@north-light/crouter 0.3.248 → 0.3.250

package/dist/core/__tests__/prune.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, } from '../canvas/canvas.js';
+import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
 import { closeDb, openDb } from '../canvas/db.js';
 import { nodeDir } from '../canvas/paths.js';
 let home;
@@ -30,6 +30,9 @@ function node(id, over = {}) {
 function totalEdges() {
     return openDb().prepare('SELECT COUNT(*) AS n FROM edges').get().n;
 }
+function markCollectibleTerminal(nodeId) {
+    transitionStatusIntent(nodeId, { terminal_reason: 'closed' });
+}
 /** The standard fixture: three prunable terminal nodes (old), three survivors
  *  (two old-but-live, one recent-but-dead), and edges that touch a pruned node
  *  so cascade is observable. */
@@ -147,6 +150,8 @@ test('count pruning keeps all live nodes even when liveCount exceeds the cap', (
     }
     createNode(node('old-a', { status: 'dead', created: at(100) }));
     createNode(node('old-b', { status: 'done', created: at(101) }));
+    markCollectibleTerminal('old-a');
+    markCollectibleTerminal('old-b');
     const result = pruneToLimit({ maxNodes: 3 });
     assert.equal(result.dryRun, false);
     assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['old-a', 'old-b']);
@@ -161,7 +166,9 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
     createNode(node('live-0', { status: 'idle', created: at(0) }));
     recordPid('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
-        createNode(node(`term-${i}`, { status: 'dead', created: at(10 + i) }));
+        const id = `term-${i}`;
+        createNode(node(id, { status: 'dead', created: at(10 + i) }));
+        markCollectibleTerminal(id);
     }
     const result = pruneToLimit({ maxNodes: 3 });
     assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['term-2', 'term-3', 'term-4']);
@@ -180,7 +187,9 @@ test('count pruning dry-run reports candidates without deleting rows or dirs', (
     createNode(node('live-0', { status: 'idle', created: at(0) }));
     recordPid('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
-        createNode(node(`term-${i}`, { status: 'dead', created: at(10 + i) }));
+        const id = `term-${i}`;
+        createNode(node(id, { status: 'dead', created: at(10 + i) }));
+        markCollectibleTerminal(id);
     }
     const result = pruneToLimit({ maxNodes: 3, dryRun: true });
     assert.equal(result.dryRun, true);

package/dist/core/__tests__/relaunch-root.test.js

@@ -173,7 +173,7 @@ test('root /new capacity refusal reaches the attached human through broker UI no
             sessionManager: {
                 getSessionId: () => 'root-new-session',
                 getSessionFile: () => null,
-                getEntries: () => [],
+                getBranch: () => [],
             },
             ui: { notify: (message) => resolveNotice(message) },
         });

package/dist/core/__tests__/respawn-throttle.test.js

@@ -1,150 +1,20 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/respawn-throttle.test.ts
-//
-// The event-driven respawn throttle (design flow B) — the replacement for the
-// deleted stranded-relaunch counters. Each respawn action consults the node's
-// consecutive short-lived-exit count: attempt n defers min(5s·2^(n-1), 10min)
-// via a REAL backoff timer that re-enqueues a fresh policy job; at
-// MAX_RESPAWN_ATTEMPTS (6) the loop terminalizes (transition('crash') +
-// surfaceBootFailure + doctrine wake, counter cleared). An exit with uptime ≥
-// HEALTHY_UPTIME_MS (60s) resets the counter BEFORE classification, restoring
-// the immediate (sub-second) respawn.
-//
-// The backoff timers are real setTimeout — only the throttle's uptime clock is
-// injected — so this file asserts the DEFERRAL (the emitted
-// `broker.respawn.deferred` event + no launch), never timer maturity: the
-// shortest deferral is 5s, well past this file's lifetime, and dispose()
-// cancels every pending timer.
-import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, readFileSync, rmSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { bindDaemonEventSource, resetEventSourceForTests } from '../events/source.js';
-import { resetFleetForTests } from '../runtime/fleet.js';
-import { HEALTHY_UPTIME_MS } from '../../daemon/fleet.js';
-import { bindTestFleet } from './helpers/fleet.js';
-let home;
-let tf;
-let nowMs = 5_000_000;
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: home,
-        kind: 'developer',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-/** Every daemon event this process emitted, oldest first. */
-function events() {
-    let raw;
-    try {
-        raw = readFileSync(join(home, 'crtrd.log'), 'utf8');
-    }
-    catch {
-        return [];
-    }
-    return raw
-        .split('\n')
-        .filter((l) => l.trim() !== '')
-        .map((l) => JSON.parse(l));
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-respawn-throttle-'));
-    mkdirSync(home, { recursive: true });
-    process.env['CRTR_HOME'] = home;
-    resetEventSourceForTests();
-    bindDaemonEventSource(); // events land in <home>/crtrd.log, like the daemon's
-    tf = bindTestFleet({ now: () => nowMs });
-});
-after(() => {
-    tf.fleet.dispose(); // cancels every pending real backoff timer
-    resetFleetForTests();
-    resetEventSourceForTests();
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-});
-// Short-lived exits 1-5 defer with doubling backoff; the 6th terminalizes.
-test('consecutive short-lived exits defer respawn on a doubling backoff, then terminalize at the cap', async () => {
-    // A booted row (saved session, no crash markers) — table row 6, respawn-resume.
-    createNode(node('T', { pi_session_id: 'sess-T' }));
-    // Five synthetic exits (no known launch time → each counts as short-lived).
-    for (let i = 0; i < 5; i++) {
-        tf.fleet.deliverExit('T', { code: 1, signal: null });
-        await tf.drain();
-    }
-    const deferred = events().filter((e) => e.event === 'broker.respawn.deferred');
-    assert.deepEqual(deferred.map((e) => e.fields?.['backoff_ms']), [5_000, 10_000, 20_000, 40_000, 80_000], 'attempts 1-5 defer on the doubling 5s·2^(n-1) schedule');
-    assert.deepEqual(deferred.map((e) => e.fields?.['consecutive_failures']), [1, 2, 3, 4, 5], 'the counter grows once per short-lived exit');
-    assert.equal(getNode('T').status, 'active', 'the node stays revivable while attempts remain');
-    assert.equal(events().some((e) => e.event === 'broker.respawn.started'), false, 'no launch fires while every attempt is deferred');
-    // The 6th short-lived exit exhausts the budget: crash + surface, no respawn.
-    tf.fleet.deliverExit('T', { code: 1, signal: null });
-    await tf.drain();
-    assert.equal(getNode('T').status, 'dead', 'the respawn loop terminalizes at MAX_RESPAWN_ATTEMPTS');
-    assert.equal(events().some((e) => e.event === 'broker.respawn.exhausted'), true, 'exhaustion is surfaced as its own event');
-});
-// A healthy-uptime exit resets the counter: the next respawn is immediate.
-test('a pre-launch respawn refusal terminalizes the stranded node and wakes its parent', async () => {
-    const missingCwd = join(home, 'reaped-worktree');
-    createNode(node('P', { lifecycle: 'resident' }));
-    createNode(node('R', { cwd: missingCwd, parent: 'P', pi_session_id: 'sess-R' }));
-    subscribe('P', 'R', true);
-    // A healthy real entry makes this exit respawn immediately (rather than
-    // waiting for the throttle), reaching reviveNode's cwd preflight through
-    // DaemonFleet.#respawn.
-    nowMs = 10_000_000;
-    tf.fleet.register('R', { pid: 424_244, exited: new Promise(() => { }) });
-    nowMs += HEALTHY_UPTIME_MS;
-    tf.fleet.deliverExit('R', { code: 1, signal: null });
-    await tf.drain();
-    assert.equal(getNode('R').status, 'dead', 'a pre-launch refusal cannot strand an active node without a fleet entry');
-    const inbox = readInboxSince('P');
-    assert.equal(inbox.length, 2, 'the terminal outcome surfaces through both the urgent failure and doctrine wake');
-    const urgent = inbox.find((entry) => entry.tier === 'urgent');
-    assert.ok(urgent, 'the parent receives the recovery-refusal surface');
-    assert.match(urgent.label, /Recovery failed/, 'the surface describes the refusal instead of falsely claiming a fresh boot failed');
-    assert.ok(inbox.some((entry) => entry.tier === 'normal'), 'the parent receives the doctrine wake');
-});
-test('an exit after HEALTHY_UPTIME_MS of uptime resets the counter and respawns immediately', async () => {
-    const originalLaunch = headlessBrokerHost.launch;
-    const launches = [];
-    try {
-        createNode(node('H', { pi_session_id: 'sess-H' }));
-        // Build up one failure first: a short-lived exit defers (5s timer, no launch).
-        tf.fleet.deliverExit('H', { code: 1, signal: null });
-        await tf.drain();
-        assert.equal(events().filter((e) => e.event === 'broker.respawn.deferred' && e.fields?.['backoff_ms'] === 5_000).length >= 1, true, 'precondition: the first short-lived exit deferred at 5s');
-        // A live registration (a manual revive winning the race) supersedes the
-        // pending backoff timer and stamps the current failure count on the entry.
-        const t0 = nowMs;
-        tf.fleet.register('H', { pid: 424_242, exited: new Promise(() => { }) });
-        assert.equal(tf.fleet.get('H').consecutiveFailures, 1, 'the entry mirrors the throttle count at registration');
-        // The relaunch runs healthy past the 60s bar, then exits: the counter
-        // resets BEFORE classification, so the respawn is immediate (backoff 0).
-        headlessBrokerHost.launch = (nodeId) => {
-            launches.push(nodeId);
-            const handle = { pid: 424_243, exited: new Promise(() => { }) };
-            tf.fleet.register(nodeId, handle); // the real host contract: registration at the launch seam
-            return handle;
+import { test } from 'node:test';
+import { decideRespawnAttempt, MAX_RESPAWN_ATTEMPTS, respawnBackoffMs } from '../../daemon/reconcilers/node-lifecycle/respawn-policy.js';
+test('respawn policy resets after settlement and exhausts six no-settlement wedge relaunches', () => {
+    const launch = Date.parse('2026-01-01T00:00:00.000Z');
+    assert.deepEqual(decideRespawnAttempt({ last_settled_at: new Date(launch + 1).toISOString(), launched_at: new Date(launch).toISOString(), respawn_failures: 4 }, launch + 2), { failures: 0, notBefore: null, exhausted: false }, 'a turn settled after launch proves progress and resets the sequence');
+    let row = { last_settled_at: null, launched_at: new Date(launch).toISOString(), respawn_failures: 0 };
+    for (let failures = 1; failures <= MAX_RESPAWN_ATTEMPTS; failures++) {
+        const now = launch + failures * 1_000;
+        const attempt = decideRespawnAttempt(row, now);
+        assert.equal(attempt.failures, failures);
+        assert.equal(Date.parse(attempt.notBefore), now + respawnBackoffMs(failures));
+        assert.equal(attempt.exhausted, failures === MAX_RESPAWN_ATTEMPTS);
+        row = {
+            last_settled_at: null,
+            launched_at: new Date(now + respawnBackoffMs(failures)).toISOString(),
+            respawn_failures: attempt.failures,
         };
-        nowMs = t0 + 61_000;
-        tf.fleet.deliverExit('H', { code: 0, signal: null });
-        await tf.drain();
-        assert.deepEqual(launches, ['H'], 'a healthy-uptime exit respawns immediately — no deferral');
-        assert.equal(tf.fleet.get('H').consecutiveFailures, 0, 'the healthy run reset the consecutive-failure counter');
-        assert.equal(getNode('H').status, 'active', 'the node is live again, never terminalized');
-    }
-    finally {
-        headlessBrokerHost.launch = originalLaunch;
     }
 });

package/dist/core/__tests__/seam/broker-crash-teardown.test.js

@@ -1,7 +1,7 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-crash-teardown.test.ts
 //
 // Daemon-epoch broker ownership, real-process crash and teardown. The broker's
-// exit event is the sole death authority: a SIGTERM of a streaming broker
+// supervision tick is the death authority after the broker exit is observed: a SIGTERM of a streaming broker
 // aborts cleanly and resumes the saved session with a continuation, and a
 // SIGKILL mid-turn — no certificate, only the durable busy marker — resumes
 // that same saved session in place and re-drives the stopped turn with the
@@ -12,8 +12,8 @@
 //
 // spawnHeadlessChild calls the production birth path in the harness process, so
 // every broker below is harness-fleet-owned from its first and only boot and
-// every SIGKILL's REAL ChildProcess exit drives policy automatically — no
-// synthetic delivery, no tick, no grace.
+// every SIGKILL's REAL ChildProcess exit is observed by the fleet; the harness
+// then drives the production supervision tick — no synthetic delivery or grace.
 // Each crash has its own real broker setup, so either top-level test remains a
 // complete journey under name filtering and pays only its own first respawn
 // backoff.
@@ -57,17 +57,22 @@ test('SIGTERM of a busy broker aborts cleanly and resumes with a continuation',
     assert.equal(h.node(id).intent ?? null, null, 'fresh broker has a null intent (not refresh/idle-release)');
     const boots = h.bootCount(id);
     // SIGTERM exercises broker.ts's bounded session.abort() path. Its REAL child
-    // exit sees the broker-written clean-abort certificate and resumes only after
-    // the first-failure backoff; no synthetic fleet delivery is involved.
+    // exit leaves the broker-written clean-abort certificate; the supervision tick
+    // classifies it and persists the first-failure backoff.
     process.kill(oldPid, 'SIGTERM');
     await h.waitFor(() => !isPidAlive(oldPid), { label: 'gracefully torn-down broker pid is dead' });
-    assert.equal(existsSync(join(jobDir(id), 'clean-abort')), true, 'settled abort leaves durable clean-abort evidence before exit policy respawns');
-    // This is the file's SECOND real broker boot (exit-event recovery), behind a
-    // 5s short-lived-exit backoff, on an oversubscribed CI runner sharing the
-    // host with the other compiled-seam files' own broker spawns. Give it a wide,
-    // still-bounded ceiling.
+    assert.equal(existsSync(join(jobDir(id), 'clean-abort')), true, 'settled abort leaves durable clean-abort evidence before supervision classifies it');
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const gracefulBackoff = h.node(id);
+    assert.equal(gracefulBackoff.respawn_failures, 1, 'the first failed launch is durably counted');
+    assert.ok(gracefulBackoff.respawn_not_before != null, 'the first retry is durably deferred');
+    assert.equal(gracefulBackoff.pi_pid, null, 'classification clears the dead broker pid');
+    await h.tick(Date.parse(gracefulBackoff.respawn_not_before) + 1);
+    // This is the file's SECOND real broker boot, after the durable 5s backoff
+    // matures on a supervision tick.
     const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
-    assert.equal(boot2.resuming, true, 'clean-abort exit-event recovery RESUMES the saved .jsonl');
+    assert.equal(boot2.resuming, true, 'clean-abort tick-driven recovery RESUMES the saved .jsonl');
     assert.equal(boot2.prompt, RUNTIME_RESTART_CONTINUATION, 'the strict resume injects the runtime-restart continuation');
     assert.ok(!boot2.rawArgv.includes('--crtr-new-cycle'), 'clean abort never starts a recovery cycle');
     const revivedPid = h.node(id).pi_pid;
@@ -90,6 +95,13 @@ test('SIGKILL of a busy broker resumes the interrupted turn in place; close tear
     markBusy(id);
     process.kill(busyPid, 'SIGKILL');
     await h.waitFor(() => !isPidAlive(busyPid), { label: 'mid-turn crashed broker pid is dead' });
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const dirtyBackoff = h.node(id);
+    assert.equal(dirtyBackoff.respawn_failures, 1, 'the first failed launch is durably counted');
+    assert.ok(dirtyBackoff.respawn_not_before != null, 'the first retry is durably deferred');
+    assert.equal(dirtyBackoff.pi_pid, null, 'classification clears the dead broker pid');
+    await h.tick(Date.parse(dirtyBackoff.respawn_not_before) + 1);
     const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
     // The fake SessionManager reports `resuming=true` for ANY existing session
     // path, including a cycle; production distinguishes cycling with the argv

package/dist/core/__tests__/seam/broker-provider-retry.test.js

@@ -7,12 +7,12 @@
 // its helpers in isolation.
 import { test, before, after, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHeadlessHarness } from '../helpers/harness.js';
 import { createAttachKit } from '../helpers/broker-clients.js';
 import { defaultModelLaddersConfig } from '../../../types.js';
-import { readFault } from '../../runtime/fault.js';
+import { admitProviderRetryEpisode, readFault, readProviderRetryEpisode } from '../../runtime/fault.js';
 import { buildPiArgv, normalizeModel } from '../../runtime/launch.js';
 import { encodeFrame } from '../../runtime/broker-protocol.js';
 const MODEL_LADDERS = defaultModelLaddersConfig();
@@ -79,6 +79,18 @@ function agentStartCount(id) {
         return 0;
     }
 }
+async function crashAndRespawn(id, boots) {
+    const pid = h.node(id)?.pi_pid;
+    assert.ok(pid != null, 'the broker has a live pid before its physical death');
+    process.kill(pid, 'SIGKILL');
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const deferred = h.node(id);
+    assert.ok(deferred.respawn_not_before != null, 'the daemon records respawn backoff after the broker exit');
+    await h.tick(Date.parse(deferred.respawn_not_before) + 1);
+    await h.awaitBoot(id, { minCount: boots + 1 });
+    await h.waitFor(() => existsSync(h.brokerSock(id)), { label: 'replacement broker listener bound' });
+}
 before(async () => {
     h = await createHeadlessHarness({ sessionPrefix: 'crtr-provider-retry' });
 });
@@ -130,6 +142,73 @@ test('a managed-cooling terminal authors a rate-limit auto fault whose deadline
     await new Promise((resolve) => setTimeout(resolve, 2500));
     assert.equal(agentStartCount(child), baselineStarts + 1, 'the fault-retry timer re-drives the turn exactly once');
 });
+test('a crashed broker re-drives only its pending provider episode, never admitted or invalidated episodes', { timeout: 90_000 }, async () => {
+    const parent = h.spawnRoot('durable provider episode parent');
+    seedPool('anthropic', false);
+    seedPool('openai-codex', false);
+    const pendingNode = await h.spawnHeadlessChild(parent, 'pending provider episode', { model: OPENAI_STRONG.spec });
+    await h.waitFor(() => agentStartCount(pendingNode) >= 1, { label: 'pending episode fixture started' });
+    const pendingStarts = agentStartCount(pendingNode);
+    h.fakeCmd(pendingNode, {
+        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 2_000,
+    });
+    const pending = await h.waitFor(() => readProviderRetryEpisode(pendingNode)?.state === 'pending' ? readProviderRetryEpisode(pendingNode) : null, { label: 'pending provider episode persisted before crash' });
+    assert.equal(pending.sessionFile, realpathSync(h.node(pendingNode).pi_session_file), 'the pending episode is tied to its transcript path');
+    await crashAndRespawn(pendingNode, h.bootCount(pendingNode));
+    await h.waitFor(() => agentStartCount(pendingNode) >= pendingStarts + 1, { label: 'replacement re-drove the pending episode' });
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    assert.equal(agentStartCount(pendingNode), pendingStarts + 1, 'a pending episode re-drives exactly once after broker death');
+    const admittedNode = await h.spawnHeadlessChild(parent, 'admitted provider episode', { model: OPENAI_STRONG.spec });
+    await h.waitFor(() => agentStartCount(admittedNode) >= 1, { label: 'admitted episode fixture started' });
+    const admittedStarts = agentStartCount(admittedNode);
+    h.fakeCmd(admittedNode, {
+        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
+    });
+    const admittedPending = await h.waitFor(() => readProviderRetryEpisode(admittedNode)?.state === 'pending' ? readProviderRetryEpisode(admittedNode) : null, { label: 'admitted episode pending record persisted' });
+    const admittedFault = readFault(admittedNode);
+    assert.ok(admittedFault !== null, 'the pending episode retains its retry fault before admission');
+    assert.equal(admitProviderRetryEpisode(admittedNode, admittedPending.sessionFile, admittedFault), true, 'the dispatch boundary durably admits the matching episode');
+    assert.equal(readProviderRetryEpisode(admittedNode)?.state, 'admitted');
+    await crashAndRespawn(admittedNode, h.bootCount(admittedNode));
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    assert.equal(agentStartCount(admittedNode), admittedStarts, 'an admitted episode is never replayed by replacement startup');
+    const invalidatedNode = await h.spawnHeadlessChild(parent, 'invalidated provider episode', { model: OPENAI_STRONG.spec });
+    await h.waitFor(() => agentStartCount(invalidatedNode) >= 1, { label: 'invalidated episode fixture started' });
+    const invalidatedStarts = agentStartCount(invalidatedNode);
+    h.fakeCmd(invalidatedNode, {
+        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
+    });
+    await h.waitFor(() => readProviderRetryEpisode(invalidatedNode)?.state === 'pending' ? true : null, { label: 'invalidated episode pending record persisted' });
+    const controller = await kit.attach(invalidatedNode, 'controller', 'invalidated-provider-episode');
+    controller.send({ type: 'new_session' });
+    await controller.waitFrame((frame) => frame.type === 'ack' && frame.for === 'new_session', 'replacement session acknowledged');
+    assert.equal(readFault(invalidatedNode), null, 'replacement discards the old daemon-owned auto fault instead of inheriting its anchor');
+    await h.waitFor(() => readProviderRetryEpisode(invalidatedNode)?.state === 'invalidated' ? true : null, { label: 'rebind durably invalidated the old episode' });
+    controller.close();
+    await crashAndRespawn(invalidatedNode, h.bootCount(invalidatedNode));
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    assert.equal(agentStartCount(invalidatedNode), invalidatedStarts, 'an invalidated rebound-session episode is never replayed by replacement startup');
+    const cyclingNode = await h.spawnHeadlessChild(parent, 'fresh-cycle provider episode', { model: OPENAI_STRONG.spec });
+    await h.waitFor(() => agentStartCount(cyclingNode) >= 1, { label: 'fresh-cycle episode fixture started' });
+    h.fakeCmd(cyclingNode, {
+        cmd: 'stop', reason: 'error', errorMessage: 'Managed provider pools are temporarily unavailable.', deadline: Date.now() + 60_000,
+    });
+    await h.waitFor(() => readProviderRetryEpisode(cyclingNode)?.state === 'pending' ? true : null, { label: 'fresh-cycle episode pending record persisted' });
+    const cyclingBoots = h.bootCount(cyclingNode);
+    const yieldResult = h.cli(cyclingNode, ['node', 'yield', 'begin a fresh cycle']);
+    assert.equal(yieldResult.code, 0, `node yield should succeed\n--stderr--\n${yieldResult.stderr}`);
+    const cyclingPid = h.node(cyclingNode)?.pi_pid;
+    assert.ok(cyclingPid != null, 'the refresh-pending broker remains live until its physical death');
+    process.kill(cyclingPid, 'SIGKILL');
+    await h.awaitFleetExit(cyclingNode);
+    await h.tick();
+    const cyclingBackoff = h.node(cyclingNode);
+    assert.ok(cyclingBackoff.respawn_not_before != null, 'the fresh-cycle relaunch receives daemon backoff');
+    await h.tick(Date.parse(cyclingBackoff.respawn_not_before) + 1);
+    await h.awaitBoot(cyclingNode, { minCount: cyclingBoots + 1 });
+    await h.waitFor(() => existsSync(h.brokerSock(cyclingNode)), { label: 'fresh-cycle replacement broker listener bound' });
+    assert.equal(readProviderRetryEpisode(cyclingNode)?.state, 'invalidated', 'new-cycle startup invalidates the old transcript episode');
+});
 test('reload_auth re-drives a parked fatal provider-auth turn exactly once', { timeout: 30_000 }, async () => {
     const parent = h.spawnRoot('auth reload parent');
     seedPool('anthropic', false);

package/dist/core/__tests__/seam/dormancy-release.test.js

@@ -194,7 +194,7 @@ test('an unattended resident with no live obligation completes on the daemon clo
         assert.equal(h.node(nodeId)?.status, 'done', 'the row is terminal and eligible for history pruning');
         const wake = readInboxSince(root).find((entry) => entry.from === nodeId && entry.data?.['reason'] === 'child-auto-done');
         assert.ok(wake, 'the subscribing root is woken when the unattended clock completes the resident');
-        assert.match(wake.label, /sent no final report/, 'the wake distinguishes automatic completion from a final report');
+        assert.match(wake.label, /submitted no final report/, 'the wake distinguishes automatic completion from a final report');
         await h.tick();
         assert.equal(h.fleet.has(nodeId), false, 'a supervision tick does not revive completed history');
     }

package/dist/core/__tests__/seam/self-close-teardown.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/seam/self-close-teardown.test.js

@@ -0,0 +1,49 @@
+// Run with: npm run build && node --test dist/core/__tests__/seam/self-close-teardown.test.js
+import { after, before, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPidAlive } from '../../canvas/pid.js';
+import { nodeDir } from '../../canvas/paths.js';
+import { createHarness } from '../helpers/harness.js';
+let h;
+let root;
+before(async () => {
+    h = await createHarness({ headless: true, sessionPrefix: 'crtr-self-close' });
+    root = h.spawnRoot('self-close teardown root');
+});
+after(async () => {
+    if (h !== undefined)
+        await h.dispose();
+});
+test('a node closes itself without killing its long-lived calling shell', { timeout: 60_000 }, async () => {
+    const id = await h.spawnHeadlessChild(root, 'self-close worker');
+    const brokerPid = h.node(id)?.pi_pid;
+    assert.ok(brokerPid != null && isPidAlive(brokerPid), 'precondition: worker broker is alive');
+    const session = h.node(id)?.pi_session_file;
+    assert.ok(session != null, 'worker has a session file');
+    writeFileSync(session, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'work' }] } }) + '\n');
+    const dir = nodeDir(id);
+    const resultPath = join(dir, 'self-close-result');
+    const shellPidPath = join(dir, 'self-close-shell.pid');
+    let shellPid;
+    try {
+        h.fakeCmd(id, { cmd: 'self_close' });
+        await h.waitFor(() => existsSync(resultPath), { label: 'self-close CLI result' });
+        assert.equal(readFileSync(resultPath, 'utf8').trim(), '0', 'the shell received a successful close result');
+        shellPid = Number(readFileSync(shellPidPath, 'utf8').trim());
+        assert.ok(Number.isInteger(shellPid) && shellPid > 0, 'fixture recorded the long-lived calling shell pid');
+        assert.equal(isPidAlive(shellPid), true, 'the calling shell survives the daemon teardown');
+        await h.waitFor(() => !isPidAlive(brokerPid), { label: 'self-closing broker exits' });
+        assert.equal(isPidAlive(shellPid), true, 'the calling shell remains alive after the broker is gone');
+        assert.equal(h.status(id), 'canceled', 'close writes the terminal transition before teardown');
+    }
+    finally {
+        if (shellPid !== undefined) {
+            try {
+                process.kill(shellPid, 'SIGKILL');
+            }
+            catch { /* shell already exited */ }
+        }
+    }
+});

package/dist/core/__tests__/seam/yield-refresh-transaction.test.js

@@ -24,8 +24,8 @@ after(async () => {
     if (h !== undefined)
         await h.dispose();
 });
-// 30s (approved compiled-seam cap): three real broker boots plus the exit-policy
-// respawn throttle's first ~5s backoff before the successful retry.
+// 30s (approved compiled-seam cap): three real broker boots plus the durable
+// respawn backoff's first ~5s delay before the successful retry.
 test('yield-message survives one pre-session_start retry and clears on session_start', { timeout: 30_000 }, async () => {
     const note = `Issue #146 pre-session_start replay ${FAIL_BEFORE_SESSION_START_ONCE} keeps the wake note`;
     const id = await h.spawnHeadlessChild(root, 'headless worker — yield message transactional retry');
@@ -35,29 +35,37 @@ test('yield-message survives one pre-session_start retry and clears on session_s
     const rc = h.cli(id, ['node', 'yield', note]);
     assert.equal(rc.code, 0, `node yield should succeed\n--stderr--\n${rc.stderr}`);
     // `node yield` arms intent=refresh; the current turn ending is what lets the
-    // stophook release the old broker. Its real ChildProcess exit enqueues policy
-    // row 3 and launches the fresh cycle (after any short-lived-exit backoff), so
-    // there is no liveness tick or grace clock.
+    // stophook release the old broker. The supervision tick classifies that real
+    // ChildProcess exit, persists its backoff, and launches the fresh cycle once
+    // the backoff matures.
     await h.stop(id);
     await h.waitFor(() => !isPidAlive(oldPid), { label: 'yielded broker exited before session_start' });
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const initialRefreshBackoff = h.node(id);
+    assert.equal(initialRefreshBackoff.respawn_failures, 1, 'the old broker death is durably counted');
+    assert.ok(initialRefreshBackoff.respawn_not_before != null, 'the initial refresh retry is durably deferred');
+    assert.equal(initialRefreshBackoff.pi_pid, null, 'classification clears the old broker pid');
+    await h.tick(Date.parse(initialRefreshBackoff.respawn_not_before) + 1);
     // The initial refresh attempt launches and fails before session_start,
     // leaving the note still present in node context.
     const failedCyclePid = await h.waitFor(() => {
         const pid = h.node(id)?.pi_pid;
         return pid != null && pid !== oldPid ? pid : null;
-    }, { label: 'exit-event refresh attempt recorded its broker pid', timeoutMs: 30_000 });
+    }, { label: 'tick-driven refresh attempt recorded its broker pid', timeoutMs: 30_000 });
     await h.waitFor(() => !isPidAlive(failedCyclePid), { label: 'one-shot cycling broker died before session_start' });
     // PID death precedes Node's ChildProcess `exit` delivery. Wait through the
-    // authoritative fleet barrier and its queued exit-policy job so the contender
-    // below reaches refresh arbitration instead of returning on stale liveness.
-    // The policy has only armed its backoff timer at this point; no recovery broker
-    // owns the slot yet.
+    // authoritative fleet barrier, then classify the failure once so the contender
+    // below reaches refresh arbitration while durable backoff is pending.
     await h.awaitFleetExit(id);
+    await h.tick();
     const afterFirstExit = h.node(id);
     assert.equal(h.fleet.has(id), false, 'the failed broker has left the authoritative fleet before focus competes');
     assert.equal(afterFirstExit?.cycles, baseCycles + 1, 'the first refresh attempt advances cycles');
     assert.equal(afterFirstExit?.intent, 'refresh', 'the durable refresh intent still confronts the strict-resume contender');
     assert.equal(afterFirstExit?.cycle_pending, true, 'cycle_pending remains true until session_start confirms');
+    assert.equal(afterFirstExit?.respawn_failures, 2, 'the failed refresh attempt is durably counted');
+    assert.ok(afterFirstExit?.respawn_not_before != null, 'focus competes while the durable refresh backoff is pending');
     assert.equal(readYieldMessage(id), note, 'yield note stays present after pre-session_start failure');
     assert.equal(existsSync(yieldMessagePath(id)), true, 'yield file survives the failed cycle');
     // A real `surface node focus` on the node right now asks the revive arbiter for

package/dist/core/canvas/canvas.d.ts

@@ -334,6 +334,10 @@ export interface PruneResult {
     pruned: PrunedNode[];
     dryRun: boolean;
 }
+/** Whether a row may be removed by an automatic collection sweep. */
+export declare function isCollectible(row: NodeRow, opts?: {
+    pastTtl?: boolean;
+}): boolean;
 /** {@link deleteNode}'s result: whether it actually deleted the node. */
 export interface DeleteNodeResult {
     deleted: boolean;
@@ -396,24 +400,14 @@ export declare function pruneNodes(opts: {
  *  store rather than per-node loss, and reaps nothing. Returns the reaped ids. */
 export declare function reapGhostRows(): string[];
 /** Count-based retention sweep: retain the `maxNodes` MOST-RECENTLY-ACTIVE
- *  nodes plus every protected node, so the real retained floor is
- *  `max(maxNodes, protectedCount)`. Bounds the otherwise-unbounded growth the
- *  TTL sweep can't (a canvas that never crosses the TTL still grows without
+ *  nodes plus every row the collection authority retains, so the real retained
+ *  floor is `max(maxNodes, retainedCount)`. Bounds the otherwise-unbounded growth
+ *  the TTL sweep can't (a canvas that never crosses the TTL still grows without
  *  limit).
  *
- *  Protected (never a prune candidate, regardless of recency rank): any
- *  non-terminal node — status active|idle — REGARDLESS of `pi_pid` liveness,
- *  or a node with an open managed worktree. A crashed-but-non-terminal row
- *  (dead pid, status still active/idle) must survive for daemon crash-recovery
- *  to resume, and an open worktree must retain its node ownership until
- *  `node worktree close`; neither is eligible for count-based pruning. The caller
- *  ($CRTR_NODE_ID) is also always protected.
- *
  *  Algorithm: order ALL nodes by recency DESC (telemetry.json mtime, falling back
- *  to `created`); `target = max(maxNodes, protectedCount)`; delete every node
- *  ranked beyond `target` (0-indexed rank >= target) that is NOT protected and
- *  NOT the caller. Retained = all protected + the newest terminal nodes up to
- *  `target`.
+ *  to `created`); `target = max(maxNodes, retainedCount)`; delete every node
+ *  ranked beyond `target` (0-indexed rank >= target) that is collectible.
  *
  *  Mirrors {@link pruneNodes} exactly for the delete (shared `deletePrunedNodes`:
  *  transactioned row sweep + FK edge cascade + best-effort dir removal). `dryRun`