@north-light/crouter 0.3.197 → 0.3.199

package/dist/daemon/cron-run.js

@@ -30,26 +30,24 @@
 // promises for graceful-teardown drain but never blocks on a slow run.
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { rmSync } from 'node:fs';
 import { synthesizedPageDocument, writeSynthesizedPage } from '../core/human/page-synth.js';
 import { ticketDir } from '../core/human/root.js';
 import { preparePage, publishPage } from '../core/human/tickets.js';
-import { readConfig } from '../core/config.js';
+import { resolvePageComponents } from '../core/config.js';
 import { dueClockCrons, dueOverlapCrons, expiredIdleCrons, runningCrons, acquireCronRunLease, releaseCronRunLease, recordCronRun, listCronRuns, advanceCron, consumeCron, cancelCron, killLeasedCronRun, verifyLeasedCronRun, getCron, setCronState, setCronLastOutputHash, } from '../core/canvas/crons.js';
 import { getNode } from '../core/canvas/canvas.js';
 import { fullName } from '../core/canvas/labels.js';
 import { killProcessGroup } from '../core/canvas/pid.js';
 import { appendInbox } from '../core/feed/inbox.js';
-import { atomicWriteJson } from '../core/fs-utils.js';
 import { emitEvent } from '../core/events/emit.js';
 import { loadProfileManifest } from '../core/profiles/manifest.js';
 import { hasNoNaturalCycle } from '../core/runtime/revive-all.js';
 import { spawnChild } from '../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../core/runtime/bearings.js';
 import { nextSlotAfter, cadenceDisplay } from '../core/wake.js';
-import { buildOperationalEnvBase } from '../core/runtime/spawn-env.js';
+import { ADMITTED_HOST_PATH_ENV, buildOperationalEnvBase, resolveAdmittedHostCommand } from '../core/runtime/spawn-env.js';
 import { parseSink } from './cron-sink.js';
 import { readProfileEnvVars } from '../core/profiles/env-store.js';
 /** Output head caps for the run log (spec: "capped, e.g. 4KB"). */
@@ -163,6 +161,16 @@ function resolveLiveProfile(c) {
         return null;
     }
 }
+function resolveLiveProfileName(c) {
+    if (c.profile == null)
+        return undefined;
+    try {
+        return loadProfileManifest(c.profile).manifest.name;
+    }
+    catch {
+        return undefined;
+    }
+}
 // ---------------------------------------------------------------------------
 // Delivery sinks
 // ---------------------------------------------------------------------------
@@ -213,9 +221,9 @@ async function deliverSpawnSink(c, kind, stdout) {
     });
     return res.node.node_id;
 }
-/** Deliver stdout through crouter as a durable notify page (fire-and-forget
- *  inbox state — jobs whose output is a person's call). Mirrors `crtr human
- *  notify` minus the CLI-env source stamp: the page names the cron instead. */
+/** Deliver stdout through crouter as a standalone human page. Mirrors
+ * `crtr human send --inbox` for a display-only page, minus the CLI-env source
+ * stamp: the page names the cron instead. */
 function deliverHumanSink(c, stdout) {
     const synthesized = writeSynthesizedPage(synthesizedPageDocument(`⏰ cron ${c.name}`, `Scheduled cron "${c.name}" delivered output for your attention.`, stdout, false));
     // Cron stdout rides into the page verbatim, so it can carry invalid page
@@ -223,19 +231,21 @@ function deliverHumanSink(c, stdout) {
     // half-built `nfy-*` directory behind.
     let prepared;
     try {
+        const profileName = resolveLiveProfileName(c);
         prepared = preparePage({
             sourceFile: synthesized.path,
-            dialect: 'md',
-            source: { sessionName: `cron ${c.name} (${c.cron_id})` },
-            productKinds: readConfig('user').page_components,
+            source: {
+                sessionName: `cron ${c.name} (${c.cron_id})`,
+                ...(profileName === undefined ? {} : { profileName }),
+            },
+            productKinds: resolvePageComponents(),
+            delivery: { placement: 'inline', inbox: true, reply: false },
         });
     }
     finally {
         rmSync(synthesized.dir, { recursive: true, force: true });
     }
-    const id = `nfy-${randomBytes(4).toString('hex')}`;
-    const rc = { mode: 'notify' };
-    atomicWriteJson(join(ticketDir(id), 'run.json'), rc);
+    const id = `page-${randomBytes(4).toString('hex')}`;
     publishPage(ticketDir(id), prepared);
 }
 /** Route stdout to the cron's armed sink. Returns the delivered string on
@@ -253,7 +263,7 @@ async function deliverToSink(c, stdout) {
         return `delivered: spawned ${nodeId}`;
     }
     deliverHumanSink(c, stdout);
-    return 'delivered: human notify';
+    return 'delivered: human send --inbox';
 }
 function failureSummary(ctx, deliveryFailure) {
     if (deliveryFailure !== null)
@@ -314,7 +324,7 @@ function buildEscalationKickoff(c, ctx, deliveryFailure) {
         `Diagnose why it failed and decide what to do:`,
         `- Transient or fixable: fix the environment/command context, verify with \`crtr cron run ${c.cron_id}\` (fires now, out of band, shows you the result), then \`crtr cron resume ${c.cron_id}\` to re-arm it.`,
         `- Obsolete: \`crtr cron cancel ${c.cron_id}\`.`,
-        `- The user's call (or the fix needs a change you cannot make): \`crtr human ask\`.`,
+        `- The user's call (or the fix needs a change you cannot make): \`crtr human send\`.`,
         '',
         'The cron stays paused until someone resumes it — nothing refires while you work.',
     ].join('\n');
@@ -625,8 +635,9 @@ export function executeCron(c, opts) {
         // Layering: profile store < the arm-time `--env` snapshot (an explicit
         // choice) < crtr's own constructed CRTR_* names, which always win.
         const profileId = resolveLiveProfile(c);
+        const operationalEnv = buildOperationalEnvBase({ targetCwd: c.cwd, targetProfileId: profileId });
         const env = {
-            ...buildOperationalEnvBase({ targetCwd: c.cwd, targetProfileId: profileId }),
+            ...operationalEnv,
             ...readProfileEnvVars(profileId),
             ...extraEnv,
             ...(profileId !== null ? { CRTR_PROFILE_ID: profileId } : {}),
@@ -646,11 +657,12 @@ export function executeCron(c, opts) {
         }
         if (c.anchor_node != null)
             env['CRTR_ANCHOR'] = c.anchor_node;
+        env[ADMITTED_HOST_PATH_ENV] = operationalEnv[ADMITTED_HOST_PATH_ENV];
         const startedAtMs = Date.now();
         const startedAtIso = new Date(startedAtMs).toISOString();
         let child;
         try {
-            child = spawn('bash', ['-c', c.command], {
+            child = spawn(resolveAdmittedHostCommand('bash', env, c.cwd), ['-c', c.command], {
                 cwd: c.cwd,
                 env,
                 detached: true, // own process group — killProcessGroup(-pid) reaps the whole tree

package/dist/daemon/crtrd.js

@@ -8,7 +8,7 @@
 // The fleet registry's entry IS the node's liveness — no pid probe, no grace
 // clock. A broker's real `exit` event enqueues an exit-policy job on the
 // daemon's serial work lane (never inline on the Node event callback), where
-// classifyDeadNode — one pure 9-row policy table over durable row state —
+// classifyDeadNode — one pure 8-row policy table over durable row state —
 // decides forget / dormant / respawn / boot-failure. The startup recovery
 // sweep classifies boot-time dead rows through the SAME table, so exit
 // recovery and startup recovery can never diverge. Every broker's argv is

package/dist/daemon/fleet.d.ts

@@ -10,12 +10,16 @@ import type { HostHandle } from '../core/runtime/host.js';
  *  seeing a silent `dead`. */
 export declare function surfaceBootFailure(meta: NodeMeta): Promise<void>;
 /** Whether a dead relaunch should resume the saved session strictly, or retry
- *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies
- *  before session_start must retry AS a cycle — a strict reopen only restores
- *  the transcript at an idle prompt, it cannot restart the dead engine turn.
- *  A dirty interrupted BUSY turn also requests a cycle; a broker-certified
- *  clean abort is handled explicitly by classifyDeadNode before this fallback. */
-export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null, interruptedTurn?: boolean): boolean;
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null): boolean;
 export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'respawn-cycle' | 'respawn-resume' | 'boot-failure';
 /** The narrow durable state the policy table reads. Structural (a Pick, not
  *  NodeMeta itself) so tests fabricate table rows directly. */
@@ -23,10 +27,18 @@ export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' |
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
- *  Evaluated in table order; `busy` is the on-disk busy marker. A clean-abort
- *  certificate is written by the broker only after Pi persisted its aborted
- *  entry; without it, a set busy marker means a dirty mid-turn crash. */
-export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean, cleanAbort?: boolean): DeadNodeAction;
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure. */
+export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean): DeadNodeAction;
 /** An exit with uptime at or above this resets the consecutive-failure
  *  counter before classification; a shorter-lived exit increments it. */
 export declare const HEALTHY_UPTIME_MS = 60000;

package/dist/daemon/fleet.js

@@ -51,21 +51,33 @@ async function surfaceRecoveryFailure(meta, error) {
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
 /** Whether a dead relaunch should resume the saved session strictly, or retry
- *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies
- *  before session_start must retry AS a cycle — a strict reopen only restores
- *  the transcript at an idle prompt, it cannot restart the dead engine turn.
- *  A dirty interrupted BUSY turn also requests a cycle; a broker-certified
- *  clean abort is handled explicitly by classifyDeadNode before this fallback. */
-export function retryResumeMode(meta, interruptedTurn = false) {
-    return meta?.cycle_pending !== true && !interruptedTurn;
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export function retryResumeMode(meta) {
+    return meta?.cycle_pending !== true;
 }
 /** One pure function producing the action for a node known-dead. Used at
  *  exactly two call sites — an exit-policy job and the startup recovery sweep
  *  (design D-12) — so exit recovery and startup recovery can never diverge.
- *  Evaluated in table order; `busy` is the on-disk busy marker. A clean-abort
- *  certificate is written by the broker only after Pi persisted its aborted
- *  entry; without it, a set busy marker means a dirty mid-turn crash. */
-export function classifyDeadNode(row, busy, cleanAbort = false) {
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure. */
+export function classifyDeadNode(row, busy) {
     if (row === null)
         return 'forget'; // row 1: row deleted
     if (row.status === 'done' || row.status === 'canceled' || row.status === 'dead')
@@ -74,15 +86,13 @@ export function classifyDeadNode(row, busy, cleanAbort = false) {
         return 'respawn-fresh'; // row 3
     if (row.intent === 'idle-release')
         return 'dormant'; // row 4
-    if (cleanAbort && row.pi_session_id != null)
-        return 'respawn-resume'; // row 5: broker-certified interrupted turn
-    if (busy)
-        return 'respawn-cycle'; // row 6: dirty interrupted turn
     if (row.pi_session_id != null)
-        return retryResumeMode(row, false) ? 'respawn-resume' : 'respawn-cycle'; // row 7
-    if (row.fork_from != null && row.pi_session_id == null)
-        return 'respawn-fresh'; // row 8: bounded ordinary fork-birth retry
-    return 'boot-failure'; // row 9
+        return retryResumeMode(row) ? 'respawn-resume' : 'respawn-cycle'; // row 5: any saved session
+    if (busy)
+        return 'respawn-fresh'; // row 6: died mid-turn before a session was ever recorded
+    if (row.fork_from != null)
+        return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
+    return 'boot-failure'; // row 8
 }
 // ---------------------------------------------------------------------------
 // Respawn throttle (replaces the stranded-relaunch counters, event-driven)
@@ -248,8 +258,12 @@ export class DaemonFleet {
     }
     async #applyPolicy(nodeId, origin) {
         const meta = getNode(nodeId);
-        const cleanAbort = hasCleanAbort(nodeId);
-        const action = classifyDeadNode(meta, isBusy(nodeId), cleanAbort);
+        // Two durable witnesses mean the dead broker had a turn in flight. A dirty
+        // death leaves the busy marker behind; a bounded graceful abort clears busy
+        // as the run settles, then writes the clean-abort certificate. Both need the
+        // same recovery: resume the saved transcript and re-drive the stopped turn.
+        const interruptedTurn = isBusy(nodeId) || hasCleanAbort(nodeId);
+        const action = classifyDeadNode(meta, interruptedTurn);
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
@@ -271,12 +285,12 @@ export class DaemonFleet {
             case 'respawn-fresh':
             case 'respawn-cycle':
             case 'respawn-resume':
-                await this.#respawn(nodeId, meta, action, origin, cleanAbort);
+                await this.#respawn(nodeId, meta, action, origin, interruptedTurn);
                 break;
         }
         return action;
     }
-    async #respawn(nodeId, meta, action, origin, cleanAbort) {
+    async #respawn(nodeId, meta, action, origin, interruptedTurn) {
         const state = this.#throttle.get(nodeId) ?? { failures: 0 };
         if (state.failures >= MAX_RESPAWN_ATTEMPTS) {
             await this.#terminalize(nodeId, meta, {
@@ -327,7 +341,12 @@ export class DaemonFleet {
         try {
             reviveNode(nodeId, {
                 resume: action === 'respawn-resume',
-                wakeReason: cleanAbort ? 'runtime-restart-abort' : undefined,
+                // A resumed session whose turn was interrupted comes back parked at an
+                // idle prompt with the dead turn unfinished. The continuation re-drives
+                // it in place, so the conversation continues instead of being rebuilt
+                // from disk on a fresh branch. Only a true resume can carry it; a cycle
+                // or fresh relaunch gets its own kickoff.
+                wakeReason: action === 'respawn-resume' && interruptedTurn ? 'runtime-restart-abort' : undefined,
                 // Replacing a dead broker instance is recovery, not a wake: nothing
                 // external arrived for this node, so an armed deadline survives the
                 // relaunch instead of being consumed by it.

package/dist/daemon/human/finish.d.ts

@@ -1,13 +1,19 @@
 import type { TicketResult } from '../../core/human/types.js';
+/** Every ticket-ending action retires the ticket's feedback companion — done
+ * when active or idle, never left resident. Idempotent and replay-safe; a
+ * corrupt feedback file must not block result publication. Exported for the
+ * daemon-start sweep, which must settle terminal tickets whether or not a
+ * reply bridge exists. */
+export declare function settleFeedbackCompanion(ticketId: string): void;
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
- * publication, then the asking node's wake. Every addressing surface — the
- * node-addressed resolve route and the ticket-id-addressed inbox respond route —
- * finishes a page here, so an answer always reaches the node that asked.
+ * publication, then optional reply delivery. Every addressing surface routes
+ * through this function, so the reply-route descriptor is the sole authority
+ * on whether completion reaches a bridge.
  */
-export declare function resolvePageTicket(nodeId: string, responses: unknown, productKinds?: string[]): Promise<TicketResult>;
+export declare function resolvePageTicket(ticketId: string, responses: unknown): Promise<TicketResult>;
 /** Cancel a ticket with the store's first-writer-wins publication. */
-export declare function cancelHumanTicket(nodeId: string, opts: {
+export declare function cancelHumanTicket(ticketId: string, opts: {
     reason?: string;
     actor?: string;
 }): Promise<TicketResult>;
@@ -16,4 +22,4 @@ export declare function cancelHumanTicket(nodeId: string, opts: {
  * receipt: every action below is replay-safe, so lost delivery can be retried
  * by a later resolve/cancel attempt or the daemon-start sweep.
  */
-export declare function deliverTerminalResult(nodeId: string): Promise<boolean>;
+export declare function deliverTerminalResult(ticketId: string): Promise<boolean>;

package/dist/daemon/human/finish.js

@@ -1,36 +1,94 @@
-import { join } from 'node:path';
 import { ApiError } from '../../api/index.js';
-import { getNode, subscribersOf } from '../../core/canvas/canvas.js';
+import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
 import { ticketDir } from '../../core/human/root.js';
+import { parsePage } from '../../core/human/page.js';
 import { cancelTicket, projectReviewOutput, readTicketResult, takeoverAndCompletePage, } from '../../core/human/tickets.js';
-import { responsePath } from '../../core/human/convention.js';
-import { readJsonOrNull } from '../../core/fs-utils.js';
+import { describePageAnswer } from '../../core/human/answer.js';
+import { renderAnswerText } from '../../core/human/answer-text.js';
+import { pagePath, readTicketReplyRoute, responsePath } from '../../core/human/convention.js';
+import { readPageFeedback } from '../../core/human/feedback.js';
+import { pageDocumentSha256 } from '../../core/human/feedback-companion.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { FinalDeliveryError, pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
-/**
- * The answer a page's asking node wakes with. Slot responses are small and
- * typed, so they are inlined as compact JSON rather than left behind the path:
- * the node reads its answers out of its own report. An acknowledgement carries
- * no responses at all and reads as one line saying the human saw the page.
- * Interim rendering — the designed answer view is phase 5.
- */
-function renderPageAnswer(result, resultPath) {
-    const entries = Object.entries(result.responses);
-    const lines = [];
-    if (entries.length === 0) {
-        lines.push('The human read the page and dismissed it. No slot responses came back, so the acknowledgement is the whole answer.');
-    }
-    else {
-        lines.push(`The human answered ${entries.length} slot${entries.length === 1 ? '' : 's'}:`, '');
-        for (const [slotId, response] of entries)
-            lines.push(`${slotId}: ${JSON.stringify(response)}`);
-        const summary = result.summary.trim();
-        if (summary !== '')
-            lines.push('', summary);
-    }
-    lines.push('', `Response metadata (slot ids, typed responses, timestamp): ${resultPath}`);
-    return lines.join('\n');
+import { emitEvent } from '../../core/events/emit.js';
+import { retireCompanion } from '../companion-retire.js';
+/** Every ticket-ending action retires the ticket's feedback companion — done
+ * when active or idle, never left resident. Idempotent and replay-safe; a
+ * corrupt feedback file must not block result publication. Exported for the
+ * daemon-start sweep, which must settle terminal tickets whether or not a
+ * reply bridge exists. */
+export function settleFeedbackCompanion(ticketId) {
+    try {
+        const companionNodeId = readPageFeedback(ticketDir(ticketId)).companionNodeId;
+        if (companionNodeId !== undefined)
+            retireCompanion(companionNodeId, 'approved');
+    }
+    catch (error) {
+        emitEvent({ level: 'warn', event: 'human.feedback_companion.retire_failed', error });
+    }
+}
+/** The settle-time feedback addendum to a page completion — answer and
+ * cancellation alike: a change notice when the final page differs from the
+ * version first commented on, and each still-open item's quote and note.
+ * Silent when the page is unchanged and no feedback remains open; never a
+ * manufactured prose diff. */
+function feedbackAddendum(dir) {
+    let sections;
+    try {
+        const feedback = readPageFeedback(dir);
+        if (feedback.companionNodeId === undefined)
+            return '';
+        sections = [];
+        if (feedback.firstCommentedSha256 !== undefined && pageDocumentSha256(dir) !== feedback.firstCommentedSha256) {
+            sections.push(`The page changed during feedback: the person commented on it and its companion conversation (node ${feedback.companionNodeId}) revised it in place. ` +
+                `Reread the final page at ${pagePath(dir, 'jsx')} before interpreting this outcome.`);
+        }
+        const open = feedback.comments.filter((comment) => comment.status === 'open');
+        if (open.length > 0) {
+            const items = open.map((comment) => [
+                ...comment.quote.split('\n').map((line) => `> ${line}`),
+                comment.note,
+            ].join('\n'));
+            sections.push([
+                `Feedback left unresolved at settlement — the companion conversation (node ${feedback.companionNodeId}) had not dealt with these items:`,
+                ...items,
+            ].join('\n\n'));
+        }
+    }
+    catch {
+        // The answer itself is the deliverable; a broken feedback record adds nothing.
+        return '';
+    }
+    return sections.length === 0 ? '' : `\n\n${sections.join('\n\n')}`;
+}
+/** A corrupt manifest must not strand the asking node: the raw response remains its escape hatch. */
+function renderCorruptPageAnswer(result, resultPath) {
+    return [
+        'The page manifest could not be read, so the raw response is provided.',
+        '',
+        JSON.stringify(result.responses),
+        '',
+        `Response record: ${resultPath}`,
+    ].join('\n');
+}
+function pageTitle(dir) {
+    try {
+        return parsePage(dir).title;
+    }
+    catch {
+        return undefined;
+    }
+}
+function renderPageAnswer(dir, result, resultPath) {
+    let manifest;
+    try {
+        manifest = parsePage(dir);
+    }
+    catch {
+        return renderCorruptPageAnswer(result, resultPath);
+    }
+    return renderAnswerText(describePageAnswer(manifest, result.responses, { completedAt: result.completedAt }), resultPath) + feedbackAddendum(dir);
 }
 function deliveryFailed(error) {
     // A canonical final is committed inside its own write boundary and can never
@@ -42,9 +100,9 @@ function deliveryFailed(error) {
     const detail = error instanceof Error ? error.message : String(error);
     return new ApiError(500, 'delivery_failed', `The answer is recorded and delivery will be retried: ${detail}`);
 }
-async function deliverOrConflict(nodeId) {
+async function deliverOrConflict(ticketId) {
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -53,16 +111,16 @@ async function deliverOrConflict(nodeId) {
 }
 /**
  * The one completion path for a page ticket: claim takeover, exclusive result
- * publication, then the asking node's wake. Every addressing surface — the
- * node-addressed resolve route and the ticket-id-addressed inbox respond route —
- * finishes a page here, so an answer always reaches the node that asked.
+ * publication, then optional reply delivery. Every addressing surface routes
+ * through this function, so the reply-route descriptor is the sole authority
+ * on whether completion reaches a bridge.
  */
-export async function resolvePageTicket(nodeId, responses, productKinds = []) {
-    const completed = takeoverAndCompletePage(ticketDir(nodeId), responses, { host: 'crtrd', pid: process.pid }, { productKinds });
+export async function resolvePageTicket(ticketId, responses) {
+    const completed = takeoverAndCompletePage(ticketDir(ticketId), responses, { host: 'crtrd', pid: process.pid });
     if (!completed.won)
-        return deliverOrConflict(nodeId);
+        return deliverOrConflict(ticketId);
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -70,12 +128,12 @@ export async function resolvePageTicket(nodeId, responses, productKinds = []) {
     return completed.result;
 }
 /** Cancel a ticket with the store's first-writer-wins publication. */
-export async function cancelHumanTicket(nodeId, opts) {
-    const canceled = cancelTicket(ticketDir(nodeId), opts);
+export async function cancelHumanTicket(ticketId, opts) {
+    const canceled = cancelTicket(ticketDir(ticketId), opts);
     if (canceled.status === 'already_resolved')
-        return deliverOrConflict(nodeId);
+        return deliverOrConflict(ticketId);
     try {
-        await deliverTerminalResult(nodeId);
+        await deliverTerminalResult(ticketId);
     }
     catch (error) {
         throw deliveryFailed(error);
@@ -87,37 +145,59 @@ export async function cancelHumanTicket(nodeId, opts) {
  * receipt: every action below is replay-safe, so lost delivery can be retried
  * by a later resolve/cancel attempt or the daemon-start sweep.
  */
-export async function deliverTerminalResult(nodeId) {
-    const dir = ticketDir(nodeId);
-    const run = readJsonOrNull(join(dir, 'run.json'));
-    if (run?.mode === 'notify')
-        return false;
+export async function deliverTerminalResult(ticketId) {
+    const dir = ticketDir(ticketId);
     const result = readTicketResult(dir);
     if (result === null)
         return false;
+    // Companion retirement rides the committed result, BEFORE the reply-route
+    // gate: every ticket-ending path (resolve, cancel, conflict replay) funnels
+    // through here, and an inbox-only page with no reply bridge still settles
+    // its companion. The daemon-start sweep settles the tickets that die before
+    // reaching this call.
+    settleFeedbackCompanion(ticketId);
+    const replyRoute = readTicketReplyRoute(dir);
+    if (replyRoute === null)
+        return false;
+    const bridgeNodeId = replyRoute.bridge_node_id;
     projectReviewOutput(dir);
-    const node = getNode(nodeId);
+    // The ROW, not node metadata: a bridge whose row has been pruned may retain
+    // its ticket files, but no lifecycle target remains. No row means nothing is
+    // left to deliver to.
+    const node = getRow(bridgeNodeId);
     if (node === null || node.status === 'dead' || node.status === 'canceled' || (node.status === 'done' && node.final_report !== null)) {
         return true;
     }
     if (result.kind === 'canceled') {
-        const note = result.reason !== undefined && result.reason !== '' ? ` — ${result.reason}` : '';
+        const title = pageTitle(dir);
+        const reason = result.reason !== undefined && result.reason !== '' ? result.reason : 'no reason was given';
+        // A human dismissal is a rejection, not a routing event: say so plainly so
+        // the agent acts on the "no" instead of re-raising the same ask.
+        const dismissed = result.actor === 'human';
+        const subject = dismissed
+            ? (title === undefined ? `human interaction ${ticketId} dismissed without answering` : `human interaction ${ticketId} — “${title}” dismissed without answering`)
+            : (title === undefined ? `human interaction ${ticketId} canceled — no answer is coming` : `human interaction ${ticketId} — “${title}” canceled, no answer is coming`);
+        // Dismissal and withdrawal are settlement paths too: the sender still
+        // needs any unresolved feedback and the exceptional page-change notice.
+        const body = (dismissed
+            ? `The user dismissed ${title === undefined ? `the human interaction ${ticketId}` : `“${title}”`} without answering — a deliberate “no, I'm not answering this.” Treat it as a rejection: no response will arrive, no partial answer exists, and the same ask must not be raised again.`
+            : (title === undefined ? `The human interaction ${ticketId} was canceled — ${reason}. No response will arrive, and any partial answers the user had entered were discarded unsent.` : `The page “${title}” was canceled — ${reason}. No response will arrive, and any partial answers the user had entered were discarded unsent.`)) + feedbackAddendum(dir);
         // One failing subscriber must not silence the rest, and the bridge stays
         // live until every notice lands: a partial fanout leaves the ticket for the
         // next resolve/cancel attempt or the daemon-start sweep to replay. A
         // subscriber notified twice reads the same idempotent "no answer is coming";
         // a subscriber never notified waits forever.
         const failedTo = [];
-        for (const subscriber of subscribersOf(nodeId)) {
+        for (const subscriber of subscribersOf(bridgeNodeId)) {
             if (result.actor !== undefined && subscriber.node_id === result.actor)
                 continue;
             try {
                 appendInbox(subscriber.node_id, {
-                    from: nodeId,
-                    tier: 'deferred',
+                    from: bridgeNodeId,
+                    tier: 'normal',
                     kind: 'message',
-                    label: `human interaction ${nodeId} canceled — no answer is coming${note}`,
-                    data: { body: `The human interaction ${nodeId} was canceled${note}. No response will arrive.` },
+                    label: subject,
+                    data: { body },
                 });
             }
             catch {
@@ -126,11 +206,11 @@ export async function deliverTerminalResult(nodeId) {
         }
         if (failedTo.length > 0)
             throw new Error(`cancellation notice failed for ${failedTo.join(', ')}`);
-        transition(nodeId, 'finish');
+        transition(bridgeNodeId, 'finish');
         return true;
     }
     if (result.kind === 'page') {
-        await pushFinal(nodeId, renderPageAnswer(result, responsePath(dir)));
+        await pushFinal(bridgeNodeId, renderPageAnswer(dir, result, responsePath(dir)));
     }
     return true;
 }

package/dist/daemon/human/sweep.js

@@ -1,11 +1,11 @@
 import { readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { getNode } from '../../core/canvas/canvas.js';
+import { getRow } from '../../core/canvas/canvas.js';
 import { getReviewByBridge } from '../../core/review/store.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { ticketsRoot } from '../../core/human/root.js';
 import { readTicketResult } from '../../core/human/tickets.js';
-import { deliverTerminalResult } from './finish.js';
+import { deliverTerminalResult, settleFeedbackCompanion } from './finish.js';
 function isTerminalBridge(status) {
     return status === 'done' || status === 'dead' || status === 'canceled';
 }
@@ -27,7 +27,13 @@ export async function reconcileUndeliveredTickets() {
             // finisher retries only when its winning operation is explicitly repeated.
             if (getReviewByBridge(entry) !== null)
                 continue;
-            const bridge = getNode(entry);
+            // A terminal page ticket retires its feedback companion whether or not a
+            // reply bridge exists: inbox-only pages have no bridge row, yet the
+            // daemon can die between result publication and companion retirement.
+            settleFeedbackCompanion(entry);
+            // The ROW is what carries status; `getNode` would answer from a pruned
+            // bridge's surviving meta.json with no status at all.
+            const bridge = getRow(entry);
             if (bridge === null || isTerminalBridge(bridge.status))
                 continue;
             if (await deliverTerminalResult(entry))

package/dist/daemon/profile-delete.d.ts

@@ -0,0 +1,7 @@
+import type { DeleteProfileResultDTO } from '../api/index.js';
+/** Validate and enact one forced profile deletion. A request from a node that
+ *  belongs to the target profile is acknowledged before its broker is stopped. */
+export declare function requestProfileDeletion(name: string, body: unknown): Promise<{
+    status: 200 | 202;
+    body: DeleteProfileResultDTO;
+}>;