@north-light/crouter 0.3.235 → 0.3.237

package/dist/core/__tests__/canvas-inbox-watcher-naming.test.js

@@ -0,0 +1,258 @@
+// Tests for the naming/goal-capture gap on the durable-inbox delivery path.
+//
+// Run with: node --conditions=crtr-src --import tsx/esm --test src/core/__tests__/canvas-inbox-watcher-naming.test.ts
+//
+// A cold-booting child's first message falls to the durable inbox and pi's
+// `input` event never fires for it, so canvas-goal-capture's first-message
+// hooks (naming, goal capture) never run for it. The inbox watcher now mirrors
+// both on its own `kind: 'human'` visible delivery. This pins that mirror:
+// a human delivery reaches the naming pipeline and captures the goal, a
+// card/envelope delivery touches neither, and an already-described node's
+// naming call still fetches state (the daemon owns the compare-and-set) but
+// never issues a commit.
+//
+// The naming attempt is observed at the daemon socket exactly as in
+// canvas-goal-capture-envelope.test.ts: generateAndCommitInitialName starts by
+// asking crtrd for the node's projection (GET .../broker/extension-state), so
+// a request for a node id is proof the pipeline ran for it. An unnamed node's
+// GET is answered with an error — same as that file — so the test never
+// reaches the real headless model call; a "described" node's GET succeeds with
+// a non-empty description, which is enough to prove the guard short-circuits
+// before any commit (POST .../broker/generated-name) is sent.
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher.js';
+import { createNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { apiSocketPath } from '../canvas/paths.js';
+import { appendInbox } from '../feed/inbox.js';
+const TICK_MS = 20;
+const DEBOUNCE_MS = 25;
+let home;
+let socket;
+const getRequests = [];
+const postRequests = [];
+/** node_id -> description the stub answers `extension-state` with. Absent =
+ *  the GET errors (mirrors canvas-goal-capture-envelope.test.ts: proof of
+ *  attempt without a real model call). Present (even '') = the GET succeeds. */
+const descriptions = new Map();
+function node(id) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd: '/tmp/work',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    };
+}
+function initialPromptPath(id) {
+    return join(home, 'nodes', id, 'context', 'initial-prompt.md');
+}
+function respond(connection, status, body) {
+    const json = JSON.stringify(body);
+    connection.end(`HTTP/1.1 ${status}\r\n`
+        + 'Content-Type: application/json\r\n'
+        + `Content-Length: ${Buffer.byteLength(json)}\r\n`
+        + 'Connection: close\r\n\r\n'
+        + json);
+}
+function nodeIdFromPath(path) {
+    return path.split('/nodes/')[1]?.split('/')[0] ?? '';
+}
+/** Every node's watcher fetches `extension-state` ONCE at session_start (to
+ *  seed report-node names for card rendering) regardless of what it later
+ *  delivers, so a bare presence check can't tell a startup fetch from a
+ *  naming-triggered one. Naming issues a SECOND, independent fetch for the
+ *  same node id — count occurrences instead of checking presence. */
+function getRequestCount(nodeId) {
+    return getRequests.filter((line) => line.includes(`/nodes/${nodeId}/`)).length;
+}
+function makeFakePi() {
+    const handlers = {};
+    return {
+        injected: [],
+        sentMessages: [],
+        on(e, h) { handlers[e] = h; },
+        sendUserMessage(content, options) { this.injected.push({ content, deliverAs: options?.deliverAs }); },
+        sendMessage(message) { this.sentMessages.push(message); },
+        fire(e, ev, ctx) { handlers[e]?.(ev, ctx); },
+    };
+}
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitFor(predicate, timeoutMs = 3000, stepMs = 10) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate())
+            return;
+        await wait(stepMs);
+    }
+}
+const disposers = [];
+function registerWatcher(pi) {
+    const dispose = registerCanvasInboxWatcher(pi);
+    pi.fire('session_start', { type: 'session_start' }, undefined);
+    return dispose;
+}
+/** Point CRTR_HOME/CRTR_NODE_ID at this node and make sure it exists in canvas.db. */
+function freshNode(id) {
+    process.env['CRTR_NODE_ID'] = id;
+    createNode(node(id));
+}
+let origHome;
+let origNode;
+let origTick;
+let origDebounce;
+before(async () => {
+    origHome = process.env['CRTR_HOME'];
+    origNode = process.env['CRTR_NODE_ID'];
+    origTick = process.env['CRTR_WATCHER_TICK_MS'];
+    origDebounce = process.env['CRTR_WATCHER_DEBOUNCE_MS'];
+    home = mkdtempSync(join(tmpdir(), 'crtr-inbox-naming-'));
+    mkdirSync(join(home, 'nodes'), { recursive: true });
+    process.env['CRTR_HOME'] = home;
+    process.env['CRTR_WATCHER_TICK_MS'] = String(TICK_MS);
+    process.env['CRTR_WATCHER_DEBOUNCE_MS'] = String(DEBOUNCE_MS);
+    socket = createServer((connection) => {
+        connection.on('data', (chunk) => {
+            const raw = chunk.toString('utf8');
+            const requestLine = raw.split('\r\n')[0] ?? '';
+            const [method, path] = requestLine.split(' ');
+            if (method === 'GET' && path?.includes('/broker/extension-state')) {
+                getRequests.push(raw);
+                const nodeId = nodeIdFromPath(path);
+                if (!descriptions.has(nodeId)) {
+                    respond(connection, '500 Internal Server Error', { error: { code: 'internal', message: 'stub daemon' } });
+                    return;
+                }
+                respond(connection, '200 OK', {
+                    node: {
+                        node_id: nodeId, name: nodeId, description: descriptions.get(nodeId), kind: 'general',
+                        mode: 'base', lifecycle: 'terminal', status: 'active', cwd: '/tmp/work',
+                        parent: null, fork_from: null, profile_id: null, intent: null, created: new Date().toISOString(),
+                    },
+                    warm_spare: false, ancestors: [], children: [], fork_source: null,
+                    subject: { kind: 'general', mode: 'base', lifecycle: 'terminal', hasManager: false, cwd: '/tmp/work', scope: 'project', orchestration: { depth: 0 }, profile: null },
+                    report_nodes: [],
+                });
+                return;
+            }
+            if (method === 'POST' && path?.includes('/broker/generated-name')) {
+                postRequests.push(raw);
+                respond(connection, '200 OK', { applied: false });
+                return;
+            }
+            // Everything else (e.g. advanceBrokerInboxCursor) — a harmless error is
+            // fine: the watcher retries cursor commits later and never blocks
+            // visible delivery on them.
+            respond(connection, '500 Internal Server Error', { error: { code: 'internal', message: 'stub daemon' } });
+        });
+    });
+    await new Promise((resolve) => socket.listen(apiSocketPath(), resolve));
+});
+afterEach(() => {
+    while (disposers.length > 0)
+        disposers.pop()();
+});
+after(async () => {
+    closeDb();
+    await new Promise((resolve) => socket.close(() => resolve()));
+    rmSync(home, { recursive: true, force: true });
+    if (origHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = origHome;
+    if (origNode === undefined)
+        delete process.env['CRTR_NODE_ID'];
+    else
+        process.env['CRTR_NODE_ID'] = origNode;
+    if (origTick === undefined)
+        delete process.env['CRTR_WATCHER_TICK_MS'];
+    else
+        process.env['CRTR_WATCHER_TICK_MS'] = origTick;
+    if (origDebounce === undefined)
+        delete process.env['CRTR_WATCHER_DEBOUNCE_MS'];
+    else
+        process.env['CRTR_WATCHER_DEBOUNCE_MS'] = origDebounce;
+});
+test('an inbox-delivered human first message reaches the naming pipeline and captures the goal', async () => {
+    freshNode('inbox-human-unnamed');
+    const pi = makeFakePi();
+    disposers.push(registerWatcher(pi));
+    await wait(TICK_MS + 100);
+    appendInbox('inbox-human-unnamed', {
+        from: 'human',
+        tier: 'normal',
+        kind: 'message',
+        label: 'build me a receipt tracker',
+        data: { body: 'build me a receipt tracker' },
+    });
+    await waitFor(() => pi.injected.length >= 1);
+    assert.equal(pi.injected[0].content, 'build me a receipt tracker', 'the human body still rides the visible digest verbatim');
+    // One GET at session_start (report-node seed) plus one from the naming
+    // pipeline (generateAndCommitInitialName's own state fetch) = 2.
+    await waitFor(() => getRequestCount('inbox-human-unnamed') >= 2);
+    assert.equal(getRequestCount('inbox-human-unnamed'), 2, 'an inbox-delivered human message reaches the same naming pipeline a live message does');
+    assert.equal(readFileSync(initialPromptPath('inbox-human-unnamed'), 'utf8').trim(), 'build me a receipt tracker', 'an inbox-delivered first message is also captured as the goal, for fresh-revive recovery');
+});
+test('a card/envelope delivery never reaches naming or goal capture', async () => {
+    freshNode('inbox-card-only');
+    const pi = makeFakePi();
+    const dispose = registerWatcher(pi);
+    await wait(TICK_MS + 100);
+    appendInbox('inbox-card-only', { from: 'child-9', tier: 'normal', kind: 'update', label: 'phase one done' });
+    await waitFor(() => pi.injected.length >= 1, 3000);
+    assert.equal(pi.injected.length, 1, 'the card still reaches the digest as a visible send');
+    dispose(); // release ownership of this node id before a second watcher binds a new one
+    // Clock: a human message to a DIFFERENT node whose naming pipeline we know
+    // fires (proven above). Once its GET lands, the card node's window to fire
+    // its own GET has already passed — the watcher fires naming synchronously
+    // off the same delivery cycle, not on a later timer.
+    freshNode('inbox-card-clock');
+    const clockPi = makeFakePi();
+    disposers.push(registerWatcher(clockPi));
+    await wait(TICK_MS + 100);
+    appendInbox('inbox-card-clock', { from: 'human', tier: 'normal', kind: 'message', label: 'clock', data: { body: 'clock' } });
+    await waitFor(() => getRequests.some((line) => line.includes('inbox-card-clock')));
+    // Exactly the one startup GET (report-node seed) — no second, naming-triggered fetch.
+    assert.equal(getRequestCount('inbox-card-only'), 1, 'a card/envelope delivery never asks the naming pipeline to name the node');
+    assert.equal(existsSync(initialPromptPath('inbox-card-only')), false, 'a card/envelope delivery never seeds a goal file either');
+});
+test('an already-described node fetches state but never commits a new name', async () => {
+    descriptions.set('inbox-already-named', 'existing-description');
+    freshNode('inbox-already-named');
+    const pi = makeFakePi();
+    const dispose = registerWatcher(pi);
+    await wait(TICK_MS + 100);
+    appendInbox('inbox-already-named', {
+        from: 'human',
+        tier: 'normal',
+        kind: 'message',
+        label: 'second thing to do',
+        data: { body: 'second thing to do' },
+    });
+    await waitFor(() => pi.injected.length >= 1);
+    // One GET at session_start plus one from the naming pipeline's own state
+    // fetch: the guard is checked AFTER this fetch resolves, not before it.
+    await waitFor(() => getRequestCount('inbox-already-named') >= 2);
+    assert.equal(getRequestCount('inbox-already-named'), 2, 'the naming pipeline still asks the daemon for the current projection');
+    dispose(); // release ownership of this node id before a second watcher binds a new one
+    // Clock: a second node's naming pipeline fires synchronously off the same
+    // delivery cycle (proven in the first test above). Once its GET has landed,
+    // this node's guard — checked in the very same .then() before any commit
+    // call — has already resolved one way or the other.
+    freshNode('inbox-commit-clock');
+    const clockPi = makeFakePi();
+    disposers.push(registerWatcher(clockPi));
+    await wait(TICK_MS + 100);
+    appendInbox('inbox-commit-clock', { from: 'human', tier: 'normal', kind: 'message', label: 'clock', data: { body: 'clock' } });
+    await waitFor(() => getRequests.some((line) => line.includes('inbox-commit-clock')));
+    await wait(DEBOUNCE_MS + 100);
+    assert.equal(postRequests.some((line) => line.includes('inbox-already-named')), false, 'an already-described node is untouched: the guard short-circuits before any generated-name commit');
+});

package/dist/core/__tests__/child-death-wake.test.js

@@ -38,7 +38,9 @@ import { closeNode } from '../runtime/close.js';
 import { superviseTick } from '../../daemon/crtrd.js';
 import { bindTestFleet } from './helpers/fleet.js';
 import { resetFleetForTests } from '../runtime/fleet.js';
+import { headlessBrokerHost } from '../runtime/host.js';
 let home;
+let tf;
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -96,9 +98,9 @@ const wakeFromChild = (parent, child) => readInboxSince(parent).find((e) => e.fr
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-child-death-wake-'));
     process.env['CRTR_HOME'] = home;
-    // superviseTick requires a bound fleet (D-2). Empty is the point: none of
-    // these fabricated rows has a live broker, so the tick must leave them alone.
-    bindTestFleet();
+    // superviseTick requires a bound fleet (D-2). It starts empty: none of these
+    // fabricated rows has a live broker.
+    tf = bindTestFleet();
 });
 beforeEach(() => {
     closeDb();
@@ -111,27 +113,41 @@ after(() => {
     resetFleetForTests();
 });
 // BROKER CUT — exit-event authority REPLACES daemon pane-gone reaping. A booted
-// child whose engine pid is dead (and whose viewer pane is gone) is REVIVABLE,
+// child whose engine pid is dead (and whose viewer pane is gone) is RECOVERED,
 // not reaped, and the daemon's tick fans NO wake to the dormant parent. This
 // single case subsumes the four deleted scenarios (crash / quiet-finalize /
-// awaiting a live grandchild / pending self-wake): with pane state ignored,
-// surfaceChildDeath gone, and the tick running no liveness pass at all (dead-
-// node recovery rides real exit events), the daemon treats them all identically
-// — no reap, no liveness wake — so the old CRUX (no spurious wake on healthy
-// dormancy) holds by construction.
-test('exit-event authority: a dead-engine booted child is revivable, NOT reaped, and the tick fans NO wake to its dormant parent', async () => {
-    inboxWaitingParent('PARENT');
-    deadEngineChild('CHILD');
-    subscribe('PARENT', 'CHILD', true); // the spawn-time spine edge
-    await superviseTick();
-    // The tick has no liveness pass: a stale recorded pid is metadata, not a
-    // death signal — the row stays revivable (recovery would ride a real exit
-    // event), never reaped to dead/done/idle.
-    assert.equal(getNode('CHILD').status, 'active', 'CHILD stays revivable, NOT reaped');
-    // surfaceChildDeath is deleted: the daemon raises no liveness wake. The
-    // doctrine wake now rides the child's own `push final` (or close.ts), so a
-    // purely-inbox-waiting parent is never spuriously woken on dormancy/crash.
-    assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — no daemon liveness wake');
+// awaiting a live grandchild / pending self-wake): with pane state ignored and
+// surfaceChildDeath gone, the daemon treats them all identically — no reap, no
+// liveness wake — so the old CRUX (no spurious wake on healthy dormancy) holds
+// by construction. The node-lifecycle tick relaunches the row through the same
+// policy table its exit event would have used (D-12); that recovery is silent.
+test('exit-event authority: a dead-engine booted child is recovered, NOT reaped, and the tick fans NO wake to its dormant parent', async () => {
+    const originalLaunch = headlessBrokerHost.launch;
+    const launches = [];
+    headlessBrokerHost.launch = (nodeId) => {
+        launches.push(nodeId);
+        const handle = { pid: 424_242, exited: new Promise(() => { }) };
+        tf.fleet.register(nodeId, handle); // the real host contract: registration at the launch seam
+        return handle;
+    };
+    try {
+        inboxWaitingParent('PARENT');
+        deadEngineChild('CHILD', { cwd: home }); // a cwd that exists — reviveNode's preflight refuses a missing one
+        subscribe('PARENT', 'CHILD', true); // the spawn-time spine edge
+        await superviseTick();
+        // A stale recorded pid is metadata, not a verdict: the row is relaunched on
+        // its saved session, never reaped to dead/done/idle.
+        assert.deepEqual(launches, ['CHILD'], 'the tick recovers the dead engine through the policy table');
+        assert.equal(getNode('CHILD').status, 'active', 'CHILD is recovered, NOT reaped');
+        // surfaceChildDeath is deleted: the daemon raises no liveness wake. The
+        // doctrine wake now rides the child's own `push final` (or close.ts), so a
+        // purely-inbox-waiting parent is never spuriously woken on dormancy/crash.
+        assert.equal(readInboxSince('PARENT').length, 0, 'PARENT inbox EMPTY — no daemon liveness wake');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        tf.fleet.forget('CHILD');
+    }
 });
 test('node close of a child wakes its SURVIVING manager (the parent outside the closing set)', async () => {
     inboxWaitingParent('PARENT');

package/dist/core/__tests__/cron-self-cancel-delivery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/cron-self-cancel-delivery.test.js

@@ -0,0 +1,72 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/cron-self-cancel-delivery.test.ts
+//
+// A cron whose own command cancels its row mid-run must still deliver the
+// output that run produced: cancellation retires the schedule, not the run in
+// flight.
+import { after, afterEach, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { closeDb } from '../canvas/db.js';
+import { armCron, cancelCron, getCron } from '../canvas/crons.js';
+import { executeCron, markSelfCanceledCronRun } from '../../daemon/cron-run.js';
+let home;
+let realHome;
+function arm(overrides) {
+    armCron({
+        name: overrides.cron_id,
+        created_by: null,
+        fire_at: new Date(Date.now() - 1_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: null,
+        cancel_on_wake: false,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'silent',
+        sink: '{}',
+        tier: 'normal',
+        ...overrides,
+    });
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-cron-broker-capacity-'));
+    realHome = process.env['CRTR_HOME'];
+    process.env['CRTR_HOME'] = home;
+});
+afterEach(() => {
+    closeDb();
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    if (realHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = realHome;
+});
+test('an on-change cron that cancels itself still delivers its final output', async () => {
+    const runIdPath = join(home, 'self-cancel-run-id');
+    arm({
+        cron_id: 'self-cancel-delivery',
+        command: `printf '%s' "$CRTR_RUN_ID" > '${runIdPath}'; echo settled; sleep 0.1`,
+        recur: JSON.stringify({ every: '1h' }),
+        on_output: 'on-change',
+        sink: JSON.stringify({ human: true }),
+    });
+    const run = executeCron(getCron('self-cancel-delivery'), { outOfBand: false });
+    for (let i = 0; i < 50 && !existsSync(runIdPath); i++)
+        await delay(10);
+    assert.ok(existsSync(runIdPath), 'the live run exposed its id to its self-cancel command');
+    assert.equal(markSelfCanceledCronRun('self-cancel-delivery', readFileSync(runIdPath, 'utf8')), true);
+    assert.equal(cancelCron('self-cancel-delivery', { preserveRunningProcess: true }), true);
+    const record = await run;
+    assert.equal(record?.delivered, 'delivered: human send --inbox');
+});

package/dist/core/__tests__/daemon-boot.test.js

@@ -15,6 +15,7 @@ import { verifyDaemonStartup, waitForDaemonExit } from '../../daemon/manage.js';
 import { waitForBrokerViewSocket } from '../runtime/placement-tmux.js';
 import { viewSocketPath } from '../canvas/paths.js';
 import { markBusy, clearBusy } from '../runtime/busy.js';
+import { headlessBrokerHost } from '../runtime/host.js';
 import { bindTestFleet } from './helpers/fleet.js';
 import { resetFleetForTests } from '../runtime/fleet.js';
 let home;
@@ -92,34 +93,45 @@ test('never-booted broker exit is marked dead and surfaced to the parent as urge
     assert.ok(wake, 'the doctrine wake rides beside the urgent push');
     assert.match(wake.label, /crashed/i);
 });
-// BROKER CUT: surfaceChildDeath was DELETED and the tick runs no liveness pass.
-// A crashed booted child (engine pid DEAD, pi_session_id set) is never marked
-// `dead` by a tick and never fans a "child died" notice — recovery rides the
-// broker's real exit event (policy rows 5/6 revive it on its saved session), so
-// a fabricated row with no fleet entry is simply left revivable and the doctrine wake
-// relocated (the revived child pushes when it truly finishes; a deliberate close
-// is woken by close.ts). This test preserves the discriminating intent in the
-// new model: a crash is never reaped to `dead` and never raises a false
-// boot-failure alarm.
-test('a crashed booted child is revivable, not reaped, and raises no false boot-failure alarm', async () => {
-    createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
-    createNode(node('C2', {
-        parent: 'P2',
-        kind: 'explore',
-        pi_pid: deadPid(), // engine crashed — its recorded pid is dead
-        pi_session_id: '019e8f00-booted-once', // it booted before dying
-        intent: null,
-    }));
-    spawnEdge('P2', 'C2');
-    markBusy('C2'); // died mid-generation
-    await superviseTick();
-    // The tick has no liveness pass: a stale recorded pid is metadata, not a
-    // death signal — the row stays active/revivable, never reaped to `dead`.
-    assert.equal(getNode('C2').status, 'active', 'crashed booted child stays revivable, NOT marked dead');
-    // surfaceChildDeath is gone and this is not a never-booted node, so the daemon
-    // fans NO push here — no false boot-failure / child-death alarm on a crash.
-    assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
-    clearBusy('C2');
+// surfaceChildDeath was DELETED, and the node-lifecycle tick recovers a crashed
+// booted child through the SAME policy table its exit event would have used
+// (design D-12), so tick recovery and exit recovery can never diverge. A row
+// whose recorded pid is provably dead and whose session was recorded is a
+// resumable crash: it is relaunched on that saved session, never reaped to
+// `dead` and never announced as a boot failure or a child death.
+test('a crashed booted child is relaunched on its saved session, not reaped, and raises no false boot-failure alarm', async () => {
+    const originalLaunch = headlessBrokerHost.launch;
+    const launches = [];
+    headlessBrokerHost.launch = (nodeId) => {
+        launches.push(nodeId);
+        const handle = { pid: 424_242, exited: new Promise(() => { }) };
+        tf.fleet.register(nodeId, handle); // the real host contract: registration at the launch seam
+        return handle;
+    };
+    try {
+        createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
+        createNode(node('C2', {
+            cwd: home, // a cwd that exists — reviveNode's preflight refuses a missing one
+            parent: 'P2',
+            kind: 'explore',
+            pi_pid: deadPid(), // engine crashed — its recorded pid is dead
+            pi_session_id: '019e8f00-booted-once', // it booted before dying
+            intent: null,
+        }));
+        spawnEdge('P2', 'C2');
+        markBusy('C2'); // died mid-generation
+        await superviseTick();
+        assert.deepEqual(launches, ['C2'], 'the tick recovers the crash through the policy table, exactly as the exit event would');
+        assert.equal(getNode('C2').status, 'active', 'crashed booted child is relaunched, NOT marked dead');
+        // surfaceChildDeath is gone and this is not a never-booted node, so the daemon
+        // fans NO push here — no false boot-failure / child-death alarm on a crash.
+        assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
+        clearBusy('C2');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        tf.fleet.forget('C2');
+    }
 });
 // An unplaced active node is not daemon-managed; the daemon leaves it untouched
 // rather than treating the missing broker/session fields as a boot failure.

package/dist/core/__tests__/helpers/harness.js

@@ -505,6 +505,7 @@ export async function createHarness(opts = {}) {
                 prompt: task,
                 parent: parentId,
                 ...(o.mode !== undefined ? { mode: o.mode } : {}),
+                ...(o.lifecycle !== undefined ? { rootLifecycle: o.lifecycle } : {}),
                 ...(o.model !== undefined ? { model: o.model } : {}),
             });
             await harness.awaitBoot(result.node.node_id);

package/dist/core/__tests__/human-deliver.test.js

@@ -192,7 +192,7 @@ describe('terminal ticket delivery', () => {
         await deliverTerminalResult(bridge);
         assert.equal(getNode(companion)?.final_report, finalReport, 'terminal replay preserves the first canonical final');
         assert.equal(getNode(companion)?.finalized_at, finalizedAt, 'terminal replay preserves the first finalization time');
-        assert.throws(() => reviveNode(companion, { resume: true }), /finalization latch/);
+        assert.throws(() => reviveNode(companion, { resume: true, capacity: 'freeze' }), /finalization latch/);
         const { bridge: dismissedBridge } = bridgeUnder();
         const dismissedDir = submitBridgePage(dismissedBridge);
         const dismissedCompanion = spawnNode({ kind: 'general', parent: dismissedBridge, cwd: home, name: 'dismissed feedback companion', lifecycle: 'resident' }).node_id;

package/dist/core/__tests__/human-node-not-supervised.test.js

@@ -14,12 +14,11 @@
 // (pid==null, session==null) as a never-booted broker and boot-failed it —
 // killing the human prompt before the person could ever answer.
 //
-// THE FIX under exit-event authority lives in TWO filters, both driven here:
-// superviseTick drops kind:'human' rows from every row pass, and the startup
-// recovery sweep skips them before classification — the sweep treats every
-// swept row as known-dead, so an unfiltered human row (session null, no fork
-// claim) would land in policy row 8 (boot failure), the modern re-incarnation
-// of the exact bug.
+// THE FIX under exit-event authority is superviseTick's one filter, driven
+// here: it drops kind:'human' rows before every row pass, including the
+// node-lifecycle tick that classifies a row with no live broker as known-dead.
+// An unfiltered human row (session null, no fork claim) would land in policy
+// row 8 (boot failure), the modern re-incarnation of the exact bug.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
@@ -28,7 +27,7 @@ import { join } from 'node:path';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 import { readInboxSince } from '../feed/inbox.js';
-import { superviseTick, runStartupRecoverySweep } from '../../daemon/crtrd.js';
+import { superviseTick } from '../../daemon/crtrd.js';
 import { bindTestFleet } from './helpers/fleet.js';
 import { resetFleetForTests } from '../runtime/fleet.js';
 let home;
@@ -49,7 +48,7 @@ function node(id, over = {}) {
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-human-not-supervised-'));
     process.env['CRTR_HOME'] = home;
-    tf = bindTestFleet(); // superviseTick + the sweep require a bound fleet (D-2)
+    tf = bindTestFleet(); // superviseTick requires a bound fleet (D-2)
 });
 beforeEach(() => {
     closeDb();
@@ -79,16 +78,12 @@ test('a kind:"human" bridge row is NEVER boot-failed by the daemon (it has no br
     // the tick leave IT alone — it is only here to catch a push.
     createNode(node('ASKER', { status: 'idle', intent: 'idle-release', pi_session_id: 'booted' }));
     subscribe('ASKER', 'HUMAN', true);
-    // Two well-spaced ticks: under exit-event authority the tick runs no liveness
-    // pass at all, and its row passes (controller-wait settle, pass-2 inbox wake)
-    // must drop the human row before reading it.
+    // Two well-spaced ticks: the row passes (controller-wait settle, inbox wake,
+    // and the node-lifecycle classification of a row with no live broker) must
+    // all drop the human row before reading it.
     const t0 = Date.now();
     await superviseTick(t0);
     await superviseTick(t0 + 10_000_000);
-    // The startup recovery sweep is the sharper threat: it classifies every swept
-    // active|idle row as known-dead, so only its kind:'human' filter keeps the
-    // bridge row out of policy row 8 (boot failure).
-    await runStartupRecoverySweep(tf.fleet);
     assert.equal(getNode('HUMAN').status, 'active', 'human bridge row stays alive — never crash-reaped as a dead broker');
     assert.equal(readInboxSince('ASKER').length, 0, 'no surfaceBootFailure urgent push — the asker is never told its human prompt "never started"');
 });