@north-light/crouter 0.3.236 → 0.3.237

package/dist/daemon/reconcilers/broker-supervision.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { getRow, getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
+import { getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
 import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { recordedPidLiveness } from '../../core/canvas/pid.js';
@@ -14,7 +14,6 @@ import { nextFaultRetry } from '../../core/runtime/fault-recovery.js';
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { headlessBrokerHost } from '../../core/runtime/host.js';
 import { reloadAuthLive } from '../../core/runtime/auth-reload.js';
-import { readConfig } from '../../core/config.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
 import { hasUnseenWakeMail } from '../../core/feed/inbox.js';
@@ -24,22 +23,16 @@ import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-regis
 import { deliverLive } from '../../core/runtime/interactive-deliver.js';
 import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
 import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.js';
+import { brokerThresholdsForDaemon } from '../../core/runtime/fleet.js';
 import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
-import { envMaxLiveBrokers, envNoDaemonAutostart, envTestParkSummaryGraceMs, envTestUnattendedParkMs, envWarnLiveBrokers, } from '../../shared/env.js';
+import { envNoDaemonAutostart, envTestParkSummaryGraceMs, envTestUnattendedParkMs, } from '../../shared/env.js';
 const execFileAsync = promisify(execFile);
-export function brokerThresholdsForDaemon() {
-    const configured = readConfig('user').brokerThresholds;
-    const automaticReviveCap = envMaxLiveBrokers() ?? configured.automaticReviveCap;
-    const warning = envWarnLiveBrokers() ?? configured.warning;
-    return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
-}
 export const YIELD_STALL_GRACE_MS = 3 * 60_000;
 const KILL_ESCALATE_MS = 20_000;
 export const WEDGE_QUIET_MS = 20 * 60_000;
 export const WEDGE_CPU_MAX_PERCENT = 2;
 const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
-const CAPACITY_LOG_THROTTLE_MS = 30_000;
 const DEFAULT_UNATTENDED_PARK_MS = 15 * 60_000;
 // Longer than a summary turn and shorter than the unattended clock itself, so a
 // stuck parking turn cannot hold a broker for a whole extra clock period.
@@ -138,22 +131,31 @@ export class BrokerSupervisionReconciler {
     unattendedSince = new Map();
     knownAuthMtimeMs = null;
     lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
-    lastCapacityLogAt = Number.NEGATIVE_INFINITY;
+    /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth
+     *  reload does not depend on a successful canvas scan, and the thresholds it
+     *  returns are read once for the whole tick. */
+    async runFleetPreamble(fleet) {
+        await this.handleAuthReload(fleet);
+        return brokerThresholdsForDaemon();
+    }
+    /** The saturation notice, run LAST in the tick: the frozen split it reports
+     *  is only known once the freeze lane has spent this tick's free slots. */
+    warnIfSaturated(ctx) {
+        if (ctx.fleet.size() < ctx.thresholds.warning || !ctx.lifecycle.acceptsDetachedWork())
+            return;
+        const warning = operationIdContext.fresh(() => this.warnOverCapInTmux(ctx.fleet.size(), ctx.thresholds, ctx.frozen));
+        ctx.lifecycle.registerDetached(warning);
+    }
     async run(now, ctx) {
-        await this.handleAuthReload(ctx.fleet);
-        const thresholds = brokerThresholdsForDaemon();
-        if (ctx.fleet.size() >= thresholds.warning && ctx.lifecycle.acceptsDetachedWork()) {
-            const warning = operationIdContext.fresh(() => this.warnOverCapInTmux(ctx.fleet.size(), thresholds.warning, thresholds.automaticReviveCap));
-            ctx.lifecycle.registerDetached(warning);
-        }
-        for (const [id, entry] of Array.from(ctx.fleet.entries())) {
+        for (const row of ctx.rows) {
+            const id = row.node_id;
+            const entry = ctx.fleet.get(id);
+            if (entry === undefined || (row.status !== 'active' && row.status !== 'idle')) {
+                this.unattendedSince.delete(id);
+                continue;
+            }
             await operationIdContext.fresh(async () => {
                 try {
-                    const row = getRow(id);
-                    if (row === null || (row.status !== 'active' && row.status !== 'idle')) {
-                        this.unattendedSince.delete(id);
-                        return;
-                    }
                     this.handleYieldStall(row, entry.pid, now);
                     await this.handleWedgeDetection(id, entry.pid, row.pi_pid_identity, now);
                     this.handleFatalFault(id);
@@ -180,7 +182,6 @@ export class BrokerSupervisionReconciler {
             if (!ctx.fleet.has(id))
                 consumePendingPark(id);
         }
-        return thresholds;
     }
     /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
      *  node is unavailable to park, attended, or has work waiting. Short-circuits
@@ -325,17 +326,28 @@ export class BrokerSupervisionReconciler {
             });
         }
     }
-    async warnOverCapInTmux(count, warning, max) {
+    async warnOverCapInTmux(count, thresholds, frozen) {
         const now = Date.now();
         if (now - this.lastOverCapWarnAt < OVER_CAP_WARN_THROTTLE_MS)
             return;
         this.lastOverCapWarnAt = now;
+        const { warning, automaticReviveCap: max } = thresholds;
+        const waiting = frozen.stalled + frozen.waitingOnMail;
         emitEvent({
             level: 'warn',
             event: 'broker.capacity.warning',
-            fields: { live_count: count, warning_threshold: warning, hard_cap: max },
+            fields: {
+                live_count: count,
+                warning_threshold: warning,
+                hard_cap: max,
+                frozen_stalled: frozen.stalled,
+                frozen_waiting_on_mail: frozen.waitingOnMail,
+            },
         });
-        const msg = `⚠ crtrd: ${count} live brokers (warning ${warning}; hard cap ${max}) — possible broker leak. ps -ax | grep broker-cli.js`;
+        const frozenNote = waiting === 0
+            ? ''
+            : ` — ${waiting} frozen (${frozen.stalled} stalled, ${frozen.waitingOnMail} waiting on mail)`;
+        const msg = `⚠ crtrd: ${count} live brokers (warning ${warning}; hard cap ${max})${frozenNote} — possible broker leak. ps -ax | grep broker-cli.js`;
         try {
             const clients = await execFileAsync('tmux', ['list-clients', '-F', '#{client_name}'], {
                 encoding: 'utf8',
@@ -637,29 +649,4 @@ export class BrokerSupervisionReconciler {
             }
         });
     }
-    hasBrokerCapacity(max, fleet) {
-        if (fleet.size() < max)
-            return true;
-        const now = Date.now();
-        if (now - this.lastCapacityLogAt >= CAPACITY_LOG_THROTTLE_MS) {
-            this.lastCapacityLogAt = now;
-            emitEvent({
-                level: 'warn',
-                event: 'broker.capacity.revive_deferred',
-                fields: { live_count: fleet.size(), hard_cap: max },
-            });
-        }
-        return false;
-    }
-    hasStartupRecoveryCapacity(fleet) {
-        const { automaticReviveCap } = brokerThresholdsForDaemon();
-        if (fleet.size() < automaticReviveCap)
-            return true;
-        emitEvent({
-            level: 'warn',
-            event: 'daemon.recovery_sweep.capacity_deferred',
-            fields: { live_count: fleet.size() },
-        });
-        return false;
-    }
 }

package/dist/daemon/reconcilers/controller-death.d.ts

@@ -0,0 +1,7 @@
+import { type NodeRow } from '../../core/canvas/index.js';
+export interface ControllerDeathContext {
+    rows: readonly NodeRow[];
+}
+export declare class ControllerDeathReconciler {
+    run(now: number, ctx: ControllerDeathContext): void;
+}

package/dist/daemon/reconcilers/controller-death.js

@@ -0,0 +1,26 @@
+import { getRow } from '../../core/canvas/index.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { appendControllerDeathNotice } from '../../core/feed/inbox.js';
+export class ControllerDeathReconciler {
+    run(now, ctx) {
+        void now; // no time-gating here — the death check is already-controller-status-driven; the param is kept for six-way call-site uniformity, matching every other reconciler's run(now, ctx) shape.
+        // Settle every wait whose controller has ended, independent of the waiter's
+        // current status. Active and focused terminal nodes own a live inbox
+        // watcher; an idle-released node is revived by the node-lifecycle tick.
+        for (const row of ctx.rows) {
+            const current = getRow(row.node_id);
+            const controllerId = current?.waiting_for;
+            if (controllerId === null || controllerId === undefined)
+                continue;
+            // Read-gate before the write boundary: only a dead controller warrants a
+            // notice. appendControllerDeathNotice re-checks liveness inside its
+            // transaction, so this gate cannot misfire.
+            const controller = getRow(controllerId);
+            if (controller !== null && (controller.status === 'active' || controller.status === 'idle'))
+                continue;
+            operationIdContext.fresh(() => {
+                appendControllerDeathNotice(row.node_id, controllerId);
+            });
+        }
+    }
+}

package/dist/daemon/reconcilers/cron-lane.d.ts

@@ -1,9 +1,6 @@
 import type { DetachedWorkLifecycle } from './broker-supervision.js';
 export interface CronLaneContext {
     lifecycle: DetachedWorkLifecycle;
-    /** P3.4's capacity authority, bound to the thresholds returned by the live
-     * supervision pass for this same tick. */
-    hasBrokerCapacity(): boolean;
 }
 export declare class CronLaneReconciler {
     run(now: number, ctx: CronLaneContext): void;

package/dist/daemon/reconcilers/cron-lane.js

@@ -20,9 +20,6 @@ export class CronLaneReconciler {
         try {
             runDueCrons(now, {
                 register: (settlement) => ctx.lifecycle.registerDetached(settlement),
-                // A due run that would launch or revive a node stays due until P3.4's
-                // capacity authority admits it.
-                hasBrokerCapacity: ctx.hasBrokerCapacity,
             });
         }
         catch (err) {

package/dist/daemon/reconcilers/live-obligation.js

@@ -45,7 +45,9 @@ export function parkEvent(nodeId, lifecycle) {
  *  (broker settlement after a parking turn) enacts `park` directly and fans
  *  nothing — the node's report is the notice. */
 export function applyParkEvent(nodeId, event) {
-    const node = transition(nodeId, event);
+    const node = event === 'cancel'
+        ? transition(nodeId, event, { reason: 'stranded' })
+        : transition(nodeId, event);
     if (event !== 'park')
         return;
     fanDoctrineWake(nodeId, subscribersOf(nodeId), `Child done — ${fullName(node)} (${nodeId}) was automatically marked done after its unattended grace with nothing left to wake it. It sent no final report.`, { reason: 'child-auto-done', child: nodeId });

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.d.ts

@@ -0,0 +1,53 @@
+import { type NodeRow } from '../../../core/canvas/index.js';
+import type { FleetRegistry } from '../../../core/runtime/fleet.js';
+/** How a candidate spends a slot when its turn comes. `thaw` simply launches a
+ *  row the cap turned away — its disposition was decided when it froze, and the
+ *  dead-row table has no jurisdiction over a broker that never existed.
+ *  `policy` re-enacts the dead-row policy table (which relaunches through
+ *  `reviveNode`); `idle-release` runs the stuck-delivery episode rules before
+ *  relaunching. */
+export type ThawEnactment = 'thaw' | 'policy' | 'idle-release';
+export interface ThawCandidate {
+    row: NodeRow;
+    enact: ThawEnactment;
+}
+/** Tier 1 is a row with nothing waiting for it that simply stopped executing —
+ *  the stalled set, served first. Tier 2 is a row waiting on mail, plus a row
+ *  that held a slot last time and settled nothing with it. */
+export type ThawTier = 1 | 2;
+export interface ThawEntry extends ThawCandidate {
+    tier: ThawTier;
+}
+export interface FreezeLaneContext {
+    fleet: FleetRegistry;
+    candidates: readonly ThawCandidate[];
+}
+/** What stayed frozen this tick, split the way the saturation warning reports
+ *  it. Rows in backoff never reach this lane and are excluded by construction. */
+export interface FrozenCounts {
+    stalled: number;
+    waitingOnMail: number;
+}
+/** Which tier a candidate competes in. A row that was launched and never
+ *  settled a turn drops to tier 2: it already spent a slot without producing
+ *  anything, so it must not keep outranking the mail it stalled behind. A row
+ *  that never launched at all has spent nothing and stays tier 1. */
+export declare function thawTier(row: NodeRow, pendingWake: boolean): ThawTier;
+/** Thaw order: tier first, then longest-frozen first. A candidate with no
+ *  `frozen_at` has not waited at all and sorts last within its tier. */
+export declare function compareThaw(a: ThawEntry, b: ThawEntry): number;
+export declare class FreezeLaneReconciler {
+    private readonly relaunchState;
+    /** End a stuck-delivery episode the tick decided is over — the node's profile
+     *  paused, or nothing wake-worthy is left in its inbox. */
+    endEpisode(nodeId: string): void;
+    run(now: number, ctx: FreezeLaneContext): Promise<FrozenCounts>;
+    private enact;
+    /** A frozen row is owed exactly one thing: the launch the cap refused. Strict
+     *  resume is the request, and `reviveNode` itself vetoes it for a pending
+     *  refresh or an unconfirmed cycle — the same modes the dead-row table would
+     *  have chosen. It is recovery, not a wake: nothing arrived for this node
+     *  while it waited, so an armed deadline survives the thaw. */
+    private enactThaw;
+    private enactIdleRelease;
+}

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.js

@@ -0,0 +1,170 @@
+// freeze-lane.ts — who gets the free slots, in what order, and what happens to
+// everyone else.
+//
+// The tick hands this lane every row that wants execution and has no engine.
+// Enactment is strictly sequential on the daemon's serial work lane, so the
+// ledger inside `headlessBrokerHost.launch` hands slots out in exactly the
+// order this lane enacts: ordering IS the allocation policy, and no candidate
+// needs to pre-reserve anything. A candidate that finds the ledger full freezes
+// (`reviveNode` with `capacity: 'freeze'` is the single freeze writer) and waits
+// for the next tick.
+//
+// The idle-release episode rules below are the former DormantInboxReconciler's,
+// moved here whole: a relaunch that only ever tried to deliver mail is a launch
+// like any other, and it now competes for slots through the same lane.
+import { getRow, subscribersOf, } from '../../../core/canvas/index.js';
+import { fullName } from '../../../core/canvas/labels.js';
+import { isSafeNodeId } from '../../../core/canvas/paths.js';
+import { emitEvent } from '../../../core/events/emit.js';
+import { operationIdContext } from '../../../core/events/operation-id.js';
+import { readCursor } from '../../../core/feed/inbox.js';
+import { fanDoctrineWake } from '../../../core/runtime/close.js';
+import { transition } from '../../../core/runtime/lifecycle.js';
+import { reviveNode } from '../../../core/runtime/revive.js';
+import { hasPendingWake } from '../live-obligation.js';
+// Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
+// livelock shape as the stranded-relaunch case, but on the pass that resumes a
+// dormant idle-released node when its inbox gains an unseen entry. The counter
+// is keyed on inbox-cursor progress, not row-state residency or pid liveness: a
+// transiently-live broker does not prove that delivery completed.
+const IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS = 6;
+const IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS = 10 * 60_000;
+const IDLE_RELEASE_RELAUNCH_BASE_MS = 20_000;
+/** Which tier a candidate competes in. A row that was launched and never
+ *  settled a turn drops to tier 2: it already spent a slot without producing
+ *  anything, so it must not keep outranking the mail it stalled behind. A row
+ *  that never launched at all has spent nothing and stays tier 1. */
+export function thawTier(row, pendingWake) {
+    if (pendingWake)
+        return 2;
+    const launched = row.launched_at;
+    if (launched == null)
+        return 1;
+    const settled = row.last_settled_at;
+    if (settled == null)
+        return 2;
+    return Date.parse(settled) > Date.parse(launched) ? 1 : 2;
+}
+/** Thaw order: tier first, then longest-frozen first. A candidate with no
+ *  `frozen_at` has not waited at all and sorts last within its tier. */
+export function compareThaw(a, b) {
+    if (a.tier !== b.tier)
+        return a.tier - b.tier;
+    const af = a.row.frozen_at;
+    const bf = b.row.frozen_at;
+    if (af == null)
+        return bf == null ? 0 : 1;
+    if (bf == null)
+        return -1;
+    return Date.parse(af) - Date.parse(bf);
+}
+export class FreezeLaneReconciler {
+    relaunchState = new Map();
+    /** End a stuck-delivery episode the tick decided is over — the node's profile
+     *  paused, or nothing wake-worthy is left in its inbox. */
+    endEpisode(nodeId) {
+        this.relaunchState.delete(nodeId);
+    }
+    async run(now, ctx) {
+        const entries = ctx.candidates.map((candidate) => ({
+            ...candidate,
+            tier: thawTier(candidate.row, hasPendingWake(candidate.row.node_id)),
+        }));
+        entries.sort(compareThaw);
+        const counts = { stalled: 0, waitingOnMail: 0 };
+        for (const entry of entries) {
+            const outcome = await operationIdContext.fresh(() => this.enact(now, entry, ctx.fleet));
+            if (outcome !== 'frozen')
+                continue;
+            if (entry.tier === 1)
+                counts.stalled += 1;
+            else
+                counts.waitingOnMail += 1;
+        }
+        return counts;
+    }
+    async enact(now, entry, fleet) {
+        const id = entry.row.node_id;
+        try {
+            if (entry.enact === 'thaw')
+                return this.enactThaw(id);
+            if (entry.enact === 'idle-release')
+                return this.enactIdleRelease(now, entry.row);
+            // The SAME policy table an exit event runs, so tick recovery and exit
+            // recovery can never diverge. It relaunches through
+            // `reviveNode(capacity: 'freeze')`, which freezes the row when the ledger
+            // is full — the outcome this lane reports as saturation.
+            await fleet.applyDeadRowPolicy(id);
+            if (fleet.has(id))
+                return 'launched';
+            return getRow(id)?.frozen_at != null ? 'frozen' : 'skipped';
+        }
+        catch (err) {
+            emitEvent({
+                level: 'error',
+                event: 'node.lifecycle.enact_failed',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                error: err,
+                fields: { ...(isSafeNodeId(id) ? {} : { affected_node_id: id }), enact: entry.enact },
+            });
+            return 'skipped';
+        }
+    }
+    /** A frozen row is owed exactly one thing: the launch the cap refused. Strict
+     *  resume is the request, and `reviveNode` itself vetoes it for a pending
+     *  refresh or an unconfirmed cycle — the same modes the dead-row table would
+     *  have chosen. It is recovery, not a wake: nothing arrived for this node
+     *  while it waited, so an armed deadline survives the thaw. */
+    enactThaw(nodeId) {
+        return reviveNode(nodeId, { resume: true, capacity: 'freeze', recovery: true }).outcome === 'frozen'
+            ? 'frozen'
+            : 'launched';
+    }
+    enactIdleRelease(now, row) {
+        const id = row.node_id;
+        const cursorNow = readCursor(id);
+        const prior = this.relaunchState.get(id);
+        const cursorChanged = prior === undefined || prior.cursor !== cursorNow;
+        const attempts = cursorChanged ? 0 : prior.attempts;
+        if (attempts >= IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS) {
+            this.relaunchState.delete(id);
+            emitEvent({
+                level: 'warn',
+                event: 'broker.idle_release.exhausted',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                fields: {
+                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                    attempts,
+                    max_attempts: IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS,
+                },
+            });
+            transition(id, 'crash');
+            fanDoctrineWake(id, subscribersOf(id), `Child crashed — ${fullName(row)} (${id}) failed to relaunch after ${attempts} attempts while trying to ` +
+                `deliver a pending inbox message (no delivery progress across any attempt), and is now dead. It stays ` +
+                `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
+            return 'skipped';
+        }
+        const lastAttempt = cursorChanged ? undefined : prior?.lastAttempt;
+        const backoff = Math.min(IDLE_RELEASE_RELAUNCH_BASE_MS * 2 ** attempts, IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS);
+        if (lastAttempt !== undefined && now - lastAttempt < backoff)
+            return 'skipped';
+        // A relaunch the broker cap froze got no slot and therefore proved nothing
+        // about this delivery, so it must not spend an attempt: only a launch that
+        // actually happened advances the episode toward exhaustion.
+        if (reviveNode(id, { resume: true, capacity: 'freeze' }).outcome === 'frozen')
+            return 'frozen';
+        this.relaunchState.set(id, { cursor: cursorNow, attempts: attempts + 1, lastAttempt: now });
+        emitEvent({
+            level: 'info',
+            event: 'broker.revive.idle_release',
+            ...(isSafeNodeId(id) ? { node_id: id } : {}),
+            attempt: attempts + 1,
+            fields: {
+                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                attempts: attempts + 1,
+                max_attempts: IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS,
+            },
+        });
+        return 'launched';
+    }
+}

package/dist/daemon/reconcilers/node-lifecycle/respawn-policy.d.ts

@@ -0,0 +1,5 @@
+import type { NodeRow } from '../../../core/canvas/index.js';
+/** Whether a durable backoff still holds this row back from a relaunch. A row
+ *  in backoff holds no slot and is excluded from the saturation figure — it is
+ *  waiting on a clock, not on capacity. */
+export declare function isInBackoff(row: NodeRow, now: number): boolean;

package/dist/daemon/reconcilers/node-lifecycle/respawn-policy.js

@@ -0,0 +1,16 @@
+// respawn-policy.ts — the tick's Backoff gate, and P5's file to own outright.
+//
+// P3 only READS `respawn_not_before`: nothing writes it yet, so the gate is
+// inert in effect. P5 replaces the in-memory throttle in `daemon/fleet.ts` with
+// the durable counter writes (`respawn_failures` + `respawn_not_before`) that
+// make it bite, and adds them here rather than in `tick.ts`.
+/** Whether a durable backoff still holds this row back from a relaunch. A row
+ *  in backoff holds no slot and is excluded from the saturation figure — it is
+ *  waiting on a clock, not on capacity. */
+export function isInBackoff(row, now) {
+    const notBefore = row.respawn_not_before;
+    if (notBefore == null)
+        return false;
+    const at = Date.parse(notBefore);
+    return Number.isFinite(at) && now < at;
+}

package/dist/daemon/reconcilers/node-lifecycle/terminating.d.ts

@@ -0,0 +1,4 @@
+import type { NodeRow } from '../../../core/canvas/index.js';
+/** Handle a terminal row that still holds a process. Deliberately inert until
+ *  P4: a row reaching here is already excluded from every other tick duty. */
+export declare function handleTerminatingRow(row: NodeRow): void;

package/dist/daemon/reconcilers/node-lifecycle/terminating.js

@@ -0,0 +1,13 @@
+// terminating.ts — the Terminating state's owner, and P4's file to own outright.
+//
+// A terminal row that still holds a process is a node whose teardown has been
+// requested but not finished. P4 gives it one bounded shutdown request and an
+// escalation after its grace, moving the inline `headlessBrokerHost.teardown`
+// calls at the close/reset sites into this daemon-side lane. P3 changes no
+// teardown behavior: it only OBSERVES such rows (the tick queries terminal rows
+// carrying a recorded pid) and hands them here, so P4 edits this file alone.
+/** Handle a terminal row that still holds a process. Deliberately inert until
+ *  P4: a row reaching here is already excluded from every other tick duty. */
+export function handleTerminatingRow(row) {
+    void row;
+}

package/dist/daemon/reconcilers/node-lifecycle/tick.d.ts

@@ -0,0 +1,26 @@
+import { type NodeRow } from '../../../core/canvas/index.js';
+import type { FleetRegistry } from '../../../core/runtime/fleet.js';
+import { type FrozenCounts } from './freeze-lane.js';
+export interface NodeLifecycleContext {
+    /** Every active and idle row (human rows excluded), plus terminal rows that
+     *  still hold a recorded pid. */
+    rows: readonly NodeRow[];
+    fleet: FleetRegistry;
+}
+/** Whether this row should have a live engine right now. An active row always
+ *  should — that status IS the claim that it is executing. An idle row was
+ *  deliberately released and holds no engine on purpose: only mail it has not
+ *  seen brings one back, because a live obligation keeps a node WAKEABLE rather
+ *  than awake, and relaunching on one would re-release it every tick. */
+export declare function wantsExecution(row: NodeRow): boolean;
+export declare class NodeLifecycleReconciler {
+    private readonly freezeLane;
+    run(now: number, ctx: NodeLifecycleContext): Promise<FrozenCounts>;
+    private classifyRow;
+    private thawMark;
+    /** An idle row with no wake-worthy inbox entry still needs the lifecycle
+     *  settlement the live park clock applies: once nothing live remains, this is
+     *  history rather than a permanently protected idle row. The row is already
+     *  parked, so only a terminalizing verdict is worth writing. */
+    private settleParked;
+}