@north-light/crouter 0.3.236 → 0.3.238

package/dist/daemon/cron-run.d.ts

@@ -2,7 +2,7 @@ import { type RunDueCronOptions } from './cron/passes.js';
 import { type Cron, type CronRunRecord } from '../core/canvas/crons.js';
 export { CRON_OUTPUT_HEAD_BYTES } from './cron/capture.js';
 export { cronDaemonInstanceId, markSelfCanceledCronRun } from './cron/live-runs.js';
-export { cronLaunchesNode, type RunDueCronOptions } from './cron/passes.js';
+export { type RunDueCronOptions } from './cron/passes.js';
 export { recoverStaleCronLeases } from './cron/lease-recovery.js';
 /** Kick off ONE cron run and return its settlement promise, resolving with
  *  the settled run record (null = the idle→running lease was lost, or the row
@@ -24,9 +24,8 @@ export declare function executeCron(c: Cron, opts: {
  *  but is NEVER awaited in the tick; returns one settlement promise per
  *  admitted run.
  *
- *  A run that would launch or revive a node (`cronLaunchesNode`) is admitted
- *  only while the fleet is under its automatic-revive cap. An unadmitted run is
- *  DEFERRED, never consumed: nothing is recorded, no recurrence advances, no
- *  one-shot is deleted, and no failure escalates — the row keeps its past-due
- *  `fire_at` and is retried on the next poll once capacity frees up. */
+ *  A run that launches or revives a node is admitted unconditionally: the
+ *  broker slot ledger is the one admission gate, so such a run's node is born
+ *  or revived frozen at the cap and the node-lifecycle tick starts it when a
+ *  slot frees. The cron itself always fires and settles. */
 export declare function runDueCrons(now: number, options?: RunDueCronOptions): Promise<void>[];

package/dist/daemon/cron-run.js

@@ -2,8 +2,8 @@
 // surface of the cron lane: subprocess spawn/capture/timeout/lease mechanics
 // for due `crons` rows (the cron-spec scheduler), and the tick pass that fires
 // them. The collaborators it composes live in `cron/`: arm-time context,
-// output capture, the live-run registry, the pre-run passes and capacity
-// admission, stale-lease recovery, the owed-gate decision, delivery sinks,
+// output capture, the live-run registry, the pre-run passes, stale-lease
+// recovery, the owed-gate decision, delivery sinks,
 // escalation, output disposition, and the one settle tail.
 //
 // A cron RUN is the enactment — there is no separate action to fire —
@@ -40,7 +40,7 @@ import { clearLiveRun, cronDaemonInstanceId, liveRunFor, registerLiveRun } from
 import { buildArmedRunContext } from './cron/armed-context.js';
 import { decideHeldSettle, EXIT_HELD, HELD_DELIVERED } from './cron/held.js';
 import { settleRun } from './cron/settle.js';
-import { applyOverlapPolicies, cronLaunchesNode, emitCapacityDeferral, expireDueCrons, } from './cron/passes.js';
+import { applyOverlapPolicies, expireDueCrons, } from './cron/passes.js';
 import { dueClockCrons, acquireCronRunLease, advanceCron, setCronState, } from '../core/canvas/crons.js';
 import { killProcessGroup } from '../core/canvas/pid.js';
 import { emitEvent } from '../core/events/emit.js';
@@ -51,7 +51,6 @@ import { resolveAdmittedHostCommand } from '../core/runtime/spawn-env.js';
 // decomposed into.
 export { CRON_OUTPUT_HEAD_BYTES } from './cron/capture.js';
 export { cronDaemonInstanceId, markSelfCanceledCronRun } from './cron/live-runs.js';
-export { cronLaunchesNode } from './cron/passes.js';
 export { recoverStaleCronLeases } from './cron/lease-recovery.js';
 /** Settle one closed child: choose the outcome (replaced short-circuit, owed
  *  gate, or the full disposition), then hand it to the one settle tail. */
@@ -350,22 +349,16 @@ export function executeCron(c, opts) {
  *  but is NEVER awaited in the tick; returns one settlement promise per
  *  admitted run.
  *
- *  A run that would launch or revive a node (`cronLaunchesNode`) is admitted
- *  only while the fleet is under its automatic-revive cap. An unadmitted run is
- *  DEFERRED, never consumed: nothing is recorded, no recurrence advances, no
- *  one-shot is deleted, and no failure escalates — the row keeps its past-due
- *  `fire_at` and is retried on the next poll once capacity frees up. */
+ *  A run that launches or revives a node is admitted unconditionally: the
+ *  broker slot ledger is the one admission gate, so such a run's node is born
+ *  or revived frozen at the cap and the node-lifecycle tick starts it when a
+ *  slot frees. The cron itself always fires and settles. */
 export function runDueCrons(now, options = {}) {
     const nowIso = new Date(now).toISOString();
     expireDueCrons(nowIso);
     applyOverlapPolicies(now, nowIso);
     const settlements = [];
-    let deferred = 0;
     for (const c of dueClockCrons(nowIso)) {
-        if (options.hasBrokerCapacity !== undefined && cronLaunchesNode(c) && !options.hasBrokerCapacity()) {
-            deferred += 1;
-            continue; // still due — retried next poll, at no cost to the row
-        }
         const settlement = executeCron(c, { outOfBand: false }).then(() => undefined);
         settlements.push(settlement);
         options.register?.(settlement);
@@ -374,7 +367,5 @@ export function runDueCrons(now, options = {}) {
     // as a process-level unhandled rejection.
     for (const s of settlements)
         void s.catch(() => { });
-    if (deferred > 0)
-        emitCapacityDeferral(now, deferred);
     return settlements;
 }

package/dist/daemon/crtrd.d.ts

@@ -1,18 +1,8 @@
 import { type DetachedWorkLifecycle } from './reconcilers/broker-supervision.js';
-import { DaemonFleet } from './fleet.js';
 export declare function brokerCommandDeclaresCanvasHome(command: string, home: string): boolean;
 /** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
  *  for a legacy/untagged broker (which the census treats as prior-epoch). */
 export declare function brokerCommandEpoch(command: string): string | null;
-/** Startup recovery sweep (design flow C step 2): the FIRST job on the serial
- *  work lane. The census already reaped every prior-epoch broker, so every
- *  active|idle row at boot is known-dead — classify each through the SAME
- *  policy table exit events use (fleet.recoverDeadNode → classifyDeadNode,
- *  design D-12), so exit recovery and startup recovery can never diverge. A
- *  raced API revive is safe: reviveNode's fleet.has guard makes the loser a
- *  no-op. Capacity-gated: past the automatic-revive cap the sweep stops — the
- *  tick's pass-2 inbox wakes own the remainder as capacity frees up. */
-export declare function runStartupRecoverySweep(fleet: DaemonFleet): Promise<void>;
 interface DaemonTickLifecycle extends DetachedWorkLifecycle {
 }
 /** Supervision tick over the daemon's current live set. */

package/dist/daemon/crtrd.js

@@ -46,7 +46,7 @@
 import { writeFileSync, readFileSync, rmSync, mkdirSync, } from 'node:fs';
 import { dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { crtrHome, isSafeNodeId } from '../core/canvas/paths.js';
+import { crtrHome } from '../core/canvas/paths.js';
 import { listNodes, migrateLegacyPidIdentities, } from '../core/canvas/index.js';
 import { createApiServer } from './api/server.js';
 import { reconcileUndeliveredTickets } from './human/sweep.js';
@@ -56,7 +56,8 @@ import { pidfilePath } from './pidfile.js';
 import { rendererWarning } from '../core/runtime/package-health.js';
 import { DEFAULT_INTERVAL_MS } from './supervise-cadence.js';
 import { BrokerSupervisionReconciler } from './reconcilers/broker-supervision.js';
-import { ControllerDeathReconciler, DormantInboxReconciler } from './reconcilers/dormant-inbox.js';
+import { ControllerDeathReconciler } from './reconcilers/controller-death.js';
+import { NodeLifecycleReconciler } from './reconcilers/node-lifecycle/tick.js';
 import { CronLaneReconciler } from './reconcilers/cron-lane.js';
 import { HumanDeliveryLaneReconciler } from './reconcilers/human-delivery-lane.js';
 import { PendingReviewSubmitReconciler } from './reconcilers/pending-review-submit.js';
@@ -229,47 +230,6 @@ async function teardownFleet(fleet) {
         fields: { brokers: items.length, sigkilled },
     });
 }
-/** Startup recovery sweep (design flow C step 2): the FIRST job on the serial
- *  work lane. The census already reaped every prior-epoch broker, so every
- *  active|idle row at boot is known-dead — classify each through the SAME
- *  policy table exit events use (fleet.recoverDeadNode → classifyDeadNode,
- *  design D-12), so exit recovery and startup recovery can never diverge. A
- *  raced API revive is safe: reviveNode's fleet.has guard makes the loser a
- *  no-op. Capacity-gated: past the automatic-revive cap the sweep stops — the
- *  tick's pass-2 inbox wakes own the remainder as capacity frees up. */
-export async function runStartupRecoverySweep(fleet) {
-    let rows;
-    try {
-        rows = listNodes({ status: ['active', 'idle'] });
-    }
-    catch (err) {
-        emitEvent({ level: 'error', event: 'daemon.recovery_sweep.failed', error: err });
-        return;
-    }
-    for (const row of rows) {
-        if (row.kind === 'human')
-            continue; // human bridge rows — never broker-hosted
-        if (!brokerSupervision.hasStartupRecoveryCapacity(fleet))
-            break;
-        await operationIdContext.fresh(async () => {
-            try {
-                await fleet.recoverDeadNode(row.node_id);
-            }
-            catch (err) {
-                emitEvent({
-                    level: 'error',
-                    event: 'daemon.recovery_sweep.node_failed',
-                    ...(isSafeNodeId(row.node_id) ? { node_id: row.node_id } : { fields: { affected_node_id: row.node_id } }),
-                    error: err,
-                });
-                // reviveNode launch failures terminalize themselves, but preflight
-                // refusals happen before its catch. Re-read and surface those rows
-                // instead of leaving an active node with no broker to retry it.
-                await fleet.terminalizeIfStillNonTerminal(row.node_id, 'daemon.recovery_sweep.node_terminalized', err);
-            }
-        });
-    }
-}
 // Pidfile
 function writePidfile() {
     // Ensure the pidfile parent exists before writing.
@@ -311,7 +271,7 @@ const directTickLifecycle = {
 };
 const brokerSupervision = new BrokerSupervisionReconciler();
 const controllerDeath = new ControllerDeathReconciler();
-const dormantInbox = new DormantInboxReconciler();
+const nodeLifecycle = new NodeLifecycleReconciler();
 const cronLane = new CronLaneReconciler();
 const humanDeliveryLane = new HumanDeliveryLaneReconciler();
 const pendingReviewSubmit = new PendingReviewSubmitReconciler();
@@ -321,26 +281,32 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
     const fleet = boundFleet();
     // Auth reload must precede the row-list guard: it is fleet-wide and does not
     // depend on a successful canvas scan.
-    const thresholds = await brokerSupervision.run(now, { fleet, lifecycle });
+    const thresholds = await brokerSupervision.runFleetPreamble(fleet);
     let rows;
+    // A terminal row that still holds a process is the Terminating state, and the
+    // lifecycle tick is the only pass that owes it anything.
+    let terminating;
     try {
-        rows = listNodes({ status: ['active', 'idle'] });
+        // Human bridge rows have no broker engine and participate in none of the
+        // recurring row-driven reconciler passes.
+        rows = listNodes({ status: ['active', 'idle'] }).filter((row) => row.kind !== 'human');
+        terminating = listNodes({ status: ['done', 'canceled', 'dead'], withRecordedPid: true })
+            .filter((row) => row.kind !== 'human');
     }
     catch (err) {
         emitEvent({ level: 'error', event: 'canvas.node_list.failed', error: err });
         return;
     }
-    // Human bridge rows have no broker engine and participate in none of the
-    // recurring row-driven reconciler passes. Startup recovery applies the same
-    // classification boundary.
-    rows = rows.filter((row) => row.kind !== 'human');
-    const hasBrokerCapacity = () => brokerSupervision.hasBrokerCapacity(thresholds.automaticReviveCap, fleet);
+    await brokerSupervision.run(now, { rows, fleet, lifecycle });
     controllerDeath.run(now, { rows });
-    dormantInbox.run(now, { rows, fleet, hasBrokerCapacity });
-    cronLane.run(now, { lifecycle, hasBrokerCapacity });
+    const frozen = await nodeLifecycle.run(now, { rows: [...rows, ...terminating], fleet });
+    cronLane.run(now, { lifecycle });
     humanDeliveryLane.run(now, { lifecycle });
     pendingReviewSubmit.run(now, { lifecycle });
     storageMaintenance.run(now, {});
+    // Last: the saturation figure is only true once the freeze lane has spent
+    // this tick's free slots.
+    brokerSupervision.warnIfSaturated({ fleet, lifecycle, thresholds, frozen });
 }
 /** Start the supervisor loop after winning the authoritative canvas claim.
  *
@@ -704,15 +670,11 @@ export async function runDaemon(opts = {}) {
         writePidfile();
         // Start the HTTP+WS API server (§4): unix socket always, TCP when opted in.
         apiServer = createApiServer({ tcp: opts.tcp });
-        // The startup recovery sweep is the FIRST job on the lane (flow C step 2):
-        // it classifies every boot-time dead row through the same policy table
-        // exit events use, before the first tick or any exit event interleaves.
-        const bootFleet = fleet;
-        enqueue(() => runStartupRecoverySweep(bootFleet));
         // Pre-warm the node pool for the most recent project recipes, so the first
-        // create after a boot is warm too. Scheduled behind the recovery sweep and
-        // fire-and-forget (the mints run off the work lane), so it never delays
-        // supervision.
+        // create after a boot is warm too. Fire-and-forget (the mints run off the
+        // work lane), so it never delays supervision. Boot-time dead rows are the
+        // node-lifecycle tick's business: the first tick classifies every one of
+        // them through the same policy table exit events use, under the same cap.
         // Collect the spares this daemon's predecessor left behind BEFORE minting
         // new ones: every broker of the prior epoch was torn down, and no sweep
         // resumes a spare, so each is a dead row holding a node dir.

package/dist/daemon/fleet.d.ts

@@ -1,5 +1,5 @@
 import { type NodeMeta } from '../core/canvas/index.js';
-import type { FleetEntry, FleetExitStatus, FleetRegistry } from '../core/runtime/fleet.js';
+import { type FleetEntry, type FleetExitStatus, type FleetRegistry } from '../core/runtime/fleet.js';
 import type { HostHandle } from '../core/runtime/host.js';
 /** Surface a vehicle that never booted (or exhausted its respawn budget).
  *
@@ -25,8 +25,8 @@ export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'release-i
  *  NodeMeta itself) so tests fabricate table rows directly. */
 export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' | 'cycle_pending' | 'fork_from' | 'lifecycle'>;
 /** One pure function producing the action for a node known-dead. Used at
- *  exactly two call sites — an exit-policy job and the startup recovery sweep
- *  (design D-12) — so exit recovery and startup recovery can never diverge.
+ *  exactly two call sites — an exit-policy job and the node-lifecycle tick
+ *  (design D-12) — so exit recovery and tick recovery can never diverge.
  *  Evaluated in table order; `busy` is the on-disk busy marker.
  *
  *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
@@ -71,14 +71,17 @@ export declare class DaemonFleet implements FleetRegistry {
     has(nodeId: string): boolean;
     get(nodeId: string): FleetEntry | undefined;
     size(): number;
+    occupancy(): number;
+    reserveSlot(nodeId: string): boolean;
+    releaseReservation(nodeId: string): void;
     entries(): Iterable<[string, FleetEntry]>;
     forget(nodeId: string): void;
     onChildExit(nodeId: string, status: FleetExitStatus): void;
     deliverExit(nodeId: string, status: FleetExitStatus): void;
-    /** Startup recovery sweep entry (design flow C step 2 / D-12): classify a
-     *  known-dead row and enact immediately through the SAME table exit events
-     *  use. Returns the action so the caller can capacity-gate launches. */
-    recoverDeadNode(nodeId: string): Promise<DeadNodeAction>;
+    /** The node-lifecycle tick's enactment entry: classify a known-dead row and
+     *  enact immediately through the SAME policy table exit events use, so tick
+     *  recovery and exit recovery can never diverge. */
+    applyDeadRowPolicy(nodeId: string): Promise<void>;
     /** A revive refusal before its launch try/catch leaves the row active but
      *  with no fleet entry. Convert that otherwise-silent strand into the same
      *  terminal outcome as a boot failure. The fresh read avoids duplicating

package/dist/daemon/fleet.js

@@ -23,6 +23,7 @@ import { hasPendingWake } from './reconcilers/live-obligation.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { emitEvent } from '../core/events/emit.js';
+import { brokerThresholdsForDaemon } from '../core/runtime/fleet.js';
 // Shared crash helpers (moved from crtrd.ts — the fleet's policy paths are now
 // their primary consumers; crtrd imports them back for its surviving passes).
 /** Surface a vehicle that never booted (or exhausted its respawn budget).
@@ -63,8 +64,8 @@ export function retryResumeMode(meta) {
     return meta?.cycle_pending !== true;
 }
 /** One pure function producing the action for a node known-dead. Used at
- *  exactly two call sites — an exit-policy job and the startup recovery sweep
- *  (design D-12) — so exit recovery and startup recovery can never diverge.
+ *  exactly two call sites — an exit-policy job and the node-lifecycle tick
+ *  (design D-12) — so exit recovery and tick recovery can never diverge.
  *  Evaluated in table order; `busy` is the on-disk busy marker.
  *
  *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
@@ -126,12 +127,20 @@ export function respawnBackoffMs(consecutiveFailures) {
         return 0;
     return Math.min(RESPAWN_BACKOFF_BASE_MS * 2 ** (consecutiveFailures - 1), RESPAWN_BACKOFF_MAX_MS);
 }
+/** How long a capacity denial stays quiet before it is worth logging again. */
+const CAPACITY_LOG_THROTTLE_MS = 30_000;
 export class DaemonFleet {
     #epoch;
     #enqueue;
     #now;
     #map = new Map();
     #throttle = new Map();
+    /** Slots claimed but not yet held by a registered broker: a launch in flight,
+     *  or a broker that exited and whose exit-policy job has not yet decided
+     *  whether to relaunch it. Counting both against the cap is what keeps a
+     *  1:1 respawn from losing its own slot to a concurrent launcher. */
+    #reservations = new Set();
+    #lastCapacityLogAt = Number.NEGATIVE_INFINITY;
     constructor(opts) {
         this.#epoch = opts.epoch;
         this.#enqueue = opts.enqueue;
@@ -155,6 +164,7 @@ export class DaemonFleet {
             clearTimeout(throttle.timer);
             throttle.timer = undefined;
         }
+        this.#reservations.delete(nodeId);
         this.#map.set(nodeId, {
             pid: handle.pid,
             launchedAt: this.#now(),
@@ -171,29 +181,59 @@ export class DaemonFleet {
     size() {
         return this.#map.size;
     }
+    occupancy() {
+        return this.#map.size + this.#reservations.size;
+    }
+    reserveSlot(nodeId) {
+        if (this.#reservations.has(nodeId) || this.#map.has(nodeId))
+            return true;
+        const { automaticReviveCap } = brokerThresholdsForDaemon();
+        if (this.occupancy() < automaticReviveCap) {
+            this.#reservations.add(nodeId);
+            return true;
+        }
+        const now = this.#now();
+        if (now - this.#lastCapacityLogAt >= CAPACITY_LOG_THROTTLE_MS) {
+            this.#lastCapacityLogAt = now;
+            emitEvent({
+                level: 'warn',
+                event: 'broker.capacity.revive_deferred',
+                fields: { live_count: this.occupancy(), hard_cap: automaticReviveCap },
+            });
+        }
+        return false;
+    }
+    releaseReservation(nodeId) {
+        this.#reservations.delete(nodeId);
+    }
     entries() {
         return this.#map.entries();
     }
     forget(nodeId) {
         this.#map.delete(nodeId);
+        this.#reservations.delete(nodeId);
         this.#clearThrottle(nodeId);
     }
     onChildExit(nodeId, status) {
-        // Remove the entry BEFORE enqueuing the policy job: the slot is freed at
-        // exit, which is what makes exit-driven 1:1 respawns cap-exempt (D-7).
+        // Move the slot from the registry to a reservation in ONE synchronous
+        // step: the exit-policy job about to be enqueued may relaunch this node,
+        // and holding the slot for it is what keeps a 1:1 respawn from losing its
+        // own capacity to a launcher that raced onto the lane first. `#applyPolicy`
+        // releases it on every path that does not relaunch.
         const entry = this.#map.get(nodeId);
         this.#map.delete(nodeId);
+        this.#reservations.add(nodeId);
         const launchedAt = entry?.launchedAt ?? null;
         this.#enqueue(() => this.#runExitPolicy(nodeId, status, launchedAt));
     }
     deliverExit(nodeId, status) {
         this.onChildExit(nodeId, status);
     }
-    /** Startup recovery sweep entry (design flow C step 2 / D-12): classify a
-     *  known-dead row and enact immediately through the SAME table exit events
-     *  use. Returns the action so the caller can capacity-gate launches. */
-    async recoverDeadNode(nodeId) {
-        return this.#applyPolicy(nodeId, 'sweep');
+    /** The node-lifecycle tick's enactment entry: classify a known-dead row and
+     *  enact immediately through the SAME policy table exit events use, so tick
+     *  recovery and exit recovery can never diverge. */
+    async applyDeadRowPolicy(nodeId) {
+        await this.#applyPolicy(nodeId, 'tick');
     }
     /** A revive refusal before its launch try/catch leaves the row active but
      *  with no fleet entry. Convert that otherwise-silent strand into the same
@@ -270,6 +310,18 @@ export class DaemonFleet {
         });
     }
     async #applyPolicy(nodeId, origin) {
+        try {
+            return await this.#decideAndEnact(nodeId, origin);
+        }
+        finally {
+            // The reservation this node has held since its exit is either consumed by
+            // a successful `register` (making this a no-op) or given back here — the
+            // one release path covering a declined policy, a deferred backoff, and
+            // terminalization alike.
+            this.releaseReservation(nodeId);
+        }
+    }
+    async #decideAndEnact(nodeId, origin) {
         const meta = getNode(nodeId);
         // Two durable witnesses mean the dead broker had a turn in flight. A dirty
         // death leaves the busy marker behind; a bounded graceful abort clears busy
@@ -329,9 +381,13 @@ export class DaemonFleet {
             });
             return;
         }
-        // Only a fresh exit consults the backoff: a matured timer and the startup
-        // sweep enact immediately (the timer already WAS the backoff, and startup
-        // counters are empty for a fresh epoch).
+        // A backoff timer already owns this node's next respawn; a tick that
+        // enacted the same policy meanwhile would defeat the throttle entirely.
+        if (origin === 'tick' && state.timer !== undefined)
+            return;
+        // Only a fresh exit consults the backoff: a matured timer and a tick
+        // enactment relaunch immediately (the timer already WAS the backoff, and a
+        // tick candidate reached the lane only after its own gating).
         if (origin === 'exit') {
             const delay = respawnBackoffMs(state.failures);
             if (delay > 0) {
@@ -369,6 +425,9 @@ export class DaemonFleet {
         });
         try {
             reviveNode(nodeId, {
+                // A recovery that loses the race for the last slot freezes and waits
+                // for one — the tick thaws it — rather than erroring the node away.
+                capacity: 'freeze',
                 resume: action === 'respawn-resume',
                 // A resumed session whose turn was interrupted comes back parked at an
                 // idle prompt with the dead turn unfinished. The continuation re-drives

package/dist/daemon/messaging/node-message.js

@@ -64,7 +64,9 @@ export async function deliverNodeMessage(args) {
             deliveryUnroutable(args.node_id, 'origin_missing');
         if (!isBrokerLive(target)) {
             try {
-                revived = reviveNode(args.node_id, { resume: true }).launch !== undefined;
+                // Mail is durable, so a wake denied for capacity waits for a slot
+                // rather than being lost: the row freezes and the tick relaunches it.
+                revived = reviveNode(args.node_id, { resume: true, capacity: 'freeze' }).launch !== undefined;
             }
             catch {
                 // The durable entry remains authoritative; one wake attempt is enough.

package/dist/daemon/profile-delete.js

@@ -216,7 +216,7 @@ async function detachProfile(plan) {
     const detached = new Set(detachedNodeIds);
     for (const nodeId of restartNodeIds) {
         if (detached.has(nodeId))
-            reviveNode(nodeId, { resume: true, recovery: true });
+            reviveNode(nodeId, { resume: true, recovery: true, capacity: 'freeze' });
     }
     return {
         ...resultForPlan(plan),

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -1,17 +1,30 @@
 import { type NodeRow } from '../../core/canvas/index.js';
-import type { FleetRegistry } from '../../core/runtime/fleet.js';
+import { type FleetRegistry } from '../../core/runtime/fleet.js';
 export interface DetachedWorkLifecycle {
     acceptsDetachedWork(): boolean;
     registerDetached(work: Promise<void>): void;
 }
 export interface BrokerSupervisionContext {
+    /** The rows the tick loaded — supervision walks these and looks each one's
+     *  fleet entry up, rather than re-reading a row per live entry. */
+    rows: readonly NodeRow[];
     fleet: FleetRegistry;
     lifecycle: DetachedWorkLifecycle;
 }
-export declare function brokerThresholdsForDaemon(): {
-    warning: number;
-    automaticReviveCap: number;
-};
+export interface SaturationContext {
+    fleet: FleetRegistry;
+    lifecycle: DetachedWorkLifecycle;
+    thresholds: {
+        warning: number;
+        automaticReviveCap: number;
+    };
+    /** What the freeze lane left frozen this tick, split into rows that stalled
+     *  and rows waiting on mail. */
+    frozen: {
+        stalled: number;
+        waitingOnMail: number;
+    };
+}
 export declare const YIELD_STALL_GRACE_MS: number;
 export declare const WEDGE_QUIET_MS: number;
 export declare const WEDGE_CPU_MAX_PERCENT = 2;
@@ -34,11 +47,17 @@ export declare class BrokerSupervisionReconciler {
     private readonly unattendedSince;
     private knownAuthMtimeMs;
     private lastOverCapWarnAt;
-    private lastCapacityLogAt;
-    run(now: number, ctx: BrokerSupervisionContext): Promise<{
+    /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth
+     *  reload does not depend on a successful canvas scan, and the thresholds it
+     *  returns are read once for the whole tick. */
+    runFleetPreamble(fleet: FleetRegistry): Promise<{
         warning: number;
         automaticReviveCap: number;
     }>;
+    /** The saturation notice, run LAST in the tick: the frozen split it reports
+     *  is only known once the freeze lane has spent this tick's free slots. */
+    warnIfSaturated(ctx: SaturationContext): void;
+    run(now: number, ctx: BrokerSupervisionContext): Promise<void>;
     /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
      *  node is unavailable to park, attended, or has work waiting. Short-circuits
      *  in cost order so the common tick does no file reads it can avoid.
@@ -58,6 +77,4 @@ export declare class BrokerSupervisionReconciler {
     private handleWedgeDetection;
     private handleFatalFault;
     private handleAuthReload;
-    hasBrokerCapacity(max: number, fleet: FleetRegistry): boolean;
-    hasStartupRecoveryCapacity(fleet: FleetRegistry): boolean;
 }