@north-light/crouter 0.3.233 → 0.3.234

package/dist/daemon/crtrd-cli.js

@@ -3,6 +3,7 @@
 // raw fatal boundary; a winning daemon stays alive through its scheduled loop.
 import '../suppress-experimental-warnings.js';
 import { runDaemon } from './crtrd.js';
+import { envCrtrdTcp } from '../shared/env.js';
 /** Extract `--tcp <host:port>` (or `--tcp=<host:port>`) from argv; falls back to
  *  `CRTRD_TCP`. Absent → unix socket only (§4.1). */
 function parseTcpArg(argv) {
@@ -13,6 +14,6 @@ function parseTcpArg(argv) {
         if (arg !== undefined && arg.startsWith('--tcp='))
             return arg.slice('--tcp='.length);
     }
-    return process.env['CRTRD_TCP'];
+    return envCrtrdTcp();
 }
 await runDaemon({ tcp: parseTcpArg(process.argv.slice(2)) });

package/dist/daemon/crtrd.js

@@ -71,7 +71,7 @@ import { setInstallId } from '../core/runtime/nodes.js';
 import { claimDaemonOwnership, releaseDaemonOwnership } from '../core/canvas/daemon-owner.js';
 import { prewarmRecentRecipes, reapStaleSpares } from '../core/runtime/warm-pool.js';
 import { DaemonFleet } from './fleet.js';
-import { migrateLegacyInboxIdentities } from '../core/feed/inbox-migrate.js';
+import { BOOT_MIGRATIONS } from './boot-migrations.js';
 import { emitEvent } from '../core/events/emit.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { bindDaemonEventSource } from '../core/events/source.js';
@@ -88,7 +88,6 @@ import { ensureOnDiskMigrations } from '../migrations/activation.js';
 export function brokerCommandDeclaresCanvasHome(command, home) {
     return command.includes(` --canvas-home ${home} `);
 }
-// ---------------------------------------------------------------------------
 // Startup epoch census (design flow C step 1): before this daemon writes its
 // readiness mirror, reap every broker of a PRIOR epoch on its own canvas.
 // Ownership is never adopted across epochs — a prior daemon's ChildProcess
@@ -96,7 +95,6 @@ export function brokerCommandDeclaresCanvasHome(command, home) {
 // let the startup recovery sweep reclassify their rows through the policy
 // table. A broker whose argv carries NO `--epoch` tag is a legacy-generation
 // broker and gets the same verdict (reap): it predates epoch ownership.
-// ---------------------------------------------------------------------------
 /** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
  *  for a legacy/untagged broker (which the census treats as prior-epoch). */
 export function brokerCommandEpoch(command) {
@@ -113,7 +111,11 @@ async function reapPriorEpochBrokers(epoch) {
         // No process table — the census cannot run. The startup recovery sweep
         // still reclassifies rows; a surviving prior-epoch broker is at worst a
         // duplicate engine risk the next daemon boot's census retries.
-        emitEvent({ level: 'warn', event: 'daemon.census.snapshot_failed' });
+        emitEvent({
+            level: 'error',
+            event: 'daemon.census.snapshot_failed',
+            fields: { invariant: 'prior-epoch brokers are reaped before readiness' },
+        });
         return;
     }
     const home = crtrHome();
@@ -177,7 +179,6 @@ async function reapPriorEpochBrokers(epoch) {
         fields: { prior_epoch_brokers: victims.length, sigtermed, sigkilled },
     });
 }
-// ---------------------------------------------------------------------------
 // Daemon-shutdown fleet teardown (invariant 2: no broker outlives the daemon
 // epoch that launched it). SIGTERM every live entry, race each handle's real
 // exit against ONE shared bounded grace, then SIGKILL each survivor's captured
@@ -185,7 +186,6 @@ async function reapPriorEpochBrokers(epoch) {
 // startup recovery sweep classifies them through the policy table, exactly as
 // it would after a daemon crash, so clean shutdown and crash converge on one
 // recovery path.
-// ---------------------------------------------------------------------------
 const FLEET_TEARDOWN_GRACE_MS = 5_000;
 async function teardownFleet(fleet) {
     const entries = Array.from(fleet.entries());
@@ -270,9 +270,7 @@ export async function runStartupRecoverySweep(fleet) {
         });
     }
 }
-// ---------------------------------------------------------------------------
 // Pidfile
-// ---------------------------------------------------------------------------
 function writePidfile() {
     // Ensure the pidfile parent exists before writing.
     mkdirSync(dirname(pidfilePath()), { recursive: true });
@@ -341,8 +339,8 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
     dormantInbox.run(now, { rows, fleet, hasBrokerCapacity });
     cronLane.run(now, { lifecycle, hasBrokerCapacity });
     humanDeliveryLane.run(now, { lifecycle });
-    pendingReviewSubmit.run({ lifecycle });
-    storageMaintenance.run(now);
+    pendingReviewSubmit.run(now, { lifecycle });
+    storageMaintenance.run(now, {});
 }
 /** Start the supervisor loop after winning the authoritative canvas claim.
  *
@@ -446,7 +444,6 @@ export async function runDaemon(opts = {}) {
             process.off('exit', onExit);
         }
     }
-    // -------------------------------------------------------------------------
     // Handover — the daemon replaces ITSELF (POST /v1/daemon/restart)
     //
     // The routine reason to restart crtrd is to put a newly selected runtime
@@ -462,7 +459,6 @@ export async function runDaemon(opts = {}) {
     // pi persisting the tool result. It is NOT a correctness fallback; a broker
     // SIGTERMed mid-turn still gets `abortAndExit`'s own bounded persistence
     // window, and the successor's startup recovery sweep resumes it either way.
-    // -------------------------------------------------------------------------
     const HANDOVER_ACK_GRACE_MS = 1_000;
     let handoverArmed = false;
     /** Arm the handover. Idempotent: a retry while one is already scheduled
@@ -684,17 +680,21 @@ export async function runDaemon(opts = {}) {
                 });
             }
         });
-        // Pre-cutover inbox state (rows without identities, ISO-timestamp cursors)
-        // is fatal to the strict reader and crash-loops every legacy broker at
-        // inbox seed; migrate it once before supervision can revive anything.
+        // Boot-time filesystem repairs (design: src/daemon/boot-migrations.ts) run
+        // unconditionally, in order, before supervision can revive anything.
+        // Today's one entry is the pre-cutover inbox-identity migration: rows
+        // without identities or ISO-timestamp cursors are fatal to the strict
+        // reader and crash-loop every legacy broker at inbox seed.
         operationIdContext.fresh(() => {
-            const inboxMigration = migrateLegacyInboxIdentities();
-            if (inboxMigration.nodes > 0 || inboxMigration.failures > 0) {
-                emitEvent({
-                    level: 'info',
-                    event: 'daemon.inbox_identity.migrated',
-                    fields: { ...inboxMigration },
-                });
+            for (const migration of BOOT_MIGRATIONS) {
+                const result = migration.apply();
+                if (result.changed) {
+                    emitEvent({
+                        level: 'info',
+                        event: 'daemon.boot_migration.applied',
+                        fields: { migration: migration.id, ...result.summary },
+                    });
+                }
             }
         });
         // Startup epoch census (design flow C step 1): reap every prior-epoch

package/dist/daemon/fleet.js

@@ -23,10 +23,8 @@ import { hasPendingWake } from './reconcilers/live-obligation.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { emitEvent } from '../core/events/emit.js';
-// ---------------------------------------------------------------------------
 // Shared crash helpers (moved from crtrd.ts — the fleet's policy paths are now
 // their primary consumers; crtrd imports them back for its surviving passes).
-// ---------------------------------------------------------------------------
 /** Surface a vehicle that never booted (or exhausted its respawn budget).
  *
  *  A pi that dies before its first session_start (so `pi_session_id` was never
@@ -111,9 +109,7 @@ export function classifyDeadNode(row, busy, pendingWake = true) {
         return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
     return 'boot-failure'; // row 8
 }
-// ---------------------------------------------------------------------------
 // Respawn throttle (replaces the stranded-relaunch counters, event-driven)
-// ---------------------------------------------------------------------------
 /** An exit with uptime at or above this resets the consecutive-failure
  *  counter before classification; a shorter-lived exit increments it. */
 export const HEALTHY_UPTIME_MS = 60_000;

package/dist/daemon/human/deliver-action.js

@@ -1,3 +1,4 @@
+import { envHomeOverride } from '../../shared/env.js';
 import { spawn } from 'node:child_process';
 import { settleActionDelivery, } from '../../core/canvas/human-deliveries.js';
 import { killProcessGroup } from '../../core/canvas/pid.js';
@@ -158,7 +159,7 @@ function actionDeliveryEnv(cwd) {
     const env = buildOperationalEnvBase({ targetCwd: cwd, targetProfileId: null });
     // Runtime identity, not host state: an action that calls `crtr` must reach
     // the daemon that delivered to it, exactly as a cron body does.
-    const canvasHome = process.env['CRTR_HOME'];
+    const canvasHome = envHomeOverride();
     if (canvasHome !== undefined && canvasHome !== '')
         env['CRTR_HOME'] = canvasHome;
     return env;

package/dist/daemon/human/sweep.js

@@ -1,11 +1,16 @@
-import { readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getRow } from '../../core/canvas/canvas.js';
 import { getReviewByBridge } from '../../core/review/store.js';
 import { emitEvent } from '../../core/events/emit.js';
+import { reviewPath } from '../../core/human/convention.js';
 import { ticketsRoot } from '../../core/human/root.js';
 import { readTicketResult } from '../../core/human/tickets.js';
-import { deliverTerminalResult, releaseActionDelivery, settleFeedbackCompanion } from './finish.js';
+import { cancelHumanTicket, deliverTerminalResult, releaseActionDelivery, settleFeedbackCompanion } from './finish.js';
+/** No surface can open a review ticket that has no canonical row, so cancellation is its
+ *  only reachable end. Boot runs this before API traffic, and a row is committed before its
+ *  ticket is published, so an in-flight review is never mistaken for one of these. */
+const UNBACKED_REVIEW_REASON = 'this review predates canonical review records and cannot be opened; re-file the review';
 function isTerminalBridge(status) {
     return status === 'done' || status === 'dead' || status === 'canceled';
 }
@@ -21,12 +26,18 @@ export async function reconcileUndeliveredTickets() {
             if (!statSync(dir).isDirectory())
                 continue;
             scanned += 1;
+            const canonical = getReviewByBridge(entry) !== null;
             const ticketResult = readTicketResult(dir);
-            if (ticketResult === null)
+            if (ticketResult === null) {
+                if (!canonical && existsSync(reviewPath(dir))) {
+                    await cancelHumanTicket(entry, { reason: UNBACKED_REVIEW_REASON, actor: 'system' });
+                    delivered += 1;
+                }
                 continue;
+            }
             // Canonical reviews own terminal delivery and bridge retirement. Their
             // finisher retries only when its winning operation is explicitly repeated.
-            if (getReviewByBridge(entry) !== null)
+            if (canonical)
                 continue;
             // A terminal page ticket retires its feedback companion whether or not a
             // reply bridge exists: inbox-only pages have no bridge row, yet the

package/dist/daemon/manage.d.ts

@@ -7,8 +7,8 @@
  *  singleton supervisor, never "a node" itself, so none of this belongs in its
  *  env regardless of whether today's code happens to read it — and at least one
  *  of these IS actively read: `host.ts`'s broker-engine resolution falls back to
- *  `process.env['CRTR_BROKER_ENGINE']` verbatim (nodeEnv() never sets that key,
- *  so nothing overrides it per child launch), so a daemon that inherits a
+ *  `envBrokerEngine()`'s raw `CRTR_BROKER_ENGINE` read verbatim (nodeEnv() never
+ *  sets that key, so nothing overrides it per child launch), so a daemon that inherits a
  *  stale/dev override throws inside `headlessBrokerHost.launch()` on EVERY
  *  relaunch it ever attempts, for its whole lifetime — the 2026-07-06 diagnosis
  *  root cause behind 19 nodes killed with "failed to relaunch and is now dead". */

package/dist/daemon/manage.js

@@ -15,9 +15,8 @@ import { hostExecPath } from '../core/runtime/branded-host.js';
 // reaches openDb) so the CLI daemon front door stays canvas.db-free (plan B-0).
 import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
 import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
-// ---------------------------------------------------------------------------
+import { envNoDaemonAutostart } from '../shared/env.js';
 // Daemon env sanitization
-// ---------------------------------------------------------------------------
 /** Env keys that must NEVER reach the daemon process. Restarting crtrd is
  *  overwhelmingly done from inside an agent node's own bash tool (`crtr sys
  *  daemon stop && start`), which inherits that node's FULL env — its identity
@@ -27,8 +26,8 @@ import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
  *  singleton supervisor, never "a node" itself, so none of this belongs in its
  *  env regardless of whether today's code happens to read it — and at least one
  *  of these IS actively read: `host.ts`'s broker-engine resolution falls back to
- *  `process.env['CRTR_BROKER_ENGINE']` verbatim (nodeEnv() never sets that key,
- *  so nothing overrides it per child launch), so a daemon that inherits a
+ *  `envBrokerEngine()`'s raw `CRTR_BROKER_ENGINE` read verbatim (nodeEnv() never
+ *  sets that key, so nothing overrides it per child launch), so a daemon that inherits a
  *  stale/dev override throws inside `headlessBrokerHost.launch()` on EVERY
  *  relaunch it ever attempts, for its whole lifetime — the 2026-07-06 diagnosis
  *  root cause behind 19 nodes killed with "failed to relaunch and is now dead". */
@@ -76,9 +75,7 @@ export function sanitizedDaemonEnv() {
         delete env[key];
     return env;
 }
-// ---------------------------------------------------------------------------
 // Entry point resolution
-// ---------------------------------------------------------------------------
 /** Locate the package or generation root from a regular build, the standalone
  *  attach bundle, or a tsx source checkout. */
 function generationRoot() {
@@ -117,9 +114,7 @@ async function resolveDaemonLaunch() {
     }
     return [result.runtime.entryPath];
 }
-// ---------------------------------------------------------------------------
 // Stray-daemon sweep
-// ---------------------------------------------------------------------------
 /** A crtrd declares its owning canvas in argv, so ownership is an exact match
  *  on this process's canvas home. Untagged daemons retain their own
  *  supervision and are never counted or killed here. */
@@ -191,9 +186,7 @@ export function sweepStrayDaemons(keepPid) {
     }
     return strays;
 }
-// ---------------------------------------------------------------------------
 // daemon launch — low-level spawn/exec
-// ---------------------------------------------------------------------------
 /** Replace PID 1 with the selected daemon generation. Docker keeps a container
  *  alive only while PID 1 lives, so a handover there must preserve its pid. */
 export async function execDaemon() {
@@ -376,9 +369,7 @@ export async function spawnDaemon() {
     }
     return { started: true, pid };
 }
-// ---------------------------------------------------------------------------
 // ensureDaemon — fire-and-forget front-door helper
-// ---------------------------------------------------------------------------
 /** Whether autostart is suppressed for this invocation. `--no-autostart` or
  *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
  *  for environments that manage crtrd externally and want the diagnostic, and
@@ -393,7 +384,7 @@ export async function spawnDaemon() {
  *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
  *  deliberately unaffected. */
 export function autostartDisabled() {
-    return process.env['CRTR_NO_DAEMON_AUTOSTART'] === '1' || process.argv.includes('--no-autostart');
+    return envNoDaemonAutostart() || process.argv.includes('--no-autostart');
 }
 /** Start the daemon if it is not already running. No-op if already up, or if
  *  autostart is suppressed for this invocation.

package/dist/daemon/pidfile.js

@@ -13,13 +13,13 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { crtrHome } from '../core/canvas/paths.js';
 import { isPidAlive } from '../core/canvas/pid.js';
+import { envPidfileOverride } from '../shared/env.js';
 // Re-exported so `isPidAlive` stays reachable from the daemon layer's public
 // surface (crtrd.ts already re-exports it; callers may reach it either way).
 export { isPidAlive };
 /** Absolute path to crtrd's pidfile. `CRTR_PIDFILE` overrides for tests. */
 export function pidfilePath() {
-    const override = process.env['CRTR_PIDFILE'];
-    return override !== undefined && override !== '' ? override : join(crtrHome(), 'crtrd.pid');
+    return envPidfileOverride() ?? join(crtrHome(), 'crtrd.pid');
 }
 /** Read the pid stored in the pidfile, or null if absent / malformed. */
 export function readPidfile() {

package/dist/daemon/reconcilers/broker-supervision.js

@@ -17,7 +17,7 @@ import { reloadAuthLive } from '../../core/runtime/auth-reload.js';
 import { readConfig } from '../../core/config.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
-import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
+import { hasUnseenWakeMail } from '../../core/feed/inbox.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
@@ -26,18 +26,12 @@ import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
 import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.js';
 import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
+import { envMaxLiveBrokers, envNoDaemonAutostart, envTestParkSummaryGraceMs, envTestUnattendedParkMs, envWarnLiveBrokers, } from '../../shared/env.js';
 const execFileAsync = promisify(execFile);
-function configuredPositiveInteger(name, fallback) {
-    const raw = process.env[name];
-    if (raw === undefined || raw === '')
-        return fallback;
-    const n = Number(raw);
-    return Number.isSafeInteger(n) && n >= 1 ? n : fallback;
-}
 export function brokerThresholdsForDaemon() {
     const configured = readConfig('user').brokerThresholds;
-    const automaticReviveCap = configuredPositiveInteger('CRTR_MAX_LIVE_BROKERS', configured.automaticReviveCap);
-    const warning = configuredPositiveInteger('CRTR_WARN_LIVE_BROKERS', configured.warning);
+    const automaticReviveCap = envMaxLiveBrokers() ?? configured.automaticReviveCap;
+    const warning = envWarnLiveBrokers() ?? configured.warning;
     return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
 }
 export const YIELD_STALL_GRACE_MS = 3 * 60_000;
@@ -51,18 +45,12 @@ const DEFAULT_UNATTENDED_PARK_MS = 15 * 60_000;
 // stuck parking turn cannot hold a broker for a whole extra clock period.
 const DEFAULT_PARK_SUMMARY_GRACE_MS = 5 * 60_000;
 export function unattendedParkMsForDaemon() {
-    const raw = process.env['CRTR_TEST_UNATTENDED_PARK_MS'];
-    if (raw === undefined)
+    if (!envNoDaemonAutostart())
         return DEFAULT_UNATTENDED_PARK_MS;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_UNATTENDED_PARK_MS;
+    return envTestUnattendedParkMs() ?? DEFAULT_UNATTENDED_PARK_MS;
 }
 export function parkSummaryGraceMsForDaemon() {
-    const raw = process.env['CRTR_TEST_PARK_SUMMARY_GRACE_MS'];
-    if (raw === undefined)
-        return DEFAULT_PARK_SUMMARY_GRACE_MS;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_PARK_SUMMARY_GRACE_MS;
+    return envTestParkSummaryGraceMs() ?? DEFAULT_PARK_SUMMARY_GRACE_MS;
 }
 export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
     if (piPidAlive !== true)
@@ -152,7 +140,7 @@ export class BrokerSupervisionReconciler {
     lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
     lastCapacityLogAt = Number.NEGATIVE_INFINITY;
     async run(now, ctx) {
-        await this.handleAuthReload(now, ctx.fleet);
+        await this.handleAuthReload(ctx.fleet);
         const thresholds = brokerThresholdsForDaemon();
         if (ctx.fleet.size() >= thresholds.warning && ctx.lifecycle.acceptsDetachedWork()) {
             const warning = operationIdContext.fresh(() => this.warnOverCapInTmux(ctx.fleet.size(), thresholds.warning, thresholds.automaticReviveCap));
@@ -218,7 +206,7 @@ export class BrokerSupervisionReconciler {
             && (fault.retry.nextAt !== undefined || nextFaultRetry(fault, now) !== null);
         if (activeAutoProviderRetry)
             return true;
-        return readInboxSince(id, readCursor(id)).some((entry) => entry.tier !== 'deferred');
+        return hasUnseenWakeMail(id);
     }
     handleUnattendedParking(id, row, livePid, now, ctx) {
         // An unclaimed warm-pool spare is not a conversation: the booted broker it
@@ -371,14 +359,19 @@ export class BrokerSupervisionReconciler {
                             timeout: 2000,
                         });
                     }
-                    catch {
-                        /* no display channel for this client */
+                    catch (err) {
+                        emitEvent({
+                            level: 'error',
+                            event: 'broker.capacity.tmux_display_failed',
+                            error: err,
+                            fields: { client },
+                        });
                     }
                 }
             }));
         }
-        catch {
-            /* no tmux server — the canonical event above still records the condition */
+        catch (err) {
+            emitEvent({ level: 'error', event: 'broker.capacity.tmux_list_clients_failed', error: err });
         }
     }
     handleYieldStall(row, pid, now) {
@@ -521,8 +514,13 @@ export class BrokerSupervisionReconciler {
                 message: label,
             });
         }
-        catch {
-            /* best-effort — the doctrine wake below is the load-bearing notice */
+        catch (err) {
+            emitEvent({
+                level: 'error',
+                event: 'broker.wedge.fault_record_failed',
+                ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
+                error: err,
+            });
         }
         fanDoctrineWake(id, subscribersOf(id), label, {
             reason: 'child-wedged',
@@ -584,8 +582,7 @@ export class BrokerSupervisionReconciler {
             message: firstLine,
         });
     }
-    async handleAuthReload(now, fleet) {
-        void now;
+    async handleAuthReload(fleet) {
         let mtimeMs = 0;
         for (const path of piCredentialPaths()) {
             try {

package/dist/daemon/reconcilers/dormant-inbox.d.ts

@@ -10,7 +10,7 @@ export interface DormantInboxContext extends ControllerDeathContext {
     hasBrokerCapacity(): boolean;
 }
 export declare class ControllerDeathReconciler {
-    run(_now: number, ctx: ControllerDeathContext): void;
+    run(now: number, ctx: ControllerDeathContext): void;
 }
 export declare class DormantInboxReconciler {
     private readonly relaunchState;

package/dist/daemon/reconcilers/dormant-inbox.js

@@ -18,7 +18,8 @@ const IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS = 6;
 const IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS = 10 * 60_000;
 const IDLE_RELEASE_RELAUNCH_BASE_MS = 20_000;
 export class ControllerDeathReconciler {
-    run(_now, ctx) {
+    run(now, ctx) {
+        void now; // no time-gating here — the death check is already-controller-status-driven; the param is kept for six-way call-site uniformity, matching every other reconciler's run(now, ctx) shape.
         // Settle every wait whose controller has ended, independent of the waiter's
         // current status. Active and focused terminal nodes own a live inbox
         // watcher; idle-released nodes are revived by the following reconciler.

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,7 +1,7 @@
 import { hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCancelOnWakeCron, subscribersOf, } from '../../core/canvas/index.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { countTickets } from '../../core/canvas/attention.js';
-import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
+import { hasUnseenWakeMail, readCursor, readInboxSince } from '../../core/feed/inbox.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
@@ -26,7 +26,7 @@ export function hasLiveObligation(nodeId) {
 export function hasPendingWake(nodeId) {
     if (hasLiveObligation(nodeId))
         return true;
-    if (readInboxSince(nodeId, readCursor(nodeId)).some((entry) => entry.tier !== 'deferred'))
+    if (hasUnseenWakeMail(nodeId))
         return true;
     return focusOf(nodeId) !== null || hasAttachedBrokerViewers(nodeId);
 }

package/dist/daemon/reconcilers/pending-review-submit.d.ts

@@ -3,5 +3,5 @@ export interface PendingReviewSubmitContext {
     lifecycle: DetachedWorkLifecycle;
 }
 export declare class PendingReviewSubmitReconciler {
-    run(ctx: PendingReviewSubmitContext): void;
+    run(now: number, ctx: PendingReviewSubmitContext): void;
 }

package/dist/daemon/reconcilers/pending-review-submit.js

@@ -11,7 +11,8 @@ import { operationIdContext } from '../../core/events/operation-id.js';
 import { listSubmitRequestedReviews } from '../../core/review/store.js';
 import { completeRequestedSubmit } from '../review/finish.js';
 export class PendingReviewSubmitReconciler {
-    run(ctx) {
+    run(now, ctx) {
+        void now; // this pass lists submit-requested reviews unconditionally — nothing here is time-gated; the param is kept for six-way call-site uniformity, matching every other reconciler's run(now, ctx) shape.
         if (!ctx.lifecycle.acceptsDetachedWork())
             return;
         let pending;

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -1,10 +1,11 @@
 export declare const DEAD_REAP_GRACE_MS: number;
+export type StorageMaintenanceContext = Record<string, never>;
 /** Recurring storage cleanup. The in-memory throttle clocks intentionally reset
  * on daemon boot, so the first tick runs both full sweeps. */
 export declare class StorageMaintenanceReconciler {
     private lastSpareSweepAt;
     private lastGhostSweepAt;
-    run(now: number): void;
+    run(now: number, ctx: StorageMaintenanceContext): void;
     /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
      * focused, or closed — every one of those resolves the node through meta.json —
      * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -16,7 +16,8 @@ const GHOST_SWEEP_INTERVAL_MS = 60 * 1000;
 export class StorageMaintenanceReconciler {
     lastSpareSweepAt = Number.NEGATIVE_INFINITY;
     lastGhostSweepAt = Number.NEGATIVE_INFINITY;
-    run(now) {
+    run(now, ctx) {
+        void ctx; // no consumer today — kept only for six-way call-site uniformity
         // Placement reap MUST precede focus GC, so GC catches a focus row the reap
         // strands. Both run after dormant-inbox reconciliation, so a same-tick
         // revive has already had the chance to re-anchor its focus.

package/dist/daemon/review/companion.js

@@ -14,7 +14,7 @@
 //    the wait exists to protect.
 import { getNode } from '../../core/canvas/canvas.js';
 import { isPidAlive } from '../../core/canvas/pid.js';
-import { readCursor, readInboxSince } from '../../core/feed/inbox.js';
+import { hasUnseenWakeMail } from '../../core/feed/inbox.js';
 import { isBusy } from '../../core/runtime/busy.js';
 /** Is the companion inside a turn right now? */
 export function companionMidTurn(nodeId) {
@@ -27,7 +27,7 @@ export function companionMidTurn(nodeId) {
  *  excluded for the same reason the settlement policy excludes it: it never
  *  starts a turn of its own. */
 export function companionHasQueuedWork(nodeId) {
-    return readInboxSince(nodeId, readCursor(nodeId)).some((entry) => entry.tier !== 'deferred');
+    return hasUnseenWakeMail(nodeId);
 }
 /** Would submitting right now step on the companion's work? */
 export function companionStillWorking(nodeId) {

package/dist/daemon/review/sweep.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { basename } from 'node:path';
+import { emitEvent } from '../../core/events/emit.js';
 import { reviewPath } from '../../core/human/convention.js';
 import { ticketDir } from '../../core/human/root.js';
 import { submitReview } from '../../core/human/tickets.js';
@@ -91,8 +92,10 @@ export async function sweepReviews() {
         catch (error) {
             // A missing immutable branch is an expected recovery outcome: realization
             // cancels the binding and never captures a replacement branch.
-            if (!(error instanceof ReviewOperationError && error.code === 'branch_lost'))
+            if (!(error instanceof ReviewOperationError && error.code === 'branch_lost')) {
+                emitEvent({ level: 'warn', event: 'daemon.review_sweep.realize_failed', fields: { review_id: review.review_id, error: errorText(error) } });
                 failed += 1;
+            }
         }
     }
     try {
@@ -102,7 +105,8 @@ export async function sweepReviews() {
         ]);
         collected = collectOrphanReviewDirectories(reviewIds);
     }
-    catch {
+    catch (error) {
+        emitEvent({ level: 'warn', event: 'daemon.review_sweep.collect_orphans_failed', fields: { error: errorText(error) } });
         failed += 1;
     }
     for (const review of listReviews({ state: 'approved' })) {
@@ -123,7 +127,8 @@ export async function sweepReviews() {
         try {
             republishTicketReview(review);
         }
-        catch {
+        catch (error) {
+            emitEvent({ level: 'warn', event: 'daemon.review_sweep.republish_failed', fields: { review_id: review.review_id, error: errorText(error) } });
             failed += 1;
         }
     }

package/dist/migrations/001-surfaces-frontmatter.js

@@ -19,9 +19,7 @@ import { parse as parseYaml } from 'yaml';
 import { parseFrontmatterGeneric } from '../core/frontmatter.js';
 import { appendRenderedKey, dropTopLevelKeys, proveFrontmatterRoundTrip, rebuildDocSource, } from './frontmatter-splice.js';
 const OLD_FIELDS = ['system-prompt-visibility', 'file-read-visibility', 'applies-to', 'read-when'];
-// ---------------------------------------------------------------------------
 // Frozen old-schema parsing (pre-cut substrate/schema.ts semantics).
-// ---------------------------------------------------------------------------
 const RUNGS = ['none', 'name', 'preview', 'content'];
 function rungRank(r) {
     return RUNGS.indexOf(r);
@@ -67,12 +65,10 @@ function classify(doc) {
         hasOldFields: OLD_FIELDS.some((k) => k in fm),
     };
 }
-// ---------------------------------------------------------------------------
 // Frozen boot-ceiling walk (pre-cut substrate/ceiling.ts), per store: a
 // directory INDEX's rung caps every descendant's boot rung; the migration
 // bakes the effective (post-ceiling) rung into each doc so the rendered boot
 // tree is preserved once the ceiling machinery is deleted.
-// ---------------------------------------------------------------------------
 function buildCeiling(docs) {
     const m = new Map();
     for (const d of docs) {
@@ -129,11 +125,9 @@ function planEntries(d, bootRung) {
     }
     return entries;
 }
-// ---------------------------------------------------------------------------
 // Serialization: cut the dead keys' exact line spans out of the raw
 // frontmatter text, append the rendered `surfaces:` block, re-parse to prove
 // the splice is meaning-preserving.
-// ---------------------------------------------------------------------------
 function migratedYaml(rawYaml, entries, docPath) {
     let out = dropTopLevelKeys(rawYaml, OLD_FIELDS, docPath);
     if (entries.length > 0)