@north-light/crouter 0.3.255 → 0.3.257

package/dist/core/worktree.js

@@ -7,6 +7,7 @@ import { isPidAlive } from './canvas/pid.js';
 import { getNode, updateNode } from './canvas/index.js';
 import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
+import { parseStatusPorcelain, planLandIntoCheckout, refDeleteTransactionStdin } from './worktree-landing.js';
 import { shellQuote } from '../shared/shell-quote.js';
 export class WorktreeError extends Error {
     code;
@@ -74,7 +75,7 @@ function checkoutPathForBranch(repoRoot, branch) {
  *  callers that must not throw on a read failure (an absent-path proof that
  *  needs to fail closed rather than error) call `gitSync` themselves and pass
  *  the output here instead of going through `checkoutPathForBranch`. */
-function checkoutPathForBranchInList(porcelain, branch) {
+export function checkoutPathForBranchInList(porcelain, branch) {
     let current = null;
     for (const line of porcelain.split('\n')) {
         if (line.startsWith('worktree '))
@@ -84,7 +85,36 @@ function checkoutPathForBranchInList(porcelain, branch) {
     }
     return null;
 }
-const WORKTREE_LOCK_WAIT_MS = 30_000;
+/** Are these two spellings the same directory?
+ *
+ *  Git canonicalizes every path it prints in `worktree list --porcelain`, while
+ *  a recorded managed-worktree path preserves the spelling of `CRTR_HOME`. When
+ *  the canvas home is reached through a symlink (macOS's `/var` → `/private/var`
+ *  is the everyday case) the two forms name one directory but differ as
+ *  strings, so a raw `===` reads a checkout crtr created as unowned. Resolution
+ *  failures fall back to `resolve`, which is the pre-canonical comparison — no
+ *  worse than the string compare it replaces. */
+export function samePath(a, b) {
+    return a === b || canonicalPath(a) === canonicalPath(b);
+}
+function canonicalPath(path) {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+export const WORKTREE_LOCK_WAIT_MS = 30_000;
+/** The lock directory naming one repository's common Git dir. Every process
+ *  that mutates a managed worktree — the synchronous commands here and the
+ *  daemon's asynchronous sweep — derives its lock path through this function,
+ *  so the two locking styles contend for the SAME name. */
+export function worktreeLockPathForCommonDir(commonDir) {
+    const lockRoot = `${crtrHome()}/worktree-locks`;
+    mkdirSync(lockRoot, { recursive: true });
+    return `${lockRoot}/${createHash('sha256').update(commonDir).digest('hex')}`;
+}
 function commonGitDir(repoRoot) {
     const commonDir = runGit(repoRoot, ['rev-parse', '--git-common-dir'], 'git_common_dir_failed', 'Inspect the repository git metadata, then retry.');
     return realpathSync(resolve(repoRoot, commonDir));
@@ -94,10 +124,7 @@ function commonGitDir(repoRoot) {
  * add instead of waiting, so callers take this transaction lock first. */
 function withRepositoryWorktreeLock(repoRoot, action) {
     const commonDir = commonGitDir(repoRoot);
-    const lockRoot = `${crtrHome()}/worktree-locks`;
-    mkdirSync(lockRoot, { recursive: true });
-    const lockPath = `${lockRoot}/${createHash('sha256').update(commonDir).digest('hex')}`;
-    return withExclusiveDirectoryLock(lockPath, action, {
+    return withExclusiveDirectoryLock(worktreeLockPathForCommonDir(commonDir), action, {
         timeoutMs: WORKTREE_LOCK_WAIT_MS,
         timeoutError: () => new WorktreeError('worktree_lock_timeout', `timed out waiting to create a managed worktree in ${commonDir}`, 'Wait for the other managed-worktree operation to finish, then retry.'),
     });
@@ -110,7 +137,7 @@ function registeredWorktree(repoRoot, path, branch) {
     for (const line of list.stdout.split('\n')) {
         if (line.startsWith('worktree '))
             current = line.slice('worktree '.length).trim();
-        else if (current === path && line === `branch refs/heads/${branch}`)
+        else if (current !== null && samePath(current, path) && line === `branch refs/heads/${branch}`)
             return true;
     }
     return false;
@@ -245,9 +272,10 @@ function gitPath(cwd, logicalPath) {
 export function isRebaseInProgress(cwd) {
     return existsSync(gitPath(cwd, 'rebase-merge')) || existsSync(gitPath(cwd, 'rebase-apply'));
 }
-/** The ONE authoritative closed-worktree state transition, shared by both
- * closing paths (explicit `closeManagedWorktreeLocked` land, and the clean
- * `autoDropCleanManagedWorktreeLocked` push-final drop): persist
+/** The ONE authoritative closed-worktree state transition, shared by every
+ * closing path (explicit `closeManagedWorktreeLocked` land, the clean
+ * `autoDropCleanManagedWorktreeLocked` push-final drop, and the daemon sweep's
+ * `reconcileManagedWorktree`): persist
  * `managed_worktree.state: 'closed'`, name its cleanup state, and repoint the
  * node's launch `cwd` to the durable base checkout. The caller broker stays
  * alive and is Pi's sole transcript writer, so its session header cannot be
@@ -255,15 +283,100 @@ export function isRebaseInProgress(cwd) {
  * revive launch fresh instead. Both closing paths MUST go through this helper
  * instead of hand-rolling the `updateNode` call, so neither can drift out of
  * sync. */
-function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
+export function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
     const node = getNode(nodeId);
     const sessionInvalidated = node?.pi_session_id != null || node?.pi_session_file != null;
+    // Every caller reaches this only after CONCLUDING the land — it succeeded, or
+    // the record was proven to have nothing to land. So a recorded land intent is
+    // discharged here, and a recorded refusal describes a state that no longer
+    // holds; dropping both leaves the sweep re-examining this record fresh.
+    const { land_intent: _landIntent, sweep: _sweep, ...retained } = wt;
     updateNode(nodeId, {
         cwd: wt.repo_root,
         ...(sessionInvalidated ? { pi_session_id: null, pi_session_file: null } : {}),
-        managed_worktree: { ...wt, state: 'closed', cleanup, closed: new Date().toISOString() },
+        managed_worktree: { ...retained, state: 'closed', cleanup, closed: new Date().toISOString() },
     });
 }
+/** Record that this node ASKED to land and was blocked, so the daemon sweep may
+ *  later retry exactly that land once the base checkout stops blocking it. The
+ *  sweep never lands commits for a node that did not get this far: a node that
+ *  crashed mid-work and never called close has its worktree preserved for a
+ *  human instead. Recording a fresh intent also clears any prior refusal state,
+ *  so the sweep re-examines promptly rather than honoring an old backoff. */
+function recordBlockedLandIntent(nodeId, blocked) {
+    const current = getNode(nodeId)?.managed_worktree;
+    if (current == null || current.state !== 'open')
+        return;
+    const { sweep: _sweep, ...retained } = current;
+    updateNode(nodeId, { managed_worktree: { ...retained, land_intent: { at: new Date().toISOString(), blocked } } });
+}
+/** Fast-forward a base branch that is CHECKED OUT somewhere, landing underneath
+ *  whatever local changes that checkout holds.
+ *
+ *  The base checkout is shared by every other node using this repository, and
+ *  its local changes usually have nothing to do with the child that is closing.
+ *  Disjoint changes ride along untouched; overlapping ones are stashed, the
+ *  fast-forward runs underneath them, and they are re-applied. The re-apply is
+ *  `stash apply`, never `stash pop`, so a conflict cannot consume the stash and
+ *  lose the work: on conflict the checkout is reset to the landed commit and the
+ *  stash is deliberately KEPT for a person to apply. Either way this never
+ *  leaves conflict markers behind in a checkout other nodes are using. */
+function landIntoBaseCheckout(baseCheckout, branch, baseSha, landedSha) {
+    const status = gitSync(['status', '--porcelain'], baseCheckout);
+    if (status.status !== 0)
+        return { ok: false, detail: (status.stderr.trim() || status.stdout.trim()).trim() };
+    const diff = gitSync(['diff', '--name-only', baseSha, landedSha], baseCheckout);
+    if (diff.status !== 0)
+        return { ok: false, detail: (diff.stderr.trim() || diff.stdout.trim()).trim() };
+    const incoming = diff.stdout.split('\n').map((l) => l.trim()).filter((l) => l !== '');
+    const plan = planLandIntoCheckout(parseStatusPorcelain(status.stdout), incoming);
+    if (plan.kind === 'refuse') {
+        return { ok: false, detail: `untracked files in ${baseCheckout} would be overwritten by the incoming commits: ${plan.collisions.join(', ')}` };
+    }
+    const merge = () => {
+        const res = gitSync(['merge', '--ff-only', landedSha], baseCheckout);
+        return res.status === 0 ? { ok: true } : { ok: false, detail: (res.stderr.trim() || res.stdout.trim()).trim() };
+    };
+    if (plan.kind === 'direct')
+        return merge();
+    // Identify the stash by the exact commit this push created. `refs/stash` can
+    // already name an UNRELATED stash the user made earlier, and a push that
+    // saved nothing leaves it untouched — applying or dropping that one would
+    // destroy work this code never owned.
+    const before = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], baseCheckout);
+    const beforeSha = before.status === 0 ? before.stdout.trim() : null;
+    const push = gitSync(['stash', 'push', '--message', `crtr landing ${branch}`], baseCheckout);
+    if (push.status !== 0)
+        return { ok: false, detail: (push.stderr.trim() || push.stdout.trim()).trim() };
+    const after = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], baseCheckout);
+    const stashSha = after.status === 0 ? after.stdout.trim() : null;
+    if (stashSha === null || stashSha === beforeSha)
+        return merge(); // nothing was saved
+    const landed = merge();
+    if (!landed.ok) {
+        // The failed merge left the tree exactly as the stash found it, so this
+        // re-apply is clean; restore before surfacing the refusal.
+        if (gitSync(['stash', 'apply', stashSha], baseCheckout).status === 0)
+            dropStashIfStillTip(baseCheckout, stashSha);
+        return landed;
+    }
+    if (gitSync(['stash', 'apply', stashSha], baseCheckout).status === 0) {
+        dropStashIfStillTip(baseCheckout, stashSha);
+        return { ok: true };
+    }
+    gitSync(['reset', '--hard', landedSha], baseCheckout);
+    return {
+        ok: true,
+        stash: `local changes in ${baseCheckout} conflicted with the landed commits and were PRESERVED as stash ${stashSha}; nothing was lost. Re-apply them with \`git -C ${shellQuote(baseCheckout)} stash apply ${stashSha}\` and resolve the conflict.`,
+    };
+}
+/** Drop a stash entry only while it is still the tip `stash@{0}` names, so a
+ *  stash someone else pushed in between is never dropped instead. */
+function dropStashIfStillTip(cwd, stashSha) {
+    const tip = gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], cwd);
+    if (tip.status === 0 && tip.stdout.trim() === stashSha)
+        gitSync(['stash', 'drop'], cwd);
+}
 function deferredCleanupResult(wt) {
     const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
     return {
@@ -349,9 +462,16 @@ function closeManagedWorktreeLocked(nodeId) {
     // captured baseSha — landing is purely local, nothing is ever pushed to
     // origin. Both landing paths require the base to still be exactly at that
     // captured tip, so neither can overwrite a concurrent base change.
+    // Every refusal below leaves a rebased, landable branch that this node ASKED
+    // to land. Recording that blocked intent is what later authorizes the daemon
+    // sweep to finish exactly this land once the blocker clears.
+    const blocked = (message, next, detail) => {
+        recordBlockedLandIntent(nodeId, message);
+        return new WorktreeError('land_base_failed', message, next, detail);
+    };
     const fastForward = gitSync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.path);
     if (fastForward.status !== 0) {
-        throw new WorktreeError('land_base_failed', `rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the user with `crtr human send` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
+        throw blocked(`rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the user with `crtr human send` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
     }
     const baseCheckout = checkoutPathForBranch(wt.path, wt.base_ref);
     if (baseCheckout !== null) {
@@ -361,17 +481,22 @@ function closeManagedWorktreeLocked(nodeId) {
             const detail = checkoutHead.status !== 0
                 ? (checkoutHead.stderr.trim() || actualHead).trim()
                 : `expected ${baseSha}, found ${actualHead}`;
-            throw new WorktreeError('land_base_failed', `local base branch '${wt.base_ref}' changed while this worktree was closing`, `Reconcile the base checkout at ${baseCheckout}, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, detail);
+            throw blocked(`local base branch '${wt.base_ref}' changed while this worktree was closing`, `Reconcile the base checkout at ${baseCheckout}, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, detail);
         }
     }
-    const land = baseCheckout !== null
-        ? gitSync(['merge', '--ff-only', landedSha], baseCheckout)
-        : gitSync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.path);
-    if (land.status !== 0) {
-        const detail = (land.stderr.trim() || land.stdout.trim()).trim();
-        throw new WorktreeError('land_base_failed', `could not fast-forward local base branch '${wt.base_ref}' to this worktree`, baseCheckout !== null
-            ? `Local base branch '${wt.base_ref}' is checked out at ${baseCheckout} in a state that blocks a fast-forward (uncommitted changes, or it has diverged). Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`
-            : 'Ask the user with `crtr human send` how to land this managed worktree.', detail);
+    let stashNote;
+    if (baseCheckout !== null) {
+        const landed = landIntoBaseCheckout(baseCheckout, wt.branch, baseSha, landedSha);
+        if (!landed.ok) {
+            throw blocked(`could not fast-forward local base branch '${wt.base_ref}' to this worktree`, `Local base branch '${wt.base_ref}' is checked out at ${baseCheckout} in a state that blocks a fast-forward. Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, landed.detail);
+        }
+        stashNote = landed.stash;
+    }
+    else {
+        const land = gitSync(['update-ref', `refs/heads/${wt.base_ref}`, landedSha, baseSha], wt.path);
+        if (land.status !== 0) {
+            throw blocked(`could not fast-forward local base branch '${wt.base_ref}' to this worktree`, 'Ask the user with `crtr human send` how to land this managed worktree.', (land.stderr.trim() || land.stdout.trim()).trim());
+        }
     }
     // The caller broker still runs from wt.path after this API response. Do not
     // invoke `git worktree remove`: it recursively deletes the caller's cwd and
@@ -385,6 +510,7 @@ function closeManagedWorktreeLocked(nodeId) {
         worktree_path: wt.path,
         landed_sha: landedSha,
         ...deferredCleanupResult(wt),
+        ...(stashNote === undefined ? {} : { base_checkout_stash: stashNote }),
     };
 }
 export function closeManagedWorktree(nodeId) {
@@ -467,7 +593,7 @@ export function abandonManagedWorktree(nodeId, by) {
  *  is still at the exact inspected SHA. `containingRef` can be the recorded
  *  local base or that base's remote-tracking upstream. */
 function bestEffortDeleteBranchWithContainmentProof(wt, branchSha, containingRef, containingSha) {
-    const stdin = `verify ${containingRef} ${containingSha}\ndelete refs/heads/${wt.branch} ${branchSha}\n`;
+    const stdin = refDeleteTransactionStdin(wt.branch, branchSha, containingRef, containingSha);
     const transaction = gitSync(['update-ref', '--stdin'], wt.repo_root, stdin);
     const branchDeleted = transaction.status === 0;
     if (branchDeleted)

package/dist/daemon/__tests__/startup-block-marker.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/__tests__/startup-block-marker.test.js

@@ -0,0 +1,86 @@
+import { test, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { blockedMigrationIn, clearDaemonStartupBlocked, daemonStartupBlocked, recordDaemonStartupBlocked, } from '../startup-block-marker.js';
+import { exclusiveLockOwnerPid, withExclusiveDirectoryLockAsync } from '../../core/exclusive-lock.js';
+import { MigrationBlockedError } from '../../migrations/activation.js';
+// REGRESSION (daemon respawn storm, cross-process half): the first fix for the
+// storm kept its suppression in module state, which caps exactly ONE process.
+// The storm is made of many — every CLI invocation and every scheduled tick is
+// its own process — so 10 separate invocations against a permanently blocked
+// home still produced 10 spawns. Suppression has to outlive a pid, and it has
+// to retire itself when the corpus is repaired or it wedges a fixed install.
+let home;
+const previousHome = process.env['CRTR_HOME'];
+beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-block-'));
+    process.env['CRTR_HOME'] = home;
+});
+afterEach(() => {
+    if (previousHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = previousHome;
+    rmSync(home, { recursive: true, force: true });
+});
+test('a recorded block is visible to a DIFFERENT process reading the same home', () => {
+    const blocker = join(home, 'INDEX.md');
+    writeFileSync(blocker, 'front door');
+    assert.equal(daemonStartupBlocked(), null, 'nothing recorded yet');
+    recordDaemonStartupBlocked('migration blocked\nRepair: crtr sys migrate', [blocker]);
+    // A fresh process shares no memory with the recorder — only this file.
+    assert.match(daemonStartupBlocked() ?? '', /Repair: crtr sys migrate/);
+});
+test('the marker retires itself once the corpus it named changes', () => {
+    const blocker = join(home, 'INDEX.md');
+    writeFileSync(blocker, 'front door');
+    recordDaemonStartupBlocked('blocked', [blocker]);
+    assert.equal(daemonStartupBlocked(), 'blocked');
+    // The repair — by `crtr sys migrate`, an editor, or a delete. Whatever did
+    // it, the user must never need to know this marker exists.
+    writeFileSync(blocker, 'front door removed, plus enough bytes to change size');
+    assert.equal(daemonStartupBlocked(), null, 'a changed blocker lifts suppression');
+});
+test('a deleted blocker also retires the marker', () => {
+    const blocker = join(home, 'INDEX.md');
+    writeFileSync(blocker, 'front door');
+    recordDaemonStartupBlocked('blocked', [blocker]);
+    rmSync(blocker);
+    assert.equal(daemonStartupBlocked(), null);
+});
+test('a marker naming no blockers cannot wedge autostart forever', () => {
+    // Nothing about it can be observed to change, so it is advisory only.
+    recordDaemonStartupBlocked('blocked with no paths', []);
+    assert.equal(daemonStartupBlocked(), null);
+});
+test('clearing is idempotent and safe on a home with no marker', () => {
+    clearDaemonStartupBlocked();
+    clearDaemonStartupBlocked();
+    assert.equal(daemonStartupBlocked(), null);
+});
+// REGRESSION (reap kills a healthy daemon mid-migration): the reap escalates to
+// SIGKILL, so it must be able to tell a child that is DOING the migration from
+// one merely queued behind it. The lock marker already names its owner's pid.
+test('the migration lock names its holder, so a reap can spare the one doing the work', async () => {
+    const lock = join(home, 'lock');
+    assert.equal(exclusiveLockOwnerPid(lock), null, 'a free lock names nobody');
+    await withExclusiveDirectoryLockAsync(lock, async () => {
+        assert.equal(exclusiveLockOwnerPid(lock), process.pid, 'the holder is named while held');
+    });
+    assert.equal(exclusiveLockOwnerPid(lock), null, 'released again');
+});
+// REGRESSION (the aggregate swallows the one error that matters): startup
+// releases its ownership claim before rethrowing a migration failure, and a
+// release that ALSO fails is reported as an AggregateError. The blocked
+// migration must still be recognised through that wrapper, or the daemon exits
+// generically and every downstream suppression stops working.
+test('a blocked migration is still recognised inside a cleanup aggregate', () => {
+    const blocked = new MigrationBlockedError('blocked', ['/some/INDEX.md']);
+    const aggregate = new AggregateError([blocked, new Error('cleanup also failed')], 'startup failed');
+    const found = blockedMigrationIn(aggregate);
+    assert.ok(found instanceof MigrationBlockedError, 'found through the wrapper');
+    assert.deepEqual(found.blockerPaths, ['/some/INDEX.md']);
+    assert.equal(blockedMigrationIn(new Error('unrelated')), null, 'an ordinary failure is not claimed');
+});

package/dist/daemon/api/handlers/worktree.js

@@ -13,6 +13,7 @@
 // leaf can reconstruct the original agent-facing contract instead of collapsing
 // to a generic status code.
 import { abandonManagedWorktree, closeManagedWorktree } from '../../../core/worktree.js';
+import { listQuarantinedManagedWorktrees } from '../../../core/worktree-quarantine.js';
 import { usage } from '../../../core/errors.js';
 function handleWorktreeClose(ctx) {
     const id = ctx.params['id'];
@@ -27,7 +28,11 @@ function handleWorktreeAbandon(ctx) {
         throw usage('abandon requires a non-empty invoking identity', { received: ctx.body, next: 'Pass the invoking node id or human identity.' });
     return { status: 200, body: abandonManagedWorktree(ctx.params['id'], by) };
 }
+async function handleQuarantinedWorktrees() {
+    return { status: 200, body: await listQuarantinedManagedWorktrees() };
+}
 export const worktreeRoutes = [
     { method: 'POST', pattern: '/v1/nodes/:id/worktree/close', handler: handleWorktreeClose },
     { method: 'POST', pattern: '/v1/nodes/:id/worktree/abandon', handler: handleWorktreeAbandon },
+    { method: 'GET', pattern: '/v1/worktrees/quarantined', handler: handleQuarantinedWorktrees },
 ];

package/dist/daemon/crtrd-cli.js

@@ -3,8 +3,8 @@
 // raw fatal boundary; a winning daemon stays alive through its scheduled loop.
 import '../suppress-experimental-warnings.js';
 import { runDaemon } from './crtrd.js';
-import { MigrationBlockedError } from '../migrations/activation.js';
 import { DAEMON_EXIT_STARTUP_BLOCKED } from './startup-policy.js';
+import { blockedMigrationIn, recordDaemonStartupBlocked } from './startup-block-marker.js';
 import { envCrtrdTcp } from '../shared/env.js';
 /** Extract `--tcp <host:port>` (or `--tcp=<host:port>`) from argv; falls back to
  *  `CRTRD_TCP`. Absent → unix socket only (§4.1). */
@@ -18,16 +18,21 @@ function parseTcpArg(argv) {
     }
     return envCrtrdTcp();
 }
-// A blocked migration is the one startup failure that is guaranteed to recur.
-// Exit on its own code — with the repair line intact on stderr — so the
-// spawner suppresses further autostarts rather than respawning into the same
-// wall. Every other failure keeps reaching Node's raw fatal boundary.
+// A blocked migration is the one startup failure guaranteed to recur, so it
+// exits on its own code rather than reaching Node's raw fatal boundary like
+// every other failure.
 try {
     await runDaemon({ tcp: parseTcpArg(process.argv.slice(2)) });
 }
 catch (error) {
-    if (!(error instanceof MigrationBlockedError))
+    // Record it in the canvas home BEFORE exiting: the exit code alone only
+    // reaches the one process that spawned us, and the processes that would spawn
+    // the next daemon are all different processes with no memory of this. The
+    // marker is what makes the suppression outlive this pid.
+    const blocked = blockedMigrationIn(error);
+    if (blocked === null)
         throw error;
-    process.stderr.write(`[crtrd] startup blocked\n${error.message}\n`);
+    recordDaemonStartupBlocked(blocked.message, blocked.blockerPaths);
+    process.stderr.write(`[crtrd] startup blocked\n${blocked.message}\n`);
     process.exit(DAEMON_EXIT_STARTUP_BLOCKED);
 }

package/dist/daemon/crtrd.js

@@ -77,6 +77,7 @@ import { emitEvent } from '../core/events/emit.js';
 import { operationIdContext } from '../core/events/operation-id.js';
 import { bindDaemonEventSource } from '../core/events/source.js';
 import { ensureOnDiskMigrations } from '../migrations/activation.js';
+import { clearDaemonStartupBlocked } from './startup-block-marker.js';
 // A broker DECLARES its owning canvas in argv at spawn (host.ts launch:
 // `broker-cli.js --canvas-home <home> --epoch <id> <nodeId>`), so ownership is
 // an exact match on this daemon's own canvas home — no path inference. An
@@ -303,7 +304,7 @@ export async function superviseTick(now = Date.now(), lifecycle = directTickLife
     cronLane.run(now, { lifecycle });
     humanDeliveryLane.run(now, { lifecycle });
     pendingReviewSubmit.run(now, { lifecycle });
-    storageMaintenance.run(now, {});
+    storageMaintenance.run(now, { lifecycle, fleet });
     await bashDeadline.run(now, { rows });
     // Last: the saturation figure is only true once the freeze lane has spent
     // this tick's free slots.
@@ -339,6 +340,10 @@ export async function runDaemon(opts = {}) {
     const claim = ownership.claim;
     try {
         await ensureOnDiskMigrations();
+        // Migrations passed, so whatever once blocked startup here is resolved.
+        // Retire the suppression marker on the success path rather than making any
+        // repair route remember to: the daemon getting this far IS the proof.
+        clearDaemonStartupBlocked();
     }
     catch (migrationError) {
         try {

package/dist/daemon/fleet.d.ts

@@ -59,6 +59,7 @@ export declare class DaemonFleet implements FleetRegistry {
     epoch(): string;
     register(nodeId: string, handle: HostHandle): void;
     has(nodeId: string): boolean;
+    isClaimed(nodeId: string): boolean;
     get(nodeId: string): FleetEntry | undefined;
     size(): number;
     occupancy(): number;

package/dist/daemon/fleet.js

@@ -149,6 +149,9 @@ export class DaemonFleet {
     has(nodeId) {
         return this.#map.has(nodeId);
     }
+    isClaimed(nodeId) {
+        return this.#map.has(nodeId) || this.#reservations.has(nodeId);
+    }
     get(nodeId) {
         return this.#map.get(nodeId);
     }

package/dist/daemon/manage.js

@@ -15,6 +15,9 @@ import { hostExecPath } from '../core/runtime/branded-host.js';
 // reaches openDb) so the CLI daemon front door stays canvas.db-free (plan B-0).
 import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
 import { DAEMON_EXIT_STARTUP_BLOCKED, DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
+import { clearDaemonStartupBlocked, daemonStartupBlocked } from './startup-block-marker.js';
+import { exclusiveLockOwnerPid } from '../core/exclusive-lock.js';
+import { onDiskMigrationLockPath } from '../core/canvas/paths.js';
 import { envNoDaemonAutostart } from '../shared/env.js';
 import { CrtrClient } from '../api/index.js';
 // Daemon env sanitization
@@ -421,7 +424,15 @@ export async function spawnDaemon() {
         });
     }
     catch (error) {
-        if (exitState === null) {
+        // Reap ONLY a child that is not doing the work. A child holding the on-disk
+        // migration lock is mid-corpus-rewrite: the reap escalates to SIGKILL, and
+        // killing a migration partway through is far worse than the resident
+        // process the reap exists to avoid. Startup verification giving up is a
+        // statement about our patience, not proof the child is stuck — a large
+        // corpus can legitimately outlast the window, and that daemon should be
+        // allowed to finish and serve.
+        const childOwnsMigrationLock = exclusiveLockOwnerPid(onDiskMigrationLockPath()) === pid;
+        if (exitState === null && !childOwnsMigrationLock) {
             try {
                 await stopDaemonProcess(pid, DAEMON_REAP_WINDOW_MS);
             }
@@ -478,6 +489,7 @@ export function resetDaemonAutostart() {
     autostartFailures = 0;
     autostartNextAttemptAt = 0;
     autostartBlocked = null;
+    clearDaemonStartupBlocked();
 }
 /** Start the daemon if it is not already running. No-op if already up, if
  *  autostart is suppressed for this invocation, while an attempt is in flight,
@@ -500,6 +512,15 @@ export function ensureDaemon(deps = {}) {
         resetDaemonAutostart();
         return;
     }
+    // The durable half of the gate. Everything above is module state, which caps
+    // exactly one process; the storm is made of many. A daemon that already
+    // proved startup is blocked left this marker in the canvas home, and it
+    // retires itself as soon as the corpus it named changes.
+    const blocked = daemonStartupBlocked();
+    if (blocked !== null) {
+        autostartBlocked = blocked;
+        return;
+    }
     autostartInFlight = true;
     void spawn().then(() => {
         autostartFailures = 0;

package/dist/daemon/reconcilers/managed-worktree-sweep.d.ts

@@ -0,0 +1,24 @@
+import type { FleetRegistry } from '../../core/runtime/fleet.js';
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export declare const WORKTREE_SWEEP_INTERVAL_MS: number;
+/** Candidates reconciled per pass. Bounds the work a large backlog can demand. */
+export declare const WORKTREE_SWEEP_BUDGET = 3;
+export interface ManagedWorktreeSweepContext {
+    lifecycle: DetachedWorkLifecycle;
+    fleet: FleetRegistry;
+}
+export declare class ManagedWorktreeSweepReconciler {
+    private lastSweepAt;
+    private inFlight;
+    /** Round-robin cursor over candidate node ids, so a permanently stuck record
+     *  at the head of the list cannot starve the ones behind it. */
+    private cursor;
+    run(now: number, ctx: ManagedWorktreeSweepContext): void;
+    /** Terminal nodes whose managed worktree is unreconciled and whose backoff has
+     *  elapsed. Canvas reads only — engine liveness is classified later, for the
+     *  budgeted few, from one shared process snapshot. Returns null when the
+     *  canvas could not be read, which authorizes nothing. */
+    private candidates;
+    private sweep;
+    private reconcileOne;
+}