slot responses came back, so the acknowledgement is the whole answer.');
+/** A corrupt manifest must not strand the asking node: the raw response remains its escape hatch. */
+function renderCorruptPageAnswer(result, resultPath) {
+    return [
+        'The page manifest could not be read, so the raw response is provided.',
+        '',
+        JSON.stringify(result.responses),
+        '',
+        `Response record: ${resultPath}`,
+    ].join('\n');
+}
+function pageTitle(dir) {
+    try {
+        return parsePage(dir, readConfig('user').page_components).title;
+    }
+    catch {
+        return undefined;
+    }
+}
+function renderPageAnswer(dir, result, resultPath) {
+    const productKinds = readConfig('user').page_components;
+    let manifest;
+    try {
+        manifest = parsePage(dir, productKinds);
     }
-    else {
-        lines.push(`The human answered ${entries.length} slot${entries.length === 1 ? '' : 's'}:`, '');
-        for (const [slotId, response] of entries)
-            lines.push(`${slotId}: ${JSON.stringify(response)}`);
-        const summary = result.summary.trim();
-        if (summary !== '')
-            lines.push('', summary);
+    catch {
+        return renderCorruptPageAnswer(result, resultPath);
     }
-    lines.push('', `Response metadata (slot ids, typed responses, timestamp): ${resultPath}`);
-    return lines.join('\n');
+    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt, productKinds }), resultPath);
 }
 function deliveryFailed(error) {
     // A canonical final is committed inside its own write boundary and can never
@@ -96,12 +105,20 @@ export async function deliverTerminalResult(nodeId) {
     if (result === null)
         return false;
     projectReviewOutput(dir);
-    const node = getNode(nodeId);
+    // The ROW, not `getNode`: a ticket directory IS the bridge's node directory,
+    // so a bridge whose row has been pruned still answers `getNode` from its
+    // surviving meta.json — with no status at all, which passed every guard below
+    // and then threw out of `transition` on every sweep, re-fanning the
+    // cancellation notice each time. No row means nothing left to deliver to.
+    const node = getRow(nodeId);
     if (node === null || node.status === 'dead' || node.status === 'canceled' || (node.status === 'done' && node.final_report !== null)) {
         return true;
     }
     if (result.kind === 'canceled') {
-        const note = result.reason !== undefined && result.reason !== '' ? ` — ${result.reason}` : '';
+        const title = pageTitle(dir);
+        const reason = result.reason !== undefined && result.reason !== '' ? result.reason : 'no reason was given';
+        const subject = title === undefined ? `human interaction ${nodeId} canceled — no answer is coming` : `human interaction ${nodeId} — “${title}” canceled, no answer is coming`;
+        const body = title === undefined ? `The human interaction ${nodeId} was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.` : `The page “${title}” was canceled — ${reason}. No response will arrive, and any partial answers the human had entered were discarded unsent.`;
         // One failing subscriber must not silence the rest, and the bridge stays
         // live until every notice lands: a partial fanout leaves the ticket for the
         // next resolve/cancel attempt or the daemon-start sweep to replay. A
@@ -114,10 +131,10 @@ export async function deliverTerminalResult(nodeId) {
             try {
                 appendInbox(subscriber.node_id, {
                     from: nodeId,
-                    tier: 'deferred',
+                    tier: 'normal',
                     kind: 'message',
-                    label: `human interaction ${nodeId} canceled — no answer is coming${note}`,
-                    data: { body: `The human interaction ${nodeId} was canceled${note}. No response will arrive.` },
+                    label: subject,
+                    data: { body },
                 });
             }
             catch {
@@ -130,7 +147,7 @@ export async function deliverTerminalResult(nodeId) {
         return true;
     }
     if (result.kind === 'page') {
-        await pushFinal(nodeId, renderPageAnswer(result, responsePath(dir)));
+        await pushFinal(nodeId, renderPageAnswer(dir, result, responsePath(dir)));
     }
     return true;
 }

package/dist/daemon/human/sweep.js

@@ -1,6 +1,6 @@
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { getNode } from '../../core/canvas/canvas.js';
+import { getRow } from '../../core/canvas/canvas.js';
 import { getReviewByBridge } from '../../core/review/store.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { ticketsRoot } from '../../core/human/root.js';
@@ -27,7 +27,9 @@ export async function reconcileUndeliveredTickets() {
             // finisher retries only when its winning operation is explicitly repeated.
             if (getReviewByBridge(entry) !== null)
                 continue;
-            const bridge = getNode(entry);
+            // The ROW is what carries status; `getNode` would answer from a pruned
+            // bridge's surviving meta.json with no status at all.
+            const bridge = getRow(entry);
             if (bridge === null || isTerminalBridge(bridge.status))
                 continue;
             if (await deliverTerminalResult(entry))

package/dist/daemon/reconcilers/broker-supervision.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { getRow, getNode, subscribersOf } from '../../core/canvas/index.js';
+import { getRow, getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
 import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { recordedPidLiveness } from '../../core/canvas/pid.js';
@@ -20,7 +20,7 @@ import { operationIdContext } from '../../core/events/operation-id.js';
 import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
     const raw = process.env[name];
@@ -174,6 +174,14 @@ export class BrokerSupervisionReconciler {
         return thresholds;
     }
     handleUnattendedParking(id, row, livePid, now) {
+        // An unclaimed warm-pool spare is not a conversation: the booted broker it
+        // holds IS its whole value, and nobody is meant to be attending it. Its
+        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
+        // parking one here would empty the pool every 15 minutes.
+        if (isWarmSpare(id)) {
+            this.unattendedSince.delete(id);
+            return;
+        }
         if (row === null
             || row.pi_session_id == null
             || row.pi_pid !== livePid
@@ -206,12 +214,7 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        const liveObligation = hasLiveObligation(id);
-        // A resident with nothing left to wake it has completed its conversation:
-        // terminalize it so history retention can eventually prune it. A resident
-        // still awaiting a child/controller/human/deadline/output stays wakeable, as does
-        // every terminal node (whose own stop guard owns semantic completion).
-        transition(id, row.lifecycle === 'resident' && !liveObligation ? 'finish' : 'release');
+        transition(id, parkEvent(id, row.lifecycle));
         headlessBrokerHost.teardown(id);
     }
     async warnOverCapInTmux(count, warning, max) {

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -7,7 +7,7 @@ import { appendControllerDeathNotice, readCursor, readInboxSince, } from '../../
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../core/runtime/revive.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { parkEvent } from './live-obligation.js';
 // Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
 // livelock shape as the stranded-relaunch case, but on the separate pass that
 // resumes a dormant idle-released node when its inbox gains an unseen entry.
@@ -80,11 +80,16 @@ export class DormantInboxReconciler {
                     if (!entries.some((entry) => entry.tier !== 'deferred')) {
                         this.relaunchState.delete(id);
                         const meta = getNode(id);
-                        // An idle resident with no wake-worthy inbox entry still needs
-                        // lifecycle settlement. Once nothing live remains, this is completed
-                        // history rather than a permanently protected idle row.
-                        if (meta?.lifecycle === 'resident' && !hasLiveObligation(id)) {
-                            transition(id, 'finish');
+                        // An idle row with no wake-worthy inbox entry still needs the same
+                        // lifecycle settlement the live park clock applies: once nothing
+                        // live remains, this is history rather than a permanently protected
+                        // idle row. The row is already parked, so only a terminalizing
+                        // verdict is worth writing. Unclaimed warm-pool spares never reach
+                        // here — `listNodes` hides them from `ctx.rows`.
+                        if (meta !== null) {
+                            const event = parkEvent(id, meta.lifecycle);
+                            if (event !== 'release')
+                                transition(id, event);
                         }
                         return;
                     }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -1,2 +1,22 @@
-/** Durable work that requires a resident to remain automatically wakeable. */
+import { type Lifecycle } from '../../core/canvas/index.js';
+/** Durable work that requires a node to remain automatically wakeable. */
 export declare function hasLiveObligation(nodeId: string): boolean;
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): 'release' | 'finish' | 'cancel';

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,7 +1,8 @@
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
 import { countTickets } from '../../core/canvas/attention.js';
+import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
-/** Durable work that requires a resident to remain automatically wakeable. */
+/** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
     return hasActiveLiveSubscription(nodeId)
         || hasLiveMessageWait(nodeId)
@@ -9,3 +10,30 @@ export function hasLiveObligation(nodeId) {
         || countTickets(nodeId) > 0
         || readOutputRequest(nodeId).state !== 'absent';
 }
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export function parkEvent(nodeId, lifecycle) {
+    if (hasLiveObligation(nodeId))
+        return 'release';
+    if (readInboxSince(nodeId, readCursor(nodeId)).length > 0)
+        return 'release';
+    if (lifecycle === 'resident')
+        return 'finish';
+    return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
+}

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -4,7 +4,12 @@ export declare const DEAD_REAP_GRACE_MS: number;
 export declare class StorageMaintenanceReconciler {
     private lastPruneAt;
     private lastSpareSweepAt;
+    private lastGhostSweepAt;
     run(now: number): void;
+    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
+     * focused, or closed — every one of those resolves the node through meta.json —
+     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
+    private reapGhostRows;
     /** Milliseconds since meta/telemetry was last written. Inbox activity is
      * deliberately excluded: children can keep writing a dead manager's inbox. */
     private msSinceDiskActivity;

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -1,6 +1,6 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { closeFocusRow, listFocuses, listNodes, pruneToLimit, } from '../../core/canvas/index.js';
+import { closeFocusRow, listFocuses, listNodes, pruneToLimit, reapGhostRows, } from '../../core/canvas/index.js';
 import { isSafeNodeId, jobDir, nodeDir } from '../../core/canvas/paths.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
@@ -12,20 +12,47 @@ export const DEAD_REAP_GRACE_MS = 10 * 60_000;
 const AUTO_PRUNE_MAX = 2000;
 const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
 const SPARE_SWEEP_INTERVAL_MS = 60 * 1000;
+const GHOST_SWEEP_INTERVAL_MS = 60 * 1000;
 /** Recurring storage cleanup. The in-memory throttle clocks intentionally reset
  * on daemon boot, so the first tick runs both full sweeps. */
 export class StorageMaintenanceReconciler {
     lastPruneAt = Number.NEGATIVE_INFINITY;
     lastSpareSweepAt = Number.NEGATIVE_INFINITY;
+    lastGhostSweepAt = Number.NEGATIVE_INFINITY;
     run(now) {
         // Placement reap MUST precede focus GC, so GC catches a focus row the reap
         // strands. Both run after dormant-inbox reconciliation, so a same-tick
         // revive has already had the chance to re-anchor its focus.
         this.reapDeadResidue(now);
         this.gcStaleFocuses();
+        this.reapGhostRows(now);
         this.autoPrune(now);
         this.gcWarmPool(now);
     }
+    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
+     * focused, or closed — every one of those resolves the node through meta.json —
+     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
+    reapGhostRows(now) {
+        if (now - this.lastGhostSweepAt < GHOST_SWEEP_INTERVAL_MS)
+            return;
+        this.lastGhostSweepAt = now;
+        operationIdContext.fresh(() => {
+            try {
+                const reaped = reapGhostRows();
+                if (reaped.length > 0) {
+                    emitEvent({
+                        level: 'info',
+                        event: 'canvas.ghost_rows.reaped',
+                        outcome: 'succeeded',
+                        fields: { reaped_count: reaped.length, reaped_ids: reaped },
+                    });
+                }
+            }
+            catch (err) {
+                emitEvent({ level: 'error', event: 'canvas.ghost_rows.reap_failed', error: err });
+            }
+        });
+    }
     /** Milliseconds since meta/telemetry was last written. Inbox activity is
      * deliberately excluded: children can keep writing a dead manager's inbox. */
     msSinceDiskActivity(nodeId, now) {

package/dist/daemon/review/sweep.js

@@ -4,6 +4,8 @@ import { reviewPath } from '../../core/human/convention.js';
 import { ticketDir } from '../../core/human/root.js';
 import { submitReview } from '../../core/human/tickets.js';
 import { reviewsRoot } from '../../core/canvas/paths.js';
+import { getNode } from '../../core/canvas/index.js';
+import { loadProfileManifest } from '../../core/profiles/manifest.js';
 import { projectReviewResult } from '../../core/review/project.js';
 import { realizeReview } from '../../core/review/realize.js';
 import { listBindingReviews, listReviews, markProjected, markProjectionError, } from '../../core/review/store.js';
@@ -23,6 +25,12 @@ function republishTicketReview(review) {
     const dir = ticketDir(review.bridge_node_id);
     if (existsSync(reviewPath(dir)))
         return;
+    const origin = getNode(review.origin_node_id);
+    if (origin === null)
+        throw new Error(`ticket review origin is missing: ${review.origin_node_id}`);
+    const profileName = origin.profile_id == null
+        ? undefined
+        : loadProfileManifest(origin.profile_id).manifest.name;
     submitReview({
         dir,
         review: {
@@ -30,7 +38,10 @@ function republishTicketReview(review) {
             ...(review.output_path === null ? {} : { output: review.output_path }),
             title: basename(review.file),
             subtitle: review.subtitle,
-            source: { nodeId: review.origin_node_id },
+            source: {
+                nodeId: review.origin_node_id,
+                ...(profileName === undefined ? {} : { profileName }),
+            },
             blockedSince: review.created,
         },
     });

package/dist/pages/bundle.css

@@ -1 +1 @@
-:where(:root,:host){color-scheme:light dark;--crtr-color-background: #ffffff;--crtr-color-surface: #f7f7f8;--crtr-color-surface-hover: #eeeeef;--crtr-color-text: #1c1c1f;--crtr-color-text-muted: #68686f;--crtr-color-border: #d9d9de;--crtr-color-accent: #5753c9;--crtr-color-accent-contrast: #ffffff;--crtr-color-danger: #c73535;--crtr-color-focus: #706bea;--crtr-chart-1: #5753c9;--crtr-chart-2: #2c8c75;--crtr-chart-3: #cf7c2a;--crtr-chart-4: #b84c84;--crtr-chart-5: #477eb8;--crtr-font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;--crtr-font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;--crtr-font-size: .875rem;--crtr-line-height: 1.5;--crtr-radius-small: .375rem;--crtr-radius-medium: .625rem;--crtr-space-1: .25rem;--crtr-space-2: .5rem;--crtr-space-3: .75rem;--crtr-space-4: 1rem;--crtr-shadow: 0 1px 2px rgb(0 0 0 / .08)}:where(crtr-options,crtr-text,crtr-table,crtr-cards,crtr-chart,crtr-pages,crtr-page,crtr-slot){color:var(--crtr-color-text);font-family:var(--crtr-font-family);font-size:var(--crtr-font-size);line-height:var(--crtr-line-height)}@media(prefers-color-scheme:dark){:where(:root,:host){--crtr-color-background: #161618;--crtr-color-surface: #222225;--crtr-color-surface-hover: #2d2d31;--crtr-color-text: #f2f2f3;--crtr-color-text-muted: #aaaab1;--crtr-color-border: #414147;--crtr-color-accent: #9692ff;--crtr-color-accent-contrast: #18181b;--crtr-color-danger: #f06a6a;--crtr-color-focus: #aaa7ff}}
+:where(:root,:host){color-scheme:var(--crtr-color-scheme, light dark);--crtr-color-background: #ffffff;--crtr-color-surface: #f7f7f8;--crtr-color-surface-hover: #eeeeef;--crtr-color-text: #1c1c1f;--crtr-color-text-muted: #68686f;--crtr-color-border: #d9d9de;--crtr-color-accent: #5753c9;--crtr-color-accent-contrast: #ffffff;--crtr-color-danger: #c73535;--crtr-color-focus: #706bea;--crtr-chart-1: #5753c9;--crtr-chart-2: #2c8c75;--crtr-chart-3: #cf7c2a;--crtr-chart-4: #b84c84;--crtr-chart-5: #477eb8;--crtr-font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;--crtr-font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;--crtr-font-size: .875rem;--crtr-line-height: 1.5;--crtr-radius-small: .375rem;--crtr-radius-medium: .625rem;--crtr-space-1: .25rem;--crtr-space-2: .5rem;--crtr-space-3: .75rem;--crtr-space-4: 1rem;--crtr-shadow: 0 1px 2px rgb(0 0 0 / .08)}:where(crtr-options){color:var(--crtr-options-color, var(--crtr-color-text));font-family:var(--crtr-options-font-family, var(--crtr-font-family));font-size:var(--crtr-options-font-size, var(--crtr-font-size));line-height:var(--crtr-options-line-height, var(--crtr-line-height))}:where(crtr-text){color:var(--crtr-text-color, var(--crtr-color-text));font-family:var(--crtr-text-font-family, var(--crtr-font-family));font-size:var(--crtr-text-font-size, var(--crtr-font-size));line-height:var(--crtr-text-line-height, var(--crtr-line-height))}:where(crtr-table){color:var(--crtr-table-color, var(--crtr-color-text));font-family:var(--crtr-table-font-family, var(--crtr-font-family));font-size:var(--crtr-table-font-size, var(--crtr-font-size));line-height:var(--crtr-table-line-height, var(--crtr-line-height))}:where(crtr-cards){color:var(--crtr-cards-color, var(--crtr-color-text));font-family:var(--crtr-cards-font-family, var(--crtr-font-family));font-size:var(--crtr-cards-font-size, var(--crtr-font-size));line-height:var(--crtr-cards-line-height, var(--crtr-line-height))}:where(crtr-chart){color:var(--crtr-chart-color, var(--crtr-color-text));font-family:var(--crtr-chart-font-family, var(--crtr-font-family));font-size:var(--crtr-chart-font-size, var(--crtr-font-size));line-height:var(--crtr-chart-line-height, var(--crtr-line-height))}:where(crtr-pages,crtr-page){color:var(--crtr-page-color, var(--crtr-color-text));font-family:var(--crtr-page-font-family, var(--crtr-font-family));font-size:var(--crtr-page-font-size, var(--crtr-font-size));line-height:var(--crtr-page-line-height, var(--crtr-line-height))}:where(crtr-slot){color:var(--crtr-slot-color, var(--crtr-color-text));font-family:var(--crtr-slot-font-family, var(--crtr-font-family));font-size:var(--crtr-slot-font-size, var(--crtr-font-size));line-height:var(--crtr-slot-line-height, var(--crtr-line-height))}@media(prefers-color-scheme:dark){:where(:root,:host){--crtr-color-background: #161618;--crtr-color-surface: #222225;--crtr-color-surface-hover: #2d2d31;--crtr-color-text: #f2f2f3;--crtr-color-text-muted: #aaaab1;--crtr-color-border: #414147;--crtr-color-accent: #9692ff;--crtr-color-accent-contrast: #18181b;--crtr-color-danger: #f06a6a;--crtr-color-focus: #aaa7ff;--crtr-shadow: 0 1px 2px rgb(0 0 0 / .45);--crtr-chart-1: #9692ff;--crtr-chart-2: #4fc3a4;--crtr-chart-3: #eba05a;--crtr-chart-4: #e281b4;--crtr-chart-5: #71b0e6}}