@north-light/crouter 0.3.249 → 0.3.251

package/dist/core/worktree.js

@@ -51,9 +51,17 @@ function resolveLandableBase(repoRoot, baseRef) {
     // syntax, which could turn a SHA or a `^{commit}` suffix into a non-landable
     // base even though no local branch by that exact name exists.
     const exists = gitSync(['show-ref', '--verify', '--quiet', ref], repoRoot);
-    if (exists.status !== 0) {
+    // `show-ref --verify --quiet` reserves exit 1 for an absent ref. gitSync
+    // preserves that numeric status for compatibility, but marks spawn failures,
+    // timeouts, and signal exits so they cannot masquerade as an absent branch.
+    if (exists.status === 1 && exists.executionFailed !== true) {
         throw new WorktreeError('missing_base_branch', `managed worktree base '${baseRef}' does not name an existing local branch`, 'The base must be a local branch that landing can fast-forward — freshen your local branch from origin first (rebase-not-merge), then base on it.');
     }
+    if (exists.status !== 0) {
+        const stderr = exists.stderr.trim() || '<empty>';
+        const execution = exists.processError === undefined ? '' : `\nprocess error: ${exists.processError}`;
+        throw new WorktreeError('base_branch_inspection_failed', `could not inspect local base branch '${baseRef}' (git show-ref exited with status ${exists.status})`, 'Inspect the repository and its Git metadata, then retry.', `status: ${exists.status}\nstderr: ${stderr}${execution}`);
+    }
     return runGit(repoRoot, ['rev-parse', '--verify', ref], 'base_branch_resolve_failed', 'Inspect the local base branch, then retry.');
 }
 /** Path of the worktree where a local branch is currently checked out, or null
@@ -238,16 +246,23 @@ export function isRebaseInProgress(cwd) {
     return existsSync(gitPath(cwd, 'rebase-merge')) || existsSync(gitPath(cwd, 'rebase-apply'));
 }
 /** The ONE authoritative closed-worktree state transition, shared by both
- *  closing paths (explicit `closeManagedWorktreeLocked` land, and the clean
- *  `autoDropCleanManagedWorktreeLocked` push-final drop): persist
- *  `managed_worktree.state: 'closed'`, name its cleanup state, and repoint the
- *  node's launch `cwd` to the durable base checkout atomically in the same
- *  `updateNode` write. A live node keeps its checkout intact for explicit
- *  post-exit cleanup: `git worktree remove` recursively deletes the caller's
- *  cwd and cannot safely run against it. Both closing paths MUST go through this helper instead of
- *  hand-rolling the `updateNode` call, so neither can drift out of sync. */
+ * closing paths (explicit `closeManagedWorktreeLocked` land, and the clean
+ * `autoDropCleanManagedWorktreeLocked` push-final drop): persist
+ * `managed_worktree.state: 'closed'`, name its cleanup state, and repoint the
+ * node's launch `cwd` to the durable base checkout. The caller broker stays
+ * alive and is Pi's sole transcript writer, so its session header cannot be
+ * safely rewritten here; clear the session coordinates and let the later
+ * revive launch fresh instead. Both closing paths MUST go through this helper
+ * instead of hand-rolling the `updateNode` call, so neither can drift out of
+ * sync. */
 function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
-    updateNode(nodeId, { cwd: wt.repo_root, managed_worktree: { ...wt, state: 'closed', cleanup, closed: new Date().toISOString() } });
+    const node = getNode(nodeId);
+    const sessionInvalidated = node?.pi_session_id != null || node?.pi_session_file != null;
+    updateNode(nodeId, {
+        cwd: wt.repo_root,
+        ...(sessionInvalidated ? { pi_session_id: null, pi_session_file: null } : {}),
+        managed_worktree: { ...wt, state: 'closed', cleanup, closed: new Date().toISOString() },
+    });
 }
 function deferredCleanupResult(wt) {
     const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
@@ -301,7 +316,29 @@ function closeManagedWorktreeLocked(nodeId) {
         const found = branch === 'HEAD' ? 'detached HEAD' : branch;
         throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, `Check out ${wt.branch} in ${wt.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`);
     }
-    const baseSha = resolveLandableBase(wt.repo_root, wt.base_ref);
+    let baseSha;
+    try {
+        // `repo_root` is the checkout that created this child, and it can vanish
+        // when that parent finishes first. The live managed checkout still names
+        // the shared repository and is the authority for every close operation.
+        baseSha = resolveLandableBase(wt.path, wt.base_ref);
+    }
+    catch (error) {
+        // A deleted parent base cannot receive a fast-forward. A clean child at
+        // its recorded creation SHA has nothing to land, however, so conclude its
+        // deferred cleanup without guessing where work should go.
+        const head = runGit(wt.path, ['rev-parse', 'HEAD'], 'landed_sha_failed', 'Inspect the worktree checkout manually, then rerun `crtr node worktree close`.');
+        if (!(error instanceof WorktreeError) || error.code !== 'missing_base_branch' || head !== wt.base_sha)
+            throw error;
+        persistClosedWorktreeState(nodeId, wt, 'pending');
+        return {
+            node_id: nodeId,
+            branch: wt.branch,
+            worktree_path: wt.path,
+            landed_sha: wt.base_sha,
+            ...deferredCleanupResult(wt),
+        };
+    }
     const rebase = gitSync(['rebase', baseSha], wt.path);
     if (rebase.status !== 0) {
         const detail = (rebase.stderr.trim() || rebase.stdout.trim()).trim();
@@ -312,11 +349,11 @@ function closeManagedWorktreeLocked(nodeId) {
     // captured baseSha — landing is purely local, nothing is ever pushed to
     // origin. Both landing paths require the base to still be exactly at that
     // captured tip, so neither can overwrite a concurrent base change.
-    const fastForward = gitSync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.repo_root);
+    const fastForward = gitSync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.path);
     if (fastForward.status !== 0) {
         throw new WorktreeError('land_base_failed', `rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the user with `crtr human send` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
     }
-    const baseCheckout = checkoutPathForBranch(wt.repo_root, wt.base_ref);
+    const baseCheckout = checkoutPathForBranch(wt.path, wt.base_ref);
     if (baseCheckout !== null) {
         const checkoutHead = gitSync(['rev-parse', 'HEAD'], baseCheckout);
         const actualHead = checkoutHead.stdout.trim();
@@ -329,7 +366,7 @@ function closeManagedWorktreeLocked(nodeId) {
     }
     const land = baseCheckout !== null
         ? gitSync(['merge', '--ff-only', landedSha], baseCheckout)
-        : gitSync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.repo_root);
+        : gitSync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.path);
     if (land.status !== 0) {
         const detail = (land.stderr.trim() || land.stdout.trim()).trim();
         throw new WorktreeError('land_base_failed', `could not fast-forward local base branch '${wt.base_ref}' to this worktree`, baseCheckout !== null
@@ -356,7 +393,10 @@ export function closeManagedWorktree(nodeId) {
     // repository to lock; every state-mutating close path runs under the lock.
     if (wt === null)
         return closeManagedWorktreeLocked(nodeId);
-    return withRepositoryWorktreeLock(wt.repo_root, () => closeManagedWorktreeLocked(nodeId));
+    // An absent checkout has no live Git directory; its separate recovery proof
+    // still relies on the recorded repository path. Every live close locks from
+    // the child checkout instead of the parent that created it.
+    return withRepositoryWorktreeLock(existsSync(wt.path) ? wt.path : wt.repo_root, () => closeManagedWorktreeLocked(nodeId));
 }
 const ABANDON_AUTHOR_NAME = 'crtr-abandon';
 const ABANDON_AUTHOR_EMAIL = 'crtr-abandon@localhost';
@@ -519,9 +559,10 @@ export function missingWorktreeRecoveryHint(wt) {
  *  be a git-ancestor of (or equal to) the CURRENT tip of its recorded base
  *  branch — i.e. landing it would be a pure no-op. Any ambiguity (missing
  *  path, mid-rebase, wrong branch, an unresolvable base, or a real ancestry
- *  divergence) returns null: this function only ever proves a no-op land
- *  when a live git check establishes it, never on a heuristic guess, so real
- *  unlanded work always falls through to the explicit-close guard. The locked
+ *  divergence) returns null. A missing base is the one exception: equality
+ *  between the live HEAD and recorded creation SHA proves no work was added.
+ *  This function only ever proves a no-op land from live Git state, never on
+ *  a heuristic guess, so real unlanded work always falls through to the explicit-close guard. The locked
  *  path re-checks this predicate before recording deferred cleanup; production
  *  code must always go through `autoDropCleanManagedWorktree`. */
 export function proveCleanEmptyManagedWorktree(wt) {
@@ -537,18 +578,23 @@ export function proveCleanEmptyManagedWorktree(wt) {
     const status = gitSync(['status', '--porcelain'], wt.path);
     if (status.status !== 0 || status.stdout.trim() !== '')
         return null;
-    let baseSha;
-    try {
-        baseSha = resolveLandableBase(wt.repo_root, wt.base_ref);
-    }
-    catch {
-        return null;
-    }
     const head = gitSync(['rev-parse', 'HEAD'], wt.path);
     if (head.status !== 0)
         return null;
     const branchSha = head.stdout.trim();
-    const ancestor = gitSync(['merge-base', '--is-ancestor', branchSha, baseSha], wt.repo_root);
+    let baseSha;
+    try {
+        baseSha = resolveLandableBase(wt.path, wt.base_ref);
+    }
+    catch (error) {
+        // A parent-first close can remove the recorded base branch. Equality with
+        // the durable creation SHA proves this clean child never added work.
+        if (error instanceof WorktreeError && error.code === 'missing_base_branch' && branchSha === wt.base_sha) {
+            return { branchSha, baseSha: wt.base_sha };
+        }
+        throw error;
+    }
+    const ancestor = gitSync(['merge-base', '--is-ancestor', branchSha, baseSha], wt.path);
     if (ancestor.status !== 0)
         return null;
     return { branchSha, baseSha };
@@ -612,7 +658,7 @@ export function autoDropCleanManagedWorktree(nodeId) {
     const pathAbsent = !existsSync(wt.path);
     if (pathAbsent ? proveAbsentPathManagedWorktree(wt) === null : proveCleanEmptyManagedWorktree(wt) === null)
         return null;
-    return withRepositoryWorktreeLock(wt.repo_root, () => {
+    return withRepositoryWorktreeLock(pathAbsent ? wt.repo_root : wt.path, () => {
         // Re-fetch inside the lock: state may have changed since the caller's
         // hasOpenManagedWorktree check ran outside it.
         const locked = openManagedWorktreeForNode(nodeId);

package/dist/daemon/__tests__/integration/api-startup-readiness.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/__tests__/integration/api-startup-readiness.test.js

@@ -0,0 +1,81 @@
+// Regression for NL-159 / #571: the daemon's pidfile/ownership claim must not
+// survive a failed mandatory Unix API bind. A directory at the socket path
+// deterministically makes `listen()` emit EADDRINUSE without touching crtrd's
+// real canvas or runtime homes.
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import test from 'node:test';
+import { closeDb } from '../../../core/canvas/db.js';
+import { claimDaemonOwnership, releaseDaemonOwnership } from '../../../core/canvas/daemon-owner.js';
+import { resetEventSourceForTests } from '../../../core/events/source.js';
+import { resetFleetForTests } from '../../../core/runtime/fleet.js';
+import { runDaemon } from '../../crtrd.js';
+import { spawnDaemon } from '../../manage.js';
+const isolatedEnvKeys = [
+    'HOME',
+    'CRTR_HOME',
+    'CRTR_PIDFILE',
+    'CRTR_RUNTIME_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_CONFIG_HOME',
+    'XDG_DATA_HOME',
+    'PI_CODING_AGENT_DIR',
+];
+test('a Unix socket bind failure rejects readiness and releases daemon ownership', async () => {
+    const root = mkdtempSync('/tmp/crtr-api-bind-failure-');
+    const home = join(root, 'home');
+    const canvasHome = join(root, 'canvas');
+    const socketPath = join(canvasHome, 'crtrd.sock');
+    const previousCwd = process.cwd();
+    const previousEnv = new Map(isolatedEnvKeys.map((key) => [key, process.env[key]]));
+    mkdirSync(home, { recursive: true });
+    mkdirSync(socketPath, { recursive: true });
+    try {
+        process.chdir(home);
+        process.env['HOME'] = home;
+        process.env['CRTR_HOME'] = canvasHome;
+        process.env['CRTR_PIDFILE'] = join(canvasHome, 'crtrd.pid');
+        process.env['CRTR_RUNTIME_HOME'] = join(root, 'runtime');
+        process.env['XDG_CACHE_HOME'] = join(root, 'cache');
+        process.env['XDG_CONFIG_HOME'] = join(root, 'config');
+        process.env['XDG_DATA_HOME'] = join(root, 'data');
+        process.env['PI_CODING_AGENT_DIR'] = join(home, '.pi', 'agent');
+        closeDb();
+        resetEventSourceForTests();
+        resetFleetForTests();
+        await assert.rejects(() => runDaemon(), (error) => error.code === 'EADDRINUSE', 'the mandatory API socket bind must reject startup');
+        const pidfile = process.env['CRTR_PIDFILE'];
+        assert.equal(existsSync(pidfile), false, 'failed readiness removes the pidfile mirror');
+        assert.equal(existsSync(socketPath), true, 'the pre-existing directory was never mistaken for a serving socket');
+        assert.match(readFileSync(join(canvasHome, 'crtrd.log'), 'utf8'), /api\.server\.failed/, 'the bind failure is recorded for cold-start diagnostics');
+        writeFileSync(pidfile, String(process.pid));
+        assert.deepEqual(await spawnDaemon(), {
+            started: false,
+            existing_pid: process.pid,
+            running: true,
+            serving: false,
+            next: 'Run `crtr sys daemon stop` to release the non-serving daemon before starting it again.',
+        }, 'start distinguishes a live non-serving pidfile owner from a serving daemon');
+        rmSync(pidfile, { force: true });
+        const retryClaim = claimDaemonOwnership('post-api-bind-failure');
+        assert.equal(retryClaim.claimed, true, 'failed readiness releases the authoritative ownership claim');
+        if (retryClaim.claimed) {
+            assert.equal(releaseDaemonOwnership(retryClaim.claim).released, true, 'the test-only retry claim releases cleanly');
+        }
+    }
+    finally {
+        closeDb();
+        resetEventSourceForTests();
+        resetFleetForTests();
+        process.chdir(previousCwd);
+        for (const key of isolatedEnvKeys) {
+            const previous = previousEnv.get(key);
+            if (previous === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = previous;
+        }
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/daemon/api/__tests__/reopen-delivery.test.js

@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { createNode, getNode, openDb } from '../../../core/canvas/index.js';
+import { armCron, getCron } from '../../../core/canvas/crons.js';
 import { closeDb } from '../../../core/canvas/db.js';
 import { viewSocketPath } from '../../../core/canvas/paths.js';
 import { readInboxSince } from '../../../core/feed/inbox.js';
@@ -98,6 +99,43 @@ function assertReopened(id) {
     assert.equal(meta?.lifecycle, 'resident');
     assert.equal(meta?.final_report, null);
 }
+function armDeadline(id) {
+    armCron({
+        cron_id: `${id}-deadline`,
+        name: `${id} deadline`,
+        command: 'echo stale deadline',
+        fire_at: new Date(Date.now() + 60_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: id,
+        cancel_on_wake: true,
+        created_by: null,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'silent',
+        sink: '{}',
+        tier: 'normal',
+    });
+}
+test('live interactive delivery clears the target deadline', async () => {
+    const id = 'live-deadline';
+    createNode(node(id, 'terminal', 'active', process.pid));
+    armDeadline(id);
+    const broker = await startLiveBroker(id);
+    try {
+        const result = await sendMessage(id, { body: 'wake before deadline', delivery: 'interactive' });
+        assert.equal(result.body.delivered_via, 'engine');
+        assert.equal(getCron(`${id}-deadline`), null, 'the accepted engine delivery won the deadline race');
+    }
+    finally {
+        await broker.close();
+    }
+});
 test('reopen makes live terminal, finalized terminal, and parked targets resident and unlatched before delivery', async () => {
     const liveId = 'live-terminal';
     createNode(node(liveId, 'terminal', 'active', process.pid));

package/dist/daemon/api/__tests__/seam/api-server.test.js

@@ -117,6 +117,7 @@ test('A3: messages append inbox.jsonl; final report writes + notifies subscriber
     assert.ok(res.notified.includes(A), `final push notifies the spawn-subscribed manager A (notified=${JSON.stringify(res.notified)})`);
     assert.deepEqual(res.transitioned, { from: 'active', to: 'done' }, 'row transitioned active→done');
     assert.equal(h.node(B)?.status, 'done', 'row status is done after final');
+    await assert.rejects(() => client.pushReport(B, { tier: 'final', delivery_tier: 'deferred', body: 'invalid tiered final' }), (error) => error instanceof ApiError && error.code === 'usage' && error.message === 'delivery_tier is only valid for update reports', 'the API rejects a delivery tier on final before it can alter final delivery');
 });
 // A4 — WS attach reconstructs the same settled broker snapshot as a direct
 //      ViewSocketClient; ?revive=0 on a dormant node → 409 without launching a broker

package/dist/daemon/api/__tests__/seam/leaf-api-parity.test.js

@@ -30,6 +30,7 @@ import { registerPush } from '../../../../commands/push.js';
 import { registerNode } from '../../../../commands/node.js';
 import { createNode, getNode } from '../../../../core/canvas/canvas.js';
 import { createManagedWorktree } from '../../../../core/worktree.js';
+import { readInboxSince } from '../../../../core/feed/inbox.js';
 import { gitSync } from '../../../../core/git.js';
 import { InputError } from '../../../../core/io.js';
 // A terminal fabricated node (no broker needed) that OWNS a managed worktree —
@@ -72,11 +73,11 @@ function pushLeaf(tier) {
 // Drive the leaf as the given caller node — sets CRTR_NODE_ID (client-side
 // identity resolution stays in the CLI process, per the B-5 scope) around the
 // run, restoring it after.
-async function runPushAs(caller, tier, body) {
+async function runPushAs(caller, tier, body, input = {}) {
     const prev = process.env['CRTR_NODE_ID'];
     process.env['CRTR_NODE_ID'] = caller;
     try {
-        return (await pushLeaf(tier).run({ body }));
+        return (await pushLeaf(tier).run({ body, ...input }));
     }
     finally {
         if (prev === undefined)
@@ -151,6 +152,16 @@ test('`crtr push final` from a child writes a report, notifies the subscribed pa
     // — the re-homed guard only engages for a managed-worktree owner.
     assert.equal('worktree_auto_dropped' in out, false, 'a normal node final is unaffected by the worktree guard');
 });
+test('`crtr push update --tier deferred` fans a deferred pointer while preserving an update report', async () => {
+    const parent = h.spawnRoot('leaf-api-parity deferred parent');
+    const child = (await client.createNode({ kind: 'developer', parent, prompt: 'deferred worker' })).node_id;
+    await h.awaitBoot(child);
+    const out = await runPushAs(child, 'update', 'deferred progress', { tier: 'deferred' });
+    assert.ok(out['notified'].includes(parent), 'the subscribed parent receives the report pointer');
+    const entry = readInboxSince(parent).find((candidate) => candidate.from === child && candidate.label === 'deferred progress');
+    assert.equal(entry?.kind, 'update', 'the stored report remains an update');
+    assert.equal(entry?.tier, 'deferred', 'the requested delivery tier reaches the parent');
+});
 // Re-homed worktree guard/auto-drop (ambiguity-2 follow-up): the pre-B-5 CLI
 // `push final` worktree behavior now lives SERVER-side in handlers/reports.ts,
 // exercised end-to-end through the real push.ts leaf.

package/dist/daemon/api/handlers/bash-jobs.js

@@ -4,6 +4,7 @@
 import { appendInbox } from '../../../core/feed/inbox.js';
 import { contextDir, isSafeNodeId } from '../../../core/canvas/paths.js';
 import { getNode } from '../../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../../core/canvas/crons.js';
 import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { assertNotFinalized } from '../../../core/runtime/reopen.js';
 import { reviveNode } from '../../../core/runtime/revive.js';
@@ -74,6 +75,7 @@ async function handleStop(ctx) {
         label: body.split('\n')[0].slice(0, 120),
         data: { body },
     });
+    cancelCronsOnWake(nodeId);
     const node = getNode(nodeId);
     if (node !== null && !isBrokerLive(node)) {
         try {

package/dist/daemon/api/handlers/broker-ops.js

@@ -1,7 +1,8 @@
 // Broker-originated canvas operations. The broker sends Pi lifecycle facts;
 // crtrd validates and commits their durable effects while the handler stays
 // strictly canvas-write-only — no broker launch, kill, or view.sock round trip.
-import { canonicalSessionFile, findNodeBySessionFile, getNode, isWarmSpare, listNodes, recordPid, setPresence, subscriptionsOf, updateNode } from '../../../core/canvas/canvas.js';
+import { canonicalSessionFile, findNodeBySessionFile, getNode, isWarmSpare, listNodes, recordPid, recordSettledTurn, setPresence, subscriptionsOf, updateNode } from '../../../core/canvas/canvas.js';
+import { isPidAlive } from '../../../core/canvas/pid.js';
 import { editorLabel } from '../../../core/canvas/labels.js';
 import { assembleNodeSubject } from '../../../core/substrate/subject.js';
 import { withCanvasWrite } from '../../../core/canvas/db.js';
@@ -13,7 +14,7 @@ import { focusOf, tearDownNode } from '../../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../../core/runtime/broker/client-registry.js';
 import { handleNewSession } from '../../../core/runtime/reset.js';
 import { evaluateStop } from '../../../core/runtime/stop-guard.js';
-import { clearFault } from '../../../core/runtime/fault.js';
+import { clearFault, recordFault } from '../../../core/runtime/fault.js';
 import { updateModelRecipe } from '../../../core/runtime/model-swap.js';
 import { completeCompanionRequestedSubmit } from '../../review/finish.js';
 import { consumePendingPark } from '../../park-pending.js';
@@ -187,6 +188,25 @@ function handleSessionBound(ctx) {
     const sessionFile = request.sessionFile === null ? null : canonicalSessionFile(request.sessionFile);
     const result = withCanvasWrite(() => {
         const before = requireNode(nodeId);
+        // A transcript is one broker's identity. Check ownership before every
+        // session-bound mutation: a live owner wins, and the claimant must stop
+        // rather than overwrite its own process-scoped identity onto that file.
+        const owner = sessionFile === null ? null : findNodeBySessionFile(sessionFile);
+        if (owner !== null && owner.node_id !== nodeId) {
+            if (isPidAlive(owner.pi_pid)) {
+                recordFault(nodeId, {
+                    link: 'daemon→node',
+                    op: 'session-file-ownership',
+                    kind: 'protocol',
+                    retry: { disposition: 'fatal' },
+                    message: `refusing to bind ${sessionFile}: it is owned by live node ${owner.node_id}`,
+                });
+                return { action: 'shutdown' };
+            }
+            // The prior owner is dead, so transfer the durable coordinate before the
+            // claimant writes it; the UNIQUE projection and both meta files agree.
+            updateNode(owner.node_id, { pi_session_id: null, pi_session_file: null });
+        }
         // The broker reports the markers present in Pi's current branch; crtrd owns
         // the review binding and decides whether that branch belongs to this node.
         const reviewId = before.review_binding?.review_id;
@@ -247,6 +267,7 @@ function settleBroker(nodeId, request) {
             return { action: 'stay_dormant' };
         throw notFound(`unknown node: ${nodeId}`, { received: nodeId });
     }
+    recordSettledTurn(nodeId, new Date().toISOString());
     if (request.stopReason === 'quit') {
         if ((node.status === 'active' || node.status === 'idle') && node.intent === null) {
             transition(nodeId, 'finish');

package/dist/daemon/api/handlers/human.js

@@ -37,7 +37,7 @@ function handleCreateBridge(ctx) {
         throw new ApiError(400, 'invalid_request', 'bridge `parent` must be a node id or null');
     }
     try {
-        const node = spawnNode({ kind: 'human', parent, cwd, name, lifecycle: 'terminal' });
+        const node = spawnNode({ kind: 'human', parent, creator: parent, cwd, name, lifecycle: 'terminal' });
         return { status: 200, body: { node_id: node.node_id, name: node.name } };
     }
     catch (error) {

package/dist/daemon/api/handlers/messages.js

@@ -8,6 +8,7 @@ import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { deliverLive, interruptLive } from '../../../core/runtime/interactive-deliver.js';
 import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { getNode, withFreshTerminalGuard } from '../../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../../core/canvas/crons.js';
 import { assertNotFinalized, assertFinalizedForReopen, commitReopen, commitReopenResident, } from '../../../core/runtime/reopen.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
 import { appendSituationalContext, formatSituationalProse } from '../../../core/runtime/situational-context.js';
@@ -249,6 +250,7 @@ async function handleMessage(ctx) {
             if (hasSidecar)
                 appendSituationalContext(id, sidecar);
             await deliverLive(id, req.body, [...(hasSidecar ? [sidecar] : []), ...oneShotCards]);
+            cancelCronsOnWake(id);
             const body = {
                 node_id: id,
                 delivered: true,
@@ -323,11 +325,17 @@ async function handleMessage(ctx) {
         return deliverImmediate();
     };
     const entry = deliver();
+    // Deferred mail normally waits for a natural cycle, but a frozen row already
+    // owes a thaw; consume its deadline when that durable future wake arrives.
+    if (tier !== 'deferred' || meta.frozen_at !== null)
+        cancelCronsOnWake(id);
     // A wake-capable tier revives a dormant target so its inbox-watcher delivers
-    // this; deferred never wakes — it rides the target's next natural cycle.
+    // this; deferred never wakes — it rides the target's next natural cycle. The
+    // APPENDED entry's tier decides, because a terminal target's deferred was
+    // already raised to a wake-capable tier by the append.
     let revived = false;
     let frozen = false;
-    if (tier !== 'deferred' && !paused && !isBrokerLive(meta)) {
+    if (entry.tier !== 'deferred' && !paused && !isBrokerLive(meta)) {
         try {
             // The entry is already durable, so a wake denied for capacity is only
             // delayed: the row freezes and the tick relaunches it — at which point
@@ -346,6 +354,7 @@ async function handleMessage(ctx) {
         revived,
         ...(frozen ? { not_revived_reason: 'capacity_frozen' } : {}),
         delivered_at: entry.ts,
+        ...(entry.tier === tier ? {} : { delivered_tier: entry.tier }),
         ...(req.delivery === 'interactive' ? { delivered_via: 'inbox' } : {}),
     };
     return { status: 201, body };

package/dist/daemon/api/handlers/nodes.js

@@ -102,6 +102,9 @@ function parseCreateBody(body) {
     if (b['description'] !== undefined && (typeof b['description'] !== 'string' || b['description'].trim() === '')) {
         throw usage('description must be a non-empty string when provided');
     }
+    if (b['creator'] !== undefined && (typeof b['creator'] !== 'string' || b['creator'].trim() === '')) {
+        throw usage('creator must be a non-empty node id when provided');
+    }
     const rootLifecycle = b['root_lifecycle'];
     if (rootLifecycle !== undefined &&
         rootLifecycle !== 'resident' &&
@@ -125,6 +128,8 @@ function buildRecipe(req, parent, cwd) {
         recipe.description = req.description;
     if (parent !== undefined)
         recipe.parent = parent;
+    if (req.creator !== undefined)
+        recipe.creator = req.creator;
     if (req.root === true)
         recipe.root = true;
     if (req.root_lifecycle !== undefined) {
@@ -174,6 +179,7 @@ function warmRequestFor(req, cwd, profileId) {
         model: req.model ?? null,
         situationalContext: req.situational_context ?? null,
         name: req.name ?? null,
+        creator: req.creator ?? null,
     };
 }
 export { resolveCreateKind } from '../../../core/runtime/launch-target.js';
@@ -508,7 +514,13 @@ function handleClose(ctx) {
     // `finish` selects the root disposition: finalize to `done` (browse `x`) vs the
     // default cancel.
     const body = ctx.body;
-    const result = closeNode(id, { rootEvent: body?.finish === true ? 'finish' : 'cancel' });
+    if (body?.caller_pid !== undefined && (!Number.isInteger(body.caller_pid) || body.caller_pid <= 0)) {
+        throw usage('caller_pid must be a positive integer when provided');
+    }
+    const result = closeNode(id, {
+        rootEvent: body?.finish === true ? 'finish' : 'cancel',
+        callerPid: body?.caller_pid,
+    });
     return { status: 200, body: toCloseResultDTO(result) };
 }
 async function handleRecycle(ctx) {

package/dist/daemon/api/handlers/reports.js

@@ -1,6 +1,7 @@
 // Report handlers (spec §6.4, §7.4). `POST /nodes/{id}/reports` is the single
-// push route — the tier is a body field; `final` drives the server-side
-// lifecycle transition inside feed `push()` (the sanctioned path). `GET
+// push route — `tier` is the report kind and update-only `delivery_tier` sets
+// subscriber delivery urgency; `final` drives the server-side lifecycle
+// transition inside feed `push()` (the sanctioned path). `GET
 // /nodes/{id}/reports` lists the node's stored report files.
 //
 // `{id}` is the REPORTING node (client-side = CRTR_NODE_ID).
@@ -24,14 +25,21 @@ function parsePushBody(body) {
         throw usage('a push report requires a JSON body { tier, body }');
     }
     const tier = body.tier;
+    const deliveryTier = body.delivery_tier;
     const text = body.body;
     if (tier !== 'update' && tier !== 'urgent' && tier !== 'final') {
         throw usage(`invalid report tier: ${String(tier)} (expected update|urgent|final)`);
     }
+    if (deliveryTier !== undefined && deliveryTier !== 'deferred' && deliveryTier !== 'normal' && deliveryTier !== 'urgent') {
+        throw usage(`invalid delivery_tier: ${String(deliveryTier)} (expected deferred|normal|urgent)`);
+    }
+    if (tier === 'final' && deliveryTier !== undefined) {
+        throw usage('delivery_tier is only valid for update reports');
+    }
     if (typeof text !== 'string' || text.trim() === '') {
         throw usage('a push report requires a non-empty body');
     }
-    return { tier, body: text };
+    return { tier, ...(deliveryTier === undefined ? {} : { delivery_tier: deliveryTier }), body: text };
 }
 async function handlePush(ctx) {
     const id = ctx.params['id'];
@@ -68,7 +76,7 @@ async function handlePush(ctx) {
         }
         autoDroppedPath = dropped.worktree_path;
     }
-    const result = await pushOrRethrow(id, req.tier, req.body);
+    const result = await pushOrRethrow(id, req);
     const transitioned = req.tier === 'final' && before !== undefined
         ? { from: before, to: getNode(id)?.status ?? 'done' }
         : undefined;
@@ -83,9 +91,9 @@ async function handlePush(ctx) {
  *  survives (a bare 409 would otherwise collapse to the generic `conflict`
  *  code). `unknown_node` is unreachable here (`requireNode` guards above), so
  *  it falls through as the generic 404. */
-async function pushOrRethrow(id, tier, body) {
+async function pushOrRethrow(id, req) {
     try {
-        return await push(id, { kind: tier, body });
+        return await push(id, { kind: req.tier, body: req.body, ...(req.delivery_tier === undefined ? {} : { deliveryTier: req.delivery_tier }) });
     }
     catch (err) {
         if (err instanceof FinalizationError && err.code === 'already_finalized') {

package/dist/daemon/api/map.js

@@ -119,6 +119,7 @@ export function toNodeDetailDTO(meta, edges) {
         pane: meta.pane ?? null,
         final_report: meta.final_report ?? null,
         finalized_at: meta.finalized_at ?? null,
+        creator: meta.creator ?? null,
         edges: toNodeEdgesDTO(meta, edges),
         paths: toNodePathsDTO(meta.node_id),
     };

package/dist/daemon/api/server.d.ts

@@ -4,20 +4,17 @@ export interface CreateApiServerOptions {
     tcp?: string;
 }
 export interface ApiServer {
+    /** Settles only after the mandatory Unix socket binds; rejects on its bind failure. */
+    ready: Promise<void>;
     /** Tear down both listeners and unlink the socket file. Double-close safe. */
     close(): Promise<void>;
 }
-/** Create and start the crtrd API server (A-9). Returns immediately with a
- *  `close()` handle; the listeners bind asynchronously (a unix socket's file is
- *  created on `listen`, so its 0600 chmod happens in the listen callback). A
- *  bind failure or a post-listen accept error is emitted and swallowed — it must
- *  NEVER become an unhandled 'error' that crashes the daemon.
+/** Create and start the crtrd API server. Returns immediately with a `close()`
+ *  handle and a `ready` promise for the mandatory Unix socket bind. TCP remains
+ *  opt-in, and its bind or post-listen accept errors are emitted but non-fatal.
  *
- *  NOTE (correction to the plan's "one http.Server bound twice"): a Node
- *  `net.Server`/`http.Server` binds exactly ONE handle — a second `.listen()`
- *  on the same instance throws `ERR_SERVER_ALREADY_LISTEN`. So the two listeners
- *  are two `http.Server` instances SHARING the same request + upgrade handler
- *  functions (the standard way to bind one logical API to two transports). The
- *  Router and attach bridge are process-wide singletons, so both servers route
- *  into identical state. */
+ *  A Node `net.Server`/`http.Server` binds exactly ONE handle, so the two
+ *  listeners are separate `http.Server` instances sharing request and upgrade
+ *  handlers. The Router and attach bridge are process-wide singletons, so both
+ *  servers route into identical state. */
 export declare function createApiServer(opts?: CreateApiServerOptions): ApiServer;