@north-light/crouter 0.3.248 → 0.3.250

package/dist/daemon/fleet.js

@@ -1,32 +1,31 @@
 // src/daemon/fleet.ts — the daemon's broker fleet: the ChildProcess-handle
 // registry (the ONE normal liveness authority), the exit-policy classifier
-// (invariant-5 policy table), and the event-driven respawn throttle.
+// (invariant-5 policy table), and durable respawn recovery.
 //
 // Constructed by runDaemon with the serial work lane's `enqueue` and this
 // daemon's epoch id, then injected into core via `bindFleet` BEFORE the API
-// server or any tick starts. Exit events never run policy inline on the Node
-// event callback — they enqueue a job on the serial lane, so policy never
-// interleaves with a tick's row reads (design D-3).
+// server or any tick starts. Exit events enqueue observation only; the durable
+// row tick owns recovery policy.
 //
 // Row state (status/intent/busy marker/session identity), never exit codes,
 // is the policy input (design D-4): the stophook writes the exit's explanation
 // before every deliberate exit, and that durable state is robust to every kill
-// path. Codes/signals are logged for diagnostics only. The single timing
-// input is uptime, used only by the throttle.
-import { getNode, subscribersOf } from '../core/canvas/index.js';
+// path. Codes/signals are logged for diagnostics only.
+import { getNode, getRow, subscribersOf } from '../core/canvas/index.js';
 import { fullName } from '../core/canvas/labels.js';
 import { isSafeNodeId } from '../core/canvas/paths.js';
 import { transition } from '../core/runtime/lifecycle.js';
 import { fanDoctrineWake } from '../core/runtime/close.js';
 import { hasCleanAbort, isBusy } from '../core/runtime/busy.js';
 import { hasPendingWake } from './reconcilers/live-obligation.js';
+import { clearRespawnPolicy, MAX_RESPAWN_ATTEMPTS, recordRespawnPolicy, respawnBackoffMs } from './reconcilers/node-lifecycle/respawn-policy.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { emitEvent } from '../core/events/emit.js';
 import { brokerThresholdsForDaemon } from '../core/runtime/fleet.js';
 // Shared crash helpers (moved from crtrd.ts — the fleet's policy paths are now
 // their primary consumers; crtrd imports them back for its surviving passes).
-/** Surface a vehicle that never booted (or exhausted its respawn budget).
+/** Surface a vehicle that never booted.
  *
  *  A pi that dies before its first session_start (so `pi_session_id` was never
  *  recorded) is invisible to its parent — the spawn returned optimistically.
@@ -42,6 +41,12 @@ export async function surfaceBootFailure(meta) {
         `If the work still needs doing, re-spawn it; if spawns keep dying, spawn fewer at a time.`;
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
+async function surfaceCrashLoop(meta) {
+    const body = `⚠ Crash loop — \`${meta.name}\` (${meta.kind}) kept dying without settling a turn.\n\n` +
+        `Its session started successfully, but six consecutive relaunches made no progress, so the daemon stopped retrying.\n\n` +
+        `Fix the crash cause, then revive the node if the work still needs doing.`;
+    await pushUrgent(meta.node_id, body, { from: meta.node_id });
+}
 /** Surface a recovery refusal that happened before a broker could launch. */
 async function surfaceRecoveryFailure(meta, error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -110,23 +115,6 @@ export function classifyDeadNode(row, busy, pendingWake = true) {
         return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
     return 'boot-failure'; // row 8
 }
-// Respawn throttle (replaces the stranded-relaunch counters, event-driven)
-/** An exit with uptime at or above this resets the consecutive-failure
- *  counter before classification; a shorter-lived exit increments it. */
-export const HEALTHY_UPTIME_MS = 60_000;
-/** At this many consecutive short-lived exits the respawn loop terminalizes:
- *  transition('crash') + surfaceBootFailure + doctrine wake, counter cleared. */
-export const MAX_RESPAWN_ATTEMPTS = 6;
-const RESPAWN_BACKOFF_BASE_MS = 5_000;
-const RESPAWN_BACKOFF_MAX_MS = 10 * 60_000;
-/** Backoff before the next respawn given the consecutive-failure count.
- *  Zero failures → immediate (the sub-second yield respawn D-3 buys); the
- *  n-th delayed attempt waits min(5s·2^n, 10min). */
-export function respawnBackoffMs(consecutiveFailures) {
-    if (consecutiveFailures <= 0)
-        return 0;
-    return Math.min(RESPAWN_BACKOFF_BASE_MS * 2 ** (consecutiveFailures - 1), RESPAWN_BACKOFF_MAX_MS);
-}
 /** How long a capacity denial stays quiet before it is worth logging again. */
 const CAPACITY_LOG_THROTTLE_MS = 30_000;
 export class DaemonFleet {
@@ -134,7 +122,6 @@ export class DaemonFleet {
     #enqueue;
     #now;
     #map = new Map();
-    #throttle = new Map();
     /** Slots claimed but not yet held by a registered broker: a launch in flight,
      *  or a broker that exited and whose exit-policy job has not yet decided
      *  whether to relaunch it. Counting both against the cap is what keeps a
@@ -156,21 +143,8 @@ export class DaemonFleet {
         if (handle.pid === null) {
             throw new Error(`fleet: refusing to register ${nodeId} with no pid`);
         }
-        // A live registration supersedes any scheduled backoff respawn: the node
-        // is alive again (a manual revive won the race), so the pending respawn
-        // must not fire a second launch.
-        const throttle = this.#throttle.get(nodeId);
-        if (throttle?.timer !== undefined) {
-            clearTimeout(throttle.timer);
-            throttle.timer = undefined;
-        }
         this.#reservations.delete(nodeId);
-        this.#map.set(nodeId, {
-            pid: handle.pid,
-            launchedAt: this.#now(),
-            handle,
-            consecutiveFailures: throttle?.failures ?? 0,
-        });
+        this.#map.set(nodeId, { pid: handle.pid, handle });
     }
     has(nodeId) {
         return this.#map.has(nodeId);
@@ -212,28 +186,22 @@ export class DaemonFleet {
     forget(nodeId) {
         this.#map.delete(nodeId);
         this.#reservations.delete(nodeId);
-        this.#clearThrottle(nodeId);
     }
     onChildExit(nodeId, status) {
         // Move the slot from the registry to a reservation in ONE synchronous
         // step: the exit-policy job about to be enqueued may relaunch this node,
-        // and holding the slot for it is what keeps a 1:1 respawn from losing its
-        // own capacity to a launcher that raced onto the lane first. `#applyPolicy`
-        // releases it on every path that does not relaunch.
-        const entry = this.#map.get(nodeId);
+        // and holding the slot through the exit observation prevents a concurrent
+        // launch from entering before the registry reflects the exit.
         this.#map.delete(nodeId);
         this.#reservations.add(nodeId);
-        const launchedAt = entry?.launchedAt ?? null;
-        this.#enqueue(() => this.#runExitPolicy(nodeId, status, launchedAt));
+        this.#enqueue(() => this.#runExitPolicy(nodeId, status));
     }
     deliverExit(nodeId, status) {
         this.onChildExit(nodeId, status);
     }
-    /** The node-lifecycle tick's enactment entry: classify a known-dead row and
-     *  enact immediately through the SAME policy table exit events use, so tick
-     *  recovery and exit recovery can never diverge. */
+    /** The node-lifecycle tick's enactment entry. */
     async applyDeadRowPolicy(nodeId) {
-        await this.#applyPolicy(nodeId, 'tick');
+        await this.#applyPolicy(nodeId);
     }
     /** A revive refusal before its launch try/catch leaves the row active but
      *  with no fleet entry. Convert that otherwise-silent strand into the same
@@ -251,49 +219,17 @@ export class DaemonFleet {
         });
         return true;
     }
-    /** Daemon shutdown: cancel every pending backoff respawn. Live processes
-     *  are torn down by the daemon's fleet-teardown stage, not here. */
-    dispose() {
-        for (const state of this.#throttle.values()) {
-            if (state.timer !== undefined) {
-                clearTimeout(state.timer);
-                state.timer = undefined;
-            }
-        }
-    }
-    #clearThrottle(nodeId) {
-        const state = this.#throttle.get(nodeId);
-        if (state?.timer !== undefined)
-            clearTimeout(state.timer);
-        this.#throttle.delete(nodeId);
-    }
-    async #runExitPolicy(nodeId, status, launchedAt) {
-        const uptimeMs = launchedAt === null ? null : Math.max(0, this.#now() - launchedAt);
-        // A newer launch may own this node by the time the lane reaches this job
-        // (an API revive raced the exit event onto the lane). The exit belonged to
-        // the OLD process; the node is alive — nothing to recover, but preserve the
-        // observation without charging the fresh launch's throttle budget.
-        if (this.#map.has(nodeId)) {
-            this.#emitExitObserved(nodeId, status, uptimeMs, this.#throttle.get(nodeId)?.failures ?? 0);
-            return;
-        }
-        const state = this.#throttle.get(nodeId) ?? { failures: 0 };
-        if (state.timer !== undefined) {
-            clearTimeout(state.timer);
-            state.timer = undefined;
-        }
-        // Healthy uptime resets the counter BEFORE classification; a short-lived
-        // exit (or a synthetic exit with no known launch time) increments it.
-        if (uptimeMs !== null && uptimeMs >= HEALTHY_UPTIME_MS) {
-            state.failures = 0;
-            this.#throttle.delete(nodeId);
+    dispose() { }
+    async #runExitPolicy(nodeId, status) {
+        try {
+            const launchedAt = getNode(nodeId)?.launched_at;
+            const launchedMs = launchedAt == null ? Number.NaN : Date.parse(launchedAt);
+            const uptimeMs = Number.isFinite(launchedMs) ? Math.max(0, this.#now() - launchedMs) : null;
+            this.#emitExitObserved(nodeId, status, uptimeMs, getNode(nodeId)?.respawn_failures ?? 0);
         }
-        else {
-            state.failures += 1;
-            this.#throttle.set(nodeId, state);
+        finally {
+            this.releaseReservation(nodeId);
         }
-        this.#emitExitObserved(nodeId, status, uptimeMs, state.failures);
-        await this.#applyPolicy(nodeId, 'exit');
     }
     #emitExitObserved(nodeId, status, uptimeMs, consecutiveFailures) {
         emitEvent({
@@ -309,19 +245,10 @@ export class DaemonFleet {
             },
         });
     }
-    async #applyPolicy(nodeId, origin) {
-        try {
-            return await this.#decideAndEnact(nodeId, origin);
-        }
-        finally {
-            // The reservation this node has held since its exit is either consumed by
-            // a successful `register` (making this a no-op) or given back here — the
-            // one release path covering a declined policy, a deferred backoff, and
-            // terminalization alike.
-            this.releaseReservation(nodeId);
-        }
+    async #applyPolicy(nodeId) {
+        return this.#decideAndEnact(nodeId);
     }
-    async #decideAndEnact(nodeId, origin) {
+    async #decideAndEnact(nodeId) {
         const meta = getNode(nodeId);
         // Two durable witnesses mean the dead broker had a turn in flight. A dirty
         // death leaves the busy marker behind; a bounded graceful abort clears busy
@@ -332,19 +259,19 @@ export class DaemonFleet {
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
-                this.#clearThrottle(nodeId);
+                clearRespawnPolicy(nodeId);
                 break;
             case 'dormant':
                 // Chosen dormancy is not a failure — the counter does not survive it.
                 // The pathological wake→fault→release→wake loop is bounded by the
-                // tick's pass-2 cursor-keyed retry cap (D-11), not this throttle.
-                this.#clearThrottle(nodeId);
+                // tick's pass-2 cursor-keyed retry cap (D-11), not this policy.
+                clearRespawnPolicy(nodeId);
                 break;
             case 'release-idle':
                 // Dormancy the daemon chose ON the node's behalf, and the same
                 // non-failure: the row lands exactly where a stophook idle-release
                 // would have left it, so pass-2 inbox wakes own its next revive.
-                this.#clearThrottle(nodeId);
+                clearRespawnPolicy(nodeId);
                 transition(nodeId, 'release');
                 emitEvent({
                     level: 'info',
@@ -352,7 +279,6 @@ export class DaemonFleet {
                     ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
                     fields: {
                         ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
-                        origin,
                     },
                 });
                 break;
@@ -366,51 +292,42 @@ export class DaemonFleet {
             case 'respawn-fresh':
             case 'respawn-cycle':
             case 'respawn-resume':
-                await this.#respawn(nodeId, meta, action, origin, interruptedTurn);
+                await this.#respawn(nodeId, meta, action, interruptedTurn);
                 break;
         }
         return action;
     }
-    async #respawn(nodeId, meta, action, origin, interruptedTurn) {
-        const state = this.#throttle.get(nodeId) ?? { failures: 0 };
-        if (state.failures >= MAX_RESPAWN_ATTEMPTS) {
+    async #respawn(nodeId, meta, action, interruptedTurn) {
+        const row = getRow(nodeId);
+        if (row === null)
+            return;
+        const assess = row.respawn_not_before == null;
+        const priorFailures = row.respawn_failures ?? 0;
+        const attempt = assess
+            ? recordRespawnPolicy(row, this.#now())
+            : { failures: priorFailures, notBefore: row.respawn_not_before, exhausted: priorFailures >= MAX_RESPAWN_ATTEMPTS };
+        if (attempt.exhausted) {
             await this.#terminalize(nodeId, meta, {
                 event: 'broker.respawn.exhausted',
-                wake: `Child crashed — ${fullName(meta)} (${nodeId}) kept dying shortly after launch (${state.failures} consecutive ` +
-                    `short-lived exits) and is now dead. It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`,
+                wake: `Child crashed — ${fullName(meta)} (${nodeId}) kept dying without settling a turn (${attempt.failures} consecutive ` +
+                    `launches) and is now dead. It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`,
+                ...(meta.pi_session_id != null ? { surface: () => surfaceCrashLoop(meta) } : {}),
             });
             return;
         }
-        // A backoff timer already owns this node's next respawn; a tick that
-        // enacted the same policy meanwhile would defeat the throttle entirely.
-        if (origin === 'tick' && state.timer !== undefined)
+        if (assess && attempt.notBefore !== null) {
+            emitEvent({
+                level: 'info',
+                event: 'broker.respawn.deferred',
+                ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
+                fields: {
+                    ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
+                    action,
+                    backoff_ms: respawnBackoffMs(attempt.failures),
+                    consecutive_failures: attempt.failures,
+                },
+            });
             return;
-        // Only a fresh exit consults the backoff: a matured timer and a tick
-        // enactment relaunch immediately (the timer already WAS the backoff, and a
-        // tick candidate reached the lane only after its own gating).
-        if (origin === 'exit') {
-            const delay = respawnBackoffMs(state.failures);
-            if (delay > 0) {
-                state.timer = setTimeout(() => {
-                    state.timer = undefined;
-                    // A fresh policy job re-reads the row, so a node closed/canceled
-                    // during the backoff lands in table row 2 and the respawn evaporates.
-                    this.#enqueue(async () => { await this.#applyPolicy(nodeId, 'timer'); });
-                }, delay);
-                this.#throttle.set(nodeId, state);
-                emitEvent({
-                    level: 'info',
-                    event: 'broker.respawn.deferred',
-                    ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
-                    fields: {
-                        ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
-                        action,
-                        backoff_ms: delay,
-                        consecutive_failures: state.failures,
-                    },
-                });
-                return;
-            }
         }
         emitEvent({
             level: 'info',
@@ -419,8 +336,7 @@ export class DaemonFleet {
             fields: {
                 ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
                 action,
-                origin,
-                consecutive_failures: state.failures,
+                consecutive_failures: attempt.failures,
             },
         });
         try {
@@ -450,7 +366,6 @@ export class DaemonFleet {
                 fields: {
                     ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
                     action,
-                    origin,
                 },
             });
             // Launch failures terminalize inside reviveNode, but its preflight
@@ -459,10 +374,8 @@ export class DaemonFleet {
             await this.terminalizeIfStillNonTerminal(nodeId, 'broker.respawn.refused', err);
         }
     }
-    /** Terminal outcome shared by table row 8 and throttle exhaustion:
-     *  transition('crash') + surfaceBootFailure + doctrine wake, counter cleared. */
+    /** Terminal outcome shared by table row 8 and respawn exhaustion. */
     async #terminalize(nodeId, meta, opts) {
-        this.#clearThrottle(nodeId);
         emitEvent({
             level: 'error',
             event: opts.event,

package/dist/daemon/human/finish.js

@@ -1,5 +1,6 @@
 import { ApiError } from '../../api/index.js';
 import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { opaqueInboxTicketId, ticketDir } from '../../core/human/root.js';
 import { readTicketActionBinding } from '../../core/human/action-binding.js';
 import { completionEventFor, composeHumanCompletion } from '../../core/human/completion.js';
@@ -275,6 +276,7 @@ export async function deliverTerminalResult(ticketId) {
                     data: { body },
                     disposition: 'human-canceled',
                 });
+                cancelCronsOnWake(subscriber.node_id);
             }
             catch {
                 failedTo.push(subscriber.node_id);

package/dist/daemon/manage.d.ts

@@ -46,7 +46,17 @@ export interface SpawnDaemonResult {
     pid?: number;
     /** PID of the already-running daemon, if it was already up. */
     existing_pid?: number;
+    /** Present only when a live pidfile owner does not answer `/healthz`. */
+    running?: true;
+    /** Present with `running:true` when the Unix API socket is not serving. */
+    serving?: false;
+    /** Recovery instruction for a live but non-serving daemon. */
+    next?: string;
 }
+/** True only when the mandatory Unix API socket answers `/healthz`. This is
+ * deliberately separate from `isDaemonRunning()`: a pidfile remains useful for
+ * identifying the process an operator must stop, but it is not readiness. */
+export declare function isDaemonServing(): Promise<boolean>;
 export interface DaemonWaitDeps {
     readPidfile?: () => number | null;
     isPidAlive?: (pid: number) => boolean;
@@ -58,6 +68,7 @@ export interface DaemonStartupDeps extends DaemonWaitDeps {
         code: number | null;
         signal: NodeJS.Signals | null;
     } | null;
+    isDaemonServing?: () => Promise<boolean>;
 }
 /** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
  *  appear before reporting success. This catches the "started:true but not yet

package/dist/daemon/manage.js

@@ -16,6 +16,7 @@ import { hostExecPath } from '../core/runtime/branded-host.js';
 import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
 import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
 import { envNoDaemonAutostart } from '../shared/env.js';
+import { CrtrClient } from '../api/index.js';
 // Daemon env sanitization
 /** Env keys that must NEVER reach the daemon process. Restarting crtrd is
  *  overwhelmingly done from inside an agent node's own bash tool (`crtr sys
@@ -201,6 +202,24 @@ export async function execDaemon() {
 // Shutdown stays short even though startup may include corpus migration.
 const DAEMON_SHUTDOWN_WINDOW_MS = 20_000;
 const DAEMON_VERIFY_POLL_MS = 10;
+/** A status/start readiness probe must not hang behind a daemon that accepts a
+ * Unix connection but never answers it. */
+const DAEMON_HEALTH_PROBE_TIMEOUT_MS = 1_000;
+/** True only when the mandatory Unix API socket answers `/healthz`. This is
+ * deliberately separate from `isDaemonRunning()`: a pidfile remains useful for
+ * identifying the process an operator must stop, but it is not readiness. */
+export async function isDaemonServing() {
+    try {
+        const health = await CrtrClient.forLocalSocket({
+            autostart: false,
+            timeoutMs: DAEMON_HEALTH_PROBE_TIMEOUT_MS,
+        }).healthz();
+        return health.ok;
+    }
+    catch {
+        return false;
+    }
+}
 function sleepMs(ms) {
     return new Promise((resolve) => {
         setTimeout(resolve, ms);
@@ -223,12 +242,13 @@ export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW
     const read = deps.readPidfile ?? readPidfile;
     const alive = deps.isPidAlive ?? isPidAlive;
     const exited = deps.childExited;
+    const serving = deps.isDaemonServing ?? isDaemonServing;
     const sleep = deps.sleepMs ?? sleepMs;
     const now = deps.now ?? Date.now;
     const deadline = now() + timeoutMs;
     while (now() <= deadline) {
         const owner = read();
-        if (owner !== null && alive(owner))
+        if (owner !== null && alive(owner) && await serving())
             return owner === pid ? null : owner;
         const exitState = exited?.();
         if (exitState !== null && exitState !== undefined) {
@@ -314,8 +334,17 @@ export async function stopDaemonProcess(pid, timeoutMs = DAEMON_SHUTDOWN_WINDOW_
  *  If the daemon is already running, returns {started:false, existing_pid}.
  *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
 export async function spawnDaemon() {
-    if (isDaemonRunning()) {
-        return { started: false, existing_pid: readPidfile() ?? undefined };
+    const recordedPid = readPidfile();
+    if (recordedPid !== null && isPidAlive(recordedPid)) {
+        if (await isDaemonServing())
+            return { started: false, existing_pid: recordedPid };
+        return {
+            started: false,
+            existing_pid: recordedPid,
+            running: true,
+            serving: false,
+            next: 'Run `crtr sys daemon stop` to release the non-serving daemon before starting it again.',
+        };
     }
     // Ensure the canvas home directory exists so the daemon can write its pidfile.
     mkdirSync(crtrHome(), { recursive: true });

package/dist/daemon/messaging/node-message.js

@@ -1,4 +1,5 @@
 import { getNode } from '../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { withFreshTerminalGuard } from '../../core/canvas/canvas.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
@@ -43,6 +44,7 @@ export async function deliverNodeMessage(args) {
             // before reporting an engine receipt so a final that committed during the
             // request is not represented as a routable delivery.
             guardRoutable(args.node_id, () => undefined);
+            cancelCronsOnWake(args.node_id);
             return { entry_id: null, via: 'engine', revived: false };
         }
         catch (error) {
@@ -57,9 +59,13 @@ export async function deliverNodeMessage(args) {
         label: args.label,
         data: { ...args.data, body: args.body },
     }));
+    if (args.mode !== 'quiet' || target.frozen_at !== null)
+        cancelCronsOnWake(args.node_id);
+    // The APPENDED entry's tier decides the wake: a quiet send to a terminal
+    // target was raised out of `deferred` by the append, and must be delivered.
     let revived = false;
     let reason;
-    if (args.mode !== 'quiet') {
+    if (entry.tier !== 'deferred') {
         target = getNode(args.node_id);
         if (target === null)
             deliveryUnroutable(args.node_id, 'origin_missing');

package/dist/daemon/reconcilers/bash-deadline.js

@@ -1,6 +1,7 @@
 import { bashJobPaths, expiredAutoBackgroundBashJobs, formatBashElapsed, stopBackgroundBashJob, } from '../../core/bash-jobs.js';
 import { isSafeNodeId } from '../../core/canvas/paths.js';
 import { contextDir } from '../../core/canvas/paths.js';
+import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
@@ -64,6 +65,7 @@ export class BashDeadlineReconciler {
                             `Log: ${paths.jobLog}  Command: ${paths.cmdSh}`,
                     },
                 });
+                cancelCronsOnWake(nodeId);
             }
             catch (err) {
                 emitEvent({ level: 'error', event: 'bash_deadline.notice_failed', ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}), error: err, fields: { job_id: jobId } });

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -36,6 +36,7 @@ export declare function wedgeVerdict(input: {
     busy: boolean;
     quietForMs: number | null;
     cpuPercent: number | null;
+    hasDescendants: boolean | null;
 }): WedgeVerdict;
 export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
 export declare function treeHasDescendants(psOutput: string, rootPid: number): boolean | null;

package/dist/daemon/reconcilers/broker-supervision.js

@@ -61,7 +61,9 @@ export function wedgeVerdict(input) {
         return 'leave';
     if (input.quietForMs === null || input.quietForMs < WEDGE_QUIET_MS)
         return 'leave';
-    if (input.cpuPercent === null || input.cpuPercent > WEDGE_CPU_MAX_PERCENT)
+    if (input.cpuPercent === null)
+        return 'pending';
+    if (input.hasDescendants !== false && input.cpuPercent > WEDGE_CPU_MAX_PERCENT)
         return 'pending';
     return 'wedged';
 }
@@ -471,18 +473,20 @@ export class BrokerSupervisionReconciler {
         const quietForMs = since === null ? null : now - since;
         const sample = quietForMs !== null && quietForMs >= WEDGE_QUIET_MS ? await this.readTreeSample(pid) : null;
         const cpuPercent = sample?.cpuPercent ?? null;
-        if (wedgeVerdict({ busy: true, quietForMs, cpuPercent }) !== 'wedged')
+        const sampleHasDescendants = sample?.hasDescendants ?? null;
+        if (wedgeVerdict({ busy: true, quietForMs, cpuPercent, hasDescendants: sampleHasDescendants }) !== 'wedged')
             return;
         if (since !== null && this.wedgeNotifiedAt.get(id) === since)
             return;
-        if (sample?.hasDescendants === false && (expectedIdentity == null || recordedPidLiveness(pid, expectedIdentity) !== 'alive'))
-            return;
         if (since !== null)
             this.wedgeNotifiedAt.set(id, since);
         const meta = getNode(id);
         const name = meta !== null ? fullName(meta) : id;
         const minutes = Math.round((quietForMs ?? WEDGE_QUIET_MS) / 60_000);
-        const hasDescendants = sample?.hasDescendants ?? true;
+        const hasDescendants = sampleHasDescendants ?? true;
+        const kickSuppressionReason = !hasDescendants && (expectedIdentity == null || recordedPidLiveness(pid, expectedIdentity) !== 'alive')
+            ? 'pid_identity_unproven'
+            : null;
         let label;
         if (hasDescendants) {
             label =
@@ -491,11 +495,18 @@ export class BrokerSupervisionReconciler {
                     `\`crtr memory read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this ` +
                     `node) so its turn can resume with no lost context.`;
         }
+        else if (kickSuppressionReason !== null) {
+            label =
+                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
+                    `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon did ` +
+                    `not SIGTERM the broker because its PID identity cannot be ` +
+                    `confirmed alive.`;
+        }
         else {
             label =
                 `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                    `${minutes}+ minutes, its process is near-idle, AND it has no subprocess to kill (the engine ` +
-                    `itself stalled). Kicking it now: SIGTERM to the broker — the daemon will resume a cleanly ` +
+                    `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). Kicking it ` +
+                    `now: SIGTERM to the broker — the daemon will resume a cleanly ` +
                     `aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`;
             try {
                 process.kill(pid, 'SIGTERM');
@@ -514,7 +525,8 @@ export class BrokerSupervisionReconciler {
                 quiet_ms: quietForMs,
                 cpu_percent: cpuPercent,
                 has_descendants: hasDescendants,
-                kicked: !hasDescendants,
+                kicked: !hasDescendants && kickSuppressionReason === null,
+                ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
             },
         });
         try {
@@ -539,7 +551,8 @@ export class BrokerSupervisionReconciler {
             child: id,
             quiet_ms: quietForMs,
             cpu_percent: cpuPercent,
-            kicked: !hasDescendants,
+            kicked: !hasDescendants && kickSuppressionReason === null,
+            ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
         });
     }
     handleFatalFault(id) {

package/dist/daemon/reconcilers/live-obligation.d.ts

@@ -25,16 +25,26 @@ export declare function hasPendingWake(nodeId: string): boolean;
  *              report is an outstanding deliverable, so such a node keeps its
  *              wakeable idle row instead of being written off.
  *
- *  Undelivered mail of ANY tier also holds the row. A deferred-only unseen set
- *  never wakes a node on its own — it rides the next natural cycle — but a
- *  terminalized row no longer takes that cycle, so writing one off would drop
- *  content the sender already handed over.
+ *  Undelivered mail holds the row, with one carve-out: a deferred-only unseen
+ *  set does not hold a RESIDENT. Deferred mail never wakes a node on its own,
+ *  and parking a resident is reversible — a message sent to it revives it and
+ *  flushes the held mail on that cycle. A terminalized row takes no such
+ *  cycle, so unread mail of any tier keeps it from being written off: the
+ *  invariant is that content a sender already handed over is never dropped.
  */
 export type ParkEvent = Extract<LifecycleEvent, 'release' | 'park' | 'cancel'>;
 export declare function parkEvent(nodeId: string, lifecycle: Lifecycle): ParkEvent;
 /** Apply an unattended decision and notify subscribers of automatic completion.
  *  This is the DEGRADED enactment: no summary turn ran, so subscribers get the
- *  doctrine wake instead of the node's own report. The live clock's good path
+ *  doctrine notice instead of the node's own report. The live clock's good path
  *  (broker settlement after a parking turn) enacts `park` directly and fans
- *  nothing — the node's report is the notice. */
+ *  nothing — the node's report is the notice.
+ *
+ *  The notice is DEFERRED: a node settling quietly at the end of its unattended
+ *  grace is not an event worth starting a manager's cycle for, so it rides the
+ *  manager's next natural cycle and arrives alongside whatever does.
+ *
+ *  Only `park` fans, and only a resident parks, so the notice speaks about a
+ *  resident throughout: its conversation ended without a final report, its state
+ *  lives in whatever report it did leave, and a message reopens it. */
 export declare function applyParkEvent(nodeId: string, event: ParkEvent): void;