@north-light/crouter 0.3.236 → 0.3.237

package/dist/core/canvas/render-source.js

@@ -18,7 +18,7 @@ import { RemoteCanvasSource } from './remote-canvas-source.js';
 import { fullName } from './labels.js';
 import { jobDir, contextDir } from './paths.js';
 import { isPidAlive } from './pid.js';
-import { resolveNodeVisual, faultSummary } from './status-glyph.js';
+import { isFrozenRow, resolveNodeVisual, faultSummary } from './status-glyph.js';
 import { readFault } from '../runtime/fault.js';
 import { parseCard } from '../../shared/generated-context.js';
 // Active-fault overlay: stale daemon-owned provider faults are hidden once the
@@ -63,7 +63,7 @@ async function nodeLineFromSource(source, nodeId, indent, connector, remote, tic
     if (node === null)
         return `${indent}${connector}? <missing meta: ${nodeId}>`;
     const hanging = remote ? null : hangingFor(node);
-    const glyph = resolveNodeVisual(node.status, { hanging }).glyph;
+    const glyph = resolveNodeVisual(node.status, { hanging, frozen: isFrozenRow(node) }).glyph;
     const ctx = remote ? '0k' : fmtCtx(readNodeTelemetry(nodeId).tokens_in);
     const asks = tickets[nodeId] ?? 0;
     const askSuffix = asks > 0 ? ` ⚑${asks}` : '';
@@ -114,7 +114,7 @@ export async function renderTreeFromSource(source, rootId) {
     const asks = tickets[rootId] ?? 0;
     const askSuffix = asks > 0 ? ` ⚑${asks}` : '';
     const hanging = remote ? null : hangingFor(node);
-    const glyph = resolveNodeVisual(node.status, { hanging }).glyph;
+    const glyph = resolveNodeVisual(node.status, { hanging, frozen: isFrozenRow(node) }).glyph;
     const faultSuffix = hanging !== null ? ` · ${faultSummary(hanging)}` : '';
     const out = [];
     out.push(`${glyph} ${fullName(node)} [${node.kind}/${node.mode}] ctx ${ctx}${askSuffix}${faultSuffix}`);
@@ -388,6 +388,8 @@ export function dashboardRowFromNodeRow(row, focusedNodeIds, remote) {
         name: row.name, // handle only; enrichRow upgrades to fullName (meta.description)
         handle: row.name,
         status: row.status,
+        frozen_at: row.frozen_at ?? null,
+        terminal_reason: row.terminal_reason ?? null,
         kind: row.kind,
         mode: row.mode,
         ctx_tokens: 0, // lazy: enrichRow
@@ -423,6 +425,8 @@ export async function dashboardRowsFromSource(source, rootId) {
             handle: node.name,
             description: node.description,
             status: node.status,
+            frozen_at: node.frozen_at ?? null,
+            terminal_reason: node.terminal_reason ?? null,
             kind: node.kind,
             mode: node.mode,
             ctx_tokens: tel.tokens_in ?? 0,

package/dist/core/canvas/status-glyph.d.ts

@@ -15,10 +15,19 @@ export interface NodeVisual {
     word?: string;
     bold?: boolean;
 }
+/** Whether a row is frozen: the broker ledger marked it waiting for a slot and
+ *  no process holds it. Both halves matter — a launch clears `frozen_at`, so a
+ *  mark sitting beside a live pid is stale rather than frozen. A projection
+ *  that carries no pid at all (the dashboard row) reads on the mark alone. */
+export declare function isFrozenRow(row: {
+    frozen_at?: string | null;
+    pi_pid?: number | null;
+}): boolean;
 /** Resolve a node's glyph + hue + overlay word, applying the precedence
- *  hanging > streaming > status. */
+ *  hanging > frozen > streaming > status. */
 export declare function resolveNodeVisual(status: NodeStatus, opts: {
     streaming?: boolean;
+    frozen?: boolean;
     hanging?: Fault | {
         kind: FaultKind;
     } | null;

package/dist/core/canvas/status-glyph.js

@@ -1,8 +1,11 @@
 // status-glyph.ts — the canonical status glyph and color map used by the canvas
 // ASCII forest and interactive browser. The overlay precedence is
-// hanging > streaming > status. `hanging` and `streaming` are
+// hanging > frozen > streaming > status. `hanging` and `streaming` are
 // mutually exclusive in practice (hanging means the turn ended, so `busy` is
-// gone) but the precedence is defined regardless.
+// gone) but the precedence is defined regardless. `frozen` outranks `streaming`
+// because a frozen row has no process at all: any streaming read against it is
+// a stale marker, and showing it as active is the lie the freeze state exists
+// to stop telling.
 import { FAULT_QUIET_MS } from '../runtime/fault.js';
 // ── Status glyphs (the mono, color-free primary encoding) ─────────────────────
 export const STATUS_GLYPH = {
@@ -24,6 +27,9 @@ export const STATUS_COLOR = {
 // ── Streaming overlay (genuinely mid-turn) — browse's existing statusRail visual.
 const STREAMING_GLYPH = '⟳';
 const STREAMING_COLOR = 92; // bright green (brighter than active-status green)
+// ── Frozen overlay (waiting on a broker slot: marked, but no process). ───────
+const FROZEN_GLYPH = '◌';
+const FROZEN_COLOR = 94; // bright blue
 // ── Active-fault overlay (one glyph, kind label carries the detail). ─────────
 export const HANGING_GLYPH = '⚠';
 export const HANGING_COLOR = 33; // yellow
@@ -42,12 +48,22 @@ export function hangingLabel(kind) {
         default: return 'other';
     }
 }
+/** Whether a row is frozen: the broker ledger marked it waiting for a slot and
+ *  no process holds it. Both halves matter — a launch clears `frozen_at`, so a
+ *  mark sitting beside a live pid is stale rather than frozen. A projection
+ *  that carries no pid at all (the dashboard row) reads on the mark alone. */
+export function isFrozenRow(row) {
+    return row.frozen_at != null && row.pi_pid == null;
+}
 /** Resolve a node's glyph + hue + overlay word, applying the precedence
- *  hanging > streaming > status. */
+ *  hanging > frozen > streaming > status. */
 export function resolveNodeVisual(status, opts) {
     if (opts.hanging != null) {
         return { glyph: HANGING_GLYPH, color: HANGING_COLOR, word: hangingLabel(opts.hanging.kind), bold: true };
     }
+    if (opts.frozen === true) {
+        return { glyph: FROZEN_GLYPH, color: FROZEN_COLOR, word: 'frozen' };
+    }
     if (opts.streaming === true) {
         return { glyph: STREAMING_GLYPH, color: STREAMING_COLOR, word: 'live', bold: true };
     }

package/dist/core/canvas/types.d.ts

@@ -18,6 +18,7 @@ export type Lifecycle = 'terminal' | 'resident';
 export type Mode = 'base' | 'orchestrator';
 /** Why a node last stopped — drives the daemon's reap-vs-revive decision. */
 export type ExitIntent = 'done' | 'refresh' | 'idle-release' | 'parked' | null;
+export type TerminalReason = 'finalized' | 'finished' | 'parked' | 'closed' | 'retired' | 'crashed' | 'stranded';
 /** The two structural edges. `subscribes_to` is the load-bearing spine (flow,
  *  org chart, views, completion routing). `spawned_by` is audit only. */
 export type EdgeType = 'subscribes_to' | 'spawned_by';
@@ -48,7 +49,7 @@ export interface LaunchSpec {
     env: Record<string, string>;
 }
 export interface ManagedWorktree {
-    state: 'open' | 'closed';
+    state: 'open' | 'closed' | 'abandoned';
     /** A closed worktree remains registered until its owner has exited, so Git
      *  never deletes the caller's live checkout beneath it. */
     cleanup?: 'pending' | 'complete';
@@ -59,6 +60,12 @@ export interface ManagedWorktree {
     base_sha: string;
     created: string;
     closed?: string;
+    abandoned?: {
+        branch: string;
+        tip_sha: string;
+        at: string;
+        by: string;
+    };
 }
 /** Immutable companion provenance. The origin session/leaf/model coordinates
  *  remain canonical in the review row rather than being duplicated into node
@@ -181,6 +188,12 @@ export interface NodeRuntime {
     /** Controller whose next inbox delivery permits this terminal node to sleep.
      * Mutable durable runtime state: ancestry never implies a wait. */
     waiting_for?: string | null;
+    frozen_at?: string | null;
+    respawn_failures?: number;
+    respawn_not_before?: string | null;
+    launched_at?: string | null;
+    last_settled_at?: string | null;
+    terminal_reason?: TerminalReason | null;
     /** Immutable basename of the committed canonical final report, or null. */
     final_report?: string | null;
     /** ISO timestamp carried by the committed canonical final report, or null. */
@@ -244,6 +257,12 @@ export interface NodeRow {
     /** Authoritative runtime columns (see NodeRuntime). */
     intent: ExitIntent;
     waiting_for: string | null;
+    frozen_at?: string | null;
+    respawn_failures?: number;
+    respawn_not_before?: string | null;
+    launched_at?: string | null;
+    last_settled_at?: string | null;
+    terminal_reason?: TerminalReason | null;
     final_report?: string | null;
     finalized_at?: string | null;
     pi_pid: number | null;

package/dist/core/feed/feed.js

@@ -91,7 +91,7 @@ function commitCanonicalFinal(nodeId, staged) {
         const subscribers = db.prepare(`SELECT from_id AS node_id, active, created FROM edges WHERE type = 'subscribes_to' AND to_id = ? ORDER BY created`).all(nodeId).map((row) => ({ node_id: row['node_id'], active: row['active'] === 1, created: row['created'] }));
         install(staged);
         installed = true;
-        db.prepare("UPDATE nodes SET status = 'done', intent = 'done', final_report = ?, finalized_at = ? WHERE node_id = ? AND final_report IS NULL").run(staged.basename, staged.ts, nodeId);
+        db.prepare("UPDATE nodes SET status = 'done', intent = 'done', terminal_reason = 'finalized', final_report = ?, finalized_at = ? WHERE node_id = ? AND final_report IS NULL").run(staged.basename, staged.ts, nodeId);
         db.exec('COMMIT');
         return { subscribers };
     }

package/dist/core/human/feedback-companion.js

@@ -40,7 +40,7 @@ function materializeFeedbackBranch(dir, capture) {
  * the first-comment race to a concurrently recorded companion. */
 export function discardFeedbackCompanion(nodeId) {
     try {
-        transition(nodeId, 'cancel');
+        transition(nodeId, 'cancel', { reason: 'retired' });
         headlessBrokerHost.teardown(nodeId);
     }
     catch { /* the refusal is authoritative; a straggler node is inert */ }
@@ -88,7 +88,10 @@ export async function realizeFeedbackCompanion(args) {
     });
     try {
         initializeForkContextExposure(node.node_id, args.senderNodeId);
-        reviveNode(node.node_id, { resume: false });
+        // The bind deadline below only a live broker can meet, so a capacity
+        // refusal must surface here and discard the companion — freezing would
+        // burn the whole deadline waiting for a launch that is not coming.
+        reviveNode(node.node_id, { resume: false, capacity: 'refuse' });
         if (!await awaitCompanionBind(node.node_id, COMPANION_BIND_DEADLINE_MS)) {
             throw new Error(`feedback companion did not bind within ${COMPANION_BIND_DEADLINE_MS}ms`);
         }

package/dist/core/memory/lint.d.ts

@@ -33,6 +33,9 @@ export type MemoryLintRule =
  | 'dangling-link'
 /** A `memory-read` route that matches no canonical name. */
  | 'memory-read-route'
+/** A document no reachability path routes an agent to — no surface delivers
+ *  it, no reached document links it, and no reached directory lists it. */
+ | 'orphan'
 /** A project store's workspace front door is missing or not its root doc. */
  | 'front-door'
 /** Boot entries in a nested store, which never rides the boot catalog. */
@@ -91,6 +94,22 @@ export declare function lintShortPreviewBody(fm: Record<string, unknown>, body:
  *  answers with its own document and its listing. Derived from the canonical
  *  tree, never from string prefixes of a name. */
 export declare function resolvableCanonicalNames(docs: readonly MemoryDoc[]): Set<string>;
+/** The orphan rule. A document is reachable when an agent is routed to it
+ *  without knowing its name: a surface delivers it (a `memory-read` surface is
+ *  deliberate companion wiring and counts), it is invocable as a slash command,
+ *  a reached document's real `[[link]]` names it, or a reached CURATED INDEX
+ *  document's listing includes it. The listing edge routes only through a
+ *  directory that carries its own non-root index document — a bare directory
+ *  has no curator, and a store's root front door is delivered with the whole
+ *  boot tree, so treating either listing as a route would reach every doc and
+ *  defeat the rule (the same reason the corpus root is never seeded). Curated
+ *  BODY LINKS on those docs still route. Reachability is computed over the
+ *  WHOLE target view — a doc linked only from another store is still reachable.
+ *  `flagStoreRoot` restricts which store's unreachable docs are flagged while
+ *  every store still participates in the graph as a potential linker. */
+export declare function lintOrphans(viewDocs: readonly MemoryDoc[], options?: {
+    flagStoreRoot?: string;
+}): MemoryLintFinding[];
 export interface MemoryLintStoreOptions {
     /** Canonical names a `[[link]]` or route may target — the target view the
      *  store's documents are read in. Omit to skip reference checks entirely

package/dist/core/memory/lint.js

@@ -133,6 +133,98 @@ export function resolvableCanonicalNames(docs) {
     walk(buildMemoryTree(docs).root);
     return names;
 }
+/** The orphan rule. A document is reachable when an agent is routed to it
+ *  without knowing its name: a surface delivers it (a `memory-read` surface is
+ *  deliberate companion wiring and counts), it is invocable as a slash command,
+ *  a reached document's real `[[link]]` names it, or a reached CURATED INDEX
+ *  document's listing includes it. The listing edge routes only through a
+ *  directory that carries its own non-root index document — a bare directory
+ *  has no curator, and a store's root front door is delivered with the whole
+ *  boot tree, so treating either listing as a route would reach every doc and
+ *  defeat the rule (the same reason the corpus root is never seeded). Curated
+ *  BODY LINKS on those docs still route. Reachability is computed over the
+ *  WHOLE target view — a doc linked only from another store is still reachable.
+ *  `flagStoreRoot` restricts which store's unreachable docs are flagged while
+ *  every store still participates in the graph as a potential linker. */
+export function lintOrphans(viewDocs, options = {}) {
+    const tree = buildMemoryTree(viewDocs);
+    const index = new Map();
+    const indexWalk = (node) => {
+        if (node.name !== '')
+            index.set(node.name, node);
+        for (const child of node.childDirectories)
+            indexWalk(child);
+        for (const child of node.childDocuments)
+            index.set(child.name, child);
+    };
+    indexWalk(tree.root);
+    const reachable = new Set();
+    const queue = [];
+    const enqueue = (name) => {
+        if (name === '' || reachable.has(name) || !index.has(name))
+            return;
+        reachable.add(name);
+        queue.push(name);
+    };
+    // Roots: a doc an agent reaches without a name — any surface entry, or a
+    // slash command. A `memory-read` surface counts (deliberate companion wiring).
+    for (const doc of viewDocs) {
+        const fm = doc.frontmatter ?? {};
+        if (parsedSubstrateSurfaces(fm).length > 0 || fm['slash'] === true)
+            enqueue(doc.name);
+    }
+    // Fixpoint: reading a reachable node routes to its real links, and — when the
+    // node is a curated non-root index — to the members its listing renders.
+    while (queue.length > 0) {
+        const node = index.get(queue.shift());
+        const doc = node.document;
+        if (doc !== null) {
+            for (const target of docLinkNames(doc.body))
+                if (index.has(target))
+                    enqueue(target);
+        }
+        if (doc === null || doc.localName === '')
+            continue;
+        for (const child of node.childDirectories) {
+            if (child.document?.frontmatter?.['unlisted'] === true)
+                continue;
+            enqueue(child.name);
+        }
+        for (const child of node.childDocuments) {
+            if (child.document.frontmatter?.['unlisted'] === true)
+                continue;
+            enqueue(child.name);
+        }
+    }
+    const findings = [];
+    for (const doc of viewDocs) {
+        if (options.flagStoreRoot !== undefined && doc.store.storeRoot !== options.flagStoreRoot)
+            continue;
+        if (reachable.has(doc.name))
+            continue;
+        // Not the running user's to fix, but still a linker in the graph above.
+        if (doc.scope === 'builtin' || doc.plugin !== undefined)
+            continue;
+        // A store's root document is its entry point by definition.
+        if (doc.localName === '')
+            continue;
+        // Persona layers are read by construction, same as the length rule.
+        if (doc.name === 'kinds' || doc.name.startsWith('kinds/'))
+            continue;
+        if (ignoresRule(doc.frontmatter ?? {}, 'orphan'))
+            continue;
+        findings.push({
+            severity: 'warning',
+            rule: 'orphan',
+            path: doc.path,
+            name: doc.name,
+            scope: doc.scope,
+            ...(doc.store.storeRoot === '' ? {} : { storeRoot: doc.store.storeRoot }),
+            message: `\`${doc.name}\` is unreachable: no surface delivers it, no reached document links it, and no reached directory lists it — it is findable only by deliberate search. Give it a surface, link it from a reached doc (a cluster index, or its directory's own ${INDEX_SEGMENT}.md), or accept it with \`lint-ignore: orphan\`.`,
+        });
+    }
+    return findings;
+}
 const FRONT_DOOR_REMEDY = 'the store\'s root INDEX.md is the workspace front door: give it `surfaces: [{on: workspace-open, at: content}, {on: read, match: "./**", at: content}]` (run `crtr memory write -h` first)';
 const GLOB_META_RE = /[*?[\]{}]/;
 function safeGlob(target, glob) {
@@ -566,6 +658,11 @@ export function lintMemoryTarget(options = {}) {
             walk(child);
     };
     walk(tree.root);
+    // Reachability is a whole-view property, so it runs once over the target view
+    // and only in the unfiltered view — a `--scope` slice hides the surfaced or
+    // linking docs that make a doc reachable and would report false orphans.
+    if (options.scope === undefined)
+        findings.push(...lintOrphans(view.docs));
     return {
         ...makeResult(findings, checked, documents, storesLinted),
         stores: view.stores,

package/dist/core/memory-resolver.d.ts

@@ -184,6 +184,10 @@ export interface MemoryTarget {
      *  or null outside a node. */
     nodeId: string | null;
 }
+/** The target the ambient process describes: cwd + the two env seams every
+ *  profile/node-aware memory path reads through (`CRTR_PROFILE_ID`,
+ *  `CRTR_NODE_ID`). */
+export declare function ambientMemoryTarget(): MemoryTarget;
 /** The exact project store owned by `ownerDir` — the `--dir` selector's store,
  *  loaded whatever its mount status so lint and migration can inspect a store
  *  the runtime refuses to mount. */

package/dist/core/memory-resolver.js

@@ -18,7 +18,7 @@ import { associateRepository } from './memory/repository-association.js';
 /** The target the ambient process describes: cwd + the two env seams every
  *  profile/node-aware memory path reads through (`CRTR_PROFILE_ID`,
  *  `CRTR_NODE_ID`). */
-function ambientTarget() {
+export function ambientMemoryTarget() {
     return {
         cwd: process.cwd(),
         profileId: envProfileId() || null,
@@ -27,7 +27,7 @@ function ambientTarget() {
 }
 /** The selected profile id from the process env, or '' when none. */
 function selectedProfileId() {
-    return ambientTarget().profileId ?? '';
+    return ambientMemoryTarget().profileId ?? '';
 }
 // Store discovery: which physical stores a target sees, in what order, and
 // whether each one's namespace lets it mount.
@@ -287,7 +287,7 @@ export function memoryStoresInPrecedence(target, scope, includeDescendants = fal
  *  how a DELETED doc's revision log is still found: history outlives the doc,
  *  so its lookup cannot go through document resolution. */
 export function nativeMemoryStoresInPrecedence(scope, includeDescendants = false) {
-    return memoryStoresInPrecedence(ambientTarget(), scope, includeDescendants)
+    return memoryStoresInPrecedence(ambientMemoryTarget(), scope, includeDescendants)
         .filter((store) => store.mountStatus === 'ready' && store.scope !== 'builtin' && store.plugin === undefined)
         .map((store) => ({ scope: store.scope, memoryDir: store.storeRoot, store }));
 }
@@ -475,9 +475,9 @@ export function listProjectMemoryDocs(startDir = process.cwd(), profileId = sele
  *  candidates stay in source order, so a caller's first-wins dedup yields the
  *  address winners. */
 export function listAllMemoryDocs(scope, quiet = false, includeDescendants = false) {
-    return [...loadMemoryTargetView(ambientTarget(), { ...(scope ? { scope } : {}), quiet, includeDescendants }).docs];
+    return [...loadMemoryTargetView(ambientMemoryTarget(), { ...(scope ? { scope } : {}), quiet, includeDescendants }).docs];
 }
-export function createMemoryDocSnapshot(target = ambientTarget()) {
+export function createMemoryDocSnapshot(target = ambientMemoryTarget()) {
     // Quiet: a snapshot feeds command registration and migration planning, where
     // another doc's frontmatter health is noise — corpus health is `lint`'s job.
     const view = loadMemoryTargetView(target, { quiet: true });
@@ -513,7 +513,7 @@ export function readMemoryDocContent(path, includeFrontmatter = false) {
 }
 /** The address winner for an exact canonical name in the ambient target. */
 export function resolveMemoryDoc(rawName, opts = {}) {
-    return resolveMemoryDocForTarget(rawName, ambientTarget(), opts);
+    return resolveMemoryDocForTarget(rawName, ambientMemoryTarget(), opts);
 }
 /** Resolve a memory document as ANOTHER node would see it — the same precedence
  *  chain (node-local > project stack > profile > user > builtin), read from the
@@ -527,7 +527,7 @@ export function resolveMemoryDocForTarget(rawName, target, opts = {}) {
  *  in source order — what path-aware inventory, diagnostics, and automatic
  *  event eligibility consume instead of the winner alone. */
 export function resolveMemoryCandidates(rawName, opts = {}) {
-    return resolveMemoryCandidatesForTarget(rawName, ambientTarget(), opts);
+    return resolveMemoryCandidatesForTarget(rawName, ambientMemoryTarget(), opts);
 }
 export function resolveMemoryCandidatesForTarget(rawName, target, opts = {}) {
     const view = loadMemoryTargetView(target, { ...opts, quiet: true });

package/dist/core/preview-registry.js

@@ -11,7 +11,7 @@
 // Source of truth: this Set must mirror every leaf that declares
 // `help.preview.suppressOutput: true` in its own command file (currently
 // canvas roster, canvas snapshot, node inspect snapshot, node inspect show,
-// and sys sysprompt). There is no automated sync — when you add or remove a leaf's
+// and sys context sysprompt). There is no automated sync — when you add or remove a leaf's
 // `preview.suppressOutput`, update this Set in the same commit.
 // `preview-registry-sync.test.ts` (which imports the real command tree — safe
 // in a test, never in the attach bundle) asserts the two stay identical.
@@ -22,7 +22,7 @@ export const SUPPRESS_OUTPUT_LEAVES = new Set([
     'canvas snapshot',
     'node inspect snapshot',
     'node inspect show',
-    'sys sysprompt',
+    'sys context sysprompt',
 ]);
 /** True when the leaf at this full help-name path (e.g. "canvas snapshot")
  *  declares `preview.suppressOutput: true`. */
@@ -162,8 +162,8 @@ export const LEAF_ICON_CP = {
     'sys settings': 0xf013,
     'sys setup': 0xf0ad,
     'sys doctor': 0xf0f1,
-    'sys sysprompt': 0xf15c,
-    'sys prompt-review': 0xf002,
+    'sys context sysprompt': 0xf15c,
+    'sys context prompt-review': 0xf002,
     'sys feedback': 0xf075,
     'sys update': 0xf021,
     'sys version': 0xf02b,

package/dist/core/review/realize.js

@@ -83,7 +83,7 @@ function cancelInvisibleBridge(nodeId) {
     // cannot produce a final report or notify the origin.
     const node = getNode(nodeId);
     if (node !== null && node.status !== 'done' && node.status !== 'canceled')
-        transition(nodeId, 'cancel');
+        transition(nodeId, 'cancel', { reason: 'retired' });
 }
 /** Assert the only route a bridge has back to its origin before ticket exposure. */
 function ensureBridgeSubscription(review, bridgeNodeId) {
@@ -168,8 +168,10 @@ export async function realizeReview(reviewId) {
     const companion = getNode(review.companion_node_id);
     if (companion === null)
         throw companionUnbound(review.review_id, 0);
+    // Realization is bounded by the bind deadline below, which only a live broker
+    // can meet: refuse at the cap rather than freeze into a certain timeout.
     if (companion.pi_session_id === null)
-        reviveNode(companion.node_id, { resume: false });
+        reviveNode(companion.node_id, { resume: false, capacity: 'refuse' });
     // R4: session_start is the durable bind boundary.
     if (!await awaitCompanionBind(review.companion_node_id, COMPANION_BIND_DEADLINE_MS)) {
         throw companionUnbound(review.review_id, COMPANION_BIND_DEADLINE_MS);

package/dist/core/runtime/close.js

@@ -188,7 +188,7 @@ export function closeNode(rootId, opts = {}) {
                         transition(id, 'finish');
                 }
                 else {
-                    transition(id, 'cancel');
+                    transition(id, 'cancel', { reason: 'closed' });
                 }
                 // 2) Tear the node's ENGINE down: send the `shutdown` frame so the broker
                 //    PROCESS exits and releases the sole .jsonl writer. Then proactively

package/dist/core/runtime/fleet.d.ts

@@ -1,4 +1,17 @@
+import { InputError } from '../io.js';
 import type { HostHandle } from './host.js';
+/** The daemon's live-broker thresholds. The hard cap is the ledger's admission
+ *  bound; `warning` is the saturation notice supervision fires below it. Lives
+ *  here — beside the ledger that enforces it — so the ledger, a refusal
+ *  message, and supervision's warning all read ONE definition. */
+export declare function brokerThresholdsForDaemon(): {
+    warning: number;
+    automaticReviveCap: number;
+};
+/** The typed refusal a caller that cannot wait gets when the ledger is full.
+ *  An InputError so its details round-trip through crtrd's error body and reach
+ *  a CLI caller as the real cap text instead of an opaque 5xx. */
+export declare function brokerCapReached(cap: number, live: number): InputError;
 /** Real child-exit status, exactly as Node reports it. Codes/signals are
  *  diagnostics only — never policy inputs (design D-4). */
 export interface FleetExitStatus {
@@ -32,8 +45,19 @@ export interface FleetRegistry {
     has(nodeId: string): boolean;
     /** Live-fleet checks pass (yield-stall, wedge, fatal-fault). */
     get(nodeId: string): FleetEntry | undefined;
-    /** The capacity count (design D-7: capacity = fleet.size(), exact). */
+    /** The capacity count: registered brokers only, excluding reservations. */
     size(): number;
+    /** Every slot the cap accounts for — registered brokers plus in-flight
+     *  reservations (a launch that has claimed a slot but not yet registered, and
+     *  an exited broker whose exit-policy job has not yet run). */
+    occupancy(): number;
+    /** Claim a slot for `nodeId`. True means the caller may launch; false means
+     *  the cap is reached and the caller must freeze or refuse. Idempotent — a
+     *  node that already holds a slot (reserved or registered) gets true without
+     *  consuming a second one. */
+    reserveSlot(nodeId: string): boolean;
+    /** Give back a slot claimed by `reserveSlot` and not consumed by a launch. */
+    releaseReservation(nodeId: string): void;
     entries(): Iterable<[string, FleetEntry]>;
     /** Drop an entry without policy (terminal exits + close paths). */
     forget(nodeId: string): void;
@@ -45,6 +69,10 @@ export interface FleetRegistry {
     /** Test seam — delivers a synthetic exit through the SAME path as
      *  onChildExit, so fabricated-row tests drive policy without a process. */
     deliverExit(nodeId: string, status: FleetExitStatus): void;
+    /** The node-lifecycle tick's enactment entry: classify a row known to have no
+     *  live engine and enact through the SAME policy table exit events use, so
+     *  tick recovery and exit recovery can never diverge. */
+    applyDeadRowPolicy(nodeId: string): Promise<void>;
 }
 /** Inject the daemon's fleet registry. Idempotent for the same instance;
  *  throws on a conflicting rebind (one registry per process, ever). */

package/dist/core/runtime/fleet.js

@@ -11,6 +11,29 @@
 // the structural enforcement that broker launches happen only inside crtrd
 // (design D-2): a CLI or library process has no fleet and cannot launch an
 // unowned broker.
+import { readConfig } from '../config.js';
+import { InputError } from '../io.js';
+import { envMaxLiveBrokers, envWarnLiveBrokers } from '../../shared/env.js';
+/** The daemon's live-broker thresholds. The hard cap is the ledger's admission
+ *  bound; `warning` is the saturation notice supervision fires below it. Lives
+ *  here — beside the ledger that enforces it — so the ledger, a refusal
+ *  message, and supervision's warning all read ONE definition. */
+export function brokerThresholdsForDaemon() {
+    const configured = readConfig('user').brokerThresholds;
+    const automaticReviveCap = envMaxLiveBrokers() ?? configured.automaticReviveCap;
+    const warning = envWarnLiveBrokers() ?? configured.warning;
+    return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
+}
+/** The typed refusal a caller that cannot wait gets when the ledger is full.
+ *  An InputError so its details round-trip through crtrd's error body and reach
+ *  a CLI caller as the real cap text instead of an opaque 5xx. */
+export function brokerCapReached(cap, live) {
+    return new InputError({
+        error: 'broker_cap_reached',
+        message: `no broker slot is free — ${live} live brokers at the cap of ${cap}.`,
+        next: `Finish or close a live node (\`crtr canvas render\` shows them), or raise the cap with CRTR_MAX_LIVE_BROKERS, then retry.`,
+    });
+}
 let bound;
 /** Inject the daemon's fleet registry. Idempotent for the same instance;
  *  throws on a conflicting rebind (one registry per process, ever). */

package/dist/core/runtime/host.js

@@ -22,7 +22,7 @@ import { buildBrokerEnv } from './spawn-env.js';
 import { hostExecPath } from './branded-host.js';
 import { isPidAlive, killProcessTreePids, isAnyPidAlive, captureTeardownSnapshot } from '../canvas/pid.js';
 import { assertMandatoryCanvasExtensions } from './canvas-extensions.js';
-import { boundFleet } from './fleet.js';
+import { boundFleet, brokerCapReached, brokerThresholdsForDaemon } from './fleet.js';
 import { emitEvent } from '../events/emit.js';
 import { bindBrokerEventSource, eventSource } from '../events/source.js';
 import { envBrokerEngine } from '../../shared/env.js';
@@ -193,6 +193,19 @@ export const headlessBrokerHost = {
     launch(nodeId, inv, opts) {
         // Fast-fail known launch errors before we detach a broker process.
         preflightBrokerLaunch(nodeId, inv, opts.cwd);
+        // Resolve the fleet BEFORE opening any handle: an unbound-fleet launch must
+        // fail fast with nothing to clean up (design D-2 — broker launches happen
+        // only inside crtrd, or a test harness that explicitly bound a fleet).
+        const fleet = boundFleet();
+        // The ledger is the ONE admission gate for a broker process: every launch
+        // path (revive, spawn, recycle, reset) funnels through here, so claiming
+        // the slot before anything is opened — and giving it back on any path that
+        // does not end in a registered handle — is what makes the cap real rather
+        // than advisory. A caller that cannot proceed without a slot sees this
+        // typed refusal; a caller that can wait catches it and freezes instead.
+        if (!fleet.reserveSlot(nodeId)) {
+            throw brokerCapReached(brokerThresholdsForDaemon().automaticReviveCap, fleet.size());
+        }
         // Redirect the detached broker's stdout+stderr to a per-node log under the
         // node's existing job/ dir. It retains arbitrary engine/process residue and
         // failed-canonical fatal fallback output. Append-mode preserves crash-revive history.
@@ -233,10 +246,6 @@ export const headlessBrokerHost = {
         }
         if (eventSource() === undefined)
             bindBrokerEventSource(nodeId);
-        // Resolve the fleet BEFORE spawning: an unbound-fleet launch must fail
-        // fast with nothing to clean up (design D-2 — broker launches happen only
-        // inside crtrd, or a test harness that explicitly bound a fleet).
-        const fleet = boundFleet();
         // `--canvas-home` declares broker ownership in argv so the daemon's
         // startup epoch census can match its own canvas' brokers exactly (crtrd's
         // brokerCommandDeclaresCanvasHome) instead of inferring from install
@@ -244,12 +253,20 @@ export const headlessBrokerHost = {
         // daemon's census reaps every prior-epoch broker without adoption (D-8).
         // Both precede the node id: the node id is by contract the FINAL argv
         // token (both broker-cli and the ps census parse it that way).
-        const child = spawn(hostExecPath(), [resolveBrokerEntry(), '--canvas-home', crtrHome(), '--epoch', fleet.epoch(), nodeId], {
-            cwd: opts.cwd,
-            detached: true,
-            stdio: ['ignore', logFd, logFd],
-            env: childEnv,
-        });
+        let child;
+        try {
+            child = spawn(hostExecPath(), [resolveBrokerEntry(), '--canvas-home', crtrHome(), '--epoch', fleet.epoch(), nodeId], {
+                cwd: opts.cwd,
+                detached: true,
+                stdio: ['ignore', logFd, logFd],
+                env: childEnv,
+            });
+        }
+        catch (error) {
+            fleet.releaseReservation(nodeId);
+            closeSync(logFd);
+            throw error;
+        }
         // The child holds its own dup of the fd; release the parent's copy so the
         // launching process (CLI or daemon) never leaks it.
         closeSync(logFd);
@@ -299,6 +316,10 @@ export const headlessBrokerHost = {
             fleet.register(nodeId, handle);
             void exited.then((status) => fleet.onChildExit(nodeId, status));
         }
+        else {
+            // Nothing was registered, so nothing will ever free this slot at exit.
+            fleet.releaseReservation(nodeId);
+        }
         return handle;
     },
     isAlive(node) {

package/dist/core/runtime/launch-prompt.d.ts

@@ -4,5 +4,5 @@
  *  before. ALL runtime/spine/lifecycle/kind prompting now lives as gated builtin
  *  memory docs (src/builtin-memory/), spliced in fresh every turn — this scaffold
  *  must never duplicate that prose. Imported by launch.ts (its own systemPrompt)
- *  and `sys prompt-review` so the two can never drift. */
+ *  and `sys context prompt-review` so the two can never drift. */
 export declare const LAUNCH_SYSTEM_PROMPT: string;