@north-light/crouter 0.3.269 → 0.3.271

package/dist/core/runtime/revive.js

@@ -43,6 +43,9 @@ import { rootOfSpine } from './nodes.js';
 import { isReviewCompanionBound } from '../review/companion.js';
 import { assertProfileActive } from '../profiles/manifest.js';
 import { isPidAlive } from '../canvas/pid.js';
+import { crtrHome, contextDir, ensureNodeDirs, jobDir, nodeDir, reportsDir } from '../canvas/paths.js';
+import { discoverLifecycleHookRegistry } from '../command-hooks/discovery.js';
+import { invokeLifecycleHooks } from '../command-hooks/transport/exec-lifecycle.js';
 // resumeArgs — which session source a revive resumes from
 /** Pick the `--session` source for a revive. Both resume=true (a true resume)
  *  and resume=false (a refresh-yield) resume by the absolute session-file path
@@ -140,8 +143,8 @@ export function hasFreshGroundState(nodeId) {
  *  Throws if the node does not exist. All other failures propagate as-is —
  *  callers (daemon, command) decide how to handle.
  */
-export function reviveNode(nodeId, opts) {
-    const decision = decideRevive(nodeId, opts, true);
+export async function reviveNode(nodeId, opts) {
+    const decision = await decideRevive(nodeId, opts, true);
     if (decision.parked)
         throw new Error(`reviveNode: internal parked decision for activating revive ${nodeId}`);
     return decision.result;
@@ -150,10 +153,10 @@ export function reviveNode(nodeId, opts) {
  * to wake an exact parked resident while preserving the ordinary activating
  * attach default. The fleet check and parked decision are synchronous with the
  * launch below, so an already-running broker wins before dormancy is observed. */
-export function decideAttachRevive(nodeId, opts, wakeParked) {
+export async function decideAttachRevive(nodeId, opts, wakeParked) {
     return decideRevive(nodeId, opts, wakeParked);
 }
-function decideRevive(nodeId, opts, wakeParked) {
+async function decideRevive(nodeId, opts, wakeParked) {
     let meta = getNode(nodeId);
     if (meta === null) {
         throw new Error(`reviveNode: unknown node ${nodeId}`);
@@ -169,13 +172,10 @@ function decideRevive(nodeId, opts, wakeParked) {
         throw new Error(`reviveNode: refusing to revive ${nodeId} — its finalization latch is set (final_report=${meta.final_report}). A final landed between the caller's reopen-gate check and this revive; re-run with --reopen if this retask is still wanted.`);
     }
     assertProfileActive(meta.profile_id);
-    // Double-launch guard: a fleet entry IS liveness (design D-1). reviveNode
-    // runs fully SYNCHRONOUSLY on the daemon thread — this check, the launch,
-    // and the fleet registration inside `headlessBrokerHost.launch` complete
-    // with no awaited gap, so no second contender can interleave past this
-    // check before the first's registration lands. A node with a live fleet
-    // entry was already revived by another path — re-launching would put a
-    // SECOND broker on the same session file.
+    // Double-launch guard: a fleet entry IS liveness (design D-1). A lifecycle
+    // hook is awaited before the broker can register, so its reservation also
+    // owns the node while launch is in flight; a second contender must not cross
+    // that awaited gap and start a second broker on the same session file.
     const fleet = boundFleet();
     if (fleet.has(nodeId)) {
         // The node is already running, but the ROW may still say terminal: a reopen
@@ -193,6 +193,17 @@ function decideRevive(nodeId, opts, wakeParked) {
             },
         };
     }
+    if (fleet.isClaimed(nodeId)) {
+        return {
+            parked: false,
+            result: {
+                window: null,
+                session: meta.tmux_session ?? null,
+                resumed: false,
+                outcome: 'already-live',
+            },
+        };
+    }
     // Focus may establish a viewport without establishing an engine. This exact
     // row has no final latch and no fleet owner; returning before reservation is
     // what keeps lifecycle, cycle count, pid, inbox cursor, and session untouched.
@@ -236,7 +247,7 @@ function decideRevive(nodeId, opts, wakeParked) {
         };
     }
     try {
-        return { parked: false, result: launchRevive(nodeId, meta, opts) };
+        return { parked: false, result: await launchRevive(nodeId, meta, opts) };
     }
     finally {
         // The slot is either consumed by the fleet registration inside `launch`
@@ -248,7 +259,7 @@ function decideRevive(nodeId, opts, wakeParked) {
 }
 /** The launch itself, from the cwd preflight through `recordPid`. Split out so
  *  the capacity claim above has exactly one release path around it. */
-function launchRevive(nodeId, meta, opts) {
+async function launchRevive(nodeId, meta, opts) {
     // Preflight, before any state mutation below: a recorded cwd that no longer
     // exists (e.g. a closed managed worktree whose tombstone dir was later
     // reaped) can never host a launch. Fail loud with a typed, user-visible
@@ -267,6 +278,10 @@ function launchRevive(nodeId, meta, opts) {
             next,
         });
     }
+    // This is the same durable distinction used to decide between a birth prompt
+    // and a revive kickoff below. Compute it before launch mutations so a stale
+    // session identity cannot make an ordinary fresh revive look like a birth.
+    const isBirth = isUnstartedBirth(nodeId);
     // Lazy host_kind coerce (§C): every launch now uses the broker host. Persist
     // that identity only after this call has passed the no-op liveness guard.
     if (meta.host_kind !== 'broker') {
@@ -452,6 +467,27 @@ function launchRevive(nodeId, meta, opts) {
     // `crash` transition (a deadline MUST survive instance death).
     if (opts.recovery !== true)
         cancelCronsOnWake(nodeId);
+    ensureNodeDirs(nodeId);
+    const lifecycleHooks = discoverLifecycleHookRegistry(meta.cwd, meta.profile_id).plans.get('node:start') ?? [];
+    await invokeLifecycleHooks(lifecycleHooks, {
+        node: {
+            id: nodeId,
+            name: meta.name,
+            kind: meta.kind,
+            mode: meta.mode,
+            lifecycle: meta.lifecycle,
+            cwd: meta.cwd,
+            nodeDir: nodeDir(nodeId),
+            contextDir: contextDir(nodeId),
+            jobDir: jobDir(nodeId),
+            reportsDir: reportsDir(nodeId),
+        },
+        runtime: {
+            isBirth,
+            canvasHome: crtrHome(),
+            profile: meta.profile_id ?? null,
+        },
+    });
     let launched;
     try {
         launched = headlessBrokerHost.launch(nodeId, inv, {

package/dist/core/runtime/session-visibility.d.ts

@@ -1,30 +1,26 @@
 import type { WireSessionTreeNode } from './broker-protocol.js';
 import type { IdentifiedMessage } from './session-cycles.js';
+import { type MessageVisibility } from './stamp/protocol.js';
 import { REVIEW_BOUNDARY_CUSTOM_TYPE } from '../../shared/generated-context.js';
 export { REVIEW_BOUNDARY_CUSTOM_TYPE };
+export type ProjectedMessage = IdentifiedMessage & {
+    visibility: MessageVisibility;
+};
 /** True when an entry is a durable review boundary, optionally for one review. */
 export declare function isReviewBoundary(entry: unknown, reviewId?: string): boolean;
 /**
- * Project identified snapshot messages to the visible window for a review companion.
+ * Project identified snapshot messages for transcript presentation.
  *
- * A companion passes its binding's review id so the slice starts at ITS OWN
+ * Every retained message carries its durable visibility classification. A
+ * companion then passes its binding's review id so its slice starts at ITS OWN
  * boundary marker: a node forked from another companion inherits that
  * companion's earlier marker, and slicing at the first marker of any review
  * would reveal the origin companion's transcript.
- *
- * Contract (in evaluation order):
- * 1. This binding's marker present (any marker when the node has no binding) →
- *    slice from the **first** occurrence (marker included) to the end.
- *    Everything before the marker is inherited context, hidden from the person.
- * 2. Not a companion (`boundaryReviewId` undefined) → return input unchanged
- *    (same reference). Ordinary nodes are not filtered.
- * 3. Bound but no matching marker → a leading compaction summary is replaced
- *    with a synthetic boundary while its retained tail remains visible. Every
- *    other markerless shape fails closed with the synthetic boundary alone.
  */
-export declare function visibleMessages(messages: IdentifiedMessage[], opts: {
+export declare function projectTranscript(messages: IdentifiedMessage[], opts: {
     boundaryReviewId: string | undefined;
-}): IdentifiedMessage[];
+    sessionEntries?: readonly unknown[];
+}): ProjectedMessage[];
 /**
  * Project a session tree to the review companion's visible transcript boundary.
  *

package/dist/core/runtime/session-visibility.js

@@ -1,14 +1,7 @@
-// session-visibility.ts — transcript boundary projection for review companions.
-//
-// The companion node inherits the origin's full session context but the person
-// must see only the transcript from the moment the review started. A durable
-// marker (the boundary message) is appended to the session before the first
-// human-visible message, and this projection uses it to slice the visible
-// window.
-//
-// Applied at the two BrokerSnapshot.messages producers (live broker and
-// dormant node read) so every presenter — attach, web node viewer, inspect — is
-// boundary-safe by construction with no presenter-side changes.
+// session-visibility.ts — the transcript projection shared by live and dormant
+// reads. Raw session entries remain authoritative; durable stamps and review
+// boundaries select which reconstructed messages a person can see.
+import { readStamps, STAMP_SCHEMA_VERSION, } from './stamp/protocol.js';
 import { REVIEW_BOUNDARY_CUSTOM_TYPE } from '../../shared/generated-context.js';
 export { REVIEW_BOUNDARY_CUSTOM_TYPE };
 /** True when an entry is a durable review boundary, optionally for one review. */
@@ -29,35 +22,55 @@ function syntheticBoundary(timestamp) {
         timestamp: timestamp ?? Date.now(),
     };
 }
+function classifyMessages(messages, sessionEntries) {
+    const internalByTimestamp = new Map();
+    for (const stamp of readStamps(sessionEntries ?? [])) {
+        if (stamp.kind !== 'message' || stamp.v !== STAMP_SCHEMA_VERSION)
+            continue;
+        const payload = stamp.payload;
+        if (typeof payload.msgTs !== 'number')
+            continue;
+        // Last stamp wins, matching every other message-stamp reader.
+        internalByTimestamp.set(payload.msgTs, payload.visibility === 'internal');
+    }
+    let visibility = 'visible';
+    return messages.map((identified) => {
+        const { message } = identified;
+        if (message.role === 'user') {
+            visibility = typeof message.timestamp === 'number'
+                && internalByTimestamp.get(message.timestamp) === true
+                ? 'internal'
+                : 'visible';
+        }
+        return { ...identified, visibility };
+    });
+}
 /**
- * Project identified snapshot messages to the visible window for a review companion.
+ * Project identified snapshot messages for transcript presentation.
  *
- * A companion passes its binding's review id so the slice starts at ITS OWN
+ * Every retained message carries its durable visibility classification. A
+ * companion then passes its binding's review id so its slice starts at ITS OWN
  * boundary marker: a node forked from another companion inherits that
  * companion's earlier marker, and slicing at the first marker of any review
  * would reveal the origin companion's transcript.
- *
- * Contract (in evaluation order):
- * 1. This binding's marker present (any marker when the node has no binding) →
- *    slice from the **first** occurrence (marker included) to the end.
- *    Everything before the marker is inherited context, hidden from the person.
- * 2. Not a companion (`boundaryReviewId` undefined) → return input unchanged
- *    (same reference). Ordinary nodes are not filtered.
- * 3. Bound but no matching marker → a leading compaction summary is replaced
- *    with a synthetic boundary while its retained tail remains visible. Every
- *    other markerless shape fails closed with the synthetic boundary alone.
  */
-export function visibleMessages(messages, opts) {
-    const markerIndex = messages.findIndex(({ message }) => isReviewBoundary(message, opts.boundaryReviewId));
+export function projectTranscript(messages, opts) {
+    const projected = classifyMessages(messages, opts.sessionEntries);
+    const markerIndex = projected.findIndex(({ message }) => isReviewBoundary(message, opts.boundaryReviewId));
     if (markerIndex !== -1)
-        return messages.slice(markerIndex);
+        return projected.slice(markerIndex);
     if (opts.boundaryReviewId === undefined)
-        return messages;
-    const [first, ...retainedTail] = messages;
+        return projected;
+    const [first, ...retainedTail] = projected;
+    const boundary = {
+        id: '~boundary',
+        message: syntheticBoundary(first?.message.timestamp),
+        visibility: 'visible',
+    };
     if (first?.message.role === 'compactionSummary') {
-        return [{ id: '~boundary', message: syntheticBoundary(first.message.timestamp) }, ...retainedTail];
+        return [boundary, ...retainedTail];
     }
-    return [{ id: '~boundary', message: syntheticBoundary(first?.message.timestamp) }];
+    return [boundary];
 }
 /**
  * Project a session tree to the review companion's visible transcript boundary.

package/dist/core/runtime/stamp/channel.d.ts

@@ -1,13 +1,17 @@
-import type { MessageOrigin } from './protocol.js';
+import type { MessageOrigin, MessageVisibility } from './protocol.js';
+export interface MessageAnnouncement {
+    origin: MessageOrigin;
+    visibility?: MessageVisibility;
+}
 /** The correlation key for one message body. Announcers pass the text they are
  *  about to send; the writer passes the text pi persisted. */
 export declare function messageSignature(text: string): string;
-/** Announce the origin of the user message `text` that is about to be sent.
- *  Call immediately before the send. */
-export declare function announceMessageOrigin(text: string, origin: MessageOrigin): void;
-/** Take the announced origin for a persisted message body, or null when no
+/** Announce the origin and visibility of the user message `text` that is about
+ *  to be sent. Every ordinary announcement promotes the run to visible. */
+export declare function announceMessageOrigin(text: string, origin: MessageOrigin, visibility?: MessageVisibility): void;
+/** Take the announced metadata for a persisted message body, or null when no
  *  seam announced this message. */
-export declare function claimMessageOrigin(text: string): MessageOrigin | null;
+export declare function claimMessageAnnouncement(text: string): MessageAnnouncement | null;
 /** Contribute namespaced fields to the next stamp the writer emits. Unknown
  *  namespaces pass through untouched; the core writer never interprets them. */
 export declare function contributeStampExt(namespace: string, fields: Record<string, unknown>): void;

package/dist/core/runtime/stamp/channel.js

@@ -14,6 +14,7 @@
 // (a delivery the engine refused) therefore cannot leak its origin onto a later
 // message; it simply ages out of the bounded queue.
 import { createHash } from 'node:crypto';
+import { setTurnVisibility } from '../turn-visibility.js';
 const STAMP_CHANNEL = Symbol.for('@crouton-kit/crtr:stamp-channel');
 /** Unclaimed announcements held at once. The queue is a correlation buffer, not
  *  a work queue: one pending announcement is the normal state. */
@@ -32,24 +33,32 @@ function channel() {
 export function messageSignature(text) {
     return createHash('sha1').update(text.trim()).digest('hex');
 }
-/** Announce the origin of the user message `text` that is about to be sent.
- *  Call immediately before the send. */
-export function announceMessageOrigin(text, origin) {
+/** Announce the origin and visibility of the user message `text` that is about
+ *  to be sent. Every ordinary announcement promotes the run to visible. */
+export function announceMessageOrigin(text, origin, visibility) {
+    setTurnVisibility(visibility ?? 'visible');
     const state = channel();
-    state.announcements.push({ signature: messageSignature(text), origin });
+    state.announcements.push({
+        signature: messageSignature(text),
+        origin,
+        ...(visibility === undefined ? {} : { visibility }),
+    });
     while (state.announcements.length > MAX_PENDING)
         state.announcements.shift();
 }
-/** Take the announced origin for a persisted message body, or null when no
+/** Take the announced metadata for a persisted message body, or null when no
  *  seam announced this message. */
-export function claimMessageOrigin(text) {
+export function claimMessageAnnouncement(text) {
     const state = channel();
     const signature = messageSignature(text);
     const index = state.announcements.findIndex((entry) => entry.signature === signature);
     if (index < 0)
         return null;
     const [claimed] = state.announcements.splice(index, 1);
-    return claimed.origin;
+    return {
+        origin: claimed.origin,
+        ...(claimed.visibility === undefined ? {} : { visibility: claimed.visibility }),
+    };
 }
 /** Contribute namespaced fields to the next stamp the writer emits. Unknown
  *  namespaces pass through untouched; the core writer never interprets them. */

package/dist/core/runtime/stamp/protocol.d.ts

@@ -52,12 +52,16 @@ export interface RuntimeOrigin {
     [field: string]: unknown;
 }
 export type MessageOrigin = HumanOrigin | RuntimeOrigin;
+export type MessageVisibility = 'visible' | 'internal';
 export interface MessageStampPayload {
     /** The target message's own `timestamp` (unix ms) — the join key. */
     msgTs: number;
     /** Absent means the message arrived with no announced origin (unknown),
      *  never a guess. */
     origin?: MessageOrigin;
+    /** Absent means visible. Internal messages remain in the raw session and
+     *  carry their classification through transcript projections. */
+    visibility?: MessageVisibility;
 }
 export type SessionStamp = StampEnvelope<'session', SessionStampPayload>;
 export type MessageStamp = StampEnvelope<'message', MessageStampPayload>;

package/dist/core/runtime/turn-visibility.d.ts

@@ -0,0 +1,10 @@
+import type { MessageVisibility } from './stamp/protocol.js';
+export type TurnVisibility = MessageVisibility;
+/** The presentation classification of the current agent run. */
+export declare function currentTurnVisibility(): TurnVisibility;
+/** Whether the current agent run is structurally internal to crouter. */
+export declare function isTurnInternal(): boolean;
+/** Set visibility before handing an admitted input to pi. */
+export declare function setTurnVisibility(visibility: TurnVisibility): void;
+/** Return to the fail-open state after the complete agent run settles. */
+export declare function clearTurnVisibility(): void;

package/dist/core/runtime/turn-visibility.js

@@ -0,0 +1,31 @@
+// Process-global visibility for the agent run currently owned by the broker.
+//
+// The broker is native ESM while guest and crouter pi extensions are Jiti-loaded,
+// so ordinary module state splits at the loader boundary. A registered symbol
+// keeps crouter's decision visible to every in-process extension.
+const TURN_VISIBILITY = Symbol.for('@crouton-kit/crtr:turn-visibility');
+function state() {
+    const host = globalThis;
+    const existing = host[TURN_VISIBILITY];
+    if (existing !== undefined)
+        return existing;
+    const created = { value: 'visible' };
+    host[TURN_VISIBILITY] = created;
+    return created;
+}
+/** The presentation classification of the current agent run. */
+export function currentTurnVisibility() {
+    return state().value;
+}
+/** Whether the current agent run is structurally internal to crouter. */
+export function isTurnInternal() {
+    return currentTurnVisibility() === 'internal';
+}
+/** Set visibility before handing an admitted input to pi. */
+export function setTurnVisibility(visibility) {
+    state().value = visibility;
+}
+/** Return to the fail-open state after the complete agent run settles. */
+export function clearTurnVisibility() {
+    state().value = 'visible';
+}

package/dist/daemon/api/__tests__/profile-launch-gates.test.js

@@ -62,7 +62,7 @@ test('create rejects a paused profile before a node exists', async () => {
     });
     assert.equal(listNodes().length, beforeRows);
 });
-test('revive refuses a paused profile before launching a broker', () => {
+test('revive refuses a paused profile before launching a broker', async () => {
     const profile = createProfile('paused revive', [{ path: cwd, memory: 'content' }]);
     pauseProfile(profile.profileId);
     const nodeId = 'paused-revive-node';
@@ -78,7 +78,7 @@ test('revive refuses a paused profile before launching a broker', () => {
         parent: null,
         profile_id: profile.profileId,
     });
-    assert.throws(() => reviveNode(nodeId, { resume: true, capacity: 'freeze' }), (error) => {
+    await assert.rejects(reviveNode(nodeId, { resume: true, capacity: 'freeze' }), (error) => {
         assert.ok(error instanceof CrtrError);
         assert.equal(error.code, 'usage');
         assert.match(error.details?.['next'], new RegExp(`crtr profile resume ${profile.profileId}`));

package/dist/daemon/api/bridge.js

@@ -384,7 +384,7 @@ export async function handleAttachUpgrade(req, socket, head, nodeId) {
                 // offline messages route cannot go stale, and a message sent to the
                 // node still revives it by the ordinary path. A person attaching
                 // deliberately says so with `?wakeParked=1`.
-                const decision = decideAttachRevive(nodeId, { resume: true, capacity: 'refuse' }, wakeParkedRequested(req));
+                const decision = await decideAttachRevive(nodeId, { resume: true, capacity: 'refuse' }, wakeParkedRequested(req));
                 if (decision.parked) {
                     refuseUpgrade(socket, 409, 'Conflict', 'node_dormant', `node ${nodeId} is parked; attach with ?wakeParked=1 to wake it`);
                     return;

package/dist/daemon/api/handlers/attach.js

@@ -37,10 +37,10 @@ async function handleAttach(ctx) {
     let resumed = false;
     let parked = false;
     if (revive) {
-        // This decision and reviveNode's fleet guard share one synchronous launch
-        // boundary. Focus may stop at an exact parked resident; ordinary/direct
-        // attach keeps wakeParked=true and preserves attach-implies-revive.
-        const decision = decideAttachRevive(id, { resume, capacity: 'refuse' }, wakeParked);
+        // This decision and reviveNode's fleet claim share one launch boundary.
+        // Focus may stop at an exact parked resident; ordinary/direct attach keeps
+        // wakeParked=true and preserves attach-implies-revive.
+        const decision = await decideAttachRevive(id, { resume, capacity: 'refuse' }, wakeParked);
         parked = decision.parked;
         if (!decision.parked) {
             revived = decision.result.launch !== undefined;

package/dist/daemon/api/handlers/bash-jobs.js

@@ -79,7 +79,7 @@ async function handleStop(ctx) {
     const node = getNode(nodeId);
     if (node !== null && !isBrokerLive(node)) {
         try {
-            reviveNode(nodeId, { resume: true, capacity: 'freeze' });
+            await reviveNode(nodeId, { resume: true, capacity: 'freeze' });
         }
         catch { /* the notice remains durable */ }
     }

package/dist/daemon/api/handlers/messages.js

@@ -224,7 +224,7 @@ async function handleMessage(ctx) {
             commitReopen(id, expectedFinalReport);
         // A fresh revive appends no inbox entry, so nothing survives a freeze for
         // the daemon to act on later: at the cap the caller is told, not ignored.
-        const result = reviveNode(id, { resume: false, capacity: 'refuse' });
+        const result = await reviveNode(id, { resume: false, capacity: 'refuse' });
         const body = {
             node_id: id,
             delivered: false,
@@ -351,7 +351,7 @@ async function handleMessage(ctx) {
             // The entry is already durable, so a wake denied for capacity is only
             // delayed: the row freezes and the tick relaunches it — at which point
             // the inbox watcher delivers this entry as it always would.
-            const result = reviveNode(id, { resume: true, capacity: 'freeze' });
+            const result = await reviveNode(id, { resume: true, capacity: 'freeze' });
             revived = result.launch !== undefined;
             frozen = result.outcome === 'frozen';
         }

package/dist/daemon/api/handlers/nodes.js

@@ -374,6 +374,8 @@ async function handleSnapshot(ctx) {
         snapshot: {
             messages: read.snapshot.messages,
             ...(read.snapshot.messageIds === undefined ? {} : { messageIds: read.snapshot.messageIds }),
+            messageVisibility: read.snapshot.messageVisibility,
+            turnVisibility: read.snapshot.turnVisibility,
             stats: read.snapshot.stats,
             state: read.snapshot.state,
             display: read.snapshot.display,
@@ -423,6 +425,7 @@ async function handleMessages(ctx) {
         node_id: id,
         messages: read.messages,
         ...(read.messageIds === undefined ? {} : { message_ids: read.messageIds }),
+        message_visibility: read.messageVisibility,
         next_cursor: read.nextCursor,
         captured_at: nowIso(),
     };
@@ -491,7 +494,7 @@ async function handleFork(ctx) {
     const result = await forkNode(id);
     return { status: 201, body: detailOf(result.node.node_id) };
 }
-function handleRevive(ctx) {
+async function handleRevive(ctx) {
     const id = ctx.params['id'];
     requireMeta(id);
     const body = ctx.body;
@@ -507,7 +510,7 @@ function handleRevive(ctx) {
     // rather than a message. A cron id that no longer resolves (canceled or
     // consumed mid-run) simply yields no block — prose, never an error.
     const cron = !resume && body?.cron_id !== undefined ? getCron(body.cron_id) : null;
-    const result = reviveNode(id, {
+    const result = await reviveNode(id, {
         resume,
         // An explicit revive is a caller asking for this node NOW; at the cap it
         // gets the refusal naming it rather than a silent nothing-happened.
@@ -629,8 +632,8 @@ function handleWait(ctx) {
     setMessageWait(id, req.controller);
     return { status: 200, body: detailOf(id) };
 }
-function handleReviveAll() {
-    const result = reviveAll();
+async function handleReviveAll() {
+    const result = await reviveAll();
     const body = {
         revived: [...result.revived],
         failed: [...result.failed],

package/dist/daemon/cron/sinks.js

@@ -15,7 +15,7 @@ import { spawnChild } from '../../core/runtime/spawn.js';
 import { cronWakeOrigin } from '../../core/runtime/bearings.js';
 import { parseSink } from '../cron-sink.js';
 import { resolveLiveProfile, resolveLiveProfileName } from './armed-context.js';
-function deliverNodeSink(c, target, stdout) {
+async function deliverNodeSink(c, target, stdout) {
     const meta = getNode(target);
     if (meta === null)
         throw new Error(`node sink ${target} is gone`);
@@ -38,7 +38,7 @@ function deliverNodeSink(c, target, stdout) {
     // The durable append succeeds even if its best-effort wake fails.
     if (entry.tier !== 'deferred' && !isBrokerLive(meta)) {
         try {
-            reviveNode(target, { resume: true, capacity: 'freeze' });
+            await reviveNode(target, { resume: true, capacity: 'freeze' });
         }
         catch {
             /* best-effort wake — the entry is durably appended regardless */
@@ -93,7 +93,7 @@ export async function deliverToSink(c, stdout) {
     if (sink === null)
         return 'no sink armed — nothing delivered';
     if (sink.kind === 'node') {
-        deliverNodeSink(c, sink.node, stdout);
+        await deliverNodeSink(c, sink.node, stdout);
         return `delivered: node ${sink.node}`;
     }
     if (sink.kind === 'spawn') {

package/dist/daemon/fleet.js

@@ -122,10 +122,7 @@ export class DaemonFleet {
     #enqueue;
     #now;
     #map = new Map();
-    /** Slots claimed but not yet held by a registered broker: a launch in flight,
-     *  or a broker that exited and whose exit-policy job has not yet decided
-     *  whether to relaunch it. Counting both against the cap is what keeps a
-     *  1:1 respawn from losing its own slot to a concurrent launcher. */
+    /** Slots claimed by launches that have not registered a broker yet. */
     #reservations = new Set();
     #lastCapacityLogAt = Number.NEGATIVE_INFINITY;
     constructor(opts) {
@@ -191,13 +188,15 @@ export class DaemonFleet {
         this.#reservations.delete(nodeId);
     }
     onChildExit(nodeId, status) {
-        // Move the slot from the registry to a reservation in ONE synchronous
-        // step: the exit-policy job about to be enqueued may relaunch this node,
-        // and holding the slot through the exit observation prevents a concurrent
-        // launch from entering before the registry reflects the exit.
+        // The real child exit is the liveness boundary. Its queued observation only
+        // records diagnostics, so it cannot retain capacity after the process is
+        // gone and make an explicit replacement look already live.
+        const meta = getNode(nodeId);
+        const launchedMs = meta?.launched_at == null ? Number.NaN : Date.parse(meta.launched_at);
+        const uptimeMs = Number.isFinite(launchedMs) ? Math.max(0, this.#now() - launchedMs) : null;
+        const consecutiveFailures = meta?.respawn_failures ?? 0;
         this.#map.delete(nodeId);
-        this.#reservations.add(nodeId);
-        this.#enqueue(() => this.#runExitPolicy(nodeId, status));
+        this.#enqueue(() => this.#emitExitObserved(nodeId, status, uptimeMs, consecutiveFailures));
     }
     deliverExit(nodeId, status) {
         this.onChildExit(nodeId, status);
@@ -223,17 +222,6 @@ export class DaemonFleet {
         return true;
     }
     dispose() { }
-    async #runExitPolicy(nodeId, status) {
-        try {
-            const launchedAt = getNode(nodeId)?.launched_at;
-            const launchedMs = launchedAt == null ? Number.NaN : Date.parse(launchedAt);
-            const uptimeMs = Number.isFinite(launchedMs) ? Math.max(0, this.#now() - launchedMs) : null;
-            this.#emitExitObserved(nodeId, status, uptimeMs, getNode(nodeId)?.respawn_failures ?? 0);
-        }
-        finally {
-            this.releaseReservation(nodeId);
-        }
-    }
     #emitExitObserved(nodeId, status, uptimeMs, consecutiveFailures) {
         emitEvent({
             level: 'info',
@@ -343,7 +331,7 @@ export class DaemonFleet {
             },
         });
         try {
-            reviveNode(nodeId, {
+            await reviveNode(nodeId, {
                 // A recovery that loses the race for the last slot freezes and waits
                 // for one — the tick thaws it — rather than erroring the node away.
                 capacity: 'freeze',

package/dist/daemon/messaging/node-message.js

@@ -87,7 +87,7 @@ export async function deliverNodeMessage(args) {
             try {
                 // Mail is durable, so a wake denied for capacity waits for a slot
                 // rather than being lost: the row freezes and the tick relaunches it.
-                const result = reviveNode(args.node_id, { resume: true, capacity: 'freeze' });
+                const result = await reviveNode(args.node_id, { resume: true, capacity: 'freeze' });
                 revived = result.launch !== undefined;
                 if (result.outcome === 'frozen')
                     reason = 'capacity_frozen';

package/dist/daemon/profile-delete.js

@@ -216,7 +216,7 @@ async function detachProfile(plan) {
     const detached = new Set(detachedNodeIds);
     for (const nodeId of restartNodeIds) {
         if (detached.has(nodeId))
-            reviveNode(nodeId, { resume: true, recovery: true, capacity: 'freeze' });
+            await reviveNode(nodeId, { resume: true, recovery: true, capacity: 'freeze' });
     }
     return {
         ...resultForPlan(plan),