@north-light/crouter 0.3.249 → 0.3.251

package/dist/core/__tests__/daemon-boot.test.js

@@ -62,23 +62,24 @@ after(() => {
 });
 // A broker that exits while pi_session_id was NEVER set: the vehicle died
 // before pi ever booted. The spawner already returned status="active", so the
-// parent must be told — the exit-policy job (table row 8) marks it dead AND
-// pushes urgent up. The old null-pid boot-grace clock is gone: the exit event
-// names the exact death, so there is nothing to bridge.
-test('never-booted broker exit is marked dead and surfaced to the parent as urgent', async () => {
+// authoritative tick applies table row 8 and tells the parent. The delivered
+// exit is observation-only.
+test('never-booted broker is marked dead by the tick and surfaced to the parent as urgent', async () => {
     createNode(node('P', { kind: 'developer', lifecycle: 'resident' }));
     createNode(node('C', {
         parent: 'P',
         kind: 'explore',
+        pi_pid: deadPid(), // launch recorded its process before it died
         pi_session_id: null, // never booted
         intent: null,
     }));
     spawnEdge('P', 'C');
-    // Exit-event authority: the launch's real child exit (delivered synthetically
-    // here — same path) classifies as table row 8: pi_session_id null, no fork
-    // claim → boot failure. No grace, no retry.
+    // The launch's real child exit is delivered synthetically here, then the
+    // authoritative tick classifies the dead recorded pid as table row 8:
+    // pi_session_id null, no fork claim → boot failure. No grace, no retry.
     tf.fleet.deliverExit('C', { code: 1, signal: null });
     await tf.drain();
+    await superviseTick();
     assert.equal(getNode('C').status, 'dead', 'never-booted child is dead');
     // Row 8 fans TWO entries: the urgent surfaceBootFailure push and the normal
     // doctrine wake (design flow B row 8 — crash + surfaceBootFailure + doctrine
@@ -115,7 +116,12 @@ test('a crashed booted child is relaunched on its saved session, not reaped, and
         spawnEdge('P2', 'C2');
         markBusy('C2'); // died mid-generation
         await superviseTick();
-        assert.deepEqual(launches, ['C2'], 'the tick recovers the crash through the policy table, exactly as the exit event would');
+        const afterFirstTick = getNode('C2');
+        assert.deepEqual(launches, [], 'the first tick records the failed launch without relaunching');
+        assert.equal(afterFirstTick.respawn_failures, 1, 'the first tick records failure one durably');
+        assert.ok(afterFirstTick.respawn_not_before, 'the first tick records durable backoff');
+        await superviseTick(Date.parse(afterFirstTick.respawn_not_before));
+        assert.deepEqual(launches, ['C2'], 'the matured tick recovers the crash through the policy table');
         assert.equal(getNode('C2').status, 'active', 'crashed booted child is relaunched, NOT marked dead');
         assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
         clearBusy('C2');
@@ -155,19 +161,21 @@ test('idle-release node with a boot-cleared (null) pid and no unseen inbox is se
     assert.equal(after.intent, null, 'no revive fired — the row is settled, not relaunched');
     assert.equal(after.pi_pid, null, 'no fresh pid — reviveNode was never invoked');
 });
-// Daemon start guard: spawnDaemon must not report success before the daemon is
-// plausibly alive and has written its pidfile. This is a pure bounded poll over
-// injected clocks/probes, so we can lock it down deterministically without a
-// real daemon process.
-test('verifyDaemonStartup waits for pidfile + live pid, then reports success for the spawned pid', async () => {
+// Daemon start guard: spawnDaemon must not report success before the daemon's
+// pidfile owner is live AND its Unix API socket serves. This is a pure bounded
+// poll over injected clocks/probes, so we can lock it down deterministically
+// without a real daemon process.
+test('verifyDaemonStartup waits for pidfile, live pid, and serving socket before reporting success', async () => {
     let now = 0;
     let pidfileReady = false;
     let pidAliveReady = false;
+    let socketServing = false;
     let slept = 0;
     const existingPid = await verifyDaemonStartup(42, 50, {
         now: () => now,
         readPidfile: () => (pidfileReady ? 42 : null),
         isPidAlive: () => pidAliveReady,
+        isDaemonServing: async () => socketServing,
         sleepMs: (ms) => {
             slept += ms;
             now += ms;
@@ -175,12 +183,15 @@ test('verifyDaemonStartup waits for pidfile + live pid, then reports success for
                 pidfileReady = true;
             if (now >= 30)
                 pidAliveReady = true;
+            if (now >= 40)
+                socketServing = true;
         },
     });
     assert.equal(existingPid, null, 'the spawned daemon owns the pidfile when startup succeeds');
     assert.equal(pidfileReady, true, 'pidfile must have appeared before success');
     assert.equal(pidAliveReady, true, 'pid must have been alive before success');
-    assert.equal(slept > 0, true, 'the guard must actually poll');
+    assert.equal(socketServing, true, 'the Unix API socket must serve before success');
+    assert.equal(slept >= 40, true, 'the guard must actually poll through socket readiness');
 });
 test('runDaemon awaits activation before ownership and readiness', () => {
     const source = readFileSync(fileURLToPath(new URL('../../daemon/crtrd.ts', import.meta.url)), 'utf8');
@@ -204,6 +215,7 @@ test('verifyDaemonStartup default window tolerates a slower cold start', async (
         now: () => now,
         readPidfile: () => (pidfileReady ? 42 : null),
         isPidAlive: () => pidAliveReady,
+        isDaemonServing: async () => pidAliveReady,
         sleepMs: (ms) => {
             now += ms;
             if (now >= 600)
@@ -221,6 +233,7 @@ test('startup verification waits for delayed activation inside the shared window
         now: () => now,
         readPidfile: () => (activationComplete ? 42 : null),
         isPidAlive: () => activationComplete,
+        isDaemonServing: async () => activationComplete,
         sleepMs: (ms) => {
             now += ms;
             if (now >= 25_000)
@@ -239,6 +252,7 @@ test('verifyDaemonStartup returns the existing live daemon when another pid won
         now: () => now,
         readPidfile: () => 7,
         isPidAlive: (pid) => pid === 7,
+        isDaemonServing: async () => true,
         sleepMs: (ms) => {
             slept += ms;
             now += ms;
@@ -276,6 +290,7 @@ test('verifyDaemonStartup throws after its tiny startup window expires', async (
         now: () => now,
         readPidfile: () => null,
         isPidAlive: () => false,
+        isDaemonServing: async () => false,
         sleepMs: (ms) => {
             now += ms;
         },
@@ -299,6 +314,7 @@ test('verifyDaemonStartup throws when the spawned daemon exits before it can bec
     await assert.rejects(async () => verifyDaemonStartup(77, 2_000, {
         readPidfile: () => null,
         isPidAlive: () => false,
+        isDaemonServing: async () => false,
         childExited: () => exited,
     }), /exited before becoming ready \(with exit code 1\)/);
     assert.ok(Date.now() - started < 1_500, 'must fail fast on the real child exit, not run out the window');

package/dist/core/__tests__/daemon-wedge.test.js

@@ -1,41 +1,47 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/daemon-wedge.test.ts
 //
 // Issue #110 — pid-alive WEDGED node detection. The pure decision core:
-// wedgeVerdict(busy, quietForMs, cpuPercent). No wall-clock sleeps, no ps
+// wedgeVerdict(busy, quietForMs, cpuPercent, hasDescendants). No wall-clock sleeps, no ps
 // shell-outs, no fake pids — every input is injected directly, mirroring the
 // yieldStallVerdict truth-table suite in refresh-stall-recycle.test.ts.
 //
-// LOCKS: (1) a routine long-running BUT ACTIVE turn (heartbeat recent, or CPU
-// non-trivial) must never verdict 'wedged' — false positives are the failure
-// mode this feature exists to avoid. (2) only busy+quiet+near-zero-CPU, all at
-// once, past the generous grace, fires. (3) a null/failed CPU sample never
+// LOCKS: (1) a routine long-running turn with a CPU-active subprocess must
+// never verdict 'wedged' — false positives are the failure mode this feature
+// exists to avoid. (2) a childless busy broker that is quiet past grace is
+// wedged even when its own CPU is high. (3) a null/failed CPU sample never
 // fires on its own (fails toward 'pending', not 'wedged').
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { wedgeVerdict, WEDGE_QUIET_MS, WEDGE_CPU_MAX_PERCENT, sumTreeCpu, treeHasDescendants, } from '../../daemon/reconcilers/broker-supervision.js';
 test('wedgeVerdict: a node whose turn already ended is never wedged, regardless of the other signals', () => {
-    assert.equal(wedgeVerdict({ busy: false, quietForMs: null, cpuPercent: null }), 'leave');
-    assert.equal(wedgeVerdict({ busy: false, quietForMs: 10 * 60 * 60_000, cpuPercent: 0 }), 'leave');
+    assert.equal(wedgeVerdict({ busy: false, quietForMs: null, cpuPercent: null, hasDescendants: null }), 'leave');
+    assert.equal(wedgeVerdict({ busy: false, quietForMs: 10 * 60 * 60_000, cpuPercent: 0, hasDescendants: null }), 'leave');
 });
 test('wedgeVerdict: a busy node with an unreadable heartbeat is left alone (not enough evidence)', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: null, cpuPercent: null }), 'leave');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: null, cpuPercent: null, hasDescendants: null }), 'leave');
 });
 test('wedgeVerdict: routine turns — even long ones — never trip before the grace elapses', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: 0, cpuPercent: 0 }), 'leave', 'just started');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: 5 * 60_000, cpuPercent: 0 }), 'leave', 'a routine multi-minute tool call');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS - 1, cpuPercent: 0 }), 'leave', 'just under the grace, even with 0% cpu');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: 0, cpuPercent: 0, hasDescendants: null }), 'leave', 'just started');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: 5 * 60_000, cpuPercent: 0, hasDescendants: null }), 'leave', 'a routine multi-minute tool call');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS - 1, cpuPercent: 0, hasDescendants: null }), 'leave', 'just under the grace, even with 0% cpu');
 });
 test('wedgeVerdict: past the grace with NO cpu corroboration only pends — never fires on time alone', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: null }), 'pending', 'cpu sample failed/unavailable — never treated as confirmation');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 10, cpuPercent: null }), 'pending', 'no amount of extra quiet time substitutes for the corroborating signal');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: null, hasDescendants: null }), 'pending', 'cpu sample failed/unavailable — never treated as confirmation');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 10, cpuPercent: null, hasDescendants: null }), 'pending', 'no amount of extra quiet time substitutes for the corroborating signal');
 });
-test('wedgeVerdict: a long-quiet turn that is STILL VISIBLY WORKING (real cpu) is exonerated, not wedged', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: WEDGE_CPU_MAX_PERCENT + 0.1 }), 'pending', 'cpu just above the ceiling — a genuinely churning long build — must not fire');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40 }), 'pending', 'clearly-active cpu never fires regardless of how quiet the heartbeat looks');
+test('wedgeVerdict: high CPU exonerates a broker with descendants but not a childless stalled engine', () => {
+    assert.equal(wedgeVerdict({
+        busy: true,
+        quietForMs: WEDGE_QUIET_MS * 3,
+        cpuPercent: WEDGE_CPU_MAX_PERCENT + 0.1,
+        hasDescendants: true,
+    }), 'pending', 'cpu just above the ceiling — a genuinely churning long build — must not fire');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40, hasDescendants: true }), 'pending', 'clearly-active child cpu never fires regardless of how quiet the heartbeat looks');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40, hasDescendants: false }), 'wedged', 'a childless broker spinning in-process is itself stalled');
 });
-test('wedgeVerdict: fires ONLY when busy + quiet-past-grace + near-zero cpu all corroborate', () => {
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: 0 }), 'wedged');
-    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS + 60_000, cpuPercent: WEDGE_CPU_MAX_PERCENT }), 'wedged', 'at the cpu ceiling (inclusive)');
+test('wedgeVerdict: fires when busy + quiet-past-grace + near-zero cpu all corroborate', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: 0, hasDescendants: true }), 'wedged');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS + 60_000, cpuPercent: WEDGE_CPU_MAX_PERCENT, hasDescendants: true }), 'wedged', 'at the cpu ceiling (inclusive)');
 });
 // sumTreeCpu (pure) — process-tree CPU sampling. Review fix for issue #110:
 // sampling only the broker pid false-fired on a broker awaiting a busy CHILD

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -29,6 +29,7 @@
 //   <nodeDir>/fake-pi.error          — any boot/import failure
 //   <nodeDir>/fake-pi.cmd            — harness writes ONE JSON command (turn|stop|auto_retry|dialog)
 //   <nodeDir>/fake-pi.dialog.jsonl   — one line per resolved unattended dialog (§5.4)
+import { spawn } from 'node:child_process';
 import { writeFileSync, readFileSync, existsSync, mkdirSync, appendFileSync, unlinkSync, } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -493,12 +494,19 @@ class FakeSession {
      *  a resolvable `/name` token must not crash on a missing method. */
     customMessages = [];
     sendCustomMessage(message, options) {
-        this.customMessages.push({
+        const customMessage = {
             customType: message.customType,
             content: message.content,
             display: message.display,
             deliverAs: options?.deliverAs,
-        });
+        };
+        this.customMessages.push(customMessage);
+        try {
+            appendFileSync(join(this.dir, 'fake-pi.custom-messages.jsonl'), JSON.stringify(customMessage) + '\n');
+        }
+        catch {
+            /* best effort test proof */
+        }
         return Promise.resolve();
     }
     abort() {
@@ -940,6 +948,16 @@ class FakeSession {
     async dispatch(cmd) {
         const ctx = this.buildCtx();
         switch (cmd.cmd) {
+            case 'self_close': {
+                const cli = join(dirname(new URL(import.meta.url).pathname), '../../../cli.js');
+                const resultPath = join(this.dir, 'self-close-result');
+                const pidPath = join(this.dir, 'self-close-shell.pid');
+                const shell = spawn('sh', ['-c', `"${process.execPath}" "${cli}" node lifecycle close --node "$CRTR_NODE_ID"; code=$?; printf '%s\\n' "$code" > "${resultPath}"; while :; do sleep 1; done`], { detached: true, stdio: 'ignore', env: process.env });
+                if (shell.pid !== undefined)
+                    writeFileSync(pidPath, `${shell.pid}\n`);
+                shell.unref();
+                break;
+            }
             case 'stream':
                 // Drive a subscribe-channel streaming turn WITHOUT a controller (G3:
                 // produce-while-detached) or with sized frames (G8: a fast event stream

package/dist/core/__tests__/human-deliver.test.js

@@ -47,7 +47,7 @@ async function withMutedStdout(fn) {
 }
 function bridgeUnder() {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const bridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     return { parent, bridge };
 }
 function submitBridgePage(bridge) {
@@ -178,7 +178,7 @@ describe('terminal ticket delivery', () => {
     test('approved companions receive one canonical final while dismissed companions remain canceled', async () => {
         const { bridge } = bridgeUnder();
         const dir = submitBridgePage(bridge);
-        const companion = spawnNode({ kind: 'general', parent: bridge, cwd: home, name: 'feedback companion', lifecycle: 'resident' }).node_id;
+        const companion = spawnNode({ kind: 'general', parent: bridge, creator: bridge, cwd: home, name: 'feedback companion', lifecycle: 'resident' }).node_id;
         createPageFeedbackComment(dir, { quote: 'Ship it?', note: 'Confirm the release.', companionNodeId: companion });
         transition(companion, 'finish');
         await resolvePageTicket(bridge, { question: { text: 'yes', edited: true } });
@@ -195,7 +195,7 @@ describe('terminal ticket delivery', () => {
         assert.throws(() => reviveNode(companion, { resume: true, capacity: 'freeze' }), /finalization latch/);
         const { bridge: dismissedBridge } = bridgeUnder();
         const dismissedDir = submitBridgePage(dismissedBridge);
-        const dismissedCompanion = spawnNode({ kind: 'general', parent: dismissedBridge, cwd: home, name: 'dismissed feedback companion', lifecycle: 'resident' }).node_id;
+        const dismissedCompanion = spawnNode({ kind: 'general', parent: dismissedBridge, creator: dismissedBridge, cwd: home, name: 'dismissed feedback companion', lifecycle: 'resident' }).node_id;
         createPageFeedbackComment(dismissedDir, { quote: 'Ship it?', note: 'Do not ship.', companionNodeId: dismissedCompanion });
         await cancelHumanTicket(dismissedBridge, { reason: 'dismissed', actor: 'human' });
         assert.equal(getNode(dismissedCompanion)?.status, 'canceled');
@@ -207,7 +207,7 @@ describe('terminal ticket delivery', () => {
     });
     test('cancelHumanTicket finishes the bridge and notifies non-actor subscribers', async () => {
         const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
-        const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+        const bridge = spawnNode({ kind: 'human', parent: actor, creator: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
         const other = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'other' }).node_id;
         const { subscribe } = await import('../canvas/canvas.js');
         subscribe(other, bridge, true);
@@ -223,7 +223,7 @@ describe('terminal ticket delivery', () => {
     });
     test('cancellation reaches subscribers when the bridge is already done, and retries conflict rather than fail', async () => {
         const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
-        const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+        const bridge = spawnNode({ kind: 'human', parent: actor, creator: actor, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
         const other = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'other' }).node_id;
         const { subscribe } = await import('../canvas/canvas.js');
         subscribe(other, bridge, true);

package/dist/core/__tests__/integration/deferred-no-wake.test.js

@@ -44,7 +44,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { DatabaseSync } from 'node:sqlite';
-import { createNode, deleteNode, getNode, setFrozen, setStatus, withFreshTerminalGuard } from '../../canvas/canvas.js';
+import { createNode, deleteNode, getNode, setFrozen, setStatus, subscribe, withFreshTerminalGuard } from '../../canvas/canvas.js';
 import { hasNoNaturalCycle } from '../../runtime/revive-all.js';
 import { canvasDbPath, nodeDir, apiSocketPath } from '../../canvas/paths.js';
 import { closeDb } from '../../canvas/db.js';
@@ -148,7 +148,10 @@ after(() => {
 // Command layer — the immediate-delivery wake block in node.ts
 test('node message send --tier deferred to an ordinary dormant (idle-released) target does not revive it — appended and held for the next natural cycle', { timeout: 30_000 }, async () => {
     const id = 'idleReleaseTarget';
-    createNode(node(id, { status: 'idle', intent: 'idle-release' }));
+    // Resident: the hold is what a target with a real later cycle gets. A
+    // terminal target takes no such cycle, so its mail is raised to the steering
+    // tier instead (locked by the next test).
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release' }));
     const inboxBefore = readInboxSince(id, undefined).length;
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
@@ -170,6 +173,30 @@ test('node message send --tier deferred to an ordinary dormant (idle-released) t
     assert.equal(after.status, 'idle', 'target left exactly where it was');
     assert.equal(after.intent, 'idle-release', 'target left exactly where it was');
 });
+test('node message send --tier deferred to a TERMINAL-lifecycle target is raised to the steering tier and wakes it', { timeout: 30_000 }, async () => {
+    const id = 'terminalLifecycleTarget';
+    createNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    // Fully stubbed (never delegates): the point is that the raised entry DOES
+    // attempt the wake, so a real detached broker must not be spawned to prove it.
+    const originalLaunch = headlessBrokerHost.launch;
+    let launchCalls = 0;
+    headlessBrokerHost.launch = (() => {
+        launchCalls++;
+        return { pid: 0x7ffffffe, exited: new Promise(() => { }) };
+    });
+    let res;
+    try {
+        res = (await messageSendLeaf().run({ to: id, tier: 'deferred', body: 'not held' }));
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+    }
+    const entries = readInboxSince(id, undefined);
+    assert.equal(entries.length, 1, 'the message is durably appended');
+    assert.equal(entries[0].tier, 'urgent', 'a terminal target takes no later cycle, so the entry is raised to the steering tier');
+    assert.equal(launchCalls, 1, 'the raised entry wakes the dormant terminal target instead of waiting for a cycle it never takes');
+    assert.equal(res['revived'], true, 'the send reports the wake it actually performed');
+});
 test('node message send --tier deferred rejects ordinary terminal targets but accepts a frozen terminal target with a thaw cycle owed', { timeout: 30_000 }, async () => {
     for (const status of ['done', 'canceled']) {
         const id = `terminal-${status}`;
@@ -385,7 +412,13 @@ test("withFreshTerminalGuard reports 'missing' — never runs the guarded body
 // proven separately below through the real inbox watcher.
 test('daemon second pass: a deferred-only unseen set never wakes an idle-released node; a later non-deferred entry wakes it (decision only — real delivery is proven separately below)', { timeout: 30_000 }, async () => {
     const id = 'idleReleaseDeferredDaemon';
-    createNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    // A live child is a standing obligation, which is what keeps this row
+    // idle-released across the tick. Without one it would settle into its park
+    // instead (the resident carve-out, locked in the next test) and the wake half
+    // below would be measuring a parked row.
+    createNode(node(`${id}Child`, { status: 'active' }));
+    subscribe(id, `${id}Child`);
     const baseline = readCursor(id); // undefined — the real watcher never ran here
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
@@ -437,6 +470,34 @@ test('daemon second pass: a deferred-only unseen set never wakes an idle-release
     const unseen = readInboxSince(id, baseline).map((e) => e.entry_id);
     assert.deepEqual(unseen, [deferredEntry.entry_id, normalEntry.entry_id], 'neither entry was dropped or skipped by the daemon');
 });
+test('the lifecycle tick parks a resident holding deferred-only mail — mail that never wakes it must not hold it idle forever either', { timeout: 30_000 }, async () => {
+    const id = 'residentDeferredOnly';
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    const originalLaunch = headlessBrokerHost.launch;
+    let launchCalls = 0;
+    headlessBrokerHost.launch = (() => {
+        launchCalls++;
+        return { pid: 0x7ffffffe, exited: new Promise(() => { }) };
+    });
+    try {
+        const held = appendInbox(id, {
+            from: null,
+            tier: 'deferred',
+            kind: 'message',
+            label: 'Child done — auto-done notice',
+            data: { reason: 'child-auto-done' },
+        });
+        await superviseTick();
+        const after = getNode(id);
+        assert.equal(after.status, 'done', 'the resident settles into its park instead of sitting idle behind mail that cannot wake it');
+        assert.equal(after.intent, 'parked', 'parked, not released');
+        assert.equal(launchCalls, 0, 'settling quietly never launches an engine');
+        assert.deepEqual(readInboxSince(id, undefined).map((e) => e.entry_id), [held.entry_id], 'the held entry survives the park, ready for the cycle that reopens the conversation');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+    }
+});
 function makeFakePi() {
     const handlers = {};
     return {
@@ -453,7 +514,7 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
     // The watcher may advance its cursor only for the current broker generation.
     // This fake Pi runs in this test process, so its fabricated node must carry
     // that process as the active broker just like a real launched node does.
-    createNode(node(id, { status: 'idle', intent: null, pi_pid: process.pid }));
+    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: null, pi_pid: process.pid }));
     const TICK_MS = 20;
     const DEBOUNCE_MS = 25;
     const SETTLE_MS = TICK_MS * 2 + DEBOUNCE_MS + 30;

package/dist/core/__tests__/integration/human-deliver-e2e.test.js

@@ -89,7 +89,7 @@ function reportBody(ref) {
 }
 test('malformed resolves leave the mounted ticket claim in place', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const pageBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const pageBridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     const pageDir = submitBridgePage(pageBridge);
     const pageClaim = claimTicket(pageDir);
     assert.ok(pageClaim !== null);
@@ -101,7 +101,7 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
         await expectReviewSubmitGuidance(pageBridge, body);
         assert.equal(readTicketClaim(pageDir)?.token, pageClaim.token, 'feedback-shaped input must not take over the live claim');
     }
-    const reviewBridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-review', lifecycle: 'terminal' }).node_id;
+    const reviewBridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-review', lifecycle: 'terminal' }).node_id;
     const reviewDir = ticketDir(reviewBridge);
     const file = join(home, 'review.md');
     writeFileSync(file, '# Review\n');
@@ -114,7 +114,7 @@ test('malformed resolves leave the mounted ticket claim in place', async () => {
 });
 test('the ticket resolve route pushFinals the readable answer to the parent', async () => {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-    const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
+    const bridge = spawnNode({ kind: 'human', parent, creator: parent, cwd: home, name: 'human-page', lifecycle: 'terminal' }).node_id;
     const dir = submitBridgePage(bridge);
     const result = await client.resolveHumanTicket(bridge, { responses: { question: { text: 'yes, ship', edited: true } } });
     assert.deepEqual(result, { completed: true, reply_delivered: true, kind: 'page' });

package/dist/core/__tests__/integration/revive.test.js

@@ -36,6 +36,7 @@ import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../ca
 import { armCron, hasPendingCancelOnWakeCron } from '../../canvas/crons.js';
 import { readInboxSince } from '../../feed/inbox.js';
 import { closeDb } from '../../canvas/db.js';
+import { apiSocketPath } from '../../canvas/paths.js';
 import { buildPiArgv } from '../../runtime/launch.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
 import { resumeArgs, reviveNode } from '../../runtime/revive.js';
@@ -43,6 +44,8 @@ import { readGoal, writeGoal } from '../../runtime/kickoff.js';
 import { parseCard } from '../../../shared/generated-context.js';
 import { seedRoadmap } from '../../runtime/roadmap.js';
 import { InputError } from '../../io.js';
+import { CrtrClient } from '../../../api/client.js';
+import { readFault } from '../../runtime/fault.js';
 import { createHarness } from '../helpers/harness.js';
 import { bindTestFleet } from '../helpers/fleet.js';
 import { resetFleetForTests } from '../../runtime/fleet.js';
@@ -309,6 +312,32 @@ test('a recovery relaunch keeps the armed deadline; a wake revive consumes it',
         await h.dispose();
     }
 });
+test('a second broker session-bound request is shut down instead of adopting a live node transcript (NL-162)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-session-owner' });
+    try {
+        const sessionFile = join(home, 'sessions', 'owned.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, '{}\n', 'utf8');
+        const owner = h.fabricateBrokerNode({
+            id: 'live-session-owner',
+            pi_pid: process.pid,
+            pi_session_id: 'owner-session',
+            pi_session_file: sessionFile,
+        });
+        const claimant = h.fabricateBrokerNode({ id: 'session-claimant', pi_pid: deadPid() });
+        const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
+        const result = await client.bindBrokerSession(claimant, {
+            piSessionId: 'claimant-session', sessionFile, pid: process.pid, reason: 'startup', reviewBoundaryIds: [],
+        });
+        assert.deepEqual(result, { action: 'shutdown' }, 'the second broker is refused before it can bind the live transcript');
+        assert.equal(h.node(owner)?.pi_session_file, sessionFile, 'the live owner retains its transcript coordinate');
+        assert.equal(h.node(claimant)?.pi_session_file, null, 'the claimant never adopts the owner transcript');
+        assert.equal(readFault(claimant)?.op, 'session-file-ownership', 'the refusal is durable and observable');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode fresh-fallback clears the stale session identity (Major-3: no phantom stranded-relaunch)', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-freshfb' });
     try {
@@ -414,6 +443,25 @@ test('reviveNode throws a typed cwd_missing error and does NOT crash the node wh
         await h.dispose();
     }
 });
+test('reviveNode relaunches fresh when the session header cwd was removed (NL-143)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-stale-session-cwd' });
+    try {
+        const removedCwd = join(home, 'removed-worktree');
+        const sessionFile = join(home, 'sessions', 'stale-cwd.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'stale-session', cwd: removedCwd })}\n`, 'utf8');
+        const M = h.fabricateBrokerNode({
+            status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'stale-session', pi_session_file: sessionFile,
+        });
+        const result = reviveNode(M, { resume: true, capacity: 'freeze', recovery: true });
+        assert.equal(result.resumed, false, 'the missing session cwd vetoes --session and launches fresh');
+        assert.equal(h.node(M)?.pi_session_id, null, 'the stale session id is cleared before the fresh launch');
+        assert.equal(h.node(M)?.pi_session_file, null, 'the stale session file is cleared before the fresh launch');
+    }
+    finally {
+        await h.dispose();
+    }
+});
 test('reviveNode crashes and clears pid when launch/preflight throws', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-fail' });
     const originalLaunch = headlessBrokerHost.launch;

package/dist/core/__tests__/integration/spawn-root.test.js

@@ -9,6 +9,8 @@ import { join } from 'node:path';
 import { createServer } from 'node:net';
 import { spawn as spawnProcess } from 'node:child_process';
 import { createNode, getNode, getRow, subscribersOf } from '../../canvas/canvas.js';
+import { coalesce, readInboxSince } from '../../feed/inbox.js';
+import { coalesceBrokerInbox } from '../../runtime/broker/inbox.js';
 import { closeDb } from '../../canvas/db.js';
 import { nodeDir } from '../../canvas/paths.js';
 import { spawnNode } from '../../runtime/nodes.js';
@@ -66,7 +68,7 @@ after(() => {
 });
 test('managed child: parent on the spine + active subscription + provenance', () => {
     createNode(spawner('A'));
-    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A' });
+    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: 'A' });
     const meta = getNode(child.node_id);
     assert.equal(meta.parent, 'A', 'child keeps its spine parent');
     assert.equal(meta.spawned_by, 'A', 'child provenance defaults to its parent');
@@ -76,6 +78,39 @@ test('managed child: parent on the spine + active subscription + provenance', ()
     assert.equal(subs[0].node_id, 'A');
     assert.equal(subs[0].active, true, 'parent subscription is active');
 });
+test('external child birth is deferred, persists its creator, and renders its age at delivery in both inbox mirrors', () => {
+    createNode(spawner('A'));
+    const creator = spawnNode({ kind: 'general', cwd: '/tmp/work', parent: null, name: 'Core' });
+    const child = spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: creator.node_id, name: 'worker' });
+    const saved = getNode(child.node_id);
+    assert.equal(saved.creator, creator.node_id, 'creator persists through meta.json and getNode');
+    const [entry] = readInboxSince('A');
+    assert.ok(entry, 'the parent receives exactly one birth entry');
+    assert.equal(entry.from, child.node_id, 'birth groups with the child’s future reports');
+    assert.equal(entry.tier, 'deferred', 'birth never starts a parent cycle');
+    assert.equal(entry.data?.['body'], `worker (${child.node_id}, developer) was created under you by Core [[CRTR_BIRTH_ANNOUNCEMENT_AGE]] ago. For your awareness only — no response or action is needed, and no need to mention it unless asked. Treat its future reports as background you already know about; investigate only if something genuinely needs you.`);
+    for (const [elapsed, age] of [
+        [0, 'moments'],
+        [60_000, '1 minute'],
+        [59 * 60_000, '59 minutes'],
+        [60 * 60_000, '1 hour'],
+        [47 * 60 * 60_000, '47 hours'],
+        [48 * 60 * 60_000, '2 days'],
+    ]) {
+        const aged = { ...entry, ts: new Date(Date.now() - elapsed).toISOString() };
+        const daemonCard = coalesce([aged])[0].text;
+        // The two inbox readers deserialize the same JSON shape under distinct entry-id brands.
+        const brokerCard = coalesceBrokerInbox([aged], new Map())[0].text;
+        for (const card of [daemonCard, brokerCard]) {
+            assert.ok(card.includes(`created under you by Core ${age} ago`), 'the renderer, not the stored body, computes age at delivery');
+            assert.doesNotMatch(card, /\[\[CRTR_BIRTH_ANNOUNCEMENT_AGE\]\]/, 'the marker is not visible to the recipient');
+        }
+    }
+    spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: 'A' });
+    assert.equal(readInboxSince('A').length, 1, 'a parent-created child stays silent');
+    spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: null });
+    assert.equal(readInboxSince('A').length, 1, 'a root never announces');
+});
 test('independent root: provenance only, no parent, no subscription', () => {
     createNode(spawner('A'));
     const root = spawnNode({