@north-light/crouter 0.3.230 → 0.3.232

package/dist/daemon/api/handlers/messages.js

@@ -8,13 +8,12 @@ import { deliverLive, interruptLive } from '../../../core/runtime/interactive-de
 import { cancelPendingHumanMessages } from '../../../core/feed/inbox.js';
 import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { withFreshTerminalGuard } from '../../../core/canvas/canvas.js';
-import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../../../core/runtime/reopen.js';
+import { assertNotFinalized, assertFinalizedForReopen, commitReopen, commitReopenResident, } from '../../../core/runtime/reopen.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { appendSituationalContext, formatSituationalProse } from '../../../core/runtime/situational-context.js';
 import { formatDataCard } from '../../../shared/generated-context.js';
 import { hasNoNaturalCycle } from '../../../core/runtime/revive-all.js';
-import { readGoal } from '../../../core/runtime/kickoff.js';
-import { readRoadmap } from '../../../core/runtime/roadmap.js';
+import { hasFreshGroundState } from '../../../core/runtime/revive.js';
 import { notFound, usage } from '../../../core/errors.js';
 import { InputError } from '../../../core/io.js';
 import { ApiError } from '../../../api/index.js';
@@ -137,8 +136,8 @@ function parseSendBody(body) {
         // Runtime cards ARE accepted here: a card-bearing send is an ordinary human
         // send that happens to carry context, and the live deliver frame places the
         // cards ahead of the body in one turn (D11).
-        if (fresh || out.reopen === true || out.situational_context !== undefined || out.output_schema !== undefined) {
-            throw usage('interactive delivery supports a body and runtime cards only (no fresh, reopen, situational_context, or output_schema)');
+        if (fresh || out.situational_context !== undefined || out.output_schema !== undefined) {
+            throw usage('interactive delivery supports a body, runtime cards, and reopen only (no fresh, situational_context, or output_schema)');
         }
         if (!hasBody)
             throw usage('interactive delivery requires a non-empty body');
@@ -179,11 +178,7 @@ function deferredNoNaturalCycle(id, status) {
  *  would resume amnesiac. Rejected fail-loud (422) BEFORE any revive/arm — the
  *  CLI's old pure pre-check, relocated behind the API so `--fresh` parity holds. */
 function assertRecoverableForFresh(id) {
-    const goal = readGoal(id);
-    if (goal !== null && goal.trim() !== '')
-        return;
-    const roadmap = readRoadmap(id);
-    if (roadmap !== null && roadmap.trim() !== '')
+    if (hasFreshGroundState(id))
         return;
     // ApiError (not a plain literal) so its message survives `toErrorBody`.
     throw new ApiError(422, 'unprocessable', `node ${id} has no goal/roadmap on disk — a fresh revive would resume amnesiac.`);
@@ -236,6 +231,13 @@ async function handleMessage(ctx) {
         };
         return { status: 201, body };
     }
+    // An interactive reopen commits before even choosing its engine-or-inbox
+    // route. A live transport race then falls back with this same committed state.
+    let reopenCommitted = false;
+    if (req.delivery === 'interactive' && req.reopen) {
+        commitReopenResident(id);
+        reopenCommitted = true;
+    }
     // --- Interactive delivery: route via the LIVE broker's serialized frame
     //     loop (broker routes idle→prompt / streaming→steer itself) instead of
     //     the durable inbox — no watcher latency, and send/stop share one
@@ -261,19 +263,19 @@ async function handleMessage(ctx) {
             // fall through to the durable inbox path
         }
     }
-    // --- Immediate delivery (spec §7.7) — full CLI `deliverImmediate` parity:
-    //     reopen latch clear, one-off output-schema grant, situational sidecar,
-    //     then the single inbox append (body / one-off request / ambient-only). ---
+    // --- Immediate delivery (spec §7.7) — pre-delivery side effects first,
+    //     then the reopen commit, then exactly one inbox append. Once the commit
+    //     succeeds, an append failure makes no further state change. ---
     const deliverImmediate = () => {
-        const expectedFinalReport = req.reopen ? assertFinalizedForReopen(id) : null;
         if (!req.reopen)
             assertNotFinalized(id);
         if (schema !== null)
             writeOutputSchema(id, 'oneoff', schema);
         if (hasSidecar)
             appendSituationalContext(id, sidecar);
-        if (req.reopen)
-            commitReopen(id, expectedFinalReport);
+        if (req.reopen && !reopenCommitted) {
+            commitReopenResident(id);
+        }
         const cards = oneShotCards.length > 0 ? { cards: oneShotCards } : {};
         if (hasBody || schema !== null) {
             const messageBody = hasBody
@@ -302,6 +304,13 @@ async function handleMessage(ctx) {
     // cycle ahead of it, so a deferred entry would sit unseen forever — reject
     // fail-loud BEFORE any side effect, atomically with the append (the read and
     // the write share one canvas write-lock). Non-deferred tiers deliver directly.
+    //
+    // `--reopen` does NOT exempt a target from this guard. It commits the target
+    // resident and retracts the finalization latch, but it never moves `status`
+    // out of `done` — so a reopened target is still one `hasNoNaturalCycle` says
+    // nothing will ever bring back on its own, and a deferred entry appended to it
+    // would wait forever. Reopen widens the WAKE-CAPABLE tiers to a finalized
+    // target; deferred stays rejected, and the rejection names those tiers.
     let entry;
     if (tier === 'deferred') {
         const outcome = withFreshTerminalGuard(id, hasNoNaturalCycle, deliverImmediate);

package/dist/daemon/api/handlers/nodes.js

@@ -88,6 +88,9 @@ function parseCreateBody(body) {
     if (b['kind'] !== undefined && (typeof b['kind'] !== 'string' || b['kind'].trim() === '')) {
         throw usage('kind must be a non-empty string when provided');
     }
+    if (b['description'] !== undefined && (typeof b['description'] !== 'string' || b['description'].trim() === '')) {
+        throw usage('description must be a non-empty string when provided');
+    }
     const rootLifecycle = b['root_lifecycle'];
     if (rootLifecycle !== undefined &&
         rootLifecycle !== 'resident' &&
@@ -110,6 +113,8 @@ function buildRecipe(req, parent, cwd) {
         recipe.mode = req.mode;
     if (req.name !== undefined)
         recipe.name = req.name;
+    if (req.description !== undefined)
+        recipe.description = req.description;
     if (parent !== undefined)
         recipe.parent = parent;
     if (req.root === true)

package/dist/daemon/api/handlers/profiles.js

@@ -7,7 +7,8 @@
 //   GET    /v1/profiles/:name    resolve one profile by name or id
 //   DELETE /v1/profiles/:name    required-force cascade or detach
 import { assertInstalledKind } from '../../../core/config.js';
-import { assertProfileProjects, createProfile, ensureRootProfile, listProfiles, loadProfileManifest, } from '../../../core/profiles/manifest.js';
+import { usage } from '../../../core/errors.js';
+import { assertProfileProjects, createProfile, ensureRootProfile, listProfiles, loadProfileManifest, updateProfileMetadata, } from '../../../core/profiles/manifest.js';
 import { requestProfileDeletion } from '../../profile-delete.js';
 import { toProfileDTO } from '../map.js';
 const ROOT_PROFILE_NAME = 'root';
@@ -42,6 +43,25 @@ function handleEnsure(ctx) {
     });
     return { status: 200, body: toProfileDTO(created) };
 }
+/** `PATCH /v1/profiles/:name/metadata` — merge and remove metadata entries
+ * on an existing profile. Resolution accepts the profile id or unique name,
+ * matching the read and delete routes; this is deliberately separate from the
+ * create-only ensure route. */
+function handleSetMetadata(ctx) {
+    const profile = loadProfileManifest(ctx.params['name']);
+    const raw = ctx.body ?? {};
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw usage('profile metadata body must be an object', { field: 'body' });
+    }
+    const req = raw;
+    const unset = req.unset === undefined ? [] : req.unset;
+    if (!Array.isArray(unset) || unset.some((key) => typeof key !== 'string')) {
+        throw usage('profile metadata `unset` must be an array of strings', { field: 'unset' });
+    }
+    const set = req.set === undefined ? {} : req.set;
+    const updated = updateProfileMetadata(profile.profileId, set, unset);
+    return { status: 200, body: toProfileDTO(updated) };
+}
 /** `GET /v1/profiles` — every profile with a readable manifest. */
 function handleList() {
     return { status: 200, body: listProfiles().map(toProfileDTO) };
@@ -61,6 +81,7 @@ async function handleDelete(ctx) {
 }
 export const profileRoutes = [
     { method: 'PUT', pattern: '/v1/profiles/:name', handler: handleEnsure },
+    { method: 'PATCH', pattern: '/v1/profiles/:name/metadata', handler: handleSetMetadata },
     { method: 'DELETE', pattern: '/v1/profiles/:name', handler: handleDelete },
     { method: 'GET', pattern: '/v1/profiles', handler: handleList },
     { method: 'GET', pattern: '/v1/profiles/:name', handler: handleGet },

package/dist/daemon/cron-run.js

@@ -44,6 +44,9 @@ import { appendInbox } from '../core/feed/inbox.js';
 import { emitEvent } from '../core/events/emit.js';
 import { loadProfileManifest } from '../core/profiles/manifest.js';
 import { hasNoNaturalCycle } from '../core/runtime/revive-all.js';
+import { isParked } from '../core/runtime/lifecycle.js';
+import { reviveNode } from '../core/runtime/revive.js';
+import { isBrokerLive } from '../core/runtime/model-swap.js';
 import { spawnChild } from '../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../core/runtime/bearings.js';
 import { nextSlotAfter, cadenceDisplay } from '../core/wake.js';
@@ -181,7 +184,12 @@ function deliverNodeSink(c, target, stdout) {
     const meta = getNode(target);
     if (meta === null)
         throw new Error(`node sink ${target} is gone`);
-    if (hasNoNaturalCycle(meta)) {
+    // A node parked by the unattended clock is written `done` with the park
+    // marker. Its cron is an explicit next cycle, unlike mass revival or deferred
+    // delivery, so accept precisely that parked shape. A final latch, a
+    // cancellation, or a node finished any other way remains undeliverable and
+    // takes the ordinary failure path.
+    if (hasNoNaturalCycle(meta) && !isParked(meta)) {
         throw new Error(`node sink ${target} has no natural cycle ahead (done or finalized)`);
     }
     const from = c.created_by != null && getNode(c.created_by) !== null ? c.created_by : null;
@@ -192,6 +200,16 @@ function deliverNodeSink(c, target, stdout) {
         label: `⏰ cron ${c.name}`,
         data: { body: stdout },
     });
+    // Mirror ordinary durable message delivery: the append is authoritative, and
+    // a wake failure must not turn that successful delivery into a cron failure.
+    if (c.tier !== 'deferred' && !isBrokerLive(meta)) {
+        try {
+            reviveNode(target, { resume: true });
+        }
+        catch {
+            /* best-effort wake — the entry is durably appended regardless */
+        }
+    }
 }
 /** Birth a fresh node with stdout as its kickoff (the recommended sink for
  *  jobs meant to outlive their creator). Returns the newborn's node id. */

package/dist/daemon/manage.d.ts

@@ -99,7 +99,22 @@ export declare function stopDaemonProcess(pid: number, timeoutMs?: number, deps?
  *  If the daemon is already running, returns {started:false, existing_pid}.
  *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
 export declare function spawnDaemon(): Promise<SpawnDaemonResult>;
-/** Start the daemon if it is not already running. No-op if already up.
+/** Whether autostart is suppressed for this invocation. `--no-autostart` or
+ *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
+ *  for environments that manage crtrd externally and want the diagnostic, and
+ *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
+ *  autostarted daemon there is detached and resident, so it outlives both the
+ *  test process and the deleted temp home with nothing left to stop it.
+ *
+ *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
+ *  daemon implicitly, so the check belongs here rather than at each caller —
+ *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
+ *  reach `ensureDaemon` without going through the CLI client at all. An
+ *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
+ *  deliberately unaffected. */
+export declare function autostartDisabled(): boolean;
+/** Start the daemon if it is not already running. No-op if already up, or if
+ *  autostart is suppressed for this invocation.
  *  Silently swallows spawn errors (the canvas still works without the daemon;
  *  nodes just won't be auto-revived). */
 export declare function ensureDaemon(): void;

package/dist/daemon/manage.js

@@ -379,10 +379,29 @@ export async function spawnDaemon() {
 // ---------------------------------------------------------------------------
 // ensureDaemon — fire-and-forget front-door helper
 // ---------------------------------------------------------------------------
-/** Start the daemon if it is not already running. No-op if already up.
+/** Whether autostart is suppressed for this invocation. `--no-autostart` or
+ *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
+ *  for environments that manage crtrd externally and want the diagnostic, and
+ *  for test lanes, which point `CRTR_HOME` at a throwaway directory: an
+ *  autostarted daemon there is detached and resident, so it outlives both the
+ *  test process and the deleted temp home with nothing left to stop it.
+ *
+ *  This is the ONE gate. `ensureDaemon` below is the only path that spawns a
+ *  daemon implicitly, so the check belongs here rather than at each caller —
+ *  `cliClient()` reads it too, but the in-process spawn/recycle/promote callers
+ *  reach `ensureDaemon` without going through the CLI client at all. An
+ *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
+ *  deliberately unaffected. */
+export function autostartDisabled() {
+    return process.env['CRTR_NO_DAEMON_AUTOSTART'] === '1' || process.argv.includes('--no-autostart');
+}
+/** Start the daemon if it is not already running. No-op if already up, or if
+ *  autostart is suppressed for this invocation.
  *  Silently swallows spawn errors (the canvas still works without the daemon;
  *  nodes just won't be auto-revived). */
 export function ensureDaemon() {
+    if (autostartDisabled())
+        return;
     if (!isDaemonRunning()) {
         void spawnDaemon().catch(() => {
             // Intentionally silent — a missing dist/daemon/crtrd-cli.js (dev mode,

package/dist/daemon/park-pending.d.ts

@@ -0,0 +1,13 @@
+/** Arm a pending park for `nodeId`. The caller delivers the parking prompt. */
+export declare function beginPendingPark(nodeId: string, now: number): void;
+export declare function isPendingPark(nodeId: string): boolean;
+/** When the pending park was armed, or undefined when none is armed. */
+export declare function pendingParkStartedAt(nodeId: string): number | undefined;
+/** Delete-and-report: true only for the caller that actually took the pending
+ *  park. Both the supervision tick and the settle handler run on the daemon
+ *  thread with no await between their check and this call, so exactly one of
+ *  them ever enacts a given park. */
+export declare function consumePendingPark(nodeId: string): boolean;
+/** Every node with a parking turn in flight — the reconciler's sweep drops the
+ *  ones whose broker has left the fleet. */
+export declare function pendingParkIds(): string[];

package/dist/daemon/park-pending.js

@@ -0,0 +1,42 @@
+// park-pending.ts — the in-flight parking turns, one map keyed by node id.
+//
+// When the unattended clock expires on a live resident, the daemon does not
+// terminalize it: it asks the still-live engine for one summary turn and hands
+// the terminal decision to broker settlement. This module is the only record
+// that a given node's next settlement means "park", read by exactly two
+// collaborators inside crtrd — the supervision reconciler (which armed it, and
+// which enforces its abort conditions and grace) and the broker-settle handler
+// (which consumes it).
+//
+// The pending park is PROCESS-LOCAL on purpose. The park clock and the pending
+// park are the same authority and must die together: if crtrd is replaced
+// mid-turn, the successor has no clock reading and no pending park, the node
+// simply stays live, and its 15-minute clock restarts. Nothing is inconsistent
+// and nothing needs repair. A durable in-flight flag would instead need its own
+// reconciliation on every daemon start to avoid stranding a node that never got
+// its prompt.
+/** node id → the timestamp its parking turn was requested at. */
+const pending = new Map();
+/** Arm a pending park for `nodeId`. The caller delivers the parking prompt. */
+export function beginPendingPark(nodeId, now) {
+    pending.set(nodeId, now);
+}
+export function isPendingPark(nodeId) {
+    return pending.has(nodeId);
+}
+/** When the pending park was armed, or undefined when none is armed. */
+export function pendingParkStartedAt(nodeId) {
+    return pending.get(nodeId);
+}
+/** Delete-and-report: true only for the caller that actually took the pending
+ *  park. Both the supervision tick and the settle handler run on the daemon
+ *  thread with no await between their check and this call, so exactly one of
+ *  them ever enacts a given park. */
+export function consumePendingPark(nodeId) {
+    return pending.delete(nodeId);
+}
+/** Every node with a parking turn in flight — the reconciler's sweep drops the
+ *  ones whose broker has left the fleet. */
+export function pendingParkIds() {
+    return Array.from(pending.keys());
+}

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -16,6 +16,7 @@ export declare const YIELD_STALL_GRACE_MS: number;
 export declare const WEDGE_QUIET_MS: number;
 export declare const WEDGE_CPU_MAX_PERCENT = 2;
 export declare function unattendedParkMsForDaemon(): number;
+export declare function parkSummaryGraceMsForDaemon(): number;
 export type WedgeVerdict = 'leave' | 'pending' | 'wedged';
 export declare function yieldStallVerdict(piPidAlive: boolean | null, intent: NodeRow['intent'], busy: boolean, stalledFor: number | null): 'leave' | 'pending' | 'kill';
 export declare function wedgeVerdict(input: {
@@ -38,7 +39,19 @@ export declare class BrokerSupervisionReconciler {
         warning: number;
         automaticReviveCap: number;
     }>;
+    /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
+     *  node is unavailable to park, attended, or has work waiting. Short-circuits
+     *  in cost order so the common tick does no file reads it can avoid.
+     *  Evaluated for a pending park too, where a busy engine is precisely what is
+     *  expected (it is writing the summary) and every other hit aborts. */
+    private parkResetCondition;
     private handleUnattendedParking;
+    /** Deliver the parking prompt over the live broker's serialized frame loop.
+     *  Two outcomes cancel the park immediately: an unreachable broker (nothing
+     *  live to summarize with) falls through to the degraded enactment, and a
+     *  `steer` route means a turn started between the idle gate and the frame, so
+     *  the node is working again and its clock simply restarts. */
+    private requestParkSummary;
     private warnOverCapInTmux;
     private handleYieldStall;
     private readTreeSample;

package/dist/daemon/reconcilers/broker-supervision.js

@@ -21,6 +21,10 @@ import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
+import { deliverLive } from '../../core/runtime/interactive-deliver.js';
+import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
+import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.js';
+import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
 const execFileAsync = promisify(execFile);
 function configuredPositiveInteger(name, fallback) {
@@ -43,6 +47,9 @@ export const WEDGE_CPU_MAX_PERCENT = 2;
 const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
 const CAPACITY_LOG_THROTTLE_MS = 30_000;
 const DEFAULT_UNATTENDED_PARK_MS = 15 * 60_000;
+// Longer than a summary turn and shorter than the unattended clock itself, so a
+// stuck parking turn cannot hold a broker for a whole extra clock period.
+const DEFAULT_PARK_SUMMARY_GRACE_MS = 5 * 60_000;
 export function unattendedParkMsForDaemon() {
     const raw = process.env['CRTR_TEST_UNATTENDED_PARK_MS'];
     if (raw === undefined)
@@ -50,6 +57,13 @@ export function unattendedParkMsForDaemon() {
     const parsed = Number(raw);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_UNATTENDED_PARK_MS;
 }
+export function parkSummaryGraceMsForDaemon() {
+    const raw = process.env['CRTR_TEST_PARK_SUMMARY_GRACE_MS'];
+    if (raw === undefined)
+        return DEFAULT_PARK_SUMMARY_GRACE_MS;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PARK_SUMMARY_GRACE_MS;
+}
 export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
     if (piPidAlive !== true)
         return 'leave';
@@ -155,7 +169,7 @@ export class BrokerSupervisionReconciler {
                     this.handleYieldStall(row, entry.pid, now);
                     await this.handleWedgeDetection(id, entry.pid, row.pi_pid_identity, now);
                     this.handleFatalFault(id);
-                    this.handleUnattendedParking(id, getNode(id), entry.pid, now);
+                    this.handleUnattendedParking(id, getNode(id), entry.pid, now, ctx);
                 }
                 catch (err) {
                     this.unattendedSince.delete(id);
@@ -172,39 +186,90 @@ export class BrokerSupervisionReconciler {
             if (!ctx.fleet.has(id))
                 this.unattendedSince.delete(id);
         }
+        // A broker that died mid-summary leaves no pending park behind: its parking
+        // turn can never settle, and the node's next clock starts from scratch.
+        for (const id of pendingParkIds()) {
+            if (!ctx.fleet.has(id))
+                consumePendingPark(id);
+        }
         return thresholds;
     }
-    handleUnattendedParking(id, row, livePid, now) {
-        // An unclaimed warm-pool spare is not a conversation: the booted broker it
-        // holds IS its whole value, and nobody is meant to be attending it. Its
-        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
-        // parking one here would empty the pool every 15 minutes.
-        if (isWarmSpare(id)) {
-            this.unattendedSince.delete(id);
-            return;
-        }
-        if (row === null
-            || row.pi_session_id == null
+    /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
+     *  node is unavailable to park, attended, or has work waiting. Short-circuits
+     *  in cost order so the common tick does no file reads it can avoid.
+     *  Evaluated for a pending park too, where a busy engine is precisely what is
+     *  expected (it is writing the summary) and every other hit aborts. */
+    parkResetCondition(id, row, livePid, now) {
+        if (row.pi_session_id == null
             || row.pi_pid !== livePid
             || row.status === 'done'
             || row.status === 'canceled'
             || row.status === 'dead'
             || row.intent !== null
-            || isBusy(id)
             || activeBackgroundBashJobs(contextDir(id)).length > 0
             || focusOf(id) !== null
-            || hasAttachedBrokerViewers(id)) {
-            this.unattendedSince.delete(id);
-            return;
-        }
+            || hasAttachedBrokerViewers(id))
+            return true;
         const fault = readFault(id);
         const activeAutoProviderRetry = fault !== null
             && fault.retry.disposition === 'auto'
             && fault.retry.by === 'daemon'
             && (fault.kind === 'connection' || fault.kind === 'rate-limit' || fault.kind === 'overloaded')
             && (fault.retry.nextAt !== undefined || nextFaultRetry(fault, now) !== null);
-        if (activeAutoProviderRetry
-            || readInboxSince(id, readCursor(id)).some((entry) => entry.tier !== 'deferred')) {
+        if (activeAutoProviderRetry)
+            return true;
+        return readInboxSince(id, readCursor(id)).some((entry) => entry.tier !== 'deferred');
+    }
+    handleUnattendedParking(id, row, livePid, now, ctx) {
+        // An unclaimed warm-pool spare is not a conversation: the booted broker it
+        // holds IS its whole value, and nobody is meant to be attending it. Its
+        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
+        // parking one here would empty the pool every 15 minutes.
+        if (isWarmSpare(id)) {
+            this.unattendedSince.delete(id);
+            consumePendingPark(id);
+            return;
+        }
+        if (row === null) {
+            this.unattendedSince.delete(id);
+            consumePendingPark(id);
+            return;
+        }
+        const reset = this.parkResetCondition(id, row, livePid, now);
+        // A parking turn is in flight for this node: it owns the decision until it
+        // settles, aborts, or runs out of grace.
+        const parkingSince = pendingParkStartedAt(id);
+        if (parkingSince !== undefined) {
+            if (reset) {
+                // Something worth attending to arrived (or the node became unavailable)
+                // during the summary turn. The node stays live and the park consequence
+                // is discarded; its clock restarts from scratch.
+                consumePendingPark(id);
+                this.unattendedSince.delete(id);
+                return;
+            }
+            if (now - parkingSince < parkSummaryGraceMsForDaemon())
+                return;
+            // The degraded path: park anyway, with the marker but no report, exactly
+            // as this clock behaved before the summary turn existed. Status flips
+            // BEFORE the host dies (the crash-safety invariant).
+            if (!consumePendingPark(id))
+                return;
+            this.unattendedSince.delete(id);
+            emitEvent({
+                level: 'warn',
+                event: 'broker.park.summary_expired',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                fields: {
+                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                    grace_ms: parkSummaryGraceMsForDaemon(),
+                },
+            });
+            applyParkEvent(id, 'park');
+            headlessBrokerHost.teardown(id);
+            return;
+        }
+        if (reset || isBusy(id)) {
             this.unattendedSince.delete(id);
             return;
         }
@@ -216,8 +281,61 @@ export class BrokerSupervisionReconciler {
         if (now - since < unattendedParkMsForDaemon())
             return;
         this.unattendedSince.delete(id);
-        applyParkEvent(id, parkEvent(id, row.lifecycle));
-        headlessBrokerHost.teardown(id);
+        const event = parkEvent(id, row.lifecycle);
+        if (event === 'release') {
+            // A pause, not a terminal write: something can still wake this node, so
+            // its row stays wakeable while the idle broker is released. Skipping the
+            // teardown here would hold the broker process for as long as the
+            // obligation lasts — the exact leak this clock exists to close.
+            applyParkEvent(id, event);
+            headlessBrokerHost.teardown(id);
+            return;
+        }
+        if (event === 'cancel') {
+            applyParkEvent(id, event);
+            headlessBrokerHost.teardown(id);
+            return;
+        }
+        // A resident ends its conversation the way a worker ends a task: it gets one
+        // last turn to leave a roadmap and a report behind. Terminalization moves to
+        // broker settlement, which re-evaluates this verdict once that turn ends.
+        if (!ctx.lifecycle.acceptsDetachedWork())
+            return;
+        beginPendingPark(id, now);
+        ctx.lifecycle.registerDetached(this.requestParkSummary(id));
+    }
+    /** Deliver the parking prompt over the live broker's serialized frame loop.
+     *  Two outcomes cancel the park immediately: an unreachable broker (nothing
+     *  live to summarize with) falls through to the degraded enactment, and a
+     *  `steer` route means a turn started between the idle gate and the frame, so
+     *  the node is working again and its clock simply restarts. */
+    async requestParkSummary(id) {
+        try {
+            const route = await deliverLive(id, formatCard('park', {}, PARK_SUMMARY_PROMPT));
+            if (route === 'steer' && consumePendingPark(id))
+                return;
+            emitEvent({
+                level: 'info',
+                event: 'broker.park.summary_requested',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                fields: { ...(isSafeNodeId(id) ? {} : { affected_node_id: id }), route },
+            });
+        }
+        catch (err) {
+            if (!consumePendingPark(id))
+                return;
+            if (err instanceof BrokerUnreachableError) {
+                applyParkEvent(id, 'park');
+                headlessBrokerHost.teardown(id);
+                return;
+            }
+            emitEvent({
+                level: 'error',
+                event: 'broker.park.summary_failed',
+                ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
+                error: err,
+            });
+        }
     }
     async warnOverCapInTmux(count, warning, max) {
         const now = Date.now();

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -16,8 +16,10 @@ export declare function hasPendingWake(nodeId: string): boolean;
  *  reconciliation (dormant-inbox) apply.
  *
  *  `release` — something can still wake it, so parking is a pause.
- *  `finish`  — a resident with nothing left to wake it has completed its
- *              conversation, and the row becomes prunable history.
+ *  `park`    — a resident with nothing left to wake it has completed its
+ *              conversation, and the row becomes prunable history. The live
+ *              clock asks it for a summary turn first; this verdict is what
+ *              that turn's settlement re-evaluates before enacting.
  *  `cancel`  — a terminal node that never pushed a final was torn down before
  *              finishing, which is what `canceled` records; it stays revivable
  *              and becomes prunable. A live subscriber still awaiting its
@@ -29,7 +31,11 @@ export declare function hasPendingWake(nodeId: string): boolean;
  *  terminalized row no longer takes that cycle, so writing one off would drop
  *  content the sender already handed over.
  */
-export type ParkEvent = Extract<LifecycleEvent, 'release' | 'finish' | 'cancel'>;
+export type ParkEvent = Extract<LifecycleEvent, 'release' | 'park' | 'cancel'>;
 export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): ParkEvent;
-/** Apply an unattended decision and notify subscribers of automatic completion. */
+/** Apply an unattended decision and notify subscribers of automatic completion.
+ *  This is the DEGRADED enactment: no summary turn ran, so subscribers get the
+ *  doctrine wake instead of the node's own report. The live clock's good path
+ *  (broker settlement after a parking turn) enacts `park` directly and fans
+ *  nothing — the node's report is the notice. */
 export declare function applyParkEvent(nodeId: string, event: ParkEvent): void;

package/dist/daemon/reconcilers/live-obligation.js

@@ -36,13 +36,17 @@ export function parkEvent(nodeId, lifecycle) {
     if (readInboxSince(nodeId, readCursor(nodeId)).length > 0)
         return 'release';
     if (lifecycle === 'resident')
-        return 'finish';
+        return 'park';
     return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
 }
-/** Apply an unattended decision and notify subscribers of automatic completion. */
+/** Apply an unattended decision and notify subscribers of automatic completion.
+ *  This is the DEGRADED enactment: no summary turn ran, so subscribers get the
+ *  doctrine wake instead of the node's own report. The live clock's good path
+ *  (broker settlement after a parking turn) enacts `park` directly and fans
+ *  nothing — the node's report is the notice. */
 export function applyParkEvent(nodeId, event) {
     const node = transition(nodeId, event);
-    if (event !== 'finish')
+    if (event !== 'park')
         return;
     fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child done — ${fullName(node)} (${nodeId}) was automatically marked done after its unattended grace with nothing left to wake it. It sent no final report.`, { reason: 'child-auto-done', child: nodeId });
 }

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -2,7 +2,6 @@ export declare const DEAD_REAP_GRACE_MS: number;
 /** Recurring storage cleanup. The in-memory throttle clocks intentionally reset
  * on daemon boot, so the first tick runs both full sweeps. */
 export declare class StorageMaintenanceReconciler {
-    private lastPruneAt;
     private lastSpareSweepAt;
     private lastGhostSweepAt;
     run(now: number): void;
@@ -19,9 +18,6 @@ export declare class StorageMaintenanceReconciler {
     /** Delete focus rows whose recorded tmux pane no longer exists. A failed tmux
      * probe is "can't tell" and never authorizes deleting every viewport. */
     private gcStaleFocuses;
-    /** Count-based full-canvas prune, throttled to once per hour. Live rows are
-     * never deleted by pruneToLimit, so the true floor can exceed AUTO_PRUNE_MAX. */
-    private autoPrune;
     /** Collect dead or expired hidden warm-pool spares. */
     private gcWarmPool;
 }