@north-light/crouter 0.3.241 → 0.3.243

package/dist/core/runtime/naming.js

@@ -1,14 +1,15 @@
 // Session naming — turn a node's first prompt into a short, human-readable
-// handle for the editor label.
+// label.
 //
-// A node's editor label is `<mode-icon> <name> <kind>` (see editorLabel in
-// labels.ts). The `<name>` is a 3-8 word kebab-case "description" derived from
-// the first prompt by asking Pi headlessly, persisted on the node's meta so it
-// survives revives and updates the live session name.
+// One call produces BOTH forms a surface needs, so no consumer has to un-mangle
+// the other's format: `name` is the 3-8 word kebab-case handle that sits in a
+// node's editor label (`<mode-icon> <name> <kind>`, see editorLabel in
+// labels.ts) and a tmux window name, `title` is the prose sentence a person
+// reads in a conversation list, punctuation intact.
 //
-// The namer returns a STRUCTURED result — {name, icon} — produced by constrained
-// sampling through the one-shot `name_session` tool, not by parsing prose. The
-// icon is a Nerd Font glyph the model picks freely
+// The namer returns a STRUCTURED result — {name, title, icon} — produced by
+// constrained sampling through the one-shot `name_session` tool, not by parsing
+// prose. The icon is a Nerd Font glyph the model picks freely
 // (guided by example blocks, not a closed enum) and is stored as its own meta
 // field, so each surface decides whether to render it.
 //
@@ -47,13 +48,19 @@ const ICON_EXAMPLES = [
     'interface/design: U+F1FC paintbrush, U+F03E image, U+F108 display',
     'communication/coordination: U+F1D8 paper plane, U+F0E6 comments, U+F0E8 sitemap, U+F0C1 link',
 ].join('\n');
-const NAME_SYSTEM_PROMPT = 'You name coding-agent work sessions. The name is a label used to identify the ' +
-    'session at a glance among many other concurrent programming sessions, so it must ' +
-    'describe what the task is about.\n\n' +
+const NAME_SYSTEM_PROMPT = 'You label agent sessions. A session is whatever a person opened it for: a coding task, ' +
+    'a question, a piece of research, an idea they are turning over, or an ordinary ' +
+    'conversation. You are labelling that session, never taking part in it — do not answer ' +
+    'the message, do not do the work it asks for, do not comment on it. Every session gets a ' +
+    'label, however short, casual, misspelled, or open-ended its opening message is.\n\n' +
     'Call the `name_session` tool exactly once with:\n' +
-    '- `name`: a concise 3-8 word kebab-case name — lowercase words joined by single ' +
-    'hyphens (e.g. `refactor-auth-token-flow`, `add-csv-export-endpoint`). No punctuation, ' +
-    'quotes, or prose.\n' +
+    '- `title`: how a person would refer to this session in a list of their conversations — ' +
+    '2-8 words, sentence case, written naturally with its punctuation intact (e.g. ' +
+    "`What's your favorite color?`, `Payroll export mapping bug`, `Ideas for the launch " +
+    'email`). No quotes, no markdown, no trailing period.\n' +
+    '- `name`: the same subject as a concise 3-8 word kebab-case handle — lowercase words ' +
+    'joined by single hyphens (e.g. `favorite-color-question`, `refactor-auth-token-flow`). ' +
+    'No punctuation, quotes, or prose.\n' +
     '- `icon`: ONE Nerd Font glyph, written as its codepoint in `U+XXXX` form (e.g. ' +
     '`U+F188`). Emit a codepoint, not a name like `nf-fa-bug`, and not an emoji.\n\n' +
     'Choosing the icon — work through it in this order:\n' +
@@ -76,14 +83,11 @@ const NAME_SYSTEM_PROMPT = 'You name coding-agent work sessions. The name is a l
  *  text for the instruction. The source is capped first, so the closing tag is
  *  always present. */
 function nameUserPrompt(source, sourceCap = PROMPT_CAP) {
-    return `<source>\n${source.slice(0, sourceCap)}\n</source>\n\nName this session based on the work described above, and pick an icon depicting it. Call \`name_session\` once, then stop.`;
+    return `<source>\n${source.slice(0, sourceCap)}\n</source>\n\nLabel the session this text is from: call \`name_session\` once with a title, a name, and an icon depicting it, then stop. Do not answer it.`;
 }
-/** A short stop-word set so the local-slug fallback skips filler words. */
-const STOPWORDS = new Set([
-    'the', 'a', 'an', 'and', 'or', 'but', 'to', 'of', 'in', 'on', 'for', 'with',
-    'is', 'are', 'be', 'this', 'that', 'it', 'as', 'at', 'by', 'from', 'into',
-    'please', 'can', 'you', 'i', 'we', 'my', 'our', 'me', 'so', 'then',
-]);
+/** Cap on a generated title — room for a full sentence-case phrase, short
+ *  enough that a conversation list stays scannable. */
+const TITLE_CAP = 72;
 /** Coerce arbitrary text into a 3-8 word kebab-case name, or '' if nothing
  *  usable survives. Lowercases, keeps [a-z0-9], collapses everything else to a
  *  single hyphen, and clamps to the first 8 words. */
@@ -96,17 +100,34 @@ export function sanitizeSessionName(raw) {
         .filter((w) => w !== '');
     return words.slice(0, 8).join('-');
 }
-/** Local fallback: derive a name straight from the prompt (no pi call). Drops
- *  stop-words, takes the first few content words. */
+/** Coerce arbitrary text into a one-line prose title, or '' if nothing usable
+ *  survives. Takes the first non-empty line, collapses runs of whitespace, drops
+ *  wrapping quotes, clamps at a word boundary, and capitalizes the opening
+ *  letter. Punctuation INSIDE the line survives — carrying it is what `title`
+ *  is for. */
+export function sanitizeSessionTitle(raw) {
+    const line = (raw ?? '').split('\n').map((l) => l.trim()).find((l) => l !== '') ?? '';
+    const collapsed = line.replace(/\s+/g, ' ').replace(/^["'`]+|["'`]+$/g, '').trim();
+    if (collapsed === '')
+        return '';
+    let clamped = collapsed;
+    if (collapsed.length > TITLE_CAP) {
+        const cut = collapsed.slice(0, TITLE_CAP);
+        const boundary = cut.lastIndexOf(' ');
+        clamped = `${(boundary > TITLE_CAP / 2 ? cut.slice(0, boundary) : cut).trimEnd()}\u2026`;
+    }
+    return clamped.charAt(0).toUpperCase() + clamped.slice(1);
+}
+/** Local fallback: the opening of the prompt as a title (no pi call), with its
+ *  punctuation. Whitespace collapses first so a multi-line message contributes
+ *  its actual opening words rather than whatever its first line happened to be. */
+export function titleFromPrompt(prompt) {
+    return sanitizeSessionTitle((prompt ?? '').replace(/\s+/g, ' '));
+}
+/** Local fallback: derive a kebab handle straight from the prompt (no pi call),
+ *  from the same opening words the fallback title keeps. */
 export function slugFromPrompt(prompt) {
-    const words = (prompt ?? '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, ' ')
-        .split(' ')
-        .filter((w) => w !== '' && !STOPWORDS.has(w));
-    const picked = (words.length > 0 ? words : (prompt ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').split(' ').filter(Boolean))
-        .slice(0, 3);
-    return sanitizeSessionName(picked.join('-')) || 'session';
+    return sanitizeSessionName(titleFromPrompt(prompt)) || 'session';
 }
 /** The namer's model: the `light` rung of the DEFAULT provider's ladder, with
  *  any thinking suffix stripped because the one-shot session uses thinking off.
@@ -134,6 +155,10 @@ function nameModelRequest() {
 const NAME_SESSION_SCHEMA = {
     type: 'object',
     properties: {
+        title: {
+            type: 'string',
+            description: 'A 2-8 word sentence-case title a person would recognize this session by in a list, with its punctuation intact, e.g. Payroll export mapping bug. No quotes, markdown, or trailing period.',
+        },
         name: {
             type: 'string',
             description: 'A 3-8 word kebab-case session name: lowercase words joined by single hyphens, e.g. refactor-auth-token-flow. No punctuation, quotes, or prose.',
@@ -143,7 +168,7 @@ const NAME_SESSION_SCHEMA = {
             description: 'The Nerd Font glyph depicting this session, as a codepoint in U+XXXX form (e.g. U+F188).',
         },
     },
-    required: ['name', 'icon'],
+    required: ['title', 'name', 'icon'],
     additionalProperties: false,
 };
 /** Normalize a model-supplied icon to a single renderable glyph, or '' when
@@ -181,35 +206,42 @@ export function sanitizeIcon(raw) {
         return '';
     return points[0].codePointAt(0) >= 0x2000 ? trimmed : '';
 }
-/** Ask Pi headlessly for a structured {name, icon} for `body`, async. Resolves
- *  to a sanitized SessionName, or `{name:'',icon:''}` on timeout, a missing tool
- *  call, or a malformed emission so the caller can fall back to a local slug.
+/** Ask Pi headlessly for a structured {name, title, icon} for `body`, async.
+ *  Resolves to a sanitized SessionName, or `{name:'',title:'',icon:''}` on
+ *  timeout, a missing tool call, or a malformed emission so the caller can fall
+ *  back to the prompt's own words.
+ *
+ *  Nothing FORCES the tool call — constrained sampling shapes the arguments once
+ *  the model decides to call it — so a model that answers in prose instead gets
+ *  one more attempt before the caller falls back.
  *
  *  This module stays canvas-free so CLI leaves can reach it. The canvas-coupled
  *  commit path lives in pi-extensions/broker-local.ts, which imports this pure
  *  helper and writes through crtrd's guarded generated-name operation. */
 export async function headlessName(body, sourceCap = PROMPT_CAP) {
-    const empty = { name: '', icon: '' };
-    const route = nameModelRequest();
-    const emitted = await headlessToolCall({
+    const empty = { name: '', title: '', icon: '' };
+    const request = {
         systemPrompt: NAME_SYSTEM_PROMPT,
         userPrompt: nameUserPrompt(body, sourceCap),
-        ...route,
+        ...nameModelRequest(),
         timeoutMs: NAME_TIMEOUT_MS,
         tool: {
             name: 'name_session',
             label: 'Name session',
-            description: 'Record the name and icon for this coding session. Call exactly once, then stop.',
+            description: 'Record the title, name, and icon for this session. Call exactly once, then stop.',
             parameters: NAME_SESSION_SCHEMA,
             constrainedSampling: { type: 'json_schema', strict: 'prefer' },
         },
-    });
+    };
+    const emitted = await headlessToolCall(request) ?? await headlessToolCall(request);
     if (emitted === null || typeof emitted !== 'object')
         return empty;
     const parsed = emitted;
-    const name = sanitizeSessionName(typeof parsed['name'] === 'string' ? parsed['name'] : '');
+    const title = sanitizeSessionTitle(typeof parsed['title'] === 'string' ? parsed['title'] : '');
+    const name = sanitizeSessionName(typeof parsed['name'] === 'string' ? parsed['name'] : '')
+        || sanitizeSessionName(title);
     const icon = sanitizeIcon(typeof parsed['icon'] === 'string' ? parsed['icon'] : '');
-    return name !== '' ? { name, icon } : empty;
+    return name !== '' ? { name, title, icon } : empty;
 }
 /** Generate a name from a bounded conversation source rather than a single
  *  kickoff message. The caller owns selecting representative conversation text;

package/dist/core/runtime/reset.js

@@ -111,11 +111,18 @@ export async function relaunchRoot(oldId, deps = {}) {
         ...inv.env,
         CRTR_SUBTREE: rootOfSpine(newMeta.node_id),
     };
-    const placed = launchBroker(newMeta.node_id, inv, {
-        cwd: old.cwd,
-        name: fullName(newMeta),
-        resuming: false,
-    });
+    let placed;
+    try {
+        placed = launchBroker(newMeta.node_id, inv, {
+            cwd: old.cwd,
+            name: fullName(newMeta),
+            resuming: false,
+        });
+    }
+    catch (error) {
+        transition(newMeta.node_id, 'crash');
+        throw error;
+    }
     if (placed.pid == null) {
         // The new broker never started — crash the half-born node and BAIL. The old
         // root is still live and untouched (nothing below this point has run).

package/dist/core/runtime/revive-all.d.ts

@@ -7,16 +7,9 @@ import type { NodeMeta, NodeStatus } from '../canvas/types.js';
  *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
  *  — the exclusion is unconditional.) */
 export declare const TERMINAL_BY_CHOICE: readonly NodeStatus[];
-/** True when `meta` has no natural future cycle ahead of it — either its own
- *  work is finished (`final_report` set) or it landed deliberately in one of
- *  TERMINAL_BY_CHOICE. Nothing in the runtime (daemon supervision, the live
- *  inbox watcher's own hold-and-flush) ever brings such a node back on its
- *  own — only an explicit revive/reopen does. Shared by `isDisconnected`
- *  (mass-revive scope, below) and `node message send --tier deferred`'s terminal-edge
- *  rejection — a deferred entry appended to such a target would
- *  never be delivered, so that doorway rejects instead of silently holding
- *  it forever. */
-export declare function hasNoNaturalCycle(meta: Pick<NodeMeta, 'status' | 'final_report'>): boolean;
+/** True when `meta` has no natural future cycle ahead of it. A frozen row is
+ *  excluded because its mark records a thaw cycle already owed. */
+export declare function hasNoNaturalCycle(meta: Pick<NodeMeta, 'status' | 'final_report' | 'frozen_at'>): boolean;
 /** True when `meta`'s engine is NOT running but it has a resumable saved session
  *  — the precise "disconnected" predicate.
  *
@@ -28,7 +21,7 @@ export declare function hasNoNaturalCycle(meta: Pick<NodeMeta, 'status' | 'final
  *    it — so such a node comes back fresh).
  *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
  *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
- *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *  - unfrozen terminal-by-choice (`done`/`canceled`) is excluded.
  *  - a node that already pushed its FINAL REPORT (`final_report` set) FINISHED
  *    its own work — it is excluded regardless of status. A crash mid-reap can
  *    leave it `dead` (not terminal-by-choice) with its report already committed;

package/dist/core/runtime/revive-all.js

@@ -3,8 +3,8 @@
 // After a mass-disconnect event (a reboot, a killed login/tmux session, a mass
 // crash, or the daemon being down a while) many nodes end up with their
 // canvas.db row + saved conversation intact but NO broker engine running. The
-// daemon recovers active|idle rows during its explicit startup sweep and from
-// broker exit events during its own epoch, but it deliberately never touches
+// daemon recovers active|idle rows during its row-driven supervision tick and
+// from broker exit events during its own epoch, but it deliberately never touches
 // terminal/dormant states, so the operator is left reviving survivors one id at
 // a time.
 //
@@ -24,17 +24,10 @@ import { reviveNode } from './revive.js';
  *  is involuntary, so it is swept. (Silas, 2026-06-13: no opt-in to include these
  *  — the exclusion is unconditional.) */
 export const TERMINAL_BY_CHOICE = ['done', 'canceled'];
-/** True when `meta` has no natural future cycle ahead of it — either its own
- *  work is finished (`final_report` set) or it landed deliberately in one of
- *  TERMINAL_BY_CHOICE. Nothing in the runtime (daemon supervision, the live
- *  inbox watcher's own hold-and-flush) ever brings such a node back on its
- *  own — only an explicit revive/reopen does. Shared by `isDisconnected`
- *  (mass-revive scope, below) and `node message send --tier deferred`'s terminal-edge
- *  rejection — a deferred entry appended to such a target would
- *  never be delivered, so that doorway rejects instead of silently holding
- *  it forever. */
+/** True when `meta` has no natural future cycle ahead of it. A frozen row is
+ *  excluded because its mark records a thaw cycle already owed. */
 export function hasNoNaturalCycle(meta) {
-    return meta.final_report != null || TERMINAL_BY_CHOICE.includes(meta.status);
+    return meta.frozen_at == null && (meta.final_report != null || TERMINAL_BY_CHOICE.includes(meta.status));
 }
 /** True when `meta`'s engine is NOT running but it has a resumable saved session
  *  — the precise "disconnected" predicate.
@@ -47,7 +40,7 @@ export function hasNoNaturalCycle(meta) {
  *    it — so such a node comes back fresh).
  *  - `human`-kind rows are the `crtr human` bridge, never a pi engine, so they
  *    are never "disconnected" (mirrors the daemon's superviseTick carve-out).
- *  - terminal-by-choice (`done`/`canceled`) is always excluded.
+ *  - unfrozen terminal-by-choice (`done`/`canceled`) is excluded.
  *  - a node that already pushed its FINAL REPORT (`final_report` set) FINISHED
  *    its own work — it is excluded regardless of status. A crash mid-reap can
  *    leave it `dead` (not terminal-by-choice) with its report already committed;

package/dist/core/runtime/warm-pool.js

@@ -50,10 +50,10 @@
 // different directory than the last one simply misses and cold-spawns — the
 // pool serves the common case of returning to the same working directory.
 //
-// Nothing ever RESUMES a spare: the daemon's recovery sweep reads `listNodes`,
-// which hides the pool, so a spare whose broker dies (every daemon handover
-// tears down every broker of the epoch) is garbage, not a parked node. It is
-// also invisible to the count-based prune for the same reason. So the pool owns
+// Nothing ever resumes a spare: the daemon's row query hides the pool, so a
+// spare whose broker dies (every daemon handover tears down every broker of the
+// epoch) is garbage, not a parked node. It is also invisible to the count-based
+// prune for the same reason. So the pool owns
 // its own garbage collection — `reapStaleSpares`, below, run at daemon start
 // and on every supervision tick.
 import { createHash } from 'node:crypto';

package/dist/daemon/api/__tests__/node-create-description.test.js

@@ -78,6 +78,7 @@ test('node create stores caller description and automatic naming leaves it and n
     const generated = await generatedNameRoute.handler(context('POST', `/v1/nodes/${nodeId}/broker/generated-name`, nodeId, {
         kind: 'initial',
         description: 'Generated replacement',
+        title: 'Generated replacement',
         icon: '',
     }));
     assert.deepEqual(generated.body, { applied: false });

package/dist/daemon/api/handlers/broker-ops.js

@@ -88,6 +88,7 @@ function extensionNode(node) {
         node_id: node.node_id,
         name: node.name,
         ...(node.description === undefined ? {} : { description: node.description }),
+        ...(node.title === undefined ? {} : { title: node.title }),
         ...(node.icon === undefined ? {} : { icon: node.icon }),
         kind: node.kind,
         mode: node.mode,
@@ -153,17 +154,18 @@ function parseGeneratedNameBody(body) {
     const value = objectBody(body, 'broker generated-name');
     if (value['kind'] !== 'initial' && value['kind'] !== 'recap')
         throw usage('kind must be initial or recap');
-    if (typeof value['description'] !== 'string' || typeof value['icon'] !== 'string') {
-        throw usage('description and icon must be strings');
+    if (typeof value['description'] !== 'string' || typeof value['title'] !== 'string' || typeof value['icon'] !== 'string') {
+        throw usage('description, title, and icon must be strings');
+    }
+    if (value['kind'] === 'initial') {
+        return { kind: 'initial', description: value['description'], title: value['title'], icon: value['icon'] };
     }
-    if (value['kind'] === 'initial')
-        return { kind: 'initial', description: value['description'], icon: value['icon'] };
     const expected = value['expected'];
     if (typeof expected !== 'object' || expected === null || Array.isArray(expected)
-        || ['name', 'description', 'icon', 'kind'].some((key) => typeof expected[key] !== 'string')) {
-        throw usage('recap expected must contain name, description, icon, and kind strings');
+        || ['name', 'description', 'title', 'icon', 'kind'].some((key) => typeof expected[key] !== 'string')) {
+        throw usage('recap expected must contain name, description, title, icon, and kind strings');
     }
-    return { kind: 'recap', description: value['description'], icon: value['icon'], expected: expected };
+    return { kind: 'recap', description: value['description'], title: value['title'], icon: value['icon'], expected: expected };
 }
 function parsePersonaAckBody(body) {
     const value = objectBody(body, 'broker persona-ack');
@@ -371,27 +373,32 @@ function handleGeneratedName(ctx) {
                 return { applied: false };
             const updated = updateNode(nodeId, {
                 description: request.description,
+                ...(request.title.trim() === '' ? {} : { title: request.title }),
                 ...(request.icon.trim() === '' ? {} : { icon: request.icon }),
             });
             return {
                 applied: true,
                 editorLabel: editorLabel(updated),
                 description: updated.description ?? '',
+                title: updated.title ?? '',
                 icon: updated.icon ?? '',
             };
         }
         const expected = request.expected;
         if (node.name !== expected.name || (node.description ?? '') !== expected.description
+            || (node.title ?? '') !== expected.title
             || (node.icon ?? '') !== expected.icon || node.kind !== expected.kind)
             return { applied: false };
         const updated = updateNode(nodeId, {
             description: request.description,
+            title: request.title.trim() === '' ? undefined : request.title,
             icon: request.icon.trim() === '' ? undefined : request.icon,
         });
         return {
             applied: true,
             editorLabel: editorLabel(updated),
             description: updated.description ?? '',
+            title: updated.title ?? '',
             icon: updated.icon ?? '',
         };
     });

package/dist/daemon/api/handlers/feedback-comments.js

@@ -67,7 +67,7 @@ async function deliverCommentTurn(args) {
             mode: 'interactive',
             data: { page_id: basename(args.dir), comment_id: args.mutation.comment.id, verb: 'create' },
         });
-        return { target_node_id: target, status: 'delivered', via: delivery.via, woke: delivery.revived };
+        return { target_node_id: target, status: 'delivered', via: delivery.via, woke: delivery.revived, ...(delivery.reason === undefined ? {} : { reason: delivery.reason }) };
     }
     catch (error) {
         // State was committed before delivery; a delivery failure remains a

package/dist/daemon/api/map.js

@@ -124,6 +124,8 @@ export function toNodeDetailDTO(meta, edges) {
     };
     if (meta.description !== undefined)
         dto.description = meta.description;
+    if (meta.title !== undefined)
+        dto.title = meta.title;
     if (meta.icon !== undefined)
         dto.icon = meta.icon;
     if (meta.cycles !== undefined)

package/dist/daemon/crtrd.js

@@ -9,9 +9,8 @@
 // clock. A broker's real `exit` event enqueues an exit-policy job on the
 // daemon's serial work lane (never inline on the Node event callback), where
 // classifyDeadNode — one pure 8-row policy table over durable row state —
-// decides forget / dormant / respawn / boot-failure. The startup recovery
-// sweep classifies boot-time dead rows through the SAME table, so exit
-// recovery and startup recovery can never diverge. Every broker's argv is
+// decides forget / dormant / respawn / boot-failure. The row-driven tick
+// classifies disconnected rows through the same table. Every broker's argv is
 // stamped `--epoch <id>`: at boot the census reaps every prior-epoch broker
 // (no adoption), and at shutdown the daemon tears its whole fleet down, so no
 // broker ever outlives the daemon epoch that launched it. A tmux pane, when
@@ -94,8 +93,8 @@ export function brokerCommandDeclaresCanvasHome(command, home) {
 // readiness mirror, reap every broker of a PRIOR epoch on its own canvas.
 // Ownership is never adopted across epochs — a prior daemon's ChildProcess
 // handles died with it, so its brokers are unsupervisable; tear them down and
-// let the startup recovery sweep reclassify their rows through the policy
-// table. A broker whose argv carries NO `--epoch` tag is a legacy-generation
+// let the next supervision tick classify their rows through the policy table.
+// A broker whose argv carries NO `--epoch` tag is a legacy-generation
 // broker and gets the same verdict (reap): it predates epoch ownership.
 /** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
  *  for a legacy/untagged broker (which the census treats as prior-epoch). */
@@ -110,9 +109,9 @@ const CENSUS_POLL_MS = 150;
 async function reapPriorEpochBrokers(epoch) {
     const snapshot = captureLivenessSnapshot();
     if (snapshot === null) {
-        // No process table — the census cannot run. The startup recovery sweep
-        // still reclassifies rows; a surviving prior-epoch broker is at worst a
-        // duplicate engine risk the next daemon boot's census retries.
+        // No process table — the census cannot run. The supervision tick still
+        // classifies rows; a surviving prior-epoch broker is at worst a duplicate
+        // engine risk the next daemon boot's census retries.
         emitEvent({
             level: 'error',
             event: 'daemon.census.snapshot_failed',
@@ -184,10 +183,9 @@ async function reapPriorEpochBrokers(epoch) {
 // Daemon-shutdown fleet teardown (invariant 2: no broker outlives the daemon
 // epoch that launched it). SIGTERM every live entry, race each handle's real
 // exit against ONE shared bounded grace, then SIGKILL each survivor's captured
-// process tree. Rows are deliberately NOT rewritten here — the NEXT daemon's
-// startup recovery sweep classifies them through the policy table, exactly as
-// it would after a daemon crash, so clean shutdown and crash converge on one
-// recovery path.
+// process tree. Rows are deliberately NOT rewritten here — the next daemon's
+// supervision tick classifies them through the policy table, so clean shutdown
+// and crash converge on one recovery path.
 const FLEET_TEARDOWN_GRACE_MS = 5_000;
 async function teardownFleet(fleet) {
     const entries = Array.from(fleet.entries());
@@ -292,7 +290,7 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
         // Human bridge rows have no broker engine and participate in none of the
         // recurring row-driven reconciler passes.
         rows = listNodes({ status: ['active', 'idle'] }).filter((row) => row.kind !== 'human');
-        terminating = listNodes({ status: ['done', 'canceled', 'dead'], withRecordedPid: true })
+        terminating = listNodes({ status: ['done', 'canceled', 'dead'], withRecordedPidOrFrozen: true })
             .filter((row) => row.kind !== 'human');
     }
     catch (err) {
@@ -427,7 +425,7 @@ export async function runDaemon(opts = {}) {
     // The grace covers: response flush → the CLI process printing and exiting →
     // pi persisting the tool result. It is NOT a correctness fallback; a broker
     // SIGTERMed mid-turn still gets `abortAndExit`'s own bounded persistence
-    // window, and the successor's startup recovery sweep resumes it either way.
+    // window, and the successor's supervision tick resolves it either way.
     const HANDOVER_ACK_GRACE_MS = 1_000;
     let handoverArmed = false;
     /** Arm the handover. Idempotent: a retry while one is already scheduled
@@ -484,7 +482,7 @@ export async function runDaemon(opts = {}) {
         catch (error) {
             // The canvas is now daemonless. Loud, and recoverable: the next front-door
             // command's ensureDaemon() starts one, and every torn-down node is
-            // reclassified by that daemon's startup recovery sweep.
+            // reclassified by that daemon's supervision tick.
             operationIdContext.fresh(() => {
                 emitEvent({ level: 'error', event: 'daemon.handover.successor_failed', error });
             });
@@ -530,9 +528,8 @@ export async function runDaemon(opts = {}) {
         void requestCleanup().catch(() => { });
     }
     /** The serial work lane (design D-3): supervision ticks, exit-policy jobs,
-     *  matured backoff respawns, and the startup recovery sweep all append here
-     *  and run strictly one at a time, so policy never interleaves with a tick's
-     *  row reads. `laneTail` never rejects — every append attaches the rejection
+     *  and matured backoff respawns run strictly one at a time, so policy never
+     *  interleaves with a tick's row reads. `laneTail` never rejects — every append attaches the rejection
      *  handler. Once admission closes, new jobs are DROPPED (not queued): a
      *  shutdown SIGTERM fans exit events across the whole fleet, and running
      *  their policy jobs would respawn brokers mid-teardown. */
@@ -574,8 +571,8 @@ export async function runDaemon(opts = {}) {
         bindDaemonEventSource();
         interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
         // Mint this daemon's epoch and bind the ONE fleet registry for the process
-        // BEFORE anything can launch a broker (the API server, the recovery sweep,
-        // any tick): every launch funnels through headlessBrokerHost.launch, which
+        // BEFORE anything can launch a broker (the API server or any tick): every
+        // launch funnels through headlessBrokerHost.launch, which
         // registers with the bound fleet — an unbound launch throws (design D-2).
         const epoch = randomBytes(8).toString('hex');
         fleet = new DaemonFleet({ epoch, enqueue });

package/dist/daemon/messaging/node-message.d.ts

@@ -3,6 +3,7 @@ export interface NodeMessageDelivery {
     entry_id: string | null;
     via: 'engine' | 'inbox';
     revived: boolean;
+    reason?: 'capacity_frozen';
 }
 export interface RuntimeMessageCard {
     /** A bare core kind only. This renders with `formatCard`, which leaves the

package/dist/daemon/messaging/node-message.js

@@ -58,6 +58,7 @@ export async function deliverNodeMessage(args) {
         data: { ...args.data, body: args.body },
     }));
     let revived = false;
+    let reason;
     if (args.mode !== 'quiet') {
         target = getNode(args.node_id);
         if (target === null)
@@ -66,12 +67,15 @@ export async function deliverNodeMessage(args) {
             try {
                 // Mail is durable, so a wake denied for capacity waits for a slot
                 // rather than being lost: the row freezes and the tick relaunches it.
-                revived = reviveNode(args.node_id, { resume: true, capacity: 'freeze' }).launch !== undefined;
+                const result = reviveNode(args.node_id, { resume: true, capacity: 'freeze' });
+                revived = result.launch !== undefined;
+                if (result.outcome === 'frozen')
+                    reason = 'capacity_frozen';
             }
             catch {
                 // The durable entry remains authoritative; one wake attempt is enough.
             }
         }
     }
-    return { entry_id: entry.entry_id, via: 'inbox', revived };
+    return { entry_id: entry.entry_id, via: 'inbox', revived, ...(reason === undefined ? {} : { reason }) };
 }

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -12,8 +12,7 @@ export declare function hasLiveObligation(nodeId: string): boolean;
  *  cycle rather than causing one. */
 export declare function hasPendingWake(nodeId: string): boolean;
 /** What parking an unattended node actually amounts to — the one rule both the
- *  live-broker park clock (broker-supervision) and the already-parked
- *  reconciliation (dormant-inbox) apply.
+ *  live-broker park clock and the lifecycle tick apply.
  *
  *  `release` — something can still wake it, so parking is a pause.
  *  `park`    — a resident with nothing left to wake it has completed its

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.d.ts

@@ -43,11 +43,6 @@ export declare class FreezeLaneReconciler {
     endEpisode(nodeId: string): void;
     run(now: number, ctx: FreezeLaneContext): Promise<FrozenCounts>;
     private enact;
-    /** A frozen row is owed exactly one thing: the launch the cap refused. Strict
-     *  resume is the request, and `reviveNode` itself vetoes it for a pending
-     *  refresh or an unconfirmed cycle — the same modes the dead-row table would
-     *  have chosen. It is recovery, not a wake: nothing arrived for this node
-     *  while it waited, so an armed deadline survives the thaw. */
     private enactThaw;
     private enactIdleRelease;
 }

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.js

@@ -8,11 +8,7 @@
 // needs to pre-reserve anything. A candidate that finds the ledger full freezes
 // (`reviveNode` with `capacity: 'freeze'` is the single freeze writer) and waits
 // for the next tick.
-//
-// The idle-release episode rules below are the former DormantInboxReconciler's,
-// moved here whole: a relaunch that only ever tried to deliver mail is a launch
-// like any other, and it now competes for slots through the same lane.
-import { getRow, subscribersOf, } from '../../../core/canvas/index.js';
+import { clearFrozen, getNode, getRow, subscribersOf, } from '../../../core/canvas/index.js';
 import { fullName } from '../../../core/canvas/labels.js';
 import { isSafeNodeId } from '../../../core/canvas/paths.js';
 import { emitEvent } from '../../../core/events/emit.js';
@@ -87,7 +83,7 @@ export class FreezeLaneReconciler {
         const id = entry.row.node_id;
         try {
             if (entry.enact === 'thaw')
-                return this.enactThaw(id);
+                return this.enactThaw(entry.row);
             if (entry.enact === 'idle-release')
                 return this.enactIdleRelease(now, entry.row);
             // The SAME policy table an exit event runs, so tick recovery and exit
@@ -110,13 +106,13 @@ export class FreezeLaneReconciler {
             return 'skipped';
         }
     }
-    /** A frozen row is owed exactly one thing: the launch the cap refused. Strict
-     *  resume is the request, and `reviveNode` itself vetoes it for a pending
-     *  refresh or an unconfirmed cycle — the same modes the dead-row table would
-     *  have chosen. It is recovery, not a wake: nothing arrived for this node
-     *  while it waited, so an armed deadline survives the thaw. */
-    enactThaw(nodeId) {
-        return reviveNode(nodeId, { resume: true, capacity: 'freeze', recovery: true }).outcome === 'frozen'
+    enactThaw(row) {
+        if (row.lifecycle === 'resident' && getNode(row.node_id)?.pi_session_id != null && !hasPendingWake(row.node_id)) {
+            transition(row.node_id, 'release');
+            clearFrozen(row.node_id);
+            return 'skipped';
+        }
+        return reviveNode(row.node_id, { resume: true, capacity: 'freeze', recovery: true }).outcome === 'frozen'
             ? 'frozen'
             : 'launched';
     }

package/dist/daemon/reconcilers/node-lifecycle/respawn-policy.js

@@ -1,9 +1,3 @@
-// respawn-policy.ts — the tick's Backoff gate, and P5's file to own outright.
-//
-// P3 only READS `respawn_not_before`: nothing writes it yet, so the gate is
-// inert in effect. P5 replaces the in-memory throttle in `daemon/fleet.ts` with
-// the durable counter writes (`respawn_failures` + `respawn_not_before`) that
-// make it bite, and adds them here rather than in `tick.ts`.
 /** Whether a durable backoff still holds this row back from a relaunch. A row
  *  in backoff holds no slot and is excluded from the saturation figure — it is
  *  waiting on a clock, not on capacity. */

package/dist/daemon/reconcilers/node-lifecycle/terminating.d.ts

@@ -1,4 +1,2 @@
 import type { NodeRow } from '../../../core/canvas/index.js';
-/** Handle a terminal row that still holds a process. Deliberately inert until
- *  P4: a row reaching here is already excluded from every other tick duty. */
 export declare function handleTerminatingRow(row: NodeRow): void;