@north-light/crouter 0.3.249 → 0.3.251

package/dist/daemon/api/server.js

@@ -1,6 +1,7 @@
 // server.ts — the crtrd HTTP+WS API server (spec §4, esp. §4.1/§5). A-9.
 //
-// ONE `http.Server`, bound TWICE (the dockerd model, §4.1):
+// Two `http.Server` listeners share one logical API (a Node server can bind one
+// handle only):
 //   - the unix socket at `apiSocketPath()` — ALWAYS bound, owner-only (mode
 //     0600 = the fs-perms-are-auth model);
 //   - an opt-in TCP listener, bound only when `--tcp <host:port>` / `CRTRD_TCP`
@@ -121,19 +122,14 @@ function closeServer(server) {
         server.close(() => resolve());
     });
 }
-/** Create and start the crtrd API server (A-9). Returns immediately with a
- *  `close()` handle; the listeners bind asynchronously (a unix socket's file is
- *  created on `listen`, so its 0600 chmod happens in the listen callback). A
- *  bind failure or a post-listen accept error is emitted and swallowed — it must
- *  NEVER become an unhandled 'error' that crashes the daemon.
+/** Create and start the crtrd API server. Returns immediately with a `close()`
+ *  handle and a `ready` promise for the mandatory Unix socket bind. TCP remains
+ *  opt-in, and its bind or post-listen accept errors are emitted but non-fatal.
  *
- *  NOTE (correction to the plan's "one http.Server bound twice"): a Node
- *  `net.Server`/`http.Server` binds exactly ONE handle — a second `.listen()`
- *  on the same instance throws `ERR_SERVER_ALREADY_LISTEN`. So the two listeners
- *  are two `http.Server` instances SHARING the same request + upgrade handler
- *  functions (the standard way to bind one logical API to two transports). The
- *  Router and attach bridge are process-wide singletons, so both servers route
- *  into identical state. */
+ *  A Node `net.Server`/`http.Server` binds exactly ONE handle, so the two
+ *  listeners are separate `http.Server` instances sharing request and upgrade
+ *  handlers. The Router and attach bridge are process-wide singletons, so both
+ *  servers route into identical state. */
 export function createApiServer(opts = {}) {
     const router = buildRouter();
     const sockPath = apiSocketPath();
@@ -199,17 +195,32 @@ export function createApiServer(opts = {}) {
         }
     };
     const bindErrorHandler = (server) => {
-        // A bind failure or post-listen accept error must not be an unhandled
-        // 'error' that crashes the process — emit and carry on.
+        // TCP is opt-in, so neither its bind failure nor a later accept error can
+        // make the mandatory Unix API unavailable.
         server.on('error', (err) => {
             emitEvent({ event: 'api.server.failed', level: 'error', error: err });
         });
     };
-    // Unix socket — ALWAYS bound. Unlink any stale socket first (mirror
-    // broker.ts's listener setup), listen, then chmod 0600 once the file exists.
+    // Unix socket — ALWAYS bound. Its bind result is startup readiness; after
+    // that point, accept errors remain observable but do not tear the daemon down.
     const socketServer = createServer(onRequest);
     socketServer.on('upgrade', onUpgrade);
-    bindErrorHandler(socketServer);
+    let socketBound = false;
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    socketServer.once('listening', () => {
+        socketBound = true;
+        resolveReady();
+    });
+    socketServer.on('error', (err) => {
+        emitEvent({ event: 'api.server.failed', level: 'error', error: err });
+        if (!socketBound)
+            rejectReady(err);
+    });
     try {
         if (existsSync(sockPath))
             unlinkSync(sockPath);
@@ -265,5 +276,5 @@ export function createApiServer(opts = {}) {
             /* best-effort cleanup */
         }
     };
-    return { close };
+    return { ready, close };
 }

package/dist/daemon/companion-retire.js

@@ -5,7 +5,7 @@
 import { getNode } from '../core/canvas/canvas.js';
 import { FinalizationError, pushFinal } from '../core/feed/feed.js';
 import { transition } from '../core/runtime/lifecycle.js';
-import { headlessBrokerHost } from '../core/runtime/host.js';
+import { requestBrokerTeardown } from '../core/runtime/host.js';
 /** Retire a companion only through the terminal transition legal for its current status. */
 export async function retireCompanion(nodeId, outcome) {
     const node = getNode(nodeId);
@@ -23,18 +23,12 @@ export async function retireCompanion(nodeId, outcome) {
                 throw error;
             result = 'already';
         }
-        try {
-            headlessBrokerHost.teardown(nodeId);
-        }
-        catch { /* the canonical final is authoritative */ }
+        requestBrokerTeardown(nodeId);
         return result;
     }
     transition(nodeId, 'cancel', { reason: 'retired' });
     if (node.status === 'active' || node.status === 'idle') {
-        try {
-            headlessBrokerHost.teardown(nodeId);
-        }
-        catch { /* the terminal transition is authoritative */ }
+        requestBrokerTeardown(nodeId);
     }
     return 'retired';
 }

package/dist/daemon/cron/sinks.js

@@ -5,6 +5,7 @@ import { ticketDir } from '../../core/human/root.js';
 import { preparePage, publishPage } from '../../core/human/tickets.js';
 import { resolvePageComponents } from '../../core/config.js';
 import { getNode } from '../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { appendInbox } from '../../core/feed/inbox.js';
 import { hasNoNaturalCycle } from '../../core/runtime/revive-all.js';
 import { isParked } from '../../core/runtime/lifecycle.js';
@@ -23,15 +24,19 @@ function deliverNodeSink(c, target, stdout) {
         throw new Error(`node sink ${target} has no natural cycle ahead (done or finalized)`);
     }
     const from = c.created_by != null && getNode(c.created_by) !== null ? c.created_by : null;
-    appendInbox(target, {
+    const entry = appendInbox(target, {
         from,
         tier: c.tier,
         kind: 'message',
         label: `⏰ cron ${c.name}`,
         data: { body: stdout },
     });
+    if (c.tier !== 'deferred' || meta.frozen_at !== null)
+        cancelCronsOnWake(target);
+    // The APPENDED tier decides the wake, not the cron's requested one: a deferred
+    // cron aimed at a terminal node was raised out of `deferred` by the append.
     // The durable append succeeds even if its best-effort wake fails.
-    if (c.tier !== 'deferred' && !isBrokerLive(meta)) {
+    if (entry.tier !== 'deferred' && !isBrokerLive(meta)) {
         try {
             reviveNode(target, { resume: true, capacity: 'freeze' });
         }

package/dist/daemon/crtrd.js

@@ -668,8 +668,11 @@ export async function runDaemon(opts = {}) {
         // no adoption across epochs, ever.
         await operationIdContext.fresh(() => reapPriorEpochBrokers(epoch));
         writePidfile();
-        // Start the HTTP+WS API server (§4): unix socket always, TCP when opted in.
+        // The Unix API socket is the daemon's readiness boundary. A rejected bind
+        // enters the existing startup catch, which closes resources and releases
+        // this invocation's pidfile mirror and ownership claim before propagating.
         apiServer = createApiServer({ tcp: opts.tcp });
+        await apiServer.ready;
         // Pre-warm the node pool for the most recent project recipes, so the first
         // create after a boot is warm too. Fire-and-forget (the mints run off the
         // work lane), so it never delays supervision. Boot-time dead rows are the

package/dist/daemon/fleet.d.ts

@@ -1,7 +1,7 @@
 import { type NodeMeta } from '../core/canvas/index.js';
 import { type FleetEntry, type FleetExitStatus, type FleetRegistry } from '../core/runtime/fleet.js';
 import type { HostHandle } from '../core/runtime/host.js';
-/** Surface a vehicle that never booted (or exhausted its respawn budget).
+/** Surface a vehicle that never booted.
  *
  *  A pi that dies before its first session_start (so `pi_session_id` was never
  *  recorded) is invisible to its parent — the spawn returned optimistically.
@@ -43,16 +43,6 @@ export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' |
  *  would drive a turn if the engine came back. It selects row 4b and defaults
  *  to `true`, so an uninformed caller keeps the conservative respawn. */
 export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean, pendingWake?: boolean): DeadNodeAction;
-/** An exit with uptime at or above this resets the consecutive-failure
- *  counter before classification; a shorter-lived exit increments it. */
-export declare const HEALTHY_UPTIME_MS = 60000;
-/** At this many consecutive short-lived exits the respawn loop terminalizes:
- *  transition('crash') + surfaceBootFailure + doctrine wake, counter cleared. */
-export declare const MAX_RESPAWN_ATTEMPTS = 6;
-/** Backoff before the next respawn given the consecutive-failure count.
- *  Zero failures → immediate (the sub-second yield respawn D-3 buys); the
- *  n-th delayed attempt waits min(5s·2^n, 10min). */
-export declare function respawnBackoffMs(consecutiveFailures: number): number;
 export interface DaemonFleetOpts {
     /** This daemon's epoch id (randomBytes(8).toString('hex'), minted by
      *  runDaemon after the ownership claim). */
@@ -78,16 +68,12 @@ export declare class DaemonFleet implements FleetRegistry {
     forget(nodeId: string): void;
     onChildExit(nodeId: string, status: FleetExitStatus): void;
     deliverExit(nodeId: string, status: FleetExitStatus): void;
-    /** The node-lifecycle tick's enactment entry: classify a known-dead row and
-     *  enact immediately through the SAME policy table exit events use, so tick
-     *  recovery and exit recovery can never diverge. */
+    /** The node-lifecycle tick's enactment entry. */
     applyDeadRowPolicy(nodeId: string): Promise<void>;
     /** A revive refusal before its launch try/catch leaves the row active but
      *  with no fleet entry. Convert that otherwise-silent strand into the same
      *  terminal outcome as a boot failure. The fresh read avoids duplicating
      *  reviveNode's launch-failure crash path. */
     terminalizeIfStillNonTerminal(nodeId: string, event: string, error: unknown): Promise<boolean>;
-    /** Daemon shutdown: cancel every pending backoff respawn. Live processes
-     *  are torn down by the daemon's fleet-teardown stage, not here. */
     dispose(): void;
 }

package/dist/daemon/fleet.js

@@ -1,32 +1,31 @@
 // src/daemon/fleet.ts — the daemon's broker fleet: the ChildProcess-handle
 // registry (the ONE normal liveness authority), the exit-policy classifier
-// (invariant-5 policy table), and the event-driven respawn throttle.
+// (invariant-5 policy table), and durable respawn recovery.
 //
 // Constructed by runDaemon with the serial work lane's `enqueue` and this
 // daemon's epoch id, then injected into core via `bindFleet` BEFORE the API
-// server or any tick starts. Exit events never run policy inline on the Node
-// event callback — they enqueue a job on the serial lane, so policy never
-// interleaves with a tick's row reads (design D-3).
+// server or any tick starts. Exit events enqueue observation only; the durable
+// row tick owns recovery policy.
 //
 // Row state (status/intent/busy marker/session identity), never exit codes,
 // is the policy input (design D-4): the stophook writes the exit's explanation
 // before every deliberate exit, and that durable state is robust to every kill
-// path. Codes/signals are logged for diagnostics only. The single timing
-// input is uptime, used only by the throttle.
-import { getNode, subscribersOf } from '../core/canvas/index.js';
+// path. Codes/signals are logged for diagnostics only.
+import { getNode, getRow, subscribersOf } from '../core/canvas/index.js';
 import { fullName } from '../core/canvas/labels.js';
 import { isSafeNodeId } from '../core/canvas/paths.js';
 import { transition } from '../core/runtime/lifecycle.js';
 import { fanDoctrineWake } from '../core/runtime/close.js';
 import { hasCleanAbort, isBusy } from '../core/runtime/busy.js';
 import { hasPendingWake } from './reconcilers/live-obligation.js';
+import { clearRespawnPolicy, MAX_RESPAWN_ATTEMPTS, recordRespawnPolicy, respawnBackoffMs } from './reconcilers/node-lifecycle/respawn-policy.js';
 import { reviveNode } from '../core/runtime/revive.js';
 import { pushUrgent } from '../core/feed/feed.js';
 import { emitEvent } from '../core/events/emit.js';
 import { brokerThresholdsForDaemon } from '../core/runtime/fleet.js';
 // Shared crash helpers (moved from crtrd.ts — the fleet's policy paths are now
 // their primary consumers; crtrd imports them back for its surviving passes).
-/** Surface a vehicle that never booted (or exhausted its respawn budget).
+/** Surface a vehicle that never booted.
  *
  *  A pi that dies before its first session_start (so `pi_session_id` was never
  *  recorded) is invisible to its parent — the spawn returned optimistically.
@@ -42,6 +41,12 @@ export async function surfaceBootFailure(meta) {
         `If the work still needs doing, re-spawn it; if spawns keep dying, spawn fewer at a time.`;
     await pushUrgent(meta.node_id, body, { from: meta.node_id });
 }
+async function surfaceCrashLoop(meta) {
+    const body = `⚠ Crash loop — \`${meta.name}\` (${meta.kind}) kept dying without settling a turn.\n\n` +
+        `Its session started successfully, but six consecutive relaunches made no progress, so the daemon stopped retrying.\n\n` +
+        `Fix the crash cause, then revive the node if the work still needs doing.`;
+    await pushUrgent(meta.node_id, body, { from: meta.node_id });
+}
 /** Surface a recovery refusal that happened before a broker could launch. */
 async function surfaceRecoveryFailure(meta, error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -110,23 +115,6 @@ export function classifyDeadNode(row, busy, pendingWake = true) {
         return 'respawn-fresh'; // row 7: bounded ordinary fork-birth retry
     return 'boot-failure'; // row 8
 }
-// Respawn throttle (replaces the stranded-relaunch counters, event-driven)
-/** An exit with uptime at or above this resets the consecutive-failure
- *  counter before classification; a shorter-lived exit increments it. */
-export const HEALTHY_UPTIME_MS = 60_000;
-/** At this many consecutive short-lived exits the respawn loop terminalizes:
- *  transition('crash') + surfaceBootFailure + doctrine wake, counter cleared. */
-export const MAX_RESPAWN_ATTEMPTS = 6;
-const RESPAWN_BACKOFF_BASE_MS = 5_000;
-const RESPAWN_BACKOFF_MAX_MS = 10 * 60_000;
-/** Backoff before the next respawn given the consecutive-failure count.
- *  Zero failures → immediate (the sub-second yield respawn D-3 buys); the
- *  n-th delayed attempt waits min(5s·2^n, 10min). */
-export function respawnBackoffMs(consecutiveFailures) {
-    if (consecutiveFailures <= 0)
-        return 0;
-    return Math.min(RESPAWN_BACKOFF_BASE_MS * 2 ** (consecutiveFailures - 1), RESPAWN_BACKOFF_MAX_MS);
-}
 /** How long a capacity denial stays quiet before it is worth logging again. */
 const CAPACITY_LOG_THROTTLE_MS = 30_000;
 export class DaemonFleet {
@@ -134,7 +122,6 @@ export class DaemonFleet {
     #enqueue;
     #now;
     #map = new Map();
-    #throttle = new Map();
     /** Slots claimed but not yet held by a registered broker: a launch in flight,
      *  or a broker that exited and whose exit-policy job has not yet decided
      *  whether to relaunch it. Counting both against the cap is what keeps a
@@ -156,21 +143,8 @@ export class DaemonFleet {
         if (handle.pid === null) {
             throw new Error(`fleet: refusing to register ${nodeId} with no pid`);
         }
-        // A live registration supersedes any scheduled backoff respawn: the node
-        // is alive again (a manual revive won the race), so the pending respawn
-        // must not fire a second launch.
-        const throttle = this.#throttle.get(nodeId);
-        if (throttle?.timer !== undefined) {
-            clearTimeout(throttle.timer);
-            throttle.timer = undefined;
-        }
         this.#reservations.delete(nodeId);
-        this.#map.set(nodeId, {
-            pid: handle.pid,
-            launchedAt: this.#now(),
-            handle,
-            consecutiveFailures: throttle?.failures ?? 0,
-        });
+        this.#map.set(nodeId, { pid: handle.pid, handle });
     }
     has(nodeId) {
         return this.#map.has(nodeId);
@@ -212,28 +186,22 @@ export class DaemonFleet {
     forget(nodeId) {
         this.#map.delete(nodeId);
         this.#reservations.delete(nodeId);
-        this.#clearThrottle(nodeId);
     }
     onChildExit(nodeId, status) {
         // Move the slot from the registry to a reservation in ONE synchronous
         // step: the exit-policy job about to be enqueued may relaunch this node,
-        // and holding the slot for it is what keeps a 1:1 respawn from losing its
-        // own capacity to a launcher that raced onto the lane first. `#applyPolicy`
-        // releases it on every path that does not relaunch.
-        const entry = this.#map.get(nodeId);
+        // and holding the slot through the exit observation prevents a concurrent
+        // launch from entering before the registry reflects the exit.
         this.#map.delete(nodeId);
         this.#reservations.add(nodeId);
-        const launchedAt = entry?.launchedAt ?? null;
-        this.#enqueue(() => this.#runExitPolicy(nodeId, status, launchedAt));
+        this.#enqueue(() => this.#runExitPolicy(nodeId, status));
     }
     deliverExit(nodeId, status) {
         this.onChildExit(nodeId, status);
     }
-    /** The node-lifecycle tick's enactment entry: classify a known-dead row and
-     *  enact immediately through the SAME policy table exit events use, so tick
-     *  recovery and exit recovery can never diverge. */
+    /** The node-lifecycle tick's enactment entry. */
     async applyDeadRowPolicy(nodeId) {
-        await this.#applyPolicy(nodeId, 'tick');
+        await this.#applyPolicy(nodeId);
     }
     /** A revive refusal before its launch try/catch leaves the row active but
      *  with no fleet entry. Convert that otherwise-silent strand into the same
@@ -251,49 +219,17 @@ export class DaemonFleet {
         });
         return true;
     }
-    /** Daemon shutdown: cancel every pending backoff respawn. Live processes
-     *  are torn down by the daemon's fleet-teardown stage, not here. */
-    dispose() {
-        for (const state of this.#throttle.values()) {
-            if (state.timer !== undefined) {
-                clearTimeout(state.timer);
-                state.timer = undefined;
-            }
-        }
-    }
-    #clearThrottle(nodeId) {
-        const state = this.#throttle.get(nodeId);
-        if (state?.timer !== undefined)
-            clearTimeout(state.timer);
-        this.#throttle.delete(nodeId);
-    }
-    async #runExitPolicy(nodeId, status, launchedAt) {
-        const uptimeMs = launchedAt === null ? null : Math.max(0, this.#now() - launchedAt);
-        // A newer launch may own this node by the time the lane reaches this job
-        // (an API revive raced the exit event onto the lane). The exit belonged to
-        // the OLD process; the node is alive — nothing to recover, but preserve the
-        // observation without charging the fresh launch's throttle budget.
-        if (this.#map.has(nodeId)) {
-            this.#emitExitObserved(nodeId, status, uptimeMs, this.#throttle.get(nodeId)?.failures ?? 0);
-            return;
-        }
-        const state = this.#throttle.get(nodeId) ?? { failures: 0 };
-        if (state.timer !== undefined) {
-            clearTimeout(state.timer);
-            state.timer = undefined;
-        }
-        // Healthy uptime resets the counter BEFORE classification; a short-lived
-        // exit (or a synthetic exit with no known launch time) increments it.
-        if (uptimeMs !== null && uptimeMs >= HEALTHY_UPTIME_MS) {
-            state.failures = 0;
-            this.#throttle.delete(nodeId);
+    dispose() { }
+    async #runExitPolicy(nodeId, status) {
+        try {
+            const launchedAt = getNode(nodeId)?.launched_at;
+            const launchedMs = launchedAt == null ? Number.NaN : Date.parse(launchedAt);
+            const uptimeMs = Number.isFinite(launchedMs) ? Math.max(0, this.#now() - launchedMs) : null;
+            this.#emitExitObserved(nodeId, status, uptimeMs, getNode(nodeId)?.respawn_failures ?? 0);
         }
-        else {
-            state.failures += 1;
-            this.#throttle.set(nodeId, state);
+        finally {
+            this.releaseReservation(nodeId);
         }
-        this.#emitExitObserved(nodeId, status, uptimeMs, state.failures);
-        await this.#applyPolicy(nodeId, 'exit');
     }
     #emitExitObserved(nodeId, status, uptimeMs, consecutiveFailures) {
         emitEvent({
@@ -309,19 +245,10 @@ export class DaemonFleet {
             },
         });
     }
-    async #applyPolicy(nodeId, origin) {
-        try {
-            return await this.#decideAndEnact(nodeId, origin);
-        }
-        finally {
-            // The reservation this node has held since its exit is either consumed by
-            // a successful `register` (making this a no-op) or given back here — the
-            // one release path covering a declined policy, a deferred backoff, and
-            // terminalization alike.
-            this.releaseReservation(nodeId);
-        }
+    async #applyPolicy(nodeId) {
+        return this.#decideAndEnact(nodeId);
     }
-    async #decideAndEnact(nodeId, origin) {
+    async #decideAndEnact(nodeId) {
         const meta = getNode(nodeId);
         // Two durable witnesses mean the dead broker had a turn in flight. A dirty
         // death leaves the busy marker behind; a bounded graceful abort clears busy
@@ -332,19 +259,19 @@ export class DaemonFleet {
         switch (action) {
             case 'forget':
                 // Fanouts for terminal exits already happened at the transition site.
-                this.#clearThrottle(nodeId);
+                clearRespawnPolicy(nodeId);
                 break;
             case 'dormant':
                 // Chosen dormancy is not a failure — the counter does not survive it.
                 // The pathological wake→fault→release→wake loop is bounded by the
-                // tick's pass-2 cursor-keyed retry cap (D-11), not this throttle.
-                this.#clearThrottle(nodeId);
+                // tick's pass-2 cursor-keyed retry cap (D-11), not this policy.
+                clearRespawnPolicy(nodeId);
                 break;
             case 'release-idle':
                 // Dormancy the daemon chose ON the node's behalf, and the same
                 // non-failure: the row lands exactly where a stophook idle-release
                 // would have left it, so pass-2 inbox wakes own its next revive.
-                this.#clearThrottle(nodeId);
+                clearRespawnPolicy(nodeId);
                 transition(nodeId, 'release');
                 emitEvent({
                     level: 'info',
@@ -352,7 +279,6 @@ export class DaemonFleet {
                     ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
                     fields: {
                         ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
-                        origin,
                     },
                 });
                 break;
@@ -366,51 +292,42 @@ export class DaemonFleet {
             case 'respawn-fresh':
             case 'respawn-cycle':
             case 'respawn-resume':
-                await this.#respawn(nodeId, meta, action, origin, interruptedTurn);
+                await this.#respawn(nodeId, meta, action, interruptedTurn);
                 break;
         }
         return action;
     }
-    async #respawn(nodeId, meta, action, origin, interruptedTurn) {
-        const state = this.#throttle.get(nodeId) ?? { failures: 0 };
-        if (state.failures >= MAX_RESPAWN_ATTEMPTS) {
+    async #respawn(nodeId, meta, action, interruptedTurn) {
+        const row = getRow(nodeId);
+        if (row === null)
+            return;
+        const assess = row.respawn_not_before == null;
+        const priorFailures = row.respawn_failures ?? 0;
+        const attempt = assess
+            ? recordRespawnPolicy(row, this.#now())
+            : { failures: priorFailures, notBefore: row.respawn_not_before, exhausted: priorFailures >= MAX_RESPAWN_ATTEMPTS };
+        if (attempt.exhausted) {
             await this.#terminalize(nodeId, meta, {
                 event: 'broker.respawn.exhausted',
-                wake: `Child crashed — ${fullName(meta)} (${nodeId}) kept dying shortly after launch (${state.failures} consecutive ` +
-                    `short-lived exits) and is now dead. It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`,
+                wake: `Child crashed — ${fullName(meta)} (${nodeId}) kept dying without settling a turn (${attempt.failures} consecutive ` +
+                    `launches) and is now dead. It stays dead until you revive it — \`crtr node lifecycle revive ${nodeId}\`.`,
+                ...(meta.pi_session_id != null ? { surface: () => surfaceCrashLoop(meta) } : {}),
             });
             return;
         }
-        // A backoff timer already owns this node's next respawn; a tick that
-        // enacted the same policy meanwhile would defeat the throttle entirely.
-        if (origin === 'tick' && state.timer !== undefined)
+        if (assess && attempt.notBefore !== null) {
+            emitEvent({
+                level: 'info',
+                event: 'broker.respawn.deferred',
+                ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
+                fields: {
+                    ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
+                    action,
+                    backoff_ms: respawnBackoffMs(attempt.failures),
+                    consecutive_failures: attempt.failures,
+                },
+            });
             return;
-        // Only a fresh exit consults the backoff: a matured timer and a tick
-        // enactment relaunch immediately (the timer already WAS the backoff, and a
-        // tick candidate reached the lane only after its own gating).
-        if (origin === 'exit') {
-            const delay = respawnBackoffMs(state.failures);
-            if (delay > 0) {
-                state.timer = setTimeout(() => {
-                    state.timer = undefined;
-                    // A fresh policy job re-reads the row, so a node closed/canceled
-                    // during the backoff lands in table row 2 and the respawn evaporates.
-                    this.#enqueue(async () => { await this.#applyPolicy(nodeId, 'timer'); });
-                }, delay);
-                this.#throttle.set(nodeId, state);
-                emitEvent({
-                    level: 'info',
-                    event: 'broker.respawn.deferred',
-                    ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}),
-                    fields: {
-                        ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
-                        action,
-                        backoff_ms: delay,
-                        consecutive_failures: state.failures,
-                    },
-                });
-                return;
-            }
         }
         emitEvent({
             level: 'info',
@@ -419,8 +336,7 @@ export class DaemonFleet {
             fields: {
                 ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
                 action,
-                origin,
-                consecutive_failures: state.failures,
+                consecutive_failures: attempt.failures,
             },
         });
         try {
@@ -450,7 +366,6 @@ export class DaemonFleet {
                 fields: {
                     ...(isSafeNodeId(nodeId) ? {} : { affected_node_id: nodeId }),
                     action,
-                    origin,
                 },
             });
             // Launch failures terminalize inside reviveNode, but its preflight
@@ -459,10 +374,8 @@ export class DaemonFleet {
             await this.terminalizeIfStillNonTerminal(nodeId, 'broker.respawn.refused', err);
         }
     }
-    /** Terminal outcome shared by table row 8 and throttle exhaustion:
-     *  transition('crash') + surfaceBootFailure + doctrine wake, counter cleared. */
+    /** Terminal outcome shared by table row 8 and respawn exhaustion. */
     async #terminalize(nodeId, meta, opts) {
-        this.#clearThrottle(nodeId);
         emitEvent({
             level: 'error',
             event: opts.event,

package/dist/daemon/human/finish.js

@@ -1,5 +1,6 @@
 import { ApiError } from '../../api/index.js';
 import { getRow, subscribersOf } from '../../core/canvas/canvas.js';
+import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { opaqueInboxTicketId, ticketDir } from '../../core/human/root.js';
 import { readTicketActionBinding } from '../../core/human/action-binding.js';
 import { completionEventFor, composeHumanCompletion } from '../../core/human/completion.js';
@@ -275,6 +276,7 @@ export async function deliverTerminalResult(ticketId) {
                     data: { body },
                     disposition: 'human-canceled',
                 });
+                cancelCronsOnWake(subscriber.node_id);
             }
             catch {
                 failedTo.push(subscriber.node_id);

package/dist/daemon/manage.d.ts

@@ -46,7 +46,17 @@ export interface SpawnDaemonResult {
     pid?: number;
     /** PID of the already-running daemon, if it was already up. */
     existing_pid?: number;
+    /** Present only when a live pidfile owner does not answer `/healthz`. */
+    running?: true;
+    /** Present with `running:true` when the Unix API socket is not serving. */
+    serving?: false;
+    /** Recovery instruction for a live but non-serving daemon. */
+    next?: string;
 }
+/** True only when the mandatory Unix API socket answers `/healthz`. This is
+ * deliberately separate from `isDaemonRunning()`: a pidfile remains useful for
+ * identifying the process an operator must stop, but it is not readiness. */
+export declare function isDaemonServing(): Promise<boolean>;
 export interface DaemonWaitDeps {
     readPidfile?: () => number | null;
     isPidAlive?: (pid: number) => boolean;
@@ -58,6 +68,7 @@ export interface DaemonStartupDeps extends DaemonWaitDeps {
         code: number | null;
         signal: NodeJS.Signals | null;
     } | null;
+    isDaemonServing?: () => Promise<boolean>;
 }
 /** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
  *  appear before reporting success. This catches the "started:true but not yet