@north-light/crouter 0.3.296 → 0.3.297

package/dist/core/runtime/broker/fault-retry.js

@@ -2,7 +2,7 @@ import { realpathSync } from 'node:fs';
 import { envModelIntent, envNodeCwd, envProfileId } from '../../../shared/env.js';
 import { isContextOverflow } from '@earendil-works/pi-ai';
 import { classify } from '../../fault-classifier.js';
-import { admitProviderRetryEpisode, clearFault, clearProviderRetryEpisode, invalidateProviderRetryEpisode, isModelNotFoundError, isProviderUnconfiguredError, readFault, readProviderRetryEpisode, recordFault, recordPendingProviderRetryFault, } from '../fault.js';
+import { admitProviderRetryEpisode, clearFault, clearProviderRetryEpisode, invalidateProviderRetryEpisode, isModelNotFoundError, isProviderUnconfiguredError, readFault, readProviderRetryEpisode, recordFault, recordPendingProviderRetryFault, reopenProviderRetryEpisode, } from '../fault.js';
 import { extractCoolingDeadline } from '../managed-provider-cooling.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../model-routes.js';
 import { operationIdContext } from '../../events/operation-id.js';
@@ -143,13 +143,22 @@ export class FaultRetry {
             recordFault(this.deps.nodeId, faultInput);
         }
     }
-    /** Startup re-drive reads only a durable pending episode. Revive deliberately
-     * clears the ordinary fault marker before this boundary, so the episode is
-     * the recovery authority and admitted/invalidated records remain inert. */
-    recoverPendingOnStartup() {
+    /** Startup re-drive reads the durable episode surviving from the process this
+     *  replaces. Revive deliberately clears the ordinary fault marker before this
+     *  boundary, so the episode is the recovery authority. A `pending` episode
+     *  re-arms unconditionally, exactly as before. An `admitted` episode re-arms
+     *  too, but only under a no-progress proof: reopened to `pending` when the
+     *  branch segment from its anchor to the current leaf carries no assistant
+     *  content and no tool activity — the dead attempt did nothing that rolling
+     *  back would destroy. An anchor absent from the loaded branch cannot happen
+     *  in production (session-file identity and the new-cycle guard already rule
+     *  it out below), so it is treated the same as "no progress" rather than
+     *  blocking the ladder. Returns 'retry-armed' when the timer now owns the
+     *  first turn, 'none' when the caller's default kickoff should proceed. */
+    recoverOnStartup() {
         const generation = this.deps.installedGeneration();
         if (generation === undefined)
-            return;
+            return 'none';
         const episode = readProviderRetryEpisode(this.deps.nodeId);
         const sessionFile = this.sessionFile(generation.session);
         // A new-cycle launch deliberately roots a new transcript branch even though
@@ -160,12 +169,48 @@ export class FaultRetry {
             if (episode !== null && sessionFile !== null && episode.sessionFile === sessionFile) {
                 invalidateProviderRetryEpisode(this.deps.nodeId, sessionFile);
             }
-            return;
+            return 'none';
+        }
+        if (episode === null || sessionFile === null || episode.sessionFile !== sessionFile)
+            return 'none';
+        if (episode.state === 'admitted') {
+            if (episode.anchorEntryId !== null && !this.hasProgressPastAnchor(generation.session, episode.anchorEntryId)) {
+                if (!reopenProviderRetryEpisode(this.deps.nodeId, sessionFile))
+                    return 'none';
+            }
+            else {
+                // Progress detected past the anchor (or no anchor to prove against) — the
+                // dead attempt did real work. Never roll that back; clear the episode and
+                // let the caller's default kickoff continue where it actually got to.
+                clearProviderRetryEpisode(this.deps.nodeId);
+                return 'none';
+            }
+        }
+        else if (episode.state !== 'pending') {
+            return 'none';
         }
-        if (episode === null || sessionFile === null || episode.state !== 'pending' || episode.sessionFile !== sessionFile)
-            return;
         recordFault(this.deps.nodeId, episode.fault);
         this.schedule();
+        return 'retry-armed';
+    }
+    /** True iff the branch segment strictly after `anchorEntryId` (root→leaf,
+     *  anchor exclusive) contains an assistant message with non-empty content or
+     *  a tool result — the two shapes a runtime card and a `content: []`
+     *  error-settled assistant message are not. An anchor missing from the loaded
+     *  branch cannot be distinguished from "no progress" here; callers treat it
+     *  as no progress rather than as a positive finding. */
+    hasProgressPastAnchor(session, anchorEntryId) {
+        const branch = session.sessionManager.getBranch();
+        const anchorIndex = branch.findIndex((entry) => entry.id === anchorEntryId);
+        const segment = anchorIndex === -1 ? branch : branch.slice(anchorIndex + 1);
+        return segment.some((entry) => {
+            if (entry.type !== 'message')
+                return false;
+            const { message } = entry;
+            if (message.role === 'toolResult')
+                return true;
+            return message.role === 'assistant' && Array.isArray(message.content) && message.content.length > 0;
+        });
     }
     schedule() {
         const generation = this.deps.installedGeneration();
@@ -408,7 +453,11 @@ export class FaultRetry {
                 return Promise.resolve();
             }
             recordFault(this.deps.nodeId, plan.fault);
-            const retryCard = formatCard('recovery', {}, fault.kind === 'connection' ? CONNECTION_FAULT_RECOVERY_BODY : PROVIDER_FAULT_RECOVERY_BODY);
+            // The attempt facts are what makes a rolled-back retry legible: every
+            // superseded attempt falls off the active branch, so this one card is the
+            // whole visible record of the sequence, and without them a reader cannot
+            // tell the third attempt from the first.
+            const retryCard = formatCard('recovery', { attempt: plan.attempt, max: plan.max }, fault.kind === 'connection' ? CONNECTION_FAULT_RECOVERY_BODY : PROVIDER_FAULT_RECOVERY_BODY);
             announceMessageOrigin(retryCard, { type: 'runtime', kind: 'recovery' });
             return operationIdContext.fresh(() => candidateSession.prompt(retryCard, { preflightResult: release }));
         });

package/dist/core/runtime/broker.js

@@ -634,13 +634,13 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // post-bind failure is re-recorded by the next failed client op.
         clearFault(nodeId, { link: 'viewer↔broker' });
         clearFault(nodeId, { link: 'relay↔broker' });
-        // The listener is also the broker startup boundary: a pending provider
-        // episode recovered after an instance death is re-armed only once this
+        // The listener is also the broker startup boundary: a pending or
+        // surviving-admitted provider episode is re-armed only once this
         // replacement can accept its normal viewer/daemon traffic. Independent of
         // the link faults cleared above — those are viewer/relay socket markers,
-        // this is the provider retry episode. Admitted and invalidated records are
+        // this is the provider retry episode. An invalidated record is
         // intentionally inert inside FaultRetry.
-        faultRetry.recoverPendingOnStartup();
+        const recovery = faultRetry.recoverOnStartup();
         // A launch prompt delivers only after the listener is accepting, so a
         // root-spawn readiness proof and prompt admission share one boundary. This
         // includes the one continuation carried by a clean runtime-abort resume.
@@ -648,7 +648,17 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // pending in kickoffPending; drivePendingKickoff is a no-op until the
         // reload_auth re-drive resolves a model, at which point it fires. For the
         // common model-present path this fires immediately — unchanged behavior.
-        if (cfg.firstPrompt !== undefined && cfg.firstPrompt !== '') {
+        //
+        // recoverOnStartup returning 'retry-armed' means a resuming, non-cycling
+        // replacement is re-driving a provider-fault recovery card instead — this
+        // can never discard a birth mandate, a wake card, or a revive kickoff,
+        // because every kickoff-composing branch other than the runtime-restart-abort
+        // continuation is either !hasSessionPath or newCycle, both of which
+        // recoverOnStartup already refuses outright by returning 'none' before an
+        // episode can even be considered. So the only prompt this suppression can
+        // ever suppress is that one continuation, and only when the episode proves
+        // the resume made no progress past its anchor.
+        if (recovery !== 'retry-armed' && cfg.firstPrompt !== undefined && cfg.firstPrompt !== '') {
             // The spawner recorded who authored this kickoff (a birth mandate, a
             // cron wake, a revive card); announce it against the exact text so the
             // stamp writer claims it on the message pi persists.

package/dist/core/runtime/fault.d.ts

@@ -36,8 +36,18 @@ export declare function readFault(nodeId: string): Fault | null;
 export declare function readProviderRetryEpisode(nodeId: string): ProviderRetryEpisode | null;
 /** Persist a newly scheduled provider retry before its broker-local timer is armed. */
 export declare function recordPendingProviderRetryEpisode(nodeId: string, episode: Omit<ProviderRetryEpisode, 'state'>): boolean;
-/** Admission is the irreversible boundary: an admitted retry is never replayed. */
+/** Admission is irreversible EXCEPT through a proven no-progress rollback: a
+ *  broker startup that finds no assistant content or tool activity past the
+ *  episode's anchor may reopen it via `reopenProviderRetryEpisode` below. Short
+ *  of that proof, an admitted episode is never replayed. */
 export declare function admitProviderRetryEpisode(nodeId: string, sessionFile: string, fault: Fault): boolean;
+/** Reopens an `admitted` episode to `pending` so a surviving broker startup can
+ *  re-drive it exactly like a never-admitted one. Callable only under the same
+ *  no-progress proof `recoverOnStartup` establishes — the branch segment from
+ *  `anchorEntryId` to the current leaf carries no assistant content and no tool
+ *  activity. Guarded by the same transcript-identity coordinate `admitProviderRetryEpisode`
+ *  uses, so a foreign or already-invalidated episode is never reopened. */
+export declare function reopenProviderRetryEpisode(nodeId: string, sessionFile: string): boolean;
 /** A replacement explicitly invalidates its old transcript's retry episode. */
 export declare function invalidateProviderRetryEpisode(nodeId: string, sessionFile: string): boolean;
 export declare function clearProviderRetryEpisode(nodeId: string): void;

package/dist/core/runtime/fault.js

@@ -279,7 +279,10 @@ export function readProviderRetryEpisode(nodeId) {
 export function recordPendingProviderRetryEpisode(nodeId, episode) {
     return writeProviderRetryEpisode(nodeId, { ...episode, sessionFile: canonicalSessionFile(episode.sessionFile), state: 'pending' });
 }
-/** Admission is the irreversible boundary: an admitted retry is never replayed. */
+/** Admission is irreversible EXCEPT through a proven no-progress rollback: a
+ *  broker startup that finds no assistant content or tool activity past the
+ *  episode's anchor may reopen it via `reopenProviderRetryEpisode` below. Short
+ *  of that proof, an admitted episode is never replayed. */
 export function admitProviderRetryEpisode(nodeId, sessionFile, fault) {
     const current = currentProviderRetryEpisode(nodeId);
     if (current === null ||
@@ -295,6 +298,18 @@ export function admitProviderRetryEpisode(nodeId, sessionFile, fault) {
         fault,
     });
 }
+/** Reopens an `admitted` episode to `pending` so a surviving broker startup can
+ *  re-drive it exactly like a never-admitted one. Callable only under the same
+ *  no-progress proof `recoverOnStartup` establishes — the branch segment from
+ *  `anchorEntryId` to the current leaf carries no assistant content and no tool
+ *  activity. Guarded by the same transcript-identity coordinate `admitProviderRetryEpisode`
+ *  uses, so a foreign or already-invalidated episode is never reopened. */
+export function reopenProviderRetryEpisode(nodeId, sessionFile) {
+    const current = currentProviderRetryEpisode(nodeId);
+    if (current === null || current.state !== 'admitted' || current.sessionFile !== canonicalSessionFile(sessionFile))
+        return false;
+    return writeProviderRetryEpisode(nodeId, { ...current, state: 'pending' });
+}
 /** A replacement explicitly invalidates its old transcript's retry episode. */
 export function invalidateProviderRetryEpisode(nodeId, sessionFile) {
     const current = currentProviderRetryEpisode(nodeId);

package/dist/core/runtime/launch.js

@@ -47,8 +47,8 @@ function ladderFor(provider, ladders = modelLadders()) {
 const MODEL_STRENGTH_RANK = { light: 0, medium: 1, strong: 2, ultra: 3 };
 /** Back-map a concrete model spec to the provider×strength ladder cell it came
  *  from. Two cells may legitimately name the SAME model id at different thinking
- *  levels (the openai ladder's `ultra` and `strong` are both gpt-5.6-sol, at
- *  `max` and `high`), so the thinking level is part of the identity: every cell
+ *  levels (a ladder is free to serve `ultra` and `strong` off one model at `max`
+ *  and `high`), so the thinking level is part of the identity: every cell
  *  is compared WITH its suffix first, and only when nothing matches exactly does
  *  the id-only comparison decide — which keeps a spec whose thinking level has
  *  since drifted (or was never set, as on a launch fallback picked straight off

package/dist/types.js

@@ -173,7 +173,7 @@ export function defaultModelLaddersConfig() {
             light: 'anthropic/claude-haiku-4-5:high',
         },
         openai: {
-            ultra: 'openai-codex/gpt-5.6-sol:max',
+            ultra: 'openai-codex/gpt-6-astra:max',
             strong: 'openai-codex/gpt-5.6-sol:high',
             medium: 'openai-codex/gpt-5.6-terra:medium',
             light: 'openai-codex/gpt-5.6-luna:low',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.296",
+  "version": "0.3.297",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -98,9 +98,9 @@
     "test:all": "npm test && npm run test:integration && npm run test:seam"
   },
   "overrides": {
-    "@earendil-works/pi-ai": "0.84.4",
-    "@earendil-works/pi-agent-core": "0.84.4",
-    "@earendil-works/pi-tui": "0.84.4"
+    "@earendil-works/pi-ai": "0.85.1",
+    "@earendil-works/pi-agent-core": "0.85.1",
+    "@earendil-works/pi-tui": "0.85.1"
   },
   "repository": {
     "type": "git",
@@ -111,10 +111,10 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@earendil-works/pi-agent-core": "0.84.4",
-    "@earendil-works/pi-ai": "0.84.4",
-    "@earendil-works/pi-coding-agent": "0.84.4",
-    "@earendil-works/pi-tui": "0.84.4",
+    "@earendil-works/pi-agent-core": "0.85.1",
+    "@earendil-works/pi-ai": "0.85.1",
+    "@earendil-works/pi-coding-agent": "0.85.1",
+    "@earendil-works/pi-tui": "0.85.1",
     "cron-parser": "^5.6.0",
     "esbuild": "^0.27.7",
     "proper-lockfile": "4.1.2",