@north-light/crouter 0.3.308 → 0.3.310

package/dist/core/worktree.js

@@ -3,7 +3,6 @@ import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { gitAsync, gitSync } from './git.js';
 import { crtrHome } from './canvas/paths.js';
-import { isPidAlive } from './canvas/pid.js';
 import { getNode, updateNode } from './canvas/index.js';
 import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
@@ -658,118 +657,6 @@ export function closeManagedWorktree(nodeId) {
     // the child checkout instead of the parent that created it.
     return withRepositoryWorktreeLock(existsSync(wt.path) ? wt.path : wt.repo_root, () => closeManagedWorktreeLocked(nodeId));
 }
-const ABANDON_AUTHOR_NAME = 'crtr-abandon';
-const ABANDON_AUTHOR_EMAIL = 'crtr-abandon@localhost';
-const ABANDON_SUBJECT = 'crtr-abandon';
-function persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by, branch = wt.branch) {
-    updateNode(nodeId, {
-        cwd: wt.repo_root,
-        managed_worktree: {
-            ...wt,
-            state: 'abandoned',
-            abandoned: { branch, tip_sha: tipSha, at, by },
-        },
-    });
-}
-/** The disposal path for `abandon` when the recorded `crtr/*` branch is gone:
- *  ordinary PR work moved this checkout onto a real branch. Abandon never
- *  lands that branch and — unlike the ordinary path above — never invents a
- *  commit on it: a synthetic `crtr-abandon` marker on someone's real PR
- *  branch is not a trade this code may make on their behalf. So this
- *  requires the checkout already clean and not mid-operation, then removes
- *  only the checkout and preserves the actual branch and its commits exactly
- *  as they stand. The caller already confirmed the node is not running. */
-function abandonBranchMovedWorktree(nodeId, wt, actualBranch, by) {
-    if (isRebaseInProgress(wt.path)) {
-        throw new WorktreeError('rebase_in_progress', 'this managed worktree is mid-rebase', `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree abandon\`.`);
-    }
-    const dirty = statusPorcelain(wt.path);
-    if (dirty !== '') {
-        throw new WorktreeError('dirty_worktree', 'managed worktree has uncommitted changes', `The recorded branch ${wt.branch} no longer exists; its checkout is now on ${actualBranch} with uncommitted changes crtr will not commit on your behalf. Commit or stash them in ${wt.path}, then rerun \`crtr node worktree abandon\`.`);
-    }
-    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true) {
-        throw new WorktreeError('wrong_branch', `managed worktree's recorded branch ${wt.branch} no longer exists, and its checkout at ${wt.path} is not registered to ${actualBranch} either`, `Inspect ${wt.path} and its git worktree registration, then ask the user with \`crtr human send\` if you are unsure how to proceed.`);
-    }
-    const actualSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'abandon_tip_failed', 'Inspect the worktree manually, then retry.');
-    // Recheck identity immediately before the destructive step.
-    if (registeredWorktree(wt.repo_root, wt.path, actualBranch) !== true || currentBranch(wt.path) !== actualBranch) {
-        throw new WorktreeError('wrong_branch', `managed worktree at ${wt.path} changed while abandoning`, `Inspect ${wt.path}, then rerun \`crtr node worktree abandon\`.`);
-    }
-    runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
-    const at = new Date().toISOString();
-    persistAbandonedWorktreeState(nodeId, wt, actualSha, at, by, actualBranch);
-    return { node_id: nodeId, branch: actualBranch, tip_sha: actualSha, worktree_path: wt.path, branch_deleted: false };
-}
-function createAbandonMarker(wt, parentSha, nodeId, at) {
-    const treeSha = runGit(wt.repo_root, ['rev-parse', `${parentSha}^{tree}`], 'abandon_tree_failed', 'Inspect the branch manually, then retry.');
-    const markerSha = runGit(wt.repo_root, ['-c', `user.name=${ABANDON_AUTHOR_NAME}`, '-c', `user.email=${ABANDON_AUTHOR_EMAIL}`, 'commit-tree', treeSha, '-p', parentSha, '-m', ABANDON_SUBJECT, '-m', `Crtr-Abandon: ${nodeId} ${at}`], 'abandon_commit_failed', 'Inspect the branch manually, then retry.');
-    runGit(wt.repo_root, ['update-ref', `refs/heads/${wt.branch}`, markerSha, parentSha], 'abandon_marker_failed', 'The branch changed while abandon was starting; inspect the worktree, then retry.');
-    return markerSha;
-}
-function abandonManagedWorktreeLocked(nodeId, by) {
-    const node = getNode(nodeId);
-    if (node === null) {
-        throw new WorktreeError('unknown_node', `unknown node: ${nodeId}`, 'Pass a real node id.');
-    }
-    const wt = openManagedWorktreeForNode(nodeId);
-    if (wt === null) {
-        const { message, next } = noManagedWorktreeMessage(nodeId, 'abandon');
-        throw new WorktreeError('no_managed_worktree', message, next);
-    }
-    if (node.status === 'active' || node.status === 'idle' || isPidAlive(node.pi_pid)) {
-        throw new WorktreeError('node_running', `node ${nodeId} is still running`, 'Stop the node before abandoning its managed worktree.');
-    }
-    if (!existsSync(wt.path)) {
-        throw new WorktreeError('worktree_missing', `managed worktree path is missing: ${wt.path}`, missingWorktreeRecoveryHint(wt));
-    }
-    const actualBranch = currentBranch(wt.path);
-    if (actualBranch !== wt.branch) {
-        const recordedRefExists = recordedBranchExists(wt.path, wt.branch);
-        if (recordedRefExists || actualBranch === 'HEAD') {
-            throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}${actualBranch === 'HEAD' ? ', found detached HEAD' : ''})`, recordedRefExists
-                ? `Check out ${wt.branch} in ${wt.path}, then rerun \`crtr node worktree abandon\`.`
-                : `The recorded branch ${wt.branch} no longer exists, and ${wt.path} is in detached HEAD, so there is no branch to preserve. Check out or create a branch there, then rerun \`crtr node worktree abandon\`.`);
-        }
-        // The recorded crtr/* branch is gone: ordinary PR work moved this checkout
-        // onto a real branch.
-        return abandonBranchMovedWorktree(nodeId, wt, actualBranch, by);
-    }
-    const at = new Date().toISOString();
-    const clean = proveCleanEmptyManagedWorktree(wt);
-    if (clean !== null && clean.branchSha === wt.base_sha) {
-        const markerSha = createAbandonMarker(wt, clean.branchSha, nodeId, at);
-        runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
-        const deleted = bestEffortDeleteBranchWithContainmentProof(wt, markerSha, `refs/heads/${wt.base_ref}`, clean.baseSha);
-        if (deleted.branchDeleted) {
-            persistClosedWorktreeState(nodeId, wt, 'complete');
-            return { node_id: nodeId, branch: wt.branch, tip_sha: markerSha, worktree_path: wt.path, branch_deleted: true };
-        }
-        const tipSha = runGit(wt.repo_root, ['rev-parse', `refs/heads/${wt.branch}`], 'abandon_tip_failed', 'Inspect the branch manually, then retry.');
-        persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by);
-        return { node_id: nodeId, branch: wt.branch, tip_sha: tipSha, worktree_path: wt.path, branch_deleted: false };
-    }
-    // A clean branch with committed work already has its complete history. The
-    // abandon record supplies the disposition; an empty provenance commit would
-    // only move the local branch away from an already-pushed tip.
-    if (!isRebaseInProgress(wt.path) && statusPorcelain(wt.path) === '') {
-        runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
-        const tipSha = runGit(wt.repo_root, ['rev-parse', `refs/heads/${wt.branch}`], 'abandon_tip_failed', 'Inspect the branch manually, then retry.');
-        persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by);
-        return { node_id: nodeId, branch: wt.branch, tip_sha: tipSha, worktree_path: wt.path, branch_deleted: false };
-    }
-    runGit(wt.path, ['add', '--all'], 'abandon_stage_failed', 'Inspect the worktree manually, then retry.');
-    runGit(wt.path, ['-c', `user.name=${ABANDON_AUTHOR_NAME}`, '-c', `user.email=${ABANDON_AUTHOR_EMAIL}`, 'commit', '--allow-empty', '-m', ABANDON_SUBJECT, '-m', `Crtr-Abandon: ${nodeId} ${at}`], 'abandon_commit_failed', 'Inspect the worktree manually, then retry.');
-    runGit(wt.repo_root, ['worktree', 'remove', wt.path], 'worktree_remove_failed', 'Inspect the worktree manually, then retry.');
-    const tipSha = runGit(wt.repo_root, ['rev-parse', `refs/heads/${wt.branch}`], 'abandon_tip_failed', 'Inspect the branch manually, then retry.');
-    persistAbandonedWorktreeState(nodeId, wt, tipSha, at, by);
-    return { node_id: nodeId, branch: wt.branch, tip_sha: tipSha, worktree_path: wt.path, branch_deleted: false };
-}
-export function abandonManagedWorktree(nodeId, by) {
-    const wt = openManagedWorktreeForNode(nodeId);
-    if (wt === null)
-        return abandonManagedWorktreeLocked(nodeId, by);
-    return withRepositoryWorktreeLock(wt.repo_root, () => abandonManagedWorktreeLocked(nodeId, by));
-}
 // Push-final auto-drop of a clean, zero-commit managed worktree
 /** Delete a source branch only while the ref that proved it already delivered
  *  is still at the exact inspected SHA. `containingRef` can be the recorded

package/dist/daemon/api/handlers/canvas.js

@@ -261,7 +261,7 @@ function handleHistoryRead(ctx) {
     if (!ref.includes(':')) {
         throw usage(`ref must be <node-id>:<relpath>; received: ${ref}`, {
             received: ref,
-            next: 'Get a valid ref from `canvas history search` or `node inspect artifacts <node-id>`.',
+            next: 'Get a valid ref from `crtr canvas history search` or `crtr node inspect artifacts <node-id>`.',
         });
     }
     let resolved;
@@ -271,13 +271,13 @@ function handleHistoryRead(ctx) {
     catch (e) {
         throw usage(`ref rejected: ${e.message}`, {
             received: ref,
-            next: 'Refs come verbatim from `canvas history search`; do not hand-construct relpaths.',
+            next: 'Refs come verbatim from `crtr canvas history search`; do not hand-construct relpaths.',
         });
     }
     if (resolved === null) {
         throw notFound(`no artifact for ref: ${ref}`, {
             ref,
-            next: 'The node or file may not exist. Re-run `canvas history search` for a current ref, or `node inspect artifacts <node-id>` to list a node\'s artifacts.',
+            next: 'The node or file may not exist. Re-run `crtr canvas history search` for a current ref, or `crtr node inspect artifacts <node-id>` to list a node\'s artifacts.',
         });
     }
     const source = resolved.source === 'report' && resolved.reportKind ? `report:${resolved.reportKind}` : resolved.source;

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -11,6 +11,14 @@ export interface BrokerSupervisionContext {
     fleet: FleetRegistry;
     lifecycle: DetachedWorkLifecycle;
 }
+type TreeSample = {
+    cpuPercent: number;
+    hasDescendants: boolean;
+} | null;
+export interface BrokerSupervisionOptions {
+    readTreeSample?: (pid: number) => Promise<TreeSample>;
+    signal?: (pid: number, signal: NodeJS.Signals) => void;
+}
 export interface SaturationContext {
     fleet: FleetRegistry;
     lifecycle: DetachedWorkLifecycle;
@@ -41,13 +49,15 @@ export declare function wedgeVerdict(input: {
 export declare function sumTreeCpu(psOutput: string, rootPid: number): number | null;
 export declare function treeHasDescendants(psOutput: string, rootPid: number): boolean | null;
 export declare class BrokerSupervisionReconciler {
-    private readonly yieldStallSince;
-    private readonly yieldTermAt;
+    private readonly yieldStalls;
     private readonly wedgeNotifiedAt;
     private readonly fatalFaultNotifiedAt;
     private readonly unattendedSince;
+    private readonly sampleTree;
+    private readonly signal;
     private knownAuthMtimeMs;
     private lastOverCapWarnAt;
+    constructor(options?: BrokerSupervisionOptions);
     /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth
      *  reload does not depend on a successful canvas scan, and the thresholds it
      *  returns are read once for the whole tick. */
@@ -70,8 +80,10 @@ export declare class BrokerSupervisionReconciler {
     private requestParkSummary;
     private warnOverCapInTmux;
     private handleYieldStall;
+    private signalYieldStall;
     private readTreeSample;
     private handleWedgeDetection;
     private handleFatalFault;
     private handleAuthReload;
 }
+export {};

package/dist/daemon/reconcilers/broker-supervision.js

@@ -30,6 +30,16 @@ import { shouldParkAfterSummary } from '../park-activity.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
 import { envNoDaemonAutostart, envTestUnattendedParkMs, parkSummaryGraceMs, envUnattendedParkMs, } from '../../shared/env.js';
 const execFileAsync = promisify(execFile);
+function incarnationOf(pid, identity) {
+    return identity === null ? null : `${pid}:${identity}`;
+}
+function busySinceForIncarnation(row) {
+    const since = busySince(row.node_id);
+    const launchedAt = row.launched_at === null || row.launched_at === undefined ? Number.NaN : Date.parse(row.launched_at);
+    if (since === null || !Number.isFinite(launchedAt) || since < launchedAt)
+        return null;
+    return since;
+}
 export const YIELD_STALL_GRACE_MS = 3 * 60_000;
 const KILL_ESCALATE_MS = 20_000;
 export const WEDGE_QUIET_MS = 20 * 60_000;
@@ -131,13 +141,18 @@ function piCredentialPaths() {
     ];
 }
 export class BrokerSupervisionReconciler {
-    yieldStallSince = new Map();
-    yieldTermAt = new Map();
+    yieldStalls = new Map();
     wedgeNotifiedAt = new Map();
     fatalFaultNotifiedAt = new Map();
     unattendedSince = new Map();
+    sampleTree;
+    signal;
     knownAuthMtimeMs = null;
     lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
+    constructor(options = {}) {
+        this.sampleTree = options.readTreeSample ?? ((pid) => this.readTreeSample(pid));
+        this.signal = options.signal ?? ((pid, signal) => process.kill(pid, signal));
+    }
     /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth
      *  reload does not depend on a successful canvas scan, and the thresholds it
      *  returns are read once for the whole tick. */
@@ -168,8 +183,8 @@ export class BrokerSupervisionReconciler {
             }
             await operationIdContext.fresh(async () => {
                 try {
-                    this.handleYieldStall(row, entry.pid, now);
-                    await this.handleWedgeDetection(id, entry.pid, row.pi_pid_identity, now);
+                    this.handleYieldStall(row, entry, ctx.fleet, now);
+                    await this.handleWedgeDetection(row, entry, ctx.fleet, now);
                     this.handleFatalFault(id);
                     this.handleUnattendedParking(id, getNode(id), entry.pid, now, ctx, unattendedParkMs);
                 }
@@ -391,62 +406,74 @@ export class BrokerSupervisionReconciler {
             emitEvent({ level: 'error', event: 'broker.capacity.tmux_list_clients_failed', error: err });
         }
     }
-    handleYieldStall(row, pid, now) {
+    handleYieldStall(row, entry, fleet, now) {
         const id = row.node_id;
-        if (row.intent !== 'refresh' || isBusy(id)) {
-            this.yieldStallSince.delete(id);
-            this.yieldTermAt.delete(id);
+        const incarnation = incarnationOf(entry.pid, row.pi_pid_identity);
+        if (row.intent !== 'refresh' || busySinceForIncarnation(row) !== null || incarnation === null) {
+            if (incarnation !== null)
+                this.yieldStalls.delete(incarnation);
             return;
         }
-        const since = this.yieldStallSince.get(id);
-        if (since === undefined) {
-            this.yieldStallSince.set(id, now);
+        let state = this.yieldStalls.get(incarnation);
+        if (state === undefined) {
+            state = { since: now };
+            this.yieldStalls.set(incarnation, state);
             return;
         }
-        if (yieldStallVerdict(true, row.intent, false, now - since) !== 'kill')
+        if (yieldStallVerdict(true, row.intent, false, now - state.since) !== 'kill')
             return;
-        if (row.pi_pid_identity == null || recordedPidLiveness(pid, row.pi_pid_identity) !== 'alive')
+        const current = getNode(id);
+        if (fleet.get(id) !== entry || current?.pi_pid !== entry.pid || current.pi_pid_identity !== row.pi_pid_identity || recordedPidLiveness(entry.pid, row.pi_pid_identity) !== 'alive')
             return;
-        const termed = this.yieldTermAt.get(id);
-        if (termed === undefined) {
+        if (state.termedAt === undefined) {
+            if (!this.signalYieldStall(id, entry.pid, 'SIGTERM'))
+                return;
+            state.termedAt = now;
             emitEvent({
                 level: 'warn',
                 event: 'broker.yield_stall.sigterm',
                 ...(isSafeNodeId(id) ? { node_id: id } : {}),
                 fields: {
                     ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    pid,
-                    elapsed_ms: now - since,
+                    pid: entry.pid,
+                    elapsed_ms: now - state.since,
                     grace_ms: YIELD_STALL_GRACE_MS,
                 },
             });
-            try {
-                process.kill(pid, 'SIGTERM');
-            }
-            catch {
-                /* already gone */
-            }
-            this.yieldTermAt.set(id, now);
         }
-        else if (now - termed >= KILL_ESCALATE_MS) {
+        else if (now - state.termedAt >= KILL_ESCALATE_MS && this.signalYieldStall(id, entry.pid, 'SIGKILL')) {
             emitEvent({
                 level: 'warn',
                 event: 'broker.yield_stall.sigkill',
                 ...(isSafeNodeId(id) ? { node_id: id } : {}),
                 fields: {
                     ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    pid,
-                    elapsed_ms: now - termed,
+                    pid: entry.pid,
+                    elapsed_ms: now - state.termedAt,
                     grace_ms: KILL_ESCALATE_MS,
-                    stall_elapsed_ms: now - since,
+                    stall_elapsed_ms: now - state.since,
                 },
             });
-            try {
-                process.kill(pid, 'SIGKILL');
-            }
-            catch {
-                /* already gone */
-            }
+        }
+    }
+    signalYieldStall(id, pid, signal) {
+        try {
+            this.signal(pid, signal);
+            return true;
+        }
+        catch (err) {
+            emitEvent({
+                level: 'error',
+                event: 'broker.yield_stall.signal_failed',
+                ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                error: err,
+                fields: {
+                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                    pid,
+                    signal,
+                },
+            });
+            return false;
         }
     }
     async readTreeSample(pid) {
@@ -467,29 +494,36 @@ export class BrokerSupervisionReconciler {
             return null;
         }
     }
-    async handleWedgeDetection(id, pid, expectedIdentity, now) {
-        if (!isBusy(id)) {
-            this.wedgeNotifiedAt.delete(id);
+    async handleWedgeDetection(row, entry, fleet, now) {
+        const id = row.node_id;
+        const incarnation = incarnationOf(entry.pid, row.pi_pid_identity);
+        const since = busySinceForIncarnation(row);
+        if (since === null || incarnation === null) {
+            if (incarnation !== null)
+                this.wedgeNotifiedAt.delete(incarnation);
             return;
         }
-        const since = busySince(id);
-        const quietForMs = since === null ? null : now - since;
-        const sample = quietForMs !== null && quietForMs >= WEDGE_QUIET_MS ? await this.readTreeSample(pid) : null;
+        const quietForMs = now - since;
+        const sample = quietForMs >= WEDGE_QUIET_MS ? await this.sampleTree(entry.pid) : null;
+        const current = getNode(id);
+        const currentSince = current === null ? null : busySinceForIncarnation(current);
+        if (fleet.get(id) !== entry || current === null || current.pi_pid !== entry.pid || current.pi_pid_identity !== row.pi_pid_identity || currentSince !== since)
+            return;
         const cpuPercent = sample?.cpuPercent ?? null;
         const sampleHasDescendants = sample?.hasDescendants ?? null;
         if (wedgeVerdict({ busy: true, quietForMs, cpuPercent, hasDescendants: sampleHasDescendants }) !== 'wedged')
             return;
-        if (since !== null && this.wedgeNotifiedAt.get(id) === since)
+        if (this.wedgeNotifiedAt.get(incarnation) === since)
             return;
-        if (since !== null)
-            this.wedgeNotifiedAt.set(id, since);
-        const meta = getNode(id);
-        const name = meta !== null ? fullName(meta) : id;
+        this.wedgeNotifiedAt.set(incarnation, since);
+        const name = fullName(current);
         const minutes = Math.round((quietForMs ?? WEDGE_QUIET_MS) / 60_000);
         const hasDescendants = sampleHasDescendants ?? true;
-        const kickSuppressionReason = !hasDescendants && (expectedIdentity == null || recordedPidLiveness(pid, expectedIdentity) !== 'alive')
+        const kickSuppressionReason = !hasDescendants && recordedPidLiveness(entry.pid, row.pi_pid_identity) !== 'alive'
             ? 'pid_identity_unproven'
             : null;
+        let kickAttempted = false;
+        let kicked = false;
         let label;
         if (hasDescendants) {
             label =
@@ -506,16 +540,32 @@ export class BrokerSupervisionReconciler {
                     `confirmed alive.`;
         }
         else {
-            label =
-                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                    `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). Kicking it ` +
-                    `now: SIGTERM to the broker — the daemon will resume a cleanly ` +
-                    `aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`;
+            kickAttempted = true;
             try {
-                process.kill(pid, 'SIGTERM');
+                this.signal(entry.pid, 'SIGTERM');
+                kicked = true;
+                label =
+                    `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
+                        `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon sent ` +
+                        `SIGTERM to the broker and will resume a cleanly aborted session with a continuation, or start a ` +
+                        `recovery cycle if the abort cannot settle.`;
             }
-            catch {
-                /* already gone — its ChildProcess exit event still owns recovery */
+            catch (err) {
+                emitEvent({
+                    level: 'error',
+                    event: 'broker.wedge.signal_failed',
+                    ...(isSafeNodeId(id) ? { node_id: id } : {}),
+                    error: err,
+                    fields: {
+                        ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
+                        pid: entry.pid,
+                        signal: 'SIGTERM',
+                    },
+                });
+                label =
+                    `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
+                        `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon ` +
+                        `attempted SIGTERM to the broker, but the signal call failed.`;
             }
         }
         emitEvent({
@@ -524,11 +574,12 @@ export class BrokerSupervisionReconciler {
             ...(isSafeNodeId(id) ? { node_id: id } : {}),
             fields: {
                 ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                pid,
+                pid: entry.pid,
                 quiet_ms: quietForMs,
                 cpu_percent: cpuPercent,
                 has_descendants: hasDescendants,
-                kicked: !hasDescendants && kickSuppressionReason === null,
+                kick_attempted: kickAttempted,
+                kicked,
                 ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
             },
         });
@@ -554,7 +605,8 @@ export class BrokerSupervisionReconciler {
             child: id,
             quiet_ms: quietForMs,
             cpu_percent: cpuPercent,
-            kicked: !hasDescendants && kickSuppressionReason === null,
+            kick_attempted: kickAttempted,
+            kicked,
             ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
         });
     }

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -13,6 +13,7 @@ export interface StorageMaintenanceContext {
 export declare class StorageMaintenanceReconciler {
     private lastSpareSweepAt;
     private lastGhostSweepAt;
+    private focusGcInFlight;
     private readonly worktreeSweep;
     run(now: number, ctx: StorageMaintenanceContext): void;
     /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
@@ -25,6 +26,10 @@ export declare class StorageMaintenanceReconciler {
     /** Reap only physical placement residue of terminal nodes. The durable row,
      * graph, and on-disk state remain available for a later manual revive. */
     private reapDeadResidue;
+    /** Register one detached focus-GC pass, never overlapping another. The pane
+     * probe is a subprocess, and running it on the tick blocks the API socket for
+     * its full duration on every beat. */
+    private scheduleFocusGc;
     /** Delete focus rows whose recorded tmux pane no longer exists. A failed tmux
      * probe is "can't tell" and never authorizes deleting every viewport. */
     private gcStaleFocuses;

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -1,10 +1,10 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { closeFocusRow, listFocuses, listNodes, reapGhostRows, } from '../../core/canvas/index.js';
+import { closeFocusRow, getFocusById, listFocuses, listNodes, reapGhostRows, } from '../../core/canvas/index.js';
 import { isSafeNodeId, jobDir, nodeDir } from '../../core/canvas/paths.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
-import { listLivePanes, tearDownNode } from '../../core/runtime/placement.js';
+import { listLivePanesAsync, tearDownNode } from '../../core/runtime/placement.js';
 import { reapStaleSpares } from '../../core/runtime/warm-pool.js';
 import { ManagedWorktreeSweepReconciler } from './managed-worktree-sweep.js';
 // How long a dead node's on-disk record must be quiet before its leftover
@@ -18,13 +18,16 @@ const GHOST_SWEEP_INTERVAL_MS = 60 * 1000;
 export class StorageMaintenanceReconciler {
     lastSpareSweepAt = Number.NEGATIVE_INFINITY;
     lastGhostSweepAt = Number.NEGATIVE_INFINITY;
+    focusGcInFlight = false;
     worktreeSweep = new ManagedWorktreeSweepReconciler();
     run(now, ctx) {
         // Placement reap MUST precede focus GC, so GC catches a focus row the reap
         // strands. Both run after the lifecycle tick, so a same-tick revive has
-        // already had the chance to re-anchor its focus.
+        // already had the chance to re-anchor its focus. The GC is detached, but it
+        // reads the focus table synchronously before its first await, so it still
+        // observes the post-reap state this ordering exists to give it.
         this.reapDeadResidue(now);
-        this.gcStaleFocuses();
+        this.scheduleFocusGc(ctx);
         this.reapGhostRows(now);
         this.gcWarmPool(now);
         // Registers detached async Git work and returns immediately: this lane is
@@ -140,9 +143,23 @@ export class StorageMaintenanceReconciler {
             });
         }
     }
+    /** Register one detached focus-GC pass, never overlapping another. The pane
+     * probe is a subprocess, and running it on the tick blocks the API socket for
+     * its full duration on every beat. */
+    scheduleFocusGc(ctx) {
+        if (this.focusGcInFlight)
+            return;
+        if (!ctx.lifecycle.acceptsDetachedWork())
+            return;
+        this.focusGcInFlight = true;
+        const pass = this.gcStaleFocuses().finally(() => {
+            this.focusGcInFlight = false;
+        });
+        ctx.lifecycle.registerDetached(pass);
+    }
     /** Delete focus rows whose recorded tmux pane no longer exists. A failed tmux
      * probe is "can't tell" and never authorizes deleting every viewport. */
-    gcStaleFocuses() {
+    async gcStaleFocuses() {
         let rows;
         try {
             rows = listFocuses();
@@ -157,7 +174,7 @@ export class StorageMaintenanceReconciler {
             return;
         let live;
         try {
-            live = listLivePanes();
+            live = await listLivePanesAsync();
         }
         catch (err) {
             operationIdContext.fresh(() => {
@@ -170,8 +187,14 @@ export class StorageMaintenanceReconciler {
         for (const focus of rows) {
             if (focus.pane === null || live.has(focus.pane))
                 continue;
-            const removed = operationIdContext.fresh(() => {
+            const proceed = operationIdContext.fresh(() => {
                 try {
+                    // The probe awaited above let other event-loop work run, so a viewer
+                    // may have re-pointed this row at a pane the probe never saw. Re-read
+                    // and match the pane before deleting; the read and the delete are both
+                    // synchronous, so nothing can interleave between them.
+                    if (getFocusById(focus.focus_id)?.pane !== focus.pane)
+                        return true;
                     emitEvent({
                         level: 'info',
                         event: 'focus.gc.removed',
@@ -190,7 +213,7 @@ export class StorageMaintenanceReconciler {
                     return false;
                 }
             });
-            if (!removed)
+            if (!proceed)
                 return;
         }
     }

package/dist/pi-extensions/__tests__/pre-command-gate.test.js

@@ -12,9 +12,9 @@
 //     executes them concurrently, so without a per-turn flag the second sibling
 //     would find the doc already exposed and slip past the hold its sibling just
 //     raised.
-//   • A session whose corpus carries no `pre-command` doc at all is the common
-//     case and must never pay a daemon round-trip. Proven by closing the daemon:
-//     if the short-circuit stopped working the call would fail loud.
+//   • A command that matches no `pre-command` doc must never pay a daemon
+//     round-trip, even when another document gates a different command. Proven
+//     against an unavailable test API socket: a lookup fails loudly.
 //
 // The gate runs against the real canvas api server, so the subject the matcher
 // gates on is the one crtrd actually serves.
@@ -104,6 +104,7 @@ function registerSubstrate() {
         bash: (command) => fire('tool_call', { toolName: 'bash', input: { command } }),
         endTurn: async () => void (await fire('turn_end', {})),
         compact: async () => void (await fire('session_compact', {})),
+        toolResult: (toolName, input) => fire('tool_result', { toolName, input, content: [] }),
     };
 }
 function assertHeld(result, what) {
@@ -207,14 +208,13 @@ test('compaction re-arms the hold and leaves an exposure ledger that reloads', a
     const reheld = assertHeld(await pi.bash('deploy prod'), 'the same command after compaction');
     assert.ok(reheld.reason.includes(DOCTRINE_BODY), 'guidance the transcript no longer carries is delivered again');
 });
-test('a corpus with no pre-command doc never reaches the daemon', async () => {
-    writeDoctrineDoc('command');
+test('a command that matches no gate never reaches the daemon', async () => {
+    writeDoctrineDoc('pre-command');
     seedNode('gate-quiet');
     const pi = registerSubstrate();
-    // No daemon. Every path below must return before the subject lookup; one that
-    // does not fails loud with `daemon_unavailable` instead of passing quietly.
+    // The test API socket is unavailable. Both hooks must return before their
+    // subject lookup; one that does not fails loud with `daemon_unavailable`.
     await closeServer();
-    assert.equal(await pi.toolCall('read', { file: '/tmp/x' }), undefined, 'a non-bash call is not the gate’s business');
-    assert.equal(await pi.toolCall('bash', { command: '   ' }), undefined, 'a bash call carrying no command is not held');
-    assert.equal(await pi.bash('deploy prod'), undefined, 'a post-execution `command` doc never holds anything');
+    assert.equal(await pi.bash('git status'), undefined, 'the pre-call hook ignores an unrelated pre-command document');
+    assert.equal(await pi.toolResult('bash', { command: 'git status' }), undefined, 'the post-result hook ignores an unrelated pre-command document');
 });