@north-light/crouter 0.3.249 → 0.3.251

package/dist/core/__tests__/integration/worktree-land.test.js

@@ -71,7 +71,11 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     assert.equal(wt.base_ref, 'main', 'default base must remain backward-compatible with persisted main worktrees');
     assert.equal(wt.path, managedWorktreePath(nodeId));
     assert.ok(existsSync(wt.path), 'worktree checkout should exist after create');
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const sessionDir = join(home, 'sessions');
+    mkdirSync(sessionDir, { recursive: true });
+    const sessionFile = join(sessionDir, 'session.jsonl');
+    writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'wt-session', cwd: wt.path })}\n`);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt, pi_session_id: 'wt-session', pi_session_file: sessionFile }));
     const result = closeManagedWorktree(nodeId);
     assert.equal(result.worktree_removed, false);
     assert.match(result.worktree_remove_error ?? '', /cleanup pending/);
@@ -83,6 +87,8 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     assert.equal(meta?.managed_worktree?.state, 'closed');
     assert.equal(meta?.managed_worktree?.cleanup, 'pending');
     assert.equal(meta?.cwd, wt.repo_root, 'a later revive uses the durable base checkout');
+    assert.equal(meta?.pi_session_id, null, 'the live transcript remains sole-writer-owned, so close invalidates its stale resume identity');
+    assert.equal(meta?.pi_session_file, null, 'a later revive launches fresh rather than loading the header that still names this checkout');
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
     const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;
@@ -334,7 +340,7 @@ test('rejects remote and nonexistent worktree bases before creating any resource
         assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/crtr/${nodeId}`], sourceDir).status, 1, `${base} must not leave a dedicated branch`);
     }
 });
-test('refuses to close when the recorded base was deleted and leaves the worktree open', () => {
+test('refuses to close a committed worktree when the recorded base was deleted', () => {
     const nodeId = 'wt-deleted-base';
     run(['branch', 'feature/deleted-base'], sourceDir);
     const mainBefore = gitSync(['rev-parse', 'main'], sourceDir).stdout.trim();
@@ -345,10 +351,83 @@ test('refuses to close when the recorded base was deleted and leaves the worktre
     run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'deleted base work'], wt.path);
     run(['branch', '-D', 'feature/deleted-base'], sourceDir);
     assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error && 'code' in error && error.code === 'missing_base_branch');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing base must not silently close or retarget the worktree');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing base with committed work must remain open for a human decision');
     assert.ok(existsSync(wt.path), 'the worktree must remain available for a human decision');
     assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), mainBefore, 'missing base must never auto-land onto main');
 });
+// NL-153/NL-154: the parent can land and finish before its clean child. Its
+// checkout and branch then disappear, leaving `repo_root` as an empty path;
+// the child itself still resolves the shared repository and is exactly at its
+// recorded creation SHA, so close is a no-op with only deferred cleanup left.
+test('close concludes a clean child after parent-first closure removes its checkout and base branch', () => {
+    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-parent-first-'));
+    try {
+        run(['init', '-b', 'main'], repo);
+        run(['config', 'user.email', 'test@example.com'], repo);
+        run(['config', 'user.name', 'Test'], repo);
+        writeFileSync(join(repo, 'README.md'), 'hello\n');
+        run(['add', '.'], repo);
+        run(['commit', '-m', 'init'], repo);
+        const parent = createManagedWorktree(repo, 'wt-parent-first-parent');
+        createNode(node('wt-parent-first-parent', { cwd: parent.path, managed_worktree: parent }));
+        const child = createManagedWorktree(parent.path, 'wt-parent-first-child', parent.branch);
+        createNode(node('wt-parent-first-child', { cwd: child.path, managed_worktree: child }));
+        assert.equal(gitSync(['rev-parse', 'HEAD'], child.path).stdout.trim(), child.base_sha, 'the child must be a clean zero-commit checkout at its recorded base');
+        closeManagedWorktree('wt-parent-first-parent');
+        run(['worktree', 'remove', parent.path], repo);
+        run(['branch', '-D', parent.branch], repo);
+        mkdirSync(parent.path, { recursive: true });
+        assert.notEqual(gitSync(['rev-parse', '--git-dir'], parent.path).status, 0, 'the recorded parent path must be an empty non-Git directory');
+        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${parent.branch}`], child.path).status, 1, 'the parent base branch must be gone');
+        const result = closeManagedWorktree('wt-parent-first-child');
+        assert.equal(result.landed_sha, child.base_sha, 'a no-op close reports the recorded creation SHA');
+        assert.equal(result.worktree_removed, false, 'the live caller checkout remains for deferred cleanup');
+        assert.equal(getNode('wt-parent-first-child')?.managed_worktree?.state, 'closed');
+        run(['worktree', 'remove', child.path], repo);
+        run(['branch', '-D', child.branch], repo);
+    }
+    finally {
+        rmSync(repo, { recursive: true, force: true });
+    }
+});
+// A failed ref inspection is not proof that a clean child has nothing to
+// land: only show-ref's completed absent-ref result may take that no-op path.
+test('close surfaces a failed base ref inspection instead of closing a clean worktree', () => {
+    const nodeId = 'wt-base-ref-inspection-failure';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
+    const wrapperPath = join(wrapperDir, 'git');
+    const originalPath = process.env['PATH'] ?? '';
+    writeFileSync(wrapperPath, `#!/bin/sh
+if [ "$1" = "show-ref" ] && [ "$2" = "--verify" ] && [ "$3" = "--quiet" ] && [ "$4" = "refs/heads/main" ]; then
+  echo "simulated unreadable ref store" >&2
+  exit 128
+fi
+PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
+`);
+    chmodSync(wrapperPath, 0o755);
+    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
+    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
+    try {
+        assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error
+            && 'code' in error
+            && error.code === 'base_branch_inspection_failed'
+            && 'detail' in error
+            && typeof error.detail === 'string'
+            && error.detail.includes('status: 128')
+            && error.detail.includes('stderr: simulated unreadable ref store'));
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        delete process.env['CRTR_TEST_REAL_PATH'];
+        rmSync(wrapperDir, { recursive: true, force: true });
+        run(['worktree', 'remove', wt.path], sourceDir);
+        run(['branch', '-D', wt.branch], sourceDir);
+    }
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the failed inspection must not mark a clean worktree closed');
+    assert.ok(!existsSync(wt.path), 'the test must clean up its temporary checkout');
+});
 // Regression for #330/#331: crtr's own untracked `.crouter/config.json` /
 // `state.json` bookkeeping (written by ordinary project-scope init) must
 // never block `close`'s dirty check — Fix A seeds `.git/info/exclude` for

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -261,10 +261,9 @@ test('autoDropCleanManagedWorktree drops a branch with real commits already cont
     assert.equal(gitSync(['merge-base', '--is-ancestor', branchSha, 'main'], repo).status, 0, 'the landed commit must remain reachable from main after the drop');
     rmSync(repo, { recursive: true, force: true });
 });
-// A base that no longer resolves (renamed/deleted local branch) must refuse
-// auto-drop rather than guess — the SAME guard `resolveLandableBase` already
-// gives the explicit close path.
-test('autoDropCleanManagedWorktree refuses when the recorded base branch no longer resolves', async () => {
+// A clean child whose recorded base branch vanished has nothing to land only
+// when its live HEAD exactly matches the persisted creation SHA.
+test('autoDropCleanManagedWorktree drops a clean worktree at base_sha when its recorded base branch no longer resolves', async () => {
     const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
     const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-missingbase-'));
     run(['init', '-b', 'main'], repo);
@@ -279,11 +278,50 @@ test('autoDropCleanManagedWorktree refuses when the recorded base branch no long
     // The recorded base branch ('main') has been renamed away since creation.
     run(['branch', '-m', 'main', 'renamed-main'], repo);
     const result = autoDropCleanManagedWorktree(nodeId);
-    assert.equal(result, null, 'an unresolvable base must never be treated as safe to drop');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open');
+    assert.ok(result !== null, 'a clean worktree exactly at its recorded base SHA has nothing to land');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
     assert.ok(existsSync(wt.path));
     rmSync(repo, { recursive: true, force: true });
 });
+// Reap may take the same missing-base no-op only after show-ref completed with
+// its documented absent-ref status; inspection failures must remain visible.
+test('autoDropCleanManagedWorktree surfaces a failed base ref inspection', async () => {
+    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
+    const nodeId = 'wt-reap-base-ref-inspection-failure';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
+    const wrapperPath = join(wrapperDir, 'git');
+    const originalPath = process.env['PATH'] ?? '';
+    writeFileSync(wrapperPath, `#!/bin/sh
+if [ "$1" = "show-ref" ] && [ "$2" = "--verify" ] && [ "$3" = "--quiet" ] && [ "$4" = "refs/heads/main" ]; then
+  echo "simulated unreadable ref store" >&2
+  exit 128
+fi
+PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
+`);
+    chmodSync(wrapperPath, 0o755);
+    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
+    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
+    try {
+        assert.throws(() => autoDropCleanManagedWorktree(nodeId), (error) => error instanceof Error
+            && 'code' in error
+            && error.code === 'base_branch_inspection_failed'
+            && 'detail' in error
+            && typeof error.detail === 'string'
+            && error.detail.includes('status: 128')
+            && error.detail.includes('stderr: simulated unreadable ref store'));
+    }
+    finally {
+        process.env['PATH'] = originalPath;
+        delete process.env['CRTR_TEST_REAL_PATH'];
+        rmSync(wrapperDir, { recursive: true, force: true });
+        run(['worktree', 'remove', wt.path], sourceDir);
+        run(['branch', '-D', wt.branch], sourceDir);
+    }
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the failed inspection must not mark a clean worktree closed');
+    assert.ok(!existsSync(wt.path), 'the test must clean up its temporary checkout');
+});
 // The Critical fix: the TOCTOU race between proving clean-and-contained and
 // the destructive branch delete. `proveCleanEmptyManagedWorktree` and
 // `autoDropCleanManagedWorktreeLocked` are exported specifically so these

package/dist/core/__tests__/migration.test.js

@@ -215,6 +215,36 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(rt['window'], null);
     assert.equal(rt['tmux_session'], null);
 });
+test('session-file ownership migration deterministically clears duplicate claimants before creating its UNIQUE index', () => {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    migrateToVersion(raw, 35);
+    const sessionFile = '/tmp/preexisting-duplicate.jsonl';
+    const aliasedSessionFile = '/tmp/./preexisting-duplicate.jsonl';
+    for (const id of ['first-owner', 'later-claimant']) {
+        const nodeDir = join(home, 'nodes', id);
+        mkdirSync(nodeDir, { recursive: true });
+        writeFileSync(join(nodeDir, 'meta.json'), JSON.stringify({
+            node_id: id, name: id, created: id === 'first-owner' ? '2026-01-01T00:00:00.000Z' : '2026-01-02T00:00:00.000Z',
+            cwd: '/tmp', kind: 'developer', mode: 'base', lifecycle: 'terminal', pi_session_id: `${id}-session`, pi_session_file: id === 'first-owner' ? sessionFile : aliasedSessionFile,
+        }));
+    }
+    raw.prepare('INSERT INTO nodes (node_id, name, kind, mode, lifecycle, status, cwd, created, pi_session_file) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')
+        .run('first-owner', 'first-owner', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-01T00:00:00.000Z', sessionFile);
+    raw.prepare('INSERT INTO nodes (node_id, name, kind, mode, lifecycle, status, cwd, created, pi_session_file) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')
+        .run('later-claimant', 'later-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-02T00:00:00.000Z', aliasedSessionFile);
+    assert.doesNotThrow(() => migrate(raw), 'a real canvas with pre-existing duplicates must migrate');
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
+        ['first-owner', sessionFile],
+        ['later-claimant', null],
+    ], 'the oldest created row wins after aliases are canonicalized; later claimants are cleared');
+    const loser = JSON.parse(readFileSync(join(home, 'nodes', 'later-claimant', 'meta.json'), 'utf8'));
+    assert.equal(loser.pi_session_id, null, 'the loser meta cannot reindex its stale session id');
+    assert.equal(loser.pi_session_file, null, 'the loser meta cannot restore the duplicate projection');
+    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(sessionFile, 'later-claimant'), /UNIQUE/, 'the schema enforces the repaired invariant');
+    raw.close();
+});
 test('node lifecycle substrate migration adds six columns and backfills terminal reasons', () => {
     ensureHome();
     const raw = new DatabaseSync(canvasDbPath());

package/dist/core/__tests__/passive-subscription.test.js

@@ -13,6 +13,7 @@ import { mkdtempSync, mkdirSync, rmSync, existsSync, readFileSync, appendFileSyn
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
 import { createNode, subscribe } from '../canvas/canvas.js';
+import { armCron, getCron } from '../canvas/crons.js';
 import { closeDb } from '../canvas/db.js';
 import { inboxPath, passivePath, apiSocketPath } from '../canvas/paths.js';
 import { createApiServer } from '../../daemon/api/server.js';
@@ -99,16 +100,53 @@ test('passive push accumulates in passive.jsonl, not inbox.jsonl', async () => {
     assert.equal(acc[0].label, 'first observation');
     assert.match(acc[0].ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/, 'report refs use a compact random suffix');
 });
-test('active push still lands in inbox.jsonl (wakes)', async () => {
+test('active push still lands in inbox.jsonl (wakes) and clears the manager deadline', async () => {
     createNode(node('pub'));
     createNode(node('worker-mgr'));
     subscribe('worker-mgr', 'pub', true); // ACTIVE
+    armCron({
+        cron_id: 'manager-deadline',
+        name: 'manager deadline',
+        command: 'echo stale deadline',
+        fire_at: new Date(Date.now() + 60_000).toISOString(),
+        recur: null,
+        tz: null,
+        expires_at: null,
+        anchor_node: 'worker-mgr',
+        cancel_on_wake: true,
+        created_by: null,
+        cwd: home,
+        env_json: null,
+        profile: null,
+        scope: 'profile',
+        run_timeout_s: 30,
+        overlap: 'skip',
+        on_output: 'silent',
+        sink: '{}',
+        tier: 'normal',
+    });
     await push('pub', { kind: 'update', body: 'active report' });
     assert.equal(existsSync(passivePath('worker-mgr')), false);
     const inbox = readInboxSince('worker-mgr');
     assert.equal(inbox.length, 1);
     assert.equal(inbox[0].from, 'pub');
     assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
+    assert.equal(getCron('manager-deadline'), null, 'the child report won the deadline race');
+});
+test('a deferred update still lands in an active subscriber inbox at deferred tier', async () => {
+    createNode(node('pub'));
+    // Resident: deferred mail to a TERMINAL target is bumped to urgent by the
+    // shipped tier bump, so only a resident subscriber shows the requested tier.
+    createNode(node('worker-mgr', { lifecycle: 'resident' }));
+    subscribe('worker-mgr', 'pub', true); // ACTIVE
+    await push('pub', { kind: 'update', deliveryTier: 'deferred', body: 'active report' });
+    assert.equal(existsSync(passivePath('worker-mgr')), false);
+    const inbox = readInboxSince('worker-mgr');
+    assert.equal(inbox.length, 1);
+    assert.equal(inbox[0].from, 'pub');
+    assert.equal(inbox[0].tier, 'deferred', 'requested delivery urgency reaches the subscriber unchanged');
+    assert.equal(inbox[0].kind, 'update', 'the stored report kind is untouched by delivery urgency');
+    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
 });
 test('mixed active + passive subscribers route to their own stores', async () => {
     createNode(node('pub'));

package/dist/core/__tests__/prune.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, } from '../canvas/canvas.js';
+import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
 import { closeDb, openDb } from '../canvas/db.js';
 import { nodeDir } from '../canvas/paths.js';
 let home;
@@ -30,6 +30,9 @@ function node(id, over = {}) {
 function totalEdges() {
     return openDb().prepare('SELECT COUNT(*) AS n FROM edges').get().n;
 }
+function markCollectibleTerminal(nodeId) {
+    transitionStatusIntent(nodeId, { terminal_reason: 'closed' });
+}
 /** The standard fixture: three prunable terminal nodes (old), three survivors
  *  (two old-but-live, one recent-but-dead), and edges that touch a pruned node
  *  so cascade is observable. */
@@ -147,6 +150,8 @@ test('count pruning keeps all live nodes even when liveCount exceeds the cap', (
     }
     createNode(node('old-a', { status: 'dead', created: at(100) }));
     createNode(node('old-b', { status: 'done', created: at(101) }));
+    markCollectibleTerminal('old-a');
+    markCollectibleTerminal('old-b');
     const result = pruneToLimit({ maxNodes: 3 });
     assert.equal(result.dryRun, false);
     assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['old-a', 'old-b']);
@@ -161,7 +166,9 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
     createNode(node('live-0', { status: 'idle', created: at(0) }));
     recordPid('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
-        createNode(node(`term-${i}`, { status: 'dead', created: at(10 + i) }));
+        const id = `term-${i}`;
+        createNode(node(id, { status: 'dead', created: at(10 + i) }));
+        markCollectibleTerminal(id);
     }
     const result = pruneToLimit({ maxNodes: 3 });
     assert.deepEqual(result.pruned.map((p) => p.node_id).sort(), ['term-2', 'term-3', 'term-4']);
@@ -180,7 +187,9 @@ test('count pruning dry-run reports candidates without deleting rows or dirs', (
     createNode(node('live-0', { status: 'idle', created: at(0) }));
     recordPid('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
-        createNode(node(`term-${i}`, { status: 'dead', created: at(10 + i) }));
+        const id = `term-${i}`;
+        createNode(node(id, { status: 'dead', created: at(10 + i) }));
+        markCollectibleTerminal(id);
     }
     const result = pruneToLimit({ maxNodes: 3, dryRun: true });
     assert.equal(result.dryRun, true);

package/dist/core/__tests__/relaunch-root.test.js

@@ -173,7 +173,7 @@ test('root /new capacity refusal reaches the attached human through broker UI no
             sessionManager: {
                 getSessionId: () => 'root-new-session',
                 getSessionFile: () => null,
-                getEntries: () => [],
+                getBranch: () => [],
             },
             ui: { notify: (message) => resolveNotice(message) },
         });

package/dist/core/__tests__/respawn-throttle.test.js

@@ -1,150 +1,20 @@
-// Run with: node --import tsx/esm --test src/core/__tests__/respawn-throttle.test.ts
-//
-// The event-driven respawn throttle (design flow B) — the replacement for the
-// deleted stranded-relaunch counters. Each respawn action consults the node's
-// consecutive short-lived-exit count: attempt n defers min(5s·2^(n-1), 10min)
-// via a REAL backoff timer that re-enqueues a fresh policy job; at
-// MAX_RESPAWN_ATTEMPTS (6) the loop terminalizes (transition('crash') +
-// surfaceBootFailure + doctrine wake, counter cleared). An exit with uptime ≥
-// HEALTHY_UPTIME_MS (60s) resets the counter BEFORE classification, restoring
-// the immediate (sub-second) respawn.
-//
-// The backoff timers are real setTimeout — only the throttle's uptime clock is
-// injected — so this file asserts the DEFERRAL (the emitted
-// `broker.respawn.deferred` event + no launch), never timer maturity: the
-// shortest deferral is 5s, well past this file's lifetime, and dispose()
-// cancels every pending timer.
-import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, readFileSync, rmSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
-import { headlessBrokerHost } from '../runtime/host.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { bindDaemonEventSource, resetEventSourceForTests } from '../events/source.js';
-import { resetFleetForTests } from '../runtime/fleet.js';
-import { HEALTHY_UPTIME_MS } from '../../daemon/fleet.js';
-import { bindTestFleet } from './helpers/fleet.js';
-let home;
-let tf;
-let nowMs = 5_000_000;
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: home,
-        kind: 'developer',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-/** Every daemon event this process emitted, oldest first. */
-function events() {
-    let raw;
-    try {
-        raw = readFileSync(join(home, 'crtrd.log'), 'utf8');
-    }
-    catch {
-        return [];
-    }
-    return raw
-        .split('\n')
-        .filter((l) => l.trim() !== '')
-        .map((l) => JSON.parse(l));
-}
-before(() => {
-    home = mkdtempSync(join(tmpdir(), 'crtr-respawn-throttle-'));
-    mkdirSync(home, { recursive: true });
-    process.env['CRTR_HOME'] = home;
-    resetEventSourceForTests();
-    bindDaemonEventSource(); // events land in <home>/crtrd.log, like the daemon's
-    tf = bindTestFleet({ now: () => nowMs });
-});
-after(() => {
-    tf.fleet.dispose(); // cancels every pending real backoff timer
-    resetFleetForTests();
-    resetEventSourceForTests();
-    closeDb();
-    rmSync(home, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-});
-// Short-lived exits 1-5 defer with doubling backoff; the 6th terminalizes.
-test('consecutive short-lived exits defer respawn on a doubling backoff, then terminalize at the cap', async () => {
-    // A booted row (saved session, no crash markers) — table row 6, respawn-resume.
-    createNode(node('T', { pi_session_id: 'sess-T' }));
-    // Five synthetic exits (no known launch time → each counts as short-lived).
-    for (let i = 0; i < 5; i++) {
-        tf.fleet.deliverExit('T', { code: 1, signal: null });
-        await tf.drain();
-    }
-    const deferred = events().filter((e) => e.event === 'broker.respawn.deferred');
-    assert.deepEqual(deferred.map((e) => e.fields?.['backoff_ms']), [5_000, 10_000, 20_000, 40_000, 80_000], 'attempts 1-5 defer on the doubling 5s·2^(n-1) schedule');
-    assert.deepEqual(deferred.map((e) => e.fields?.['consecutive_failures']), [1, 2, 3, 4, 5], 'the counter grows once per short-lived exit');
-    assert.equal(getNode('T').status, 'active', 'the node stays revivable while attempts remain');
-    assert.equal(events().some((e) => e.event === 'broker.respawn.started'), false, 'no launch fires while every attempt is deferred');
-    // The 6th short-lived exit exhausts the budget: crash + surface, no respawn.
-    tf.fleet.deliverExit('T', { code: 1, signal: null });
-    await tf.drain();
-    assert.equal(getNode('T').status, 'dead', 'the respawn loop terminalizes at MAX_RESPAWN_ATTEMPTS');
-    assert.equal(events().some((e) => e.event === 'broker.respawn.exhausted'), true, 'exhaustion is surfaced as its own event');
-});
-// A healthy-uptime exit resets the counter: the next respawn is immediate.
-test('a pre-launch respawn refusal terminalizes the stranded node and wakes its parent', async () => {
-    const missingCwd = join(home, 'reaped-worktree');
-    createNode(node('P', { lifecycle: 'resident' }));
-    createNode(node('R', { cwd: missingCwd, parent: 'P', pi_session_id: 'sess-R' }));
-    subscribe('P', 'R', true);
-    // A healthy real entry makes this exit respawn immediately (rather than
-    // waiting for the throttle), reaching reviveNode's cwd preflight through
-    // DaemonFleet.#respawn.
-    nowMs = 10_000_000;
-    tf.fleet.register('R', { pid: 424_244, exited: new Promise(() => { }) });
-    nowMs += HEALTHY_UPTIME_MS;
-    tf.fleet.deliverExit('R', { code: 1, signal: null });
-    await tf.drain();
-    assert.equal(getNode('R').status, 'dead', 'a pre-launch refusal cannot strand an active node without a fleet entry');
-    const inbox = readInboxSince('P');
-    assert.equal(inbox.length, 2, 'the terminal outcome surfaces through both the urgent failure and doctrine wake');
-    const urgent = inbox.find((entry) => entry.tier === 'urgent');
-    assert.ok(urgent, 'the parent receives the recovery-refusal surface');
-    assert.match(urgent.label, /Recovery failed/, 'the surface describes the refusal instead of falsely claiming a fresh boot failed');
-    assert.ok(inbox.some((entry) => entry.tier === 'normal'), 'the parent receives the doctrine wake');
-});
-test('an exit after HEALTHY_UPTIME_MS of uptime resets the counter and respawns immediately', async () => {
-    const originalLaunch = headlessBrokerHost.launch;
-    const launches = [];
-    try {
-        createNode(node('H', { pi_session_id: 'sess-H' }));
-        // Build up one failure first: a short-lived exit defers (5s timer, no launch).
-        tf.fleet.deliverExit('H', { code: 1, signal: null });
-        await tf.drain();
-        assert.equal(events().filter((e) => e.event === 'broker.respawn.deferred' && e.fields?.['backoff_ms'] === 5_000).length >= 1, true, 'precondition: the first short-lived exit deferred at 5s');
-        // A live registration (a manual revive winning the race) supersedes the
-        // pending backoff timer and stamps the current failure count on the entry.
-        const t0 = nowMs;
-        tf.fleet.register('H', { pid: 424_242, exited: new Promise(() => { }) });
-        assert.equal(tf.fleet.get('H').consecutiveFailures, 1, 'the entry mirrors the throttle count at registration');
-        // The relaunch runs healthy past the 60s bar, then exits: the counter
-        // resets BEFORE classification, so the respawn is immediate (backoff 0).
-        headlessBrokerHost.launch = (nodeId) => {
-            launches.push(nodeId);
-            const handle = { pid: 424_243, exited: new Promise(() => { }) };
-            tf.fleet.register(nodeId, handle); // the real host contract: registration at the launch seam
-            return handle;
+import { test } from 'node:test';
+import { decideRespawnAttempt, MAX_RESPAWN_ATTEMPTS, respawnBackoffMs } from '../../daemon/reconcilers/node-lifecycle/respawn-policy.js';
+test('respawn policy resets after settlement and exhausts six no-settlement wedge relaunches', () => {
+    const launch = Date.parse('2026-01-01T00:00:00.000Z');
+    assert.deepEqual(decideRespawnAttempt({ last_settled_at: new Date(launch + 1).toISOString(), launched_at: new Date(launch).toISOString(), respawn_failures: 4 }, launch + 2), { failures: 0, notBefore: null, exhausted: false }, 'a turn settled after launch proves progress and resets the sequence');
+    let row = { last_settled_at: null, launched_at: new Date(launch).toISOString(), respawn_failures: 0 };
+    for (let failures = 1; failures <= MAX_RESPAWN_ATTEMPTS; failures++) {
+        const now = launch + failures * 1_000;
+        const attempt = decideRespawnAttempt(row, now);
+        assert.equal(attempt.failures, failures);
+        assert.equal(Date.parse(attempt.notBefore), now + respawnBackoffMs(failures));
+        assert.equal(attempt.exhausted, failures === MAX_RESPAWN_ATTEMPTS);
+        row = {
+            last_settled_at: null,
+            launched_at: new Date(now + respawnBackoffMs(failures)).toISOString(),
+            respawn_failures: attempt.failures,
         };
-        nowMs = t0 + 61_000;
-        tf.fleet.deliverExit('H', { code: 0, signal: null });
-        await tf.drain();
-        assert.deepEqual(launches, ['H'], 'a healthy-uptime exit respawns immediately — no deferral');
-        assert.equal(tf.fleet.get('H').consecutiveFailures, 0, 'the healthy run reset the consecutive-failure counter');
-        assert.equal(getNode('H').status, 'active', 'the node is live again, never terminalized');
-    }
-    finally {
-        headlessBrokerHost.launch = originalLaunch;
     }
 });

package/dist/core/__tests__/seam/broker-crash-teardown.test.js

@@ -1,7 +1,7 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/seam/broker-crash-teardown.test.ts
 //
 // Daemon-epoch broker ownership, real-process crash and teardown. The broker's
-// exit event is the sole death authority: a SIGTERM of a streaming broker
+// supervision tick is the death authority after the broker exit is observed: a SIGTERM of a streaming broker
 // aborts cleanly and resumes the saved session with a continuation, and a
 // SIGKILL mid-turn — no certificate, only the durable busy marker — resumes
 // that same saved session in place and re-drives the stopped turn with the
@@ -12,8 +12,8 @@
 //
 // spawnHeadlessChild calls the production birth path in the harness process, so
 // every broker below is harness-fleet-owned from its first and only boot and
-// every SIGKILL's REAL ChildProcess exit drives policy automatically — no
-// synthetic delivery, no tick, no grace.
+// every SIGKILL's REAL ChildProcess exit is observed by the fleet; the harness
+// then drives the production supervision tick — no synthetic delivery or grace.
 // Each crash has its own real broker setup, so either top-level test remains a
 // complete journey under name filtering and pays only its own first respawn
 // backoff.
@@ -57,17 +57,22 @@ test('SIGTERM of a busy broker aborts cleanly and resumes with a continuation',
     assert.equal(h.node(id).intent ?? null, null, 'fresh broker has a null intent (not refresh/idle-release)');
     const boots = h.bootCount(id);
     // SIGTERM exercises broker.ts's bounded session.abort() path. Its REAL child
-    // exit sees the broker-written clean-abort certificate and resumes only after
-    // the first-failure backoff; no synthetic fleet delivery is involved.
+    // exit leaves the broker-written clean-abort certificate; the supervision tick
+    // classifies it and persists the first-failure backoff.
     process.kill(oldPid, 'SIGTERM');
     await h.waitFor(() => !isPidAlive(oldPid), { label: 'gracefully torn-down broker pid is dead' });
-    assert.equal(existsSync(join(jobDir(id), 'clean-abort')), true, 'settled abort leaves durable clean-abort evidence before exit policy respawns');
-    // This is the file's SECOND real broker boot (exit-event recovery), behind a
-    // 5s short-lived-exit backoff, on an oversubscribed CI runner sharing the
-    // host with the other compiled-seam files' own broker spawns. Give it a wide,
-    // still-bounded ceiling.
+    assert.equal(existsSync(join(jobDir(id), 'clean-abort')), true, 'settled abort leaves durable clean-abort evidence before supervision classifies it');
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const gracefulBackoff = h.node(id);
+    assert.equal(gracefulBackoff.respawn_failures, 1, 'the first failed launch is durably counted');
+    assert.ok(gracefulBackoff.respawn_not_before != null, 'the first retry is durably deferred');
+    assert.equal(gracefulBackoff.pi_pid, null, 'classification clears the dead broker pid');
+    await h.tick(Date.parse(gracefulBackoff.respawn_not_before) + 1);
+    // This is the file's SECOND real broker boot, after the durable 5s backoff
+    // matures on a supervision tick.
     const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
-    assert.equal(boot2.resuming, true, 'clean-abort exit-event recovery RESUMES the saved .jsonl');
+    assert.equal(boot2.resuming, true, 'clean-abort tick-driven recovery RESUMES the saved .jsonl');
     assert.equal(boot2.prompt, RUNTIME_RESTART_CONTINUATION, 'the strict resume injects the runtime-restart continuation');
     assert.ok(!boot2.rawArgv.includes('--crtr-new-cycle'), 'clean abort never starts a recovery cycle');
     const revivedPid = h.node(id).pi_pid;
@@ -90,6 +95,13 @@ test('SIGKILL of a busy broker resumes the interrupted turn in place; close tear
     markBusy(id);
     process.kill(busyPid, 'SIGKILL');
     await h.waitFor(() => !isPidAlive(busyPid), { label: 'mid-turn crashed broker pid is dead' });
+    await h.awaitFleetExit(id);
+    await h.tick();
+    const dirtyBackoff = h.node(id);
+    assert.equal(dirtyBackoff.respawn_failures, 1, 'the first failed launch is durably counted');
+    assert.ok(dirtyBackoff.respawn_not_before != null, 'the first retry is durably deferred');
+    assert.equal(dirtyBackoff.pi_pid, null, 'classification clears the dead broker pid');
+    await h.tick(Date.parse(dirtyBackoff.respawn_not_before) + 1);
     const boot2 = await h.awaitBoot(id, { minCount: boots + 1, timeoutMs: 25_000 });
     // The fake SessionManager reports `resuming=true` for ANY existing session
     // path, including a cycle; production distinguishes cycling with the argv