@north-light/crouter 0.3.197 → 0.3.199

package/dist/daemon/profile-delete.js

@@ -0,0 +1,306 @@
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { cronIdsForProfileDeletion, cronIdsForProfileDetach, deleteCronsForProfile, deleteNodes, getNode, getRow, globalizeCronsForProfile, listNodesByProfile, nodesRoot, reviewDir, } from '../core/canvas/index.js';
+import { usage } from '../core/errors.js';
+import { emitEvent } from '../core/events/emit.js';
+import { clearDefaultProfileId, defaultProfileDirs, } from '../core/profiles/default-binding.js';
+import { reserveProfileDeletion } from '../core/profiles/deletion-reservation.js';
+import { deleteProfile, loadProfileManifest, } from '../core/profiles/manifest.js';
+import { deleteReviewsByOriginNodes, reviewIdsByOriginNodes, } from '../core/review/store.js';
+import { boundFleet } from '../core/runtime/fleet.js';
+import { headlessBrokerHost } from '../core/runtime/host.js';
+import { transition } from '../core/runtime/lifecycle.js';
+import { tearDownNode } from '../core/runtime/placement.js';
+import { reshapeNode } from '../core/runtime/promote.js';
+import { reviveNode } from '../core/runtime/revive.js';
+const SELF_DELETE_GRACE_MS = 1_000;
+const TICKET_FILES = new Set([
+    'page.json',
+    'page.tsx',
+    'page.html',
+    'page.js',
+    'review.json',
+    'response.json',
+    'progress.json',
+    'claim.json',
+    'reply-route.json',
+    'feedback-comments.json',
+    'feedback.json',
+    '.ticket-lock',
+]);
+const pending = new Map();
+function requestObject(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+        throw usage('profile deletion requires a JSON request body', {
+            error: 'force_required',
+            message: 'profile deletion requires --force',
+            next: 'Re-run `crtr profile delete <profile> --force` after reviewing its effects.',
+        });
+    }
+    return body;
+}
+function validateRequest(body) {
+    const value = requestObject(body);
+    if (value['force'] !== true) {
+        throw usage('profile deletion requires --force', {
+            error: 'force_required',
+            message: 'profile deletion requires --force',
+            next: 'Re-run `crtr profile delete <profile> --force` after reviewing its effects.',
+        });
+    }
+    if (value['detach'] !== undefined && typeof value['detach'] !== 'boolean') {
+        throw usage('detach must be a boolean', {
+            error: 'invalid_detach',
+            message: 'detach must be a boolean',
+            next: 'Use --detach as a presence-only flag, or omit it.',
+        });
+    }
+    const caller = value['caller_node_id'];
+    if (caller !== undefined && caller !== null && (typeof caller !== 'string' || caller === '')) {
+        throw usage('caller_node_id must be a nonempty string or null');
+    }
+    return {
+        force: true,
+        ...(value['detach'] === true ? { detach: true } : {}),
+        ...(caller === undefined ? {} : { caller_node_id: caller }),
+    };
+}
+function manifestSourceNodeId(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof parsed.source?.nodeId === 'string' && parsed.source.nodeId !== ''
+            ? parsed.source.nodeId
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function ticketCleanupForNodes(nodeIds) {
+    const wanted = new Set(nodeIds);
+    const root = nodesRoot();
+    if (wanted.size === 0 || !existsSync(root))
+        return [];
+    const cleanup = [];
+    for (const dirent of readdirSync(root, { withFileTypes: true })) {
+        if (!dirent.isDirectory())
+            continue;
+        const dir = join(root, dirent.name);
+        const sourceIds = [
+            manifestSourceNodeId(join(dir, 'page.json')),
+            manifestSourceNodeId(join(dir, 'review.json')),
+        ];
+        if (!sourceIds.some((sourceId) => sourceId !== null && wanted.has(sourceId)))
+            continue;
+        cleanup.push({
+            dir,
+            wholeDirectory: wanted.has(dirent.name) || getRow(dirent.name) === null,
+        });
+    }
+    return cleanup.sort((a, b) => a.dir.localeCompare(b.dir));
+}
+function isTicketOwnedResidue(name) {
+    if (TICKET_FILES.has(name))
+        return true;
+    for (const base of TICKET_FILES) {
+        if (name.startsWith(`${base}.`) && (name.endsWith('.tmp') || name.endsWith('.lock'))) {
+            return true;
+        }
+    }
+    return false;
+}
+function cleanTickets(tickets) {
+    let cleaned = 0;
+    for (const ticket of tickets) {
+        if (!existsSync(ticket.dir))
+            continue;
+        if (ticket.wholeDirectory) {
+            rmSync(ticket.dir, { recursive: true, force: true });
+            cleaned += 1;
+            continue;
+        }
+        for (const dirent of readdirSync(ticket.dir, { withFileTypes: true })) {
+            if (!isTicketOwnedResidue(dirent.name))
+                continue;
+            rmSync(join(ticket.dir, dirent.name), { recursive: true, force: true });
+        }
+        cleaned += 1;
+    }
+    return cleaned;
+}
+function openWorktreeError(nodes) {
+    const blocked = nodes
+        .filter((node) => node.managed_worktree?.state === 'open')
+        .map((node) => ({ node_id: node.node_id, path: node.managed_worktree.path }));
+    if (blocked.length === 0)
+        return null;
+    const message = `profile deletion is blocked by ${blocked.length} open managed worktree${blocked.length === 1 ? '' : 's'}`;
+    return usage(message, {
+        error: 'open_managed_worktree',
+        message,
+        nodes: blocked,
+        next: `Close ${blocked.map(({ node_id }) => node_id).join(', ')} with \`crtr node worktree close <node>\`, then retry.`,
+    });
+}
+function prepareDeletion(entry, request) {
+    const nodes = listNodesByProfile(entry.profileId);
+    const blocked = openWorktreeError(nodes);
+    if (blocked !== null)
+        throw blocked;
+    const nodeIds = nodes.map(({ node_id }) => node_id);
+    const mode = request.detach === true ? 'detached' : 'deleted';
+    return {
+        entry,
+        mode,
+        nodes,
+        nodeIds,
+        tickets: mode === 'deleted' ? ticketCleanupForNodes(nodeIds) : [],
+        cronIds: mode === 'deleted'
+            ? cronIdsForProfileDeletion(entry.profileId, nodeIds)
+            : cronIdsForProfileDetach(entry.profileId),
+        reviewIds: mode === 'deleted' ? reviewIdsByOriginNodes(nodeIds) : [],
+        defaultDirs: defaultProfileDirs(entry.profileId),
+    };
+}
+function assertDeletionPlanPreconditions(plan) {
+    const currentNodes = plan.nodeIds.flatMap((nodeId) => {
+        const node = getNode(nodeId);
+        return node === null ? [] : [node];
+    });
+    const blocked = openWorktreeError(currentNodes);
+    if (blocked !== null)
+        throw blocked;
+}
+function resultForPlan(plan) {
+    return {
+        profile_id: plan.entry.profileId,
+        name: plan.entry.manifest.name,
+        mode: plan.mode,
+        nodes: plan.nodeIds.length,
+        crons: plan.cronIds.length,
+        tickets: plan.tickets.length,
+        reviews: plan.reviewIds.length,
+        default_pins: plan.defaultDirs.length,
+    };
+}
+async function detachProfile(plan) {
+    assertDeletionPlanPreconditions(plan);
+    const existingNodeIds = plan.nodeIds.filter((nodeId) => getNode(nodeId) !== null);
+    const fleet = boundFleet();
+    const live = existingNodeIds.flatMap((nodeId) => {
+        const entry = fleet.get(nodeId);
+        return entry === undefined ? [] : [{ nodeId, exited: entry.handle.exited }];
+    });
+    const restartNodeIds = [];
+    for (const { nodeId } of live) {
+        const current = getNode(nodeId);
+        if (current?.status === 'active' || current?.status === 'idle') {
+            transition(nodeId, 'release');
+            restartNodeIds.push(nodeId);
+        }
+        headlessBrokerHost.teardown(nodeId);
+    }
+    await Promise.all(live.map(({ exited }) => exited));
+    const detachedNodeIds = [];
+    for (const nodeId of existingNodeIds) {
+        if (getNode(nodeId) === null)
+            continue;
+        reshapeNode(nodeId, { profileId: null });
+        detachedNodeIds.push(nodeId);
+    }
+    const cronIds = globalizeCronsForProfile(plan.entry.profileId);
+    const defaultDirs = clearDefaultProfileId(plan.entry.profileId);
+    deleteProfile(plan.entry.profileId);
+    const detached = new Set(detachedNodeIds);
+    for (const nodeId of restartNodeIds) {
+        if (detached.has(nodeId))
+            reviveNode(nodeId, { resume: true, recovery: true });
+    }
+    return {
+        ...resultForPlan(plan),
+        nodes: detachedNodeIds.length,
+        crons: cronIds.length,
+        default_pins: defaultDirs.length,
+    };
+}
+function hardDeleteProfile(plan) {
+    assertDeletionPlanPreconditions(plan);
+    const cronIds = deleteCronsForProfile(plan.entry.profileId, plan.nodeIds);
+    for (const nodeId of plan.nodeIds) {
+        headlessBrokerHost.teardown(nodeId);
+        tearDownNode(nodeId);
+    }
+    const reviewIds = deleteReviewsByOriginNodes(plan.nodeIds);
+    for (const reviewId of reviewIds)
+        rmSync(reviewDir(reviewId), { recursive: true, force: true });
+    const tickets = cleanTickets(plan.tickets);
+    const deletedNodeIds = deleteNodes(plan.nodeIds);
+    const defaultDirs = clearDefaultProfileId(plan.entry.profileId);
+    deleteProfile(plan.entry.profileId);
+    return {
+        ...resultForPlan(plan),
+        nodes: deletedNodeIds.length,
+        crons: cronIds.length,
+        tickets,
+        reviews: reviewIds.length,
+        default_pins: defaultDirs.length,
+    };
+}
+async function executePlan(plan) {
+    return plan.mode === 'detached' ? detachProfile(plan) : hardDeleteProfile(plan);
+}
+function scheduleSelfDeletion(plan, releaseReservation) {
+    const result = {
+        ...resultForPlan(plan),
+        accepted: true,
+        grace_ms: SELF_DELETE_GRACE_MS,
+    };
+    pending.set(plan.entry.profileId, { result });
+    setTimeout(() => {
+        void (async () => {
+            try {
+                await executePlan(plan);
+            }
+            catch (error) {
+                emitEvent({
+                    level: 'error',
+                    event: 'profile.delete.deferred_failed',
+                    error: error instanceof Error ? error : new Error(String(error)),
+                    fields: { profile_id: plan.entry.profileId, mode: plan.mode },
+                });
+            }
+            finally {
+                pending.delete(plan.entry.profileId);
+                releaseReservation();
+            }
+        })();
+    }, SELF_DELETE_GRACE_MS);
+    return result;
+}
+/** Validate and enact one forced profile deletion. A request from a node that
+ *  belongs to the target profile is acknowledged before its broker is stopped. */
+export async function requestProfileDeletion(name, body) {
+    const request = validateRequest(body);
+    const entry = loadProfileManifest(name);
+    const existing = pending.get(entry.profileId);
+    if (existing !== undefined)
+        return { status: 202, body: existing.result };
+    const releaseReservation = reserveProfileDeletion(entry.profileId);
+    let deferred = false;
+    try {
+        const plan = prepareDeletion(entry, request);
+        const selfDeleting = request.caller_node_id != null && plan.nodeIds.includes(request.caller_node_id);
+        if (selfDeleting) {
+            const result = scheduleSelfDeletion(plan, releaseReservation);
+            deferred = true;
+            return { status: 202, body: result };
+        }
+        return { status: 200, body: await executePlan(plan) };
+    }
+    finally {
+        if (!deferred)
+            releaseReservation();
+    }
+}

package/dist/daemon/reconcilers/broker-supervision.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { getRow, getNode, subscribersOf } from '../../core/canvas/index.js';
+import { getRow, getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
 import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { recordedPidLiveness } from '../../core/canvas/pid.js';
@@ -20,7 +20,8 @@ import { operationIdContext } from '../../core/events/operation-id.js';
 import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
+import { parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
     const raw = process.env[name];
@@ -174,6 +175,14 @@ export class BrokerSupervisionReconciler {
         return thresholds;
     }
     handleUnattendedParking(id, row, livePid, now) {
+        // An unclaimed warm-pool spare is not a conversation: the booted broker it
+        // holds IS its whole value, and nobody is meant to be attending it. Its
+        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
+        // parking one here would empty the pool every 15 minutes.
+        if (isWarmSpare(id)) {
+            this.unattendedSince.delete(id);
+            return;
+        }
         if (row === null
             || row.pi_session_id == null
             || row.pi_pid !== livePid
@@ -183,7 +192,8 @@ export class BrokerSupervisionReconciler {
             || row.intent !== null
             || isBusy(id)
             || activeBackgroundBashJobs(contextDir(id)).length > 0
-            || focusOf(id) !== null) {
+            || focusOf(id) !== null
+            || hasAttachedBrokerViewers(id)) {
             this.unattendedSince.delete(id);
             return;
         }
@@ -206,12 +216,7 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        const liveObligation = hasLiveObligation(id);
-        // A resident with nothing left to wake it has completed its conversation:
-        // terminalize it so history retention can eventually prune it. A resident
-        // still awaiting a child/controller/human/deadline/output stays wakeable, as does
-        // every terminal node (whose own stop guard owns semantic completion).
-        transition(id, row.lifecycle === 'resident' && !liveObligation ? 'finish' : 'release');
+        transition(id, parkEvent(id, row.lifecycle));
         headlessBrokerHost.teardown(id);
     }
     async warnOverCapInTmux(count, warning, max) {

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -7,7 +7,7 @@ import { appendControllerDeathNotice, readCursor, readInboxSince, } from '../../
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../core/runtime/revive.js';
-import { hasLiveObligation } from './live-obligation.js';
+import { parkEvent } from './live-obligation.js';
 // Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
 // livelock shape as the stranded-relaunch case, but on the separate pass that
 // resumes a dormant idle-released node when its inbox gains an unseen entry.
@@ -80,11 +80,16 @@ export class DormantInboxReconciler {
                     if (!entries.some((entry) => entry.tier !== 'deferred')) {
                         this.relaunchState.delete(id);
                         const meta = getNode(id);
-                        // An idle resident with no wake-worthy inbox entry still needs
-                        // lifecycle settlement. Once nothing live remains, this is completed
-                        // history rather than a permanently protected idle row.
-                        if (meta?.lifecycle === 'resident' && !hasLiveObligation(id)) {
-                            transition(id, 'finish');
+                        // An idle row with no wake-worthy inbox entry still needs the same
+                        // lifecycle settlement the live park clock applies: once nothing
+                        // live remains, this is history rather than a permanently protected
+                        // idle row. The row is already parked, so only a terminalizing
+                        // verdict is worth writing. Unclaimed warm-pool spares never reach
+                        // here — `listNodes` hides them from `ctx.rows`.
+                        if (meta !== null) {
+                            const event = parkEvent(id, meta.lifecycle);
+                            if (event !== 'release')
+                                transition(id, event);
                         }
                         return;
                     }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -1,2 +1,22 @@
-/** Durable work that requires a resident to remain automatically wakeable. */
+import { type Lifecycle } from '../../core/canvas/index.js';
+/** Durable work that requires a node to remain automatically wakeable. */
 export declare function hasLiveObligation(nodeId: string): boolean;
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): 'release' | 'finish' | 'cancel';

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,7 +1,8 @@
-import { hasActiveLiveSubscription, hasLiveMessageWait, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
+import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, } from '../../core/canvas/index.js';
 import { countTickets } from '../../core/canvas/attention.js';
+import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
-/** Durable work that requires a resident to remain automatically wakeable. */
+/** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
     return hasActiveLiveSubscription(nodeId)
         || hasLiveMessageWait(nodeId)
@@ -9,3 +10,30 @@ export function hasLiveObligation(nodeId) {
         || countTickets(nodeId) > 0
         || readOutputRequest(nodeId).state !== 'absent';
 }
+/** What parking an unattended node actually amounts to — the one rule both the
+ *  live-broker park clock (broker-supervision) and the already-parked
+ *  reconciliation (dormant-inbox) apply.
+ *
+ *  `release` — something can still wake it, so parking is a pause.
+ *  `finish`  — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history.
+ *  `cancel`  — a terminal node that never pushed a final was torn down before
+ *              finishing, which is what `canceled` records; it stays revivable
+ *              and becomes prunable. A live subscriber still awaiting its
+ *              report is an outstanding deliverable, so such a node keeps its
+ *              wakeable idle row instead of being written off.
+ *
+ *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
+ *  never wakes a node on its own — it rides the next natural cycle — but a
+ *  terminalized row no longer takes that cycle, so writing one off would drop
+ *  content the sender already handed over.
+ */
+export function parkEvent(nodeId, lifecycle) {
+    if (hasLiveObligation(nodeId))
+        return 'release';
+    if (readInboxSince(nodeId, readCursor(nodeId)).length > 0)
+        return 'release';
+    if (lifecycle === 'resident')
+        return 'finish';
+    return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
+}

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -4,7 +4,12 @@ export declare const DEAD_REAP_GRACE_MS: number;
 export declare class StorageMaintenanceReconciler {
     private lastPruneAt;
     private lastSpareSweepAt;
+    private lastGhostSweepAt;
     run(now: number): void;
+    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
+     * focused, or closed — every one of those resolves the node through meta.json —
+     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
+    private reapGhostRows;
     /** Milliseconds since meta/telemetry was last written. Inbox activity is
      * deliberately excluded: children can keep writing a dead manager's inbox. */
     private msSinceDiskActivity;

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -1,6 +1,6 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { closeFocusRow, listFocuses, listNodes, pruneToLimit, } from '../../core/canvas/index.js';
+import { closeFocusRow, listFocuses, listNodes, pruneToLimit, reapGhostRows, } from '../../core/canvas/index.js';
 import { isSafeNodeId, jobDir, nodeDir } from '../../core/canvas/paths.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
@@ -12,20 +12,47 @@ export const DEAD_REAP_GRACE_MS = 10 * 60_000;
 const AUTO_PRUNE_MAX = 2000;
 const PRUNE_INTERVAL_MS = 60 * 60 * 1000;
 const SPARE_SWEEP_INTERVAL_MS = 60 * 1000;
+const GHOST_SWEEP_INTERVAL_MS = 60 * 1000;
 /** Recurring storage cleanup. The in-memory throttle clocks intentionally reset
  * on daemon boot, so the first tick runs both full sweeps. */
 export class StorageMaintenanceReconciler {
     lastPruneAt = Number.NEGATIVE_INFINITY;
     lastSpareSweepAt = Number.NEGATIVE_INFINITY;
+    lastGhostSweepAt = Number.NEGATIVE_INFINITY;
     run(now) {
         // Placement reap MUST precede focus GC, so GC catches a focus row the reap
         // strands. Both run after dormant-inbox reconciliation, so a same-tick
         // revive has already had the chance to re-anchor its focus.
         this.reapDeadResidue(now);
         this.gcStaleFocuses();
+        this.reapGhostRows(now);
         this.autoPrune(now);
         this.gcWarmPool(now);
     }
+    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
+     * focused, or closed — every one of those resolves the node through meta.json —
+     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
+    reapGhostRows(now) {
+        if (now - this.lastGhostSweepAt < GHOST_SWEEP_INTERVAL_MS)
+            return;
+        this.lastGhostSweepAt = now;
+        operationIdContext.fresh(() => {
+            try {
+                const reaped = reapGhostRows();
+                if (reaped.length > 0) {
+                    emitEvent({
+                        level: 'info',
+                        event: 'canvas.ghost_rows.reaped',
+                        outcome: 'succeeded',
+                        fields: { reaped_count: reaped.length, reaped_ids: reaped },
+                    });
+                }
+            }
+            catch (err) {
+                emitEvent({ level: 'error', event: 'canvas.ghost_rows.reap_failed', error: err });
+            }
+        });
+    }
     /** Milliseconds since meta/telemetry was last written. Inbox activity is
      * deliberately excluded: children can keep writing a dead manager's inbox. */
     msSinceDiskActivity(nodeId, now) {

package/dist/daemon/review/deliver.js

@@ -3,8 +3,8 @@ import { formatReviewApproval } from '../../shared/generated-context.js';
 import { deliverNodeMessage } from '../messaging/node-message.js';
 function approvalBody(review, resultPath) {
     const summary = review.changed
-        ? `The human reviewed and approved \`${review.file}\`. The document changed during review; re-read it before continuing. Review conversation: node \`${review.companion_node_id}\`.`
-        : `The human reviewed and approved \`${review.file}\`. The document was not modified.`;
+        ? `The user reviewed and approved \`${review.file}\`. The document changed during review; re-read it before continuing. Review conversation: node \`${review.companion_node_id}\`.`
+        : `The user reviewed and approved \`${review.file}\`. The document was not modified.`;
     return `${summary}\n\nDurable review result: ${resultPath}`;
 }
 /** Render the immutable approval fact without replaying comment text. */
@@ -25,7 +25,7 @@ export async function deliverApproval(review, resultPath) {
         const delivery = await deliverNodeMessage({
             node_id: review.origin_node_id,
             body,
-            label: 'human review approved',
+            label: 'review approved by the user',
             from: 'crtrd',
             mode: 'interactive',
             data: { review_id: review.review_id, result_path: resultPath },

package/dist/daemon/review/finish.d.ts

@@ -18,8 +18,6 @@ export interface ReviewCancellationFinishOutcome {
     ticket_result?: TicketResult;
 }
 export type ReviewFinishOutcome = ReviewApprovalFinishOutcome | ReviewCancellationFinishOutcome;
-/** Retire a companion only through a lifecycle transition legal for its current status. */
-export declare function retireCompanion(nodeId: string, outcome: 'approved' | 'canceled'): 'retired' | 'already' | 'missing';
 /** Approve on the human's behalf, waiting first when the companion is still
  *  working. Waiting is the only new outcome: an idle companion approves in the
  *  same pass it always did, and the wait never freezes the review — comments

package/dist/daemon/review/finish.js

@@ -1,5 +1,4 @@
 import { withCanvasWrite } from '../../core/canvas/db.js';
-import { getNode } from '../../core/canvas/canvas.js';
 import { responsePath } from '../../core/human/convention.js';
 import { ticketDir } from '../../core/human/root.js';
 import { readTicketResult } from '../../core/human/tickets.js';
@@ -10,9 +9,8 @@ import { readReviewSource } from '../../core/review/document.js';
 import { signalReviewActivity } from '../../core/review/signal.js';
 import { approveReviewLocked, cancelReviewRow, getReview, getReviewByCompanion, markDelivered, markDeliveryError, markProjected, markProjectionError, requestReviewSubmit, requireVisibleReview, } from '../../core/review/store.js';
 import { ReviewOperationError } from '../../core/review/types.js';
-import { transition } from '../../core/runtime/lifecycle.js';
-import { headlessBrokerHost } from '../../core/runtime/host.js';
 import { emitEvent } from '../../core/events/emit.js';
+import { retireCompanion } from '../companion-retire.js';
 import { deliverNodeMessage } from '../messaging/node-message.js';
 import { cancelHumanTicket, deliverTerminalResult } from '../human/finish.js';
 import { companionHasQueuedWork, companionMidTurn, companionStillWorking } from './companion.js';
@@ -69,32 +67,6 @@ async function serializedFinish(reviewId, work) {
             finishChains.delete(reviewId);
     }
 }
-/** Retire a companion only through a lifecycle transition legal for its current status. */
-export function retireCompanion(nodeId, outcome) {
-    const node = getNode(nodeId);
-    if (node === null)
-        return 'missing';
-    if (node.status === 'done' || node.status === 'canceled')
-        return 'already';
-    if (outcome === 'approved' && (node.status === 'active' || node.status === 'idle')) {
-        transition(nodeId, 'finish');
-        try {
-            headlessBrokerHost.teardown(nodeId);
-        }
-        catch { /* the terminal transition is authoritative */ }
-        return 'retired';
-    }
-    // Cancellation is legal from every status. An already-dead companion cannot
-    // be finished, so it is retired as canceled even when approval won.
-    transition(nodeId, 'cancel');
-    if (node.status === 'active' || node.status === 'idle') {
-        try {
-            headlessBrokerHost.teardown(nodeId);
-        }
-        catch { /* the terminal transition is authoritative */ }
-    }
-    return 'retired';
-}
 async function finishApproved(review, result) {
     let current = requireVisibleReview(review.review_id);
     if (current.projected_at === null) {

package/dist/daemon/review/sweep.js

@@ -4,6 +4,8 @@ import { reviewPath } from '../../core/human/convention.js';
 import { ticketDir } from '../../core/human/root.js';
 import { submitReview } from '../../core/human/tickets.js';
 import { reviewsRoot } from '../../core/canvas/paths.js';
+import { getNode } from '../../core/canvas/index.js';
+import { loadProfileManifest } from '../../core/profiles/manifest.js';
 import { projectReviewResult } from '../../core/review/project.js';
 import { realizeReview } from '../../core/review/realize.js';
 import { listBindingReviews, listReviews, markProjected, markProjectionError, } from '../../core/review/store.js';
@@ -23,6 +25,12 @@ function republishTicketReview(review) {
     const dir = ticketDir(review.bridge_node_id);
     if (existsSync(reviewPath(dir)))
         return;
+    const origin = getNode(review.origin_node_id);
+    if (origin === null)
+        throw new Error(`ticket review origin is missing: ${review.origin_node_id}`);
+    const profileName = origin.profile_id == null
+        ? undefined
+        : loadProfileManifest(origin.profile_id).manifest.name;
     submitReview({
         dir,
         review: {
@@ -30,7 +38,10 @@ function republishTicketReview(review) {
             ...(review.output_path === null ? {} : { output: review.output_path }),
             title: basename(review.file),
             subtitle: review.subtitle,
-            source: { nodeId: review.origin_node_id },
+            source: {
+                nodeId: review.origin_node_id,
+                ...(profileName === undefined ? {} : { profileName }),
+            },
             blockedSince: review.created,
         },
     });