@north-light/crouter 0.3.263 → 0.3.270

package/dist/core/tui/markdown.js

@@ -0,0 +1,407 @@
+// markdown.ts — a tiny, pure markdown → styled-spans renderer for crtr's
+// raw-ANSI TUIs.
+//
+// WHY THIS EXISTS instead of the managed termrender subprocess: `renderFrame`
+// (canvas browse) is a pure function of state/size/caps called on EVERY
+// keystroke. termrender's `renderMarkdownBlockAwareLines` shells out to a python
+// venv per call, and pi-tui's Markdown component needs a component tree — both
+// are unusable inside a synchronous frame paint. So this module supports the
+// subset of markdown that actually shows up in a preview (headings, lists, code,
+// quotes, rules, tables, and inline emphasis) with no dependencies at all.
+//
+// It returns Span[][] — one span group per screen line, already wrapped to the
+// caller's width and already carrying its own prefixes (list markers, quote
+// bars). The caller assembles each line with draw.ts's `assemble`, so hue stays
+// gated on `caps.color` exactly like every other line in the frame.
+import { clip } from './draw.js';
+const FG_CYAN = '36';
+// ── Style composition ─────────────────────────────────────────────────────────
+/** Layer `add` over `base`. Structural flags OR together (a bold heading keeps
+ *  its bold inside an italic run); hue is last-one-wins. */
+function extend(base, add) {
+    const out = {};
+    const fg = add.fg ?? base.fg;
+    const bg = add.bg ?? base.bg;
+    if (fg !== undefined)
+        out.fg = fg;
+    if (bg !== undefined)
+        out.bg = bg;
+    if (add.bold || base.bold)
+        out.bold = true;
+    if (add.dim || base.dim)
+        out.dim = true;
+    if (add.italic || base.italic)
+        out.italic = true;
+    if (add.reverse || base.reverse)
+        out.reverse = true;
+    return out;
+}
+const RE_FENCE = /^\s{0,3}(```|~~~)/;
+const RE_HEAD = /^\s{0,3}(#{1,6})\s+(.*)$/;
+const RE_BULLET = /^(\s*)[-*+]\s+(.*)$/;
+const RE_ORDER = /^(\s*)(\d{1,9})[.)]\s+(.*)$/;
+const RE_QUOTE = /^\s{0,3}>\s?(.*)$/;
+const RE_RULE = /^\s{0,3}(?:(?:-\s*){3,}|(?:\*\s*){3,}|(?:_\s*){3,})$/;
+const RE_TABLE = /^\s*\|/;
+/** Does this line open a new block? Used to decide whether a following line is a
+ *  lazy continuation of the paragraph / list item / quote being accumulated. */
+function isBlockStart(line) {
+    return RE_FENCE.test(line) || RE_HEAD.test(line) || RE_RULE.test(line)
+        || RE_BULLET.test(line) || RE_ORDER.test(line) || RE_QUOTE.test(line) || RE_TABLE.test(line);
+}
+function parseBlocks(src) {
+    const lines = src.replace(/\r\n?/g, '\n').split('\n');
+    const out = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.trim() === '') {
+            i++;
+            continue;
+        }
+        const fence = RE_FENCE.exec(line);
+        if (fence !== null) {
+            const tok = fence[1];
+            i++;
+            const body = [];
+            while (i < lines.length && !lines[i].trimStart().startsWith(tok)) {
+                body.push(lines[i]);
+                i++;
+            }
+            if (i < lines.length)
+                i++; // consume the closing fence
+            out.push({ k: 'code', lines: body });
+            continue;
+        }
+        // Rule before bullet: `---` and `***` would otherwise look like list markers.
+        if (RE_RULE.test(line)) {
+            out.push({ k: 'rule' });
+            i++;
+            continue;
+        }
+        const head = RE_HEAD.exec(line);
+        if (head !== null) {
+            out.push({ k: 'head', level: head[1].length, text: head[2].replace(/\s+#+\s*$/, '').trim() });
+            i++;
+            continue;
+        }
+        if (RE_TABLE.test(line)) {
+            const body = [];
+            while (i < lines.length && RE_TABLE.test(lines[i])) {
+                body.push(lines[i].trim());
+                i++;
+            }
+            out.push({ k: 'table', lines: body });
+            continue;
+        }
+        const bullet = RE_BULLET.exec(line);
+        const order = bullet === null ? RE_ORDER.exec(line) : null;
+        if (bullet !== null || order !== null) {
+            const indent = (bullet !== null ? bullet[1] : order[1]).length;
+            const marker = bullet !== null ? '• ' : `${order[2]}. `;
+            let text = bullet !== null ? bullet[2] : order[3];
+            i++;
+            while (i < lines.length && lines[i].trim() !== '' && !isBlockStart(lines[i])) {
+                text += ` ${lines[i].trim()}`;
+                i++;
+            }
+            out.push({ k: 'item', depth: Math.min(4, Math.floor(indent / 2)), marker, text: text.trim() });
+            continue;
+        }
+        const quote = RE_QUOTE.exec(line);
+        if (quote !== null) {
+            let text = quote[1];
+            i++;
+            for (;;) {
+                if (i >= lines.length)
+                    break;
+                const more = RE_QUOTE.exec(lines[i]);
+                if (more !== null) {
+                    text += ` ${more[1]}`;
+                    i++;
+                    continue;
+                }
+                if (lines[i].trim() !== '' && !isBlockStart(lines[i])) {
+                    text += ` ${lines[i].trim()}`;
+                    i++;
+                    continue;
+                }
+                break;
+            }
+            out.push({ k: 'quote', text: text.trim() });
+            continue;
+        }
+        let text = line.trim();
+        i++;
+        while (i < lines.length && lines[i].trim() !== '' && !isBlockStart(lines[i])) {
+            text += ` ${lines[i].trim()}`;
+            i++;
+        }
+        out.push({ k: 'para', text });
+    }
+    return out;
+}
+// ── Inline grammar ────────────────────────────────────────────────────────────
+const ESCAPABLE = /[\\`*_~[\]()#>-]/;
+/** Parse inline markup left to right, recursing on delimited content with the
+ *  base style extended. Unclosed or implausible delimiters stay literal, which is
+ *  the right failure mode for a preview: never eat the user's text. */
+export function inlineSpans(src, base = {}) {
+    const out = [];
+    let buf = '';
+    const flush = () => { if (buf !== '') {
+        out.push({ text: buf, style: base });
+        buf = '';
+    } };
+    const emit = (spans) => { flush(); for (const s of spans)
+        out.push(s); };
+    const n = src.length;
+    let i = 0;
+    while (i < n) {
+        const c = src[i];
+        if (c === '\\' && i + 1 < n && ESCAPABLE.test(src[i + 1])) {
+            buf += src[i + 1];
+            i += 2;
+            continue;
+        }
+        if (c === '`') {
+            const end = src.indexOf('`', i + 1);
+            if (end > i + 1) {
+                emit([{ text: src.slice(i + 1, end), style: extend(base, { fg: FG_CYAN }) }]);
+                i = end + 1;
+                continue;
+            }
+        }
+        // [label](url) — keep the label in cyan, drop the URL (a preview has no room
+        // for it and nothing here is clickable).
+        if (c === '[') {
+            const close = src.indexOf(']', i + 1);
+            if (close > i + 1 && src[close + 1] === '(') {
+                const paren = src.indexOf(')', close + 2);
+                if (paren > close) {
+                    emit(inlineSpans(src.slice(i + 1, close), extend(base, { fg: FG_CYAN })));
+                    i = paren + 1;
+                    continue;
+                }
+            }
+        }
+        if (c === '~' && src[i + 1] === '~') {
+            const end = src.indexOf('~~', i + 2);
+            if (end > i + 1) {
+                emit(inlineSpans(src.slice(i + 2, end), extend(base, { dim: true })));
+                i = end + 2;
+                continue;
+            }
+        }
+        if (c === '*' || c === '_') {
+            const run = src[i + 1] === c ? (src[i + 2] === c ? 3 : 2) : 1;
+            const delim = c.repeat(run);
+            // `_` must not open mid-word, or every snake_case identifier turns italic.
+            const wordBefore = c === '_' && i > 0 && /\w/.test(src[i - 1]);
+            const opens = !wordBefore && i + run < n && !/\s/.test(src[i + run]);
+            if (opens) {
+                let end = -1;
+                let from = i + run;
+                for (;;) {
+                    const at = src.indexOf(delim, from);
+                    if (at < 0)
+                        break;
+                    const tightRight = !/\s/.test(src[at - 1] ?? ' ');
+                    const wordAfter = c === '_' && /\w/.test(src[at + run] ?? '');
+                    if (tightRight && !wordAfter) {
+                        end = at;
+                        break;
+                    }
+                    from = at + 1;
+                }
+                if (end > i) {
+                    const add = run === 3 ? { bold: true, italic: true } : run === 2 ? { bold: true } : { italic: true };
+                    emit(inlineSpans(src.slice(i + run, end), extend(base, add)));
+                    i = end + run;
+                    continue;
+                }
+            }
+        }
+        buf += c;
+        i++;
+    }
+    flush();
+    return out;
+}
+// ── Wrapping ──────────────────────────────────────────────────────────────────
+function spanWidth(spans) {
+    let n = 0;
+    for (const s of spans)
+        n += [...s.text].length;
+    return n;
+}
+function sameStyle(a, b) {
+    if (a === b)
+        return true;
+    if (a === undefined || b === undefined)
+        return false;
+    return a.fg === b.fg && a.bg === b.bg && !!a.bold === !!b.bold
+        && !!a.dim === !!b.dim && !!a.italic === !!b.italic && !!a.reverse === !!b.reverse;
+}
+/** Merge neighbouring same-style spans. Word-wrapping emits one span per word, and
+ *  `assemble` wraps EVERY span in its own SGR pair — so without this a styled
+ *  sentence ships as a stutter of escape sequences. */
+function coalesce(spans) {
+    const out = [];
+    for (const s of spans) {
+        const last = out[out.length - 1];
+        if (last !== undefined && sameStyle(last.style, s.style))
+            last.text += s.text;
+        else
+            out.push({ text: s.text, ...(s.style === undefined ? {} : { style: s.style }) });
+    }
+    return out;
+}
+/** Greedy word-wrap over a span stream, with a first-line prefix and a separate
+ *  continuation prefix so list markers and quote bars hang correctly. A word
+ *  longer than the line is hard-sliced rather than dropped. */
+function wrapSpans(spans, width, first, cont) {
+    const lines = [];
+    const limitFor = (idx) => Math.max(1, width - spanWidth(idx === 0 ? first : cont));
+    let line = [];
+    let used = 0;
+    let limit = limitFor(0);
+    const flushLine = () => {
+        lines.push(coalesce([...(lines.length === 0 ? first : cont), ...line]));
+        line = [];
+        used = 0;
+        limit = limitFor(lines.length);
+    };
+    let pendingSpace = false;
+    for (const span of spans) {
+        for (const part of span.text.split(/(\s+)/)) {
+            if (part === '')
+                continue;
+            if (/^\s+$/.test(part)) {
+                if (used > 0)
+                    pendingSpace = true;
+                continue;
+            }
+            const w = [...part].length;
+            const extra = pendingSpace ? 1 : 0;
+            if (used + extra + w <= limit) {
+                // The break space carries the word's style so a styled run stays one span.
+                if (pendingSpace) {
+                    line.push({ text: ' ', style: span.style });
+                    used++;
+                }
+                line.push({ text: part, style: span.style });
+                used += w;
+                pendingSpace = false;
+                continue;
+            }
+            if (used > 0)
+                flushLine();
+            pendingSpace = false;
+            let rest = [...part];
+            while (rest.length > limit) {
+                line.push({ text: rest.slice(0, limit).join(''), style: span.style });
+                rest = rest.slice(limit);
+                flushLine();
+            }
+            if (rest.length > 0) {
+                line.push({ text: rest.join(''), style: span.style });
+                used = rest.length;
+            }
+        }
+    }
+    if (line.length > 0)
+        flushLine();
+    return lines;
+}
+// ── Blocks → lines ────────────────────────────────────────────────────────────
+function blockToLines(b, width, base) {
+    switch (b.k) {
+        case 'rule':
+            return [[{ text: '─'.repeat(Math.max(1, width)), style: { dim: true } }]];
+        case 'code':
+            return b.lines.map((l) => [{ text: clip(l.replace(/\t/g, '  '), width), style: extend(base, { fg: FG_CYAN }) }]);
+        case 'table':
+            return b.lines.map((l) => [{ text: clip(l, width), style: extend(base, { dim: true }) }]);
+        case 'head': {
+            // Level 3+ is a sub-sub-heading — bold alone would out-shout the body it
+            // introduces, so it goes dim-bold.
+            const st = extend(base, b.level >= 3 ? { bold: true, dim: true } : { bold: true });
+            return wrapSpans(inlineSpans(b.text, st), width, [], []);
+        }
+        case 'item': {
+            const pad = ' '.repeat(b.depth * 2);
+            const first = [{ text: pad }, { text: b.marker, style: extend(base, { dim: true }) }];
+            const cont = [{ text: pad + ' '.repeat([...b.marker].length) }];
+            return wrapSpans(inlineSpans(b.text, base), width, first, cont);
+        }
+        case 'quote': {
+            const bar = [{ text: '▏ ', style: { dim: true } }];
+            return wrapSpans(inlineSpans(b.text, extend(base, { dim: true })), width, bar, bar);
+        }
+        case 'para':
+            return wrapSpans(inlineSpans(b.text, base), width, [], []);
+    }
+}
+/** Trim the last line to make room, then mark the cut. Without this a truncated
+ *  reply reads as the end of the text — exactly the wrong impression for "where
+ *  did this node leave off?". */
+function appendEllipsis(lines, width) {
+    const last = lines[lines.length - 1];
+    if (last === undefined)
+        return;
+    let w = spanWidth(last);
+    while (w > width - 1 && last.length > 0) {
+        const tail = last[last.length - 1];
+        const chars = [...tail.text];
+        if (chars.length <= 1) {
+            last.pop();
+            w -= chars.length;
+        }
+        else {
+            tail.text = chars.slice(0, -1).join('');
+            w--;
+        }
+    }
+    last.push({ text: '…', style: { dim: true } });
+}
+/**
+ * Render `src` as markdown into at most `maxLines` span groups, each already
+ * wrapped to `width` visible columns.
+ *
+ * `spacing` inserts a blank line between blocks — true where the panel has room
+ * to breathe, false in a cramped one where every line counts. Consecutive list
+ * items never get one, so a tight list stays tight.
+ *
+ * `base` is the style every rendered run inherits (the caller's block style,
+ * e.g. the dim of a report body); markdown's own styles layer over it.
+ */
+export function renderMarkdownSpans(src, width, maxLines, spacing = false, base = {}) {
+    if (width <= 0 || maxLines <= 0)
+        return [];
+    const blocks = parseBlocks(src);
+    const out = [];
+    let truncated = false;
+    let prev;
+    for (const b of blocks) {
+        if (out.length >= maxLines) {
+            truncated = true;
+            break;
+        }
+        if (prev !== undefined && spacing && !(prev.k === 'item' && b.k === 'item'))
+            out.push([]);
+        for (const line of blockToLines(b, width, base)) {
+            if (out.length >= maxLines) {
+                truncated = true;
+                break;
+            }
+            out.push(line);
+        }
+        prev = b;
+    }
+    while (out.length > 0 && out[out.length - 1].length === 0)
+        out.pop();
+    if (truncated)
+        appendEllipsis(out, width);
+    return out;
+}

package/dist/core/user-settings.d.ts

@@ -113,6 +113,10 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
+    lifecycle: {
+        surface: "specialized";
+        owner: string;
+    };
     completion_bell: {
         surface: "settings";
         setting: {

package/dist/core/user-settings.js

@@ -149,6 +149,7 @@ export const CONFIG_SETTINGS_COVERAGE = {
         },
     },
     brokerThresholds: { surface: 'specialized', owner: 'Broker limits tab' },
+    lifecycle: { surface: 'specialized', owner: 'sys config set lifecycle.unattendedParkMs' },
     completion_bell: {
         surface: 'settings',
         setting: {

package/dist/daemon/api/__tests__/node-model-validation.test.js

@@ -103,6 +103,26 @@ test('promote and yield reject unregistered model recipes before reshaping the n
         assert.equal(after?.mode, before?.mode, `${operation} did not reshape the node`);
     }
 });
+test('promote and yield reject an unregistered resolved portable override before reshaping the node', async () => {
+    const cwd = join(home, 'target-project');
+    mkdirSync(join(cwd, '.crouter'), { recursive: true });
+    writeFileSync(join(cwd, '.crouter', 'config.json'), JSON.stringify({
+        modelLadders: { openai: { strong: 'target-openai/missing-strong' } },
+    }));
+    const registry = { find: () => undefined, hasConfiguredAuth: () => false };
+    for (const operation of ['promote', 'yield']) {
+        const id = `${operation}-portable-model`;
+        createNode(node(id, cwd));
+        const before = getNode(id);
+        const request = ctx('POST', `/v1/nodes/${id}/${operation}`, id, { model: 'openai/strong' });
+        await assert.rejects(() => operation === 'promote'
+            ? handlePromote(request, { modelRegistry: registry })
+            : handleYield(request, { modelRegistry: registry }), (error) => error instanceof CrtrError && error.code === 'usage' && /target-openai\/missing-strong/.test(error.message));
+        const after = getNode(id);
+        assert.deepEqual(after?.launch, before?.launch, `${operation} did not rewrite the launch recipe`);
+        assert.equal(after?.mode, before?.mode, `${operation} did not reshape the node`);
+    }
+});
 test('config normalizes portable models against the target node scope', async () => {
     const cwd = join(home, 'target-project');
     mkdirSync(join(cwd, '.crouter'), { recursive: true });
@@ -131,4 +151,5 @@ test('config normalizes portable models against the target node scope', async ()
     await handleConfig(ctx('PATCH', `/v1/nodes/${id}/config`, id, { model: 'openai/strong' }), { modelRegistry: registry });
     assert.equal(getNode(id)?.model_override, 'target-openai/o-strong');
     assert.equal(getNode(id)?.launch?.model, 'target-openai/o-strong');
+    assert.equal(getNode(id)?.launch?.modelExact, true, 'a config override cannot route away on revive');
 });

package/dist/daemon/api/__tests__/profile-launch-gates.test.js

@@ -62,7 +62,7 @@ test('create rejects a paused profile before a node exists', async () => {
     });
     assert.equal(listNodes().length, beforeRows);
 });
-test('revive refuses a paused profile before launching a broker', () => {
+test('revive refuses a paused profile before launching a broker', async () => {
     const profile = createProfile('paused revive', [{ path: cwd, memory: 'content' }]);
     pauseProfile(profile.profileId);
     const nodeId = 'paused-revive-node';
@@ -78,7 +78,7 @@ test('revive refuses a paused profile before launching a broker', () => {
         parent: null,
         profile_id: profile.profileId,
     });
-    assert.throws(() => reviveNode(nodeId, { resume: true, capacity: 'freeze' }), (error) => {
+    await assert.rejects(reviveNode(nodeId, { resume: true, capacity: 'freeze' }), (error) => {
         assert.ok(error instanceof CrtrError);
         assert.equal(error.code, 'usage');
         assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));

package/dist/daemon/api/bridge.d.ts

@@ -49,9 +49,10 @@ export declare function startRemoteAttachHeartbeat(ws: WebSocket, intervalMs?: n
  *   1. Guard `isSafeNodeId` (→ 400) and existence (→ 404) BEFORE building any
  *      fs path or reviving — an unsafe id must never reach `viewSocketPath`.
  *   2. Unless revive is opted out (`?revive=0` / `X-Crtr-Attach-Revive: 0`):
- *      `reviveNode(id, { resume:true })` then
+ *      `decideAttachRevive(id, { resume:true }, wakeParked)` then
  *      `waitForBrokerViewSocket` (bounded). Revive throw OR socket-not-listenable
- *      → refuse 409, WS never opens.
+ *      → refuse 409, WS never opens. Without `?wakeParked=1` an exact parked
+ *      resident is left parked and refused 409 `node_dormant` — see the call site.
  *   3. Revive opted out: a single connect probe. Dormant (socket refuses) →
  *      refuse 409 (spec §5.3 asymmetry: a dead broker can't stream over WS).
  *   4. Only then upgrade and hand the live WS to {@link bridgeConnection}. */

package/dist/daemon/api/bridge.js

@@ -7,8 +7,9 @@
 // Teardown is idempotent, and each WebSocket owns one `view.sock` connection;
 // the broker fans out to its clients natively.
 //
-// Attach implies revive. Before opening WebSocket, the upgrade handler calls
-// `reviveNode(id, { resume: true })` unless `?revive=0` or
+// Attach implies revive, EXCEPT for an exact parked resident, which only
+// `?wakeParked=1` wakes. Before opening WebSocket, the upgrade handler calls
+// `decideAttachRevive(id, { resume: true }, wakeParked)` unless `?revive=0` or
 // `X-Crtr-Attach-Revive: 0` opts out, then waits for `view.sock` to become
 // listenable. A failed revive or an unready socket refuses the upgrade with 409.
 // With revive opted out, a dormant node also refuses with 409. Pre-upgrade
@@ -16,8 +17,8 @@
 // faults use WebSocket close codes (1008/1009/1011).
 //
 // Once open, the bridge only relays sockets. It never touches SessionManager,
-// spawns `pi --session`, or writes a `.jsonl`; `reviveNode()` is its sole engine
-// launch path. It records a fault only when the broker socket fails.
+// spawns `pi --session`, or writes a `.jsonl`; the revive boundary is its sole
+// engine launch path. It records a fault only when the broker socket fails.
 import { createConnection } from 'node:net';
 import { WebSocketServer } from 'ws';
 import { isSafeNodeId, viewSocketPath } from '../../core/canvas/paths.js';
@@ -25,7 +26,7 @@ import { getNode } from '../../core/canvas/index.js';
 import { BROKER_READ_CAPS, CLIENT_READ_CAPS, FrameDecoder, FrameOverflowError, } from '../../core/runtime/broker-protocol.js';
 import { classify } from '../../core/fault-classifier.js';
 import { clearFault, recordFault } from '../../core/runtime/fault.js';
-import { reviveNode } from '../../core/runtime/revive.js';
+import { decideAttachRevive } from '../../core/runtime/revive.js';
 import { probeViewSocket, waitForBrokerViewSocket } from '../../core/runtime/view-socket.js';
 /** Our own noServer WS server: A-9 routes matched attach upgrades to
  *  {@link handleAttachUpgrade}, which performs the handshake through this. Bounds
@@ -147,6 +148,16 @@ function reviveOptedOut(req) {
     const value = Array.isArray(header) ? header[0] : header;
     return value === '0';
 }
+/** `?wakeParked=1` — this attach is a person deliberately opening a node, so an
+ *  exact parked resident should be woken for it, exactly as the LOCAL attach
+ *  ensure does for a direct attach. crouter's own remote viewer
+ *  (`RelayTransport`) sends it. Without it the caller is a viewport reconnecting
+ *  — a product page re-dialling after its socket dropped — and a parked node
+ *  stays parked. */
+function wakeParkedRequested(req) {
+    const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+    return url.searchParams.get('wakeParked') === '1';
+}
 /** Relay one remote WS ⇄ one node broker `view.sock`. Opens the socket on
  *  connect; forwards each complete frame socket→WS (bounded decode, one WS
  *  message per frame) and re-frames each WS message WS→socket (trailing
@@ -314,9 +325,10 @@ function bridgeConnection(ws, nodeId) {
  *   1. Guard `isSafeNodeId` (→ 400) and existence (→ 404) BEFORE building any
  *      fs path or reviving — an unsafe id must never reach `viewSocketPath`.
  *   2. Unless revive is opted out (`?revive=0` / `X-Crtr-Attach-Revive: 0`):
- *      `reviveNode(id, { resume:true })` then
+ *      `decideAttachRevive(id, { resume:true }, wakeParked)` then
  *      `waitForBrokerViewSocket` (bounded). Revive throw OR socket-not-listenable
- *      → refuse 409, WS never opens.
+ *      → refuse 409, WS never opens. Without `?wakeParked=1` an exact parked
+ *      resident is left parked and refused 409 `node_dormant` — see the call site.
  *   3. Revive opted out: a single connect probe. Dormant (socket refuses) →
  *      refuse 409 (spec §5.3 asymmetry: a dead broker can't stream over WS).
  *   4. Only then upgrade and hand the live WS to {@link bridgeConnection}. */
@@ -363,8 +375,21 @@ export async function handleAttachUpgrade(req, socket, head, nodeId) {
                 // live broker publishes: at the cap, refuse the upgrade with the real
                 // reason instead of freezing and then timing out on a socket that was
                 // never going to appear.
-                const result = reviveNode(nodeId, { resume: true, capacity: 'refuse' });
-                launchExited = result.launch?.exited;
+                //
+                // An unqualified remote attach is a viewport, not a reason to run.
+                // Waking an exact parked resident here restarted its park clock on
+                // every browser reconnect, so a watched conversation churned park →
+                // revive → park. Nothing observes a parked node in the meantime: it has
+                // no engine and appends nothing, so a transcript served from the
+                // offline messages route cannot go stale, and a message sent to the
+                // node still revives it by the ordinary path. A person attaching
+                // deliberately says so with `?wakeParked=1`.
+                const decision = await decideAttachRevive(nodeId, { resume: true, capacity: 'refuse' }, wakeParkedRequested(req));
+                if (decision.parked) {
+                    refuseUpgrade(socket, 409, 'Conflict', 'node_dormant', `node ${nodeId} is parked; attach with ?wakeParked=1 to wake it`);
+                    return;
+                }
+                launchExited = decision.result.launch?.exited;
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);

package/dist/daemon/api/handlers/attach.js

@@ -37,10 +37,10 @@ async function handleAttach(ctx) {
     let resumed = false;
     let parked = false;
     if (revive) {
-        // This decision and reviveNode's fleet guard share one synchronous launch
-        // boundary. Focus may stop at an exact parked resident; ordinary/direct
-        // attach keeps wakeParked=true and preserves attach-implies-revive.
-        const decision = decideAttachRevive(id, { resume, capacity: 'refuse' }, wakeParked);
+        // This decision and reviveNode's fleet claim share one launch boundary.
+        // Focus may stop at an exact parked resident; ordinary/direct attach keeps
+        // wakeParked=true and preserves attach-implies-revive.
+        const decision = await decideAttachRevive(id, { resume, capacity: 'refuse' }, wakeParked);
         parked = decision.parked;
         if (!decision.parked) {
             revived = decision.result.launch !== undefined;

package/dist/daemon/api/handlers/bash-jobs.js

@@ -79,7 +79,7 @@ async function handleStop(ctx) {
     const node = getNode(nodeId);
     if (node !== null && !isBrokerLive(node)) {
         try {
-            reviveNode(nodeId, { resume: true, capacity: 'freeze' });
+            await reviveNode(nodeId, { resume: true, capacity: 'freeze' });
         }
         catch { /* the notice remains durable */ }
     }