@north-light/crouter 0.3.311 → 0.3.313

package/dist/api/client.d.ts

@@ -1,4 +1,4 @@
-import type { DaemonRestartDTO, HealthDTO, StatusDTO } from './dto/health.js';
+import type { DaemonAdmitDTO, DaemonRestartDTO, HealthDTO, MigrateStateDTO, MigrateStateRequest, StatusDTO } from './dto/health.js';
 import type { BashJobStatusDTO, BashJobStopResultDTO } from './dto/bash-jobs.js';
 import type { ArtifactListDTO, ArtifactsQuery, ContextListDTO, CreateNodeRequest, ListNodesQuery, NodeDetailDTO, NodeMessagesPageDTO, NodeMessagesQuery, NodeSessionDTO, NodeSnapshotDTO, NodeSubjectDTO, NodeSummaryDTO, TranscriptDTO, TranscriptQuery } from './dto/nodes.js';
 import type { NodeOutcomeResponseDTO, OutcomeDeliveryDTO, RegisterOutcomeDeliveryRequest } from './dto/node-outcomes.js';
@@ -15,14 +15,15 @@ import type { FilePeekDTO } from './dto/files.js';
 import type { MemoryDocRefDTO } from './dto/memory.js';
 import type { ChatInventoryDTO, ProspectiveChatInventoryDTO, ProspectiveChatInventoryQuery } from './dto/chat-inventory.js';
 import type { CredentialRemovalResultDTO, CredentialResultDTO, InstallCredentialRequest, ModelAuthListDTO } from './dto/modelauth.js';
-import type { CreateHumanBridgeRequest, HumanBridgeResultDTO, HumanCancelRequest, HumanCancelResultDTO, HumanResolveRequest, HumanResolveResultDTO } from './dto/human.js';
 import type { CancelReviewRequest, CreateReviewRequest, ListReviewsQuery, ReviewCancelResultDTO, ReviewDocumentBaseDTO, ReviewDTO, ReviewListDTO, ReviewSubmitResultDTO } from './dto/reviews.js';
 import type { CreateReviewCommentRequest, EditReviewCommentRequest, ListReviewCommentsQuery, ReadReviewCommentEventsQuery, ReviewCommentActionRequest, ReviewCommentDetailDTO, ReviewCommentEventsDTO, ReviewCommentListDTO, ReviewCommentMutationDTO, ReviewCommentRangeBatchRequest, ReviewCommentRangeBatchResultDTO } from './dto/review-comments.js';
 import type { CancelInboxTicketRequest, CanceledTicketResultDTO, InboxListDTO, InboxPageDTO, InboxPageHistoryDTO, InboxPageResponseDTO, InboxTicketIdDTO, PageFeedbackResolutionDTO, PageResponsesDTO, PageTicketResultDTO, RespondInboxPageRequest } from './dto/inbox.js';
 import type { CreateHumanRequestDTO, CreateHumanRequestRequest, HumanRequestDTO, HumanRequestIdDTO, ReplaceHumanRequestRequest, RespondHumanRequestRequest, SettleHumanRequestRequest } from './dto/human-requests.js';
-import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryStatsQuery, HistoryStatsResultDTO, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
+import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryStatsQuery, HistoryStatsResultDTO, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
 import type { AbandonWorktreeRequest, AbandonWorktreeResultDTO, CloseWorktreeResultDTO, QuarantinedWorktreeDTO } from './dto/worktree.js';
-import type { BrokerExtensionStateDTO, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerInboxCursorDirective, BrokerInboxCursorRequest, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerParkActivityResultDTO, BrokerParkCompleteRequest, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from './dto/broker-ops.js';
+import type { BrokerExtensionStateDTO, BrokerExecutionRequest, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerParkActivityResultDTO, BrokerParkCompleteRequest, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from './dto/broker-ops.js';
+import type { AcknowledgeMailRequest, AcknowledgeMailResultDTO, ClaimMailRequest, ClaimMailResultDTO } from './dto/mail.js';
+import type { BrokerFaultInputDTO, BrokerFaultRequest, BrokerFaultResultDTO, BrokerProviderRetryRequest, BrokerProviderRetryResultDTO, BrokerTurnRequest, BrokerTurnResultDTO, NodeFaultClearResultDTO, RecoveryStateDTO } from './dto/recovery.js';
 export interface CrtrClientOptions {
     /** Unix socket path (default local transport). Exactly one of socketPath|baseUrl. */
     socketPath?: string;
@@ -51,9 +52,6 @@ export interface CrtrClientOptions {
      * socket or interrupted response. Each probe is capped to the remaining
      * budget. Defaults to `HEALTHZ_POLL_WINDOW_MS`. */
     coldStartPollWindowMs?: number;
-    /** Injected check for a standing startup block. After an attempted spawn,
-     * its result supplements the observed transport failure with the known repair. */
-    coldStartAbort?: () => string | null;
 }
 /** One strict wall-clock availability window shared by local API clients and
  * daemon management. Each probe gets only the budget remaining at its start. */
@@ -75,7 +73,6 @@ export declare class CrtrClient {
     private readonly onColdSocket?;
     private readonly coldStartDiagnostic?;
     private readonly coldStartPollWindowMs;
-    private readonly coldStartAbort?;
     /** Guards against invoking the daemon-start hook more than once per client. */
     private coldStartAttempted;
     constructor(opts: CrtrClientOptions);
@@ -93,6 +90,8 @@ export declare class CrtrClient {
      *  caller living inside a node the handover will tear down still gets a
      *  settled result. */
     restartDaemon(): Promise<DaemonRestartDTO>;
+    admitDaemon(): Promise<DaemonAdmitDTO>;
+    migrateState(req: MigrateStateRequest): Promise<MigrateStateDTO>;
     createNode(req: CreateNodeRequest): Promise<NodeDetailDTO>;
     /** List canvas nodes with composable row filters. `include: 'activity'` adds
      * latest/canonical reports and pending-human counts in the same response. */
@@ -123,8 +122,18 @@ export declare class CrtrClient {
     bindBrokerSession(id: string, req: BrokerSessionBoundRequest): Promise<BrokerSessionBoundResultDTO>;
     settleBroker(id: string, req: BrokerSettleRequest): Promise<BrokerSettleDirective>;
     completeBrokerPark(id: string, req: BrokerParkCompleteRequest): Promise<BrokerSettleDirective>;
-    recordBrokerParkActivity(id: string): Promise<BrokerParkActivityResultDTO>;
-    advanceBrokerInboxCursor(id: string, req: BrokerInboxCursorRequest): Promise<BrokerInboxCursorDirective>;
+    recordBrokerParkActivity(id: string, req: BrokerExecutionRequest): Promise<BrokerParkActivityResultDTO>;
+    claimNodeMail(id: string, req: ClaimMailRequest): Promise<ClaimMailResultDTO>;
+    acknowledgeNodeMail(id: string, req: AcknowledgeMailRequest): Promise<AcknowledgeMailResultDTO>;
+    recordBrokerTurn(id: string, req: BrokerTurnRequest): Promise<BrokerTurnResultDTO>;
+    mutateBrokerProviderRetry(id: string, req: BrokerProviderRetryRequest): Promise<BrokerProviderRetryResultDTO>;
+    mutateBrokerFault(id: string, req: BrokerFaultRequest): Promise<BrokerFaultResultDTO>;
+    getBrokerRecovery(id: string, expectedExecutionId: string): Promise<RecoveryStateDTO>;
+    recordNodeFault(id: string, req: BrokerFaultInputDTO): Promise<BrokerFaultResultDTO>;
+    clearNodeFault(id: string, opts?: {
+        link?: BrokerFaultInputDTO['link'];
+        preserve_episode?: boolean;
+    }): Promise<NodeFaultClearResultDTO>;
     commitBrokerModel(id: string, req: BrokerModelCommitRequest): Promise<BrokerModelCommitResultDTO>;
     brokerExtensionState(id: string): Promise<BrokerExtensionStateDTO>;
     commitBrokerGeneratedName(id: string, req: BrokerGeneratedNameRequest): Promise<BrokerGeneratedNameResultDTO>;
@@ -212,20 +221,9 @@ export declare class CrtrClient {
     listModelAuth(): Promise<ModelAuthListDTO>;
     installCredential(provider: string, req: InstallCredentialRequest): Promise<CredentialResultDTO>;
     removeCredential(provider: string): Promise<CredentialRemovalResultDTO>;
-    /** Create a terminal `kind:'human'` bridge node with NO broker engine
-     *  (`spawnNode` server-side). Distinct from `createNode` (which launches a
-     *  broker) precisely because a human bridge must never have one. */
-    createHumanBridge(req: CreateHumanBridgeRequest): Promise<HumanBridgeResultDTO>;
-    /** Resolve a page ticket answer. crtrd claims the ticket (taking over a live
-     * inbox claim where one exists), publishes the canonical result, and follows
-     * its optional reply route before this resolves. */
-    resolveHumanTicket(ticketId: string, body: HumanResolveRequest): Promise<HumanResolveResultDTO>;
-    /** Cancel a pending ticket and retire its optional reply bridge. */
-    cancelHumanTicket(ticketId: string, body: HumanCancelRequest): Promise<HumanCancelResultDTO>;
     createReview(req: CreateReviewRequest): Promise<ReviewDTO>;
     listReviews(query?: ListReviewsQuery): Promise<ReviewListDTO>;
     getReview(reviewId: string): Promise<ReviewDTO>;
-    getReviewByBridge(bridgeNodeId: string): Promise<ReviewDTO>;
     submitReview(reviewId: string): Promise<ReviewSubmitResultDTO>;
     cancelReview(reviewId: string, req?: CancelReviewRequest): Promise<ReviewCancelResultDTO>;
     getReviewDocumentBase(reviewId: string): Promise<ReviewDocumentBaseDTO>;
@@ -255,10 +253,10 @@ export declare class CrtrClient {
     getInboxResponse(ticketId: InboxTicketIdDTO): Promise<InboxPageResponseDTO>;
     /** Cancel a ticket (terminal response, never deletion). */
     cancelHumanInboxTicket(ticketId: InboxTicketIdDTO, request?: CancelInboxTicketRequest): Promise<CanceledTicketResultDTO>;
-    /** Create one durable human request. Its `request_id` is the same opaque id
-     *  the inbox routes address, so the request and the inbox ticket are one
-     *  record. An unresolvable `action.name` is rejected before the page is
-     *  published, leaving no inbox row behind. */
+    /** Create one durable human request. The minted `request_id` identifies the
+     *  request; inbox presentation has its own ticket id. An unresolvable
+     *  `action.name` is rejected before the page is published, leaving no inbox
+     *  row behind. */
     createHumanRequest(request: CreateHumanRequestRequest): Promise<CreateHumanRequestDTO>;
     /** Read one request: its current state, its answer when answered, and the
      *  delivery state of its completion action when it bound one. */
@@ -310,7 +308,6 @@ export declare class CrtrClient {
      *  enriched on-demand view. */
     canvasRoster(): Promise<RosterDTO>;
     prune(req: PruneRequest): Promise<PruneResultDTO>;
-    rebuildIndex(): Promise<RebuildIndexResultDTO>;
     /** Raw request for routes not yet method-wrapped. Applies the same
      *  autostart + error-mapping semantics. */
     request<T>(method: string, path: string, body?: unknown): Promise<T>;
@@ -318,10 +315,6 @@ export declare class CrtrClient {
      * JSON parse. Every wrapper goes through here; only non-JSON routes call it directly. */
     private send;
     private nodePath;
-    /** Validate a human interaction id before route construction. Reply-bearing
-     * tickets use bridge ids and standalone pages use page ids; both obey the
-     * safe node-id segment contract. */
-    private interactionPath;
     /** Validate a background job id before route construction. Job ids arrive
      *  from the daemon's file-backed roster and must remain one path segment. */
     private jobPath;
@@ -329,6 +322,10 @@ export declare class CrtrClient {
      *  it raw, so a value carrying `/`, whitespace or `?` would corrupt the
      *  request line rather than 404 cleanly. Mirrors `nodePath`. */
     private cronPath;
+    /** Validate a request id before route construction. Requests use the daemon's
+     * node-id-shaped identifiers, while inbox presentation uses a separate ticket
+     * id. A malformed request id is a server-rejectable request. */
+    private requestPath;
     /** Validate an opaque inbox ticket id before route construction. A local
      *  shape violation is a caller bug, not a server-rejectable request — throws
      *  `TypeError` (matching the existing safe-segment discipline of a local

package/dist/api/client.js

@@ -72,7 +72,6 @@ export class CrtrClient {
     onColdSocket;
     coldStartDiagnostic;
     coldStartPollWindowMs;
-    coldStartAbort;
     /** Guards against invoking the daemon-start hook more than once per client. */
     coldStartAttempted = false;
     constructor(opts) {
@@ -92,8 +91,6 @@ export class CrtrClient {
             this.onColdSocket = opts.onColdSocket;
         if (opts.coldStartDiagnostic !== undefined)
             this.coldStartDiagnostic = opts.coldStartDiagnostic;
-        if (opts.coldStartAbort !== undefined)
-            this.coldStartAbort = opts.coldStartAbort;
         this.coldStartPollWindowMs = opts.coldStartPollWindowMs ?? HEALTHZ_POLL_WINDOW_MS;
     }
     /** Construct a client bound to the default local socket with autostart on. Pass
@@ -109,7 +106,21 @@ export class CrtrClient {
     /** One `/healthz` observation without cold-socket recovery. Availability
      * waiters own retry policy and pass their remaining wall-clock budget here. */
     async probeHealthz(timeoutMs) {
-        return parse(await this.transport('GET', routes.healthz(), undefined, undefined, timeoutMs));
+        const response = await this.transport('GET', routes.healthz(), undefined, undefined, timeoutMs);
+        // A restricted daemon is alive and deliberately answers its health DTO with
+        // 503. Preserve that state for daemon startup management instead of treating
+        // the expected non-2xx status as a generic API failure.
+        if (response.status === 503) {
+            try {
+                const health = JSON.parse(response.text);
+                if (typeof health.startup_blocked === 'string')
+                    return health;
+            }
+            catch {
+                // `parse` below reports malformed/non-health 503 responses normally.
+            }
+        }
+        return parse(response);
     }
     status() {
         return this.request('GET', routes.status());
@@ -121,6 +132,12 @@ export class CrtrClient {
     restartDaemon() {
         return this.request('POST', routes.daemonRestart());
     }
+    admitDaemon() {
+        return this.request('POST', routes.daemonAdmit());
+    }
+    migrateState(req) {
+        return this.request('POST', routes.daemonMigrate(), req);
+    }
     // Nodes
     createNode(req) {
         return this.request('POST', routes.nodes(), req);
@@ -191,11 +208,38 @@ export class CrtrClient {
     completeBrokerPark(id, req) {
         return this.request('POST', routes.nodeBrokerParkComplete(this.nodePath(id)), req);
     }
-    recordBrokerParkActivity(id) {
-        return this.request('POST', routes.nodeBrokerParkActivity(this.nodePath(id)), {});
+    recordBrokerParkActivity(id, req) {
+        return this.request('POST', routes.nodeBrokerParkActivity(this.nodePath(id)), req);
+    }
+    claimNodeMail(id, req) {
+        return this.request('POST', routes.nodeMailClaim(this.nodePath(id)), req);
+    }
+    acknowledgeNodeMail(id, req) {
+        return this.request('POST', routes.nodeMailAcknowledge(this.nodePath(id)), req);
+    }
+    recordBrokerTurn(id, req) {
+        return this.request('POST', routes.brokerTurn(this.nodePath(id)), req);
+    }
+    mutateBrokerProviderRetry(id, req) {
+        return this.request('POST', routes.brokerProviderRetry(this.nodePath(id)), req);
     }
-    advanceBrokerInboxCursor(id, req) {
-        return this.request('POST', routes.nodeBrokerInboxCursor(this.nodePath(id)), req);
+    mutateBrokerFault(id, req) {
+        return this.request('POST', routes.brokerFault(this.nodePath(id)), req);
+    }
+    getBrokerRecovery(id, expectedExecutionId) {
+        return this.request('GET', `${routes.brokerRecovery(this.nodePath(id))}?expected_execution_id=${encodeURIComponent(expectedExecutionId)}`);
+    }
+    recordNodeFault(id, req) {
+        return this.request('POST', routes.nodeFault(this.nodePath(id)), req);
+    }
+    clearNodeFault(id, opts = {}) {
+        const query = new URLSearchParams();
+        if (opts.link !== undefined)
+            query.set('link', opts.link);
+        if (opts.preserve_episode !== undefined)
+            query.set('preserve_episode', String(opts.preserve_episode));
+        const suffix = query.size === 0 ? '' : `?${query.toString()}`;
+        return this.request('DELETE', `${routes.nodeFault(this.nodePath(id))}${suffix}`);
     }
     commitBrokerModel(id, req) {
         return this.request('POST', routes.nodeBrokerModel(this.nodePath(id)), req);
@@ -400,23 +444,6 @@ export class CrtrClient {
     removeCredential(provider) {
         return this.request('DELETE', routes.modelAuth(provider));
     }
-    // Human bridge + completion-handler forwarding (spec §6.5)
-    /** Create a terminal `kind:'human'` bridge node with NO broker engine
-     *  (`spawnNode` server-side). Distinct from `createNode` (which launches a
-     *  broker) precisely because a human bridge must never have one. */
-    createHumanBridge(req) {
-        return this.request('POST', routes.humanBridge(), req);
-    }
-    /** Resolve a page ticket answer. crtrd claims the ticket (taking over a live
-     * inbox claim where one exists), publishes the canonical result, and follows
-     * its optional reply route before this resolves. */
-    resolveHumanTicket(ticketId, body) {
-        return this.request('POST', routes.humanTicketResolve(this.interactionPath(ticketId)), body);
-    }
-    /** Cancel a pending ticket and retire its optional reply bridge. */
-    cancelHumanTicket(ticketId, body) {
-        return this.request('POST', routes.humanTicketCancel(this.interactionPath(ticketId)), body);
-    }
     // Daemon-owned document reviews and comments
     createReview(req) {
         return this.request('POST', routes.humanReviews(), req);
@@ -427,9 +454,6 @@ export class CrtrClient {
     getReview(reviewId) {
         return this.request('GET', routes.humanReview(this.reviewPath(reviewId)));
     }
-    getReviewByBridge(bridgeNodeId) {
-        return this.request('GET', routes.humanReviewByBridge(this.nodePath(bridgeNodeId)));
-    }
     submitReview(reviewId) {
         return this.request('POST', routes.humanReviewSubmit(this.reviewPath(reviewId)), {});
     }
@@ -507,35 +531,35 @@ export class CrtrClient {
         return this.request('POST', routes.humanInboxCancel(this.ticketId(ticketId)), request ?? {});
     }
     // Durable programmatic human requests
-    /** Create one durable human request. Its `request_id` is the same opaque id
-     *  the inbox routes address, so the request and the inbox ticket are one
-     *  record. An unresolvable `action.name` is rejected before the page is
-     *  published, leaving no inbox row behind. */
+    /** Create one durable human request. The minted `request_id` identifies the
+     *  request; inbox presentation has its own ticket id. An unresolvable
+     *  `action.name` is rejected before the page is published, leaving no inbox
+     *  row behind. */
     createHumanRequest(request) {
         return this.request('POST', routes.humanRequests(), request);
     }
     /** Read one request: its current state, its answer when answered, and the
      *  delivery state of its completion action when it bound one. */
     getHumanRequest(requestId) {
-        return this.request('GET', routes.humanRequest(this.ticketId(requestId)));
+        return this.request('GET', routes.humanRequest(this.requestPath(requestId)));
     }
     /** Revise a pending request's page in place. Identity, provenance, and the
      *  frozen action binding are preserved; a settled request refuses. */
     replaceHumanRequest(requestId, request) {
-        return this.request('POST', routes.humanRequestReplace(this.ticketId(requestId)), request);
+        return this.request('POST', routes.humanRequestReplace(this.requestPath(requestId)), request);
     }
     /** Settle a request `answered` programmatically. Races a human answer to the
      *  same first-writer-wins result. */
     respondHumanRequest(requestId, request) {
-        return this.request('POST', routes.humanRequestRespond(this.ticketId(requestId)), request);
+        return this.request('POST', routes.humanRequestRespond(this.requestPath(requestId)), request);
     }
     /** The recipient surface closing a request without answering. */
     dismissHumanRequest(requestId, request = {}) {
-        return this.request('POST', routes.humanRequestDismiss(this.ticketId(requestId)), request);
+        return this.request('POST', routes.humanRequestDismiss(this.requestPath(requestId)), request);
     }
     /** The requester withdrawing its own request. */
     cancelHumanRequest(requestId, request = {}) {
-        return this.request('POST', routes.humanRequestCancel(this.ticketId(requestId)), request);
+        return this.request('POST', routes.humanRequestCancel(this.requestPath(requestId)), request);
     }
     /** Resolve one page feedback comment — the bound companion's report that it
      *  has been dealt with. `nodeId` names the caller; the daemon refuses any
@@ -603,9 +627,6 @@ export class CrtrClient {
     prune(req) {
         return this.request('POST', routes.canvasPrune(), req);
     }
-    rebuildIndex() {
-        return this.request('POST', routes.canvasRebuildIndex(), {});
-    }
     // Escape hatch
     /** Raw request for routes not yet method-wrapped. Applies the same
      *  autostart + error-mapping semantics. */
@@ -640,15 +661,6 @@ export class CrtrClient {
         }
         return id;
     }
-    /** Validate a human interaction id before route construction. Reply-bearing
-     * tickets use bridge ids and standalone pages use page ids; both obey the
-     * safe node-id segment contract. */
-    interactionPath(id) {
-        if (!isSafeNodeId(id)) {
-            throw new ApiError(400, 'invalid_ticket_id', `invalid interaction ticket id: ${JSON.stringify(id)}`);
-        }
-        return id;
-    }
     /** Validate a background job id before route construction. Job ids arrive
      *  from the daemon's file-backed roster and must remain one path segment. */
     jobPath(id) {
@@ -666,6 +678,15 @@ export class CrtrClient {
         }
         return id;
     }
+    /** Validate a request id before route construction. Requests use the daemon's
+     * node-id-shaped identifiers, while inbox presentation uses a separate ticket
+     * id. A malformed request id is a server-rejectable request. */
+    requestPath(id) {
+        if (!isSafeNodeId(id)) {
+            throw new ApiError(400, 'invalid_request_id', `invalid request id: ${JSON.stringify(id)}`);
+        }
+        return id;
+    }
     /** Validate an opaque inbox ticket id before route construction. A local
      *  shape violation is a caller bug, not a server-rejectable request — throws
      *  `TypeError` (matching the existing safe-segment discipline of a local
@@ -784,9 +805,17 @@ export class CrtrClient {
             initialError,
             probe: async (timeoutMs) => {
                 const response = await this.transport('GET', routes.healthz(), undefined, undefined, timeoutMs);
-                if (response.status < 200 || response.status >= 300) {
-                    throw new ApiError(response.status, 'daemon_health_unavailable', `crtrd health check returned HTTP ${response.status}: ${response.text.slice(0, 500)}`);
+                if (response.status >= 200 && response.status < 300)
+                    return;
+                try {
+                    const health = JSON.parse(response.text);
+                    if (typeof health.startup_blocked === 'string')
+                        return;
                 }
+                catch {
+                    // The normal unavailable error below carries the response body.
+                }
+                throw new ApiError(response.status, 'daemon_health_unavailable', `crtrd health check returned HTTP ${response.status}: ${response.text.slice(0, 500)}`);
             },
         });
     }
@@ -804,9 +833,6 @@ export class CrtrClient {
         }
         catch (error) {
             if (startedHere) {
-                const standingBlock = safeColdStartAbort(this.coldStartAbort);
-                if (standingBlock !== null)
-                    throw new ApiError(503, 'daemon_unavailable', `crtrd cannot start: ${standingBlock}`);
                 const diagnostic = safeColdStartDiagnostic(this.coldStartDiagnostic);
                 if (diagnostic !== undefined) {
                     const transportError = toTransportApiError(error);
@@ -874,19 +900,6 @@ function toTransportApiError(err) {
 function sleepMs(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-/** Invoke the injected `coldStartDiagnostic` hook, treating a THROW the same
- * as an absent/undefined result — the contract `CrtrClientOptions` documents
- * ("a thrown/undefined result is treated as 'no diagnostic'"). */
-function safeColdStartAbort(hook) {
-    if (hook === undefined)
-        return null;
-    try {
-        return hook();
-    }
-    catch {
-        return null;
-    }
-}
 export function safeColdStartDiagnostic(hook) {
     if (hook === undefined)
         return undefined;

package/dist/api/dto/broker-ops.d.ts

@@ -6,6 +6,7 @@ import type { NodeSubjectDTO } from './nodes.js';
  * review markers visible in Pi's current branch; crtrd owns the node binding
  * used to decide whether that branch is valid. */
 export interface BrokerSessionBoundRequest {
+    executionId: string;
     piSessionId: string;
     sessionFile: string | null;
     pid: number;
@@ -20,7 +21,10 @@ export interface BrokerSessionBoundResultDTO {
 /** `POST /v1/nodes/{id}/broker/settle` body. These are the facts only Pi can
  * know at its settlement boundary; crtrd reads all current canvas state and
  * selects the durable consequence. */
-export interface BrokerSettleRequest {
+export interface BrokerExecutionRequest {
+    expected_execution_id: string;
+}
+export interface BrokerSettleRequest extends BrokerExecutionRequest {
     stopReason: string;
     backgroundJobsRunning: boolean;
     pushedFinal: boolean;
@@ -44,25 +48,11 @@ export interface BrokerParkActivityResultDTO {
 }
 /** `POST /v1/nodes/{id}/broker/park-complete` body. The isolated parking turn
  * has ended; crtrd alone decides whether its pending park still applies. */
-export interface BrokerParkCompleteRequest {
+export interface BrokerParkCompleteRequest extends BrokerExecutionRequest {
     outcome: 'completed' | 'failed';
 }
-/** `POST /v1/nodes/{id}/broker/inbox-cursor` body. The watcher advances this
- * only after Pi has settled every handoff through the supplied physical entry.
- * `brokerPid` binds the commit to the broker generation crtrd currently owns. */
-export interface BrokerInboxCursorRequest {
-    throughEntryId: string;
-    brokerPid: number;
-}
-/** crtrd either commits the durable cursor or preserves it while a refresh
- * discards the current Pi conversation, so the next broker replays the entry. */
-export type BrokerInboxCursorDirective = {
-    action: 'advanced';
-} | {
-    action: 'hold_refresh';
-};
 /** Durable model recipe selected by the live broker after Pi accepts a model or thinking change. */
-export interface BrokerModelCommitRequest {
+export interface BrokerModelCommitRequest extends BrokerExecutionRequest {
     spec: string;
     pinnedOverride?: boolean;
     userSelected: boolean;
@@ -133,7 +123,7 @@ export interface BrokerExtensionStateDTO {
 /** Guarded generated-label update. `initial` can only fill a blank generated
  * description; `recap` additionally compares the exact automatic-name snapshot
  * captured before the headless naming call. */
-export type BrokerGeneratedNameRequest = {
+export type BrokerGeneratedNameRequest = BrokerExecutionRequest & ({
     kind: 'initial';
     description: string;
     title: string;
@@ -150,7 +140,7 @@ export type BrokerGeneratedNameRequest = {
         icon: string;
         kind: string;
     };
-};
+});
 /** A daemon-selected Pi editor-label directive. No handler calls a broker.
  * `description`/`title`/`icon` are the values as STORED (an empty title or icon
  * is left unset), so the broker announces what the node now carries rather than
@@ -162,7 +152,7 @@ export interface BrokerGeneratedNameResultDTO {
     title?: string;
     icon?: string;
 }
-export interface BrokerPersonaAckRequest {
+export interface BrokerPersonaAckRequest extends BrokerExecutionRequest {
     from: {
         kind: string;
         mode: 'base' | 'orchestrator';

package/dist/api/dto/canvas.d.ts

@@ -242,8 +242,7 @@ export interface SnapshotDTO {
     subscriptions: Record<string, NodeIdDTO[]>;
 }
 /** One node row in the lean roster (`GET /v1/canvas/roster`). Carries only
- *  columns already native to the `nodes` row — no meta.json read, no
- *  process-liveness probe. `attention_count`/`last_activity`/`ctx_tokens`/
+ *  stored node fields, without a process-liveness probe. `attention_count`/`last_activity`/`ctx_tokens`/
  *  `streaming`/`hanging`/`viewed` stay on `SnapshotNodeDTO`; a roster consumer
  *  that needs attention counts fetches them separately via the existing
  *  `POST /v1/canvas/attention/counts` (already scoped to exactly the ids it
@@ -313,11 +312,3 @@ export interface PruneResultDTO {
     dry_run: boolean;
     ttl_days: number;
 }
-/** `POST /v1/canvas/rebuild-index` result. Fails loud server-side when metas
- *  exist on disk but the rebuild yields zero rows (a corrupt/empty index). */
-export interface RebuildIndexResultDTO {
-    /** How many `nodes/<id>/meta.json` files were found on disk. */
-    metas: number;
-    /** How many node rows exist in canvas.db after the rebuild. */
-    rows: number;
-}

package/dist/api/dto/health.d.ts

@@ -1,4 +1,6 @@
 import type { NodeStatusDTO } from './common.js';
+/** Ephemeral daemon lifecycle phase reported by health and status. */
+export type StartupPhaseDTO = 'initializing' | 'blocked' | 'prepared' | 'recovering' | 'ready';
 /** `GET /healthz` — substrate readiness probe. Versions are informational, never
  *  a gate. Used by the provisioning ladder. */
 export interface HealthDTO {
@@ -6,6 +8,10 @@ export interface HealthDTO {
     daemon_up: boolean;
     store_accessible: boolean;
     brokers_reconciled: boolean;
+    /** Present while corpus migration or normal daemon startup is incomplete. */
+    startup_blocked?: string;
+    /** Always present; only `ready` admits normal daemon work. */
+    startup_phase: StartupPhaseDTO;
 }
 /** `GET /v1/status` — daemon status snapshot. Backs `crtr sys daemon status`
  *  state and the `crtr canvas dashboard` header. `runtime_version` is also
@@ -24,6 +30,8 @@ export interface StatusDTO {
     };
     runtime_version: string;
     api_version: string;
+    /** Always present; only `ready` admits normal daemon work. */
+    startup_phase: StartupPhaseDTO;
 }
 /** `POST /v1/daemon/restart` — the ack for a daemon-owned handover.
  *
@@ -33,6 +41,111 @@ export interface StatusDTO {
  *  `accepted` is therefore a promise about the future, not a completed action —
  *  the successor daemon is spawned after `grace_ms`, and every node the
  *  teardown interrupts is resumed by it. */
+export interface MigrateStateRequest {
+    dry_run?: boolean;
+    dirs?: string[];
+}
+export interface MigrateStateDTO {
+    profiles: number;
+    stores: number;
+    changed: number;
+    applied: {
+        store: string;
+        lane: string;
+        migration: string;
+        files: string[];
+    }[];
+    skipped: {
+        store: string;
+        relPath: string;
+        error: string;
+    }[];
+    blockers: {
+        kind: string;
+        message: string;
+        store?: string;
+        target?: string;
+        path?: string;
+        name?: string;
+        paths?: readonly string[];
+    }[];
+    discovery_roots: {
+        reason: string;
+        root: string;
+        boundary: string;
+        detail?: string;
+    }[];
+    discovered_stores: {
+        store: string;
+        scope: string;
+        namespace: string;
+        mount_status: string;
+        writable: boolean;
+        reasons: string[];
+        targets: readonly string[];
+        docs: number;
+    }[];
+    discovered_targets: {
+        id: string;
+        kind: string;
+        origin: string;
+        cwd: string;
+        profile_id: string | null;
+        node_id: string | null;
+        stores: readonly string[];
+    }[];
+    repository_namespaces: {
+        repository_root: string;
+        repository_key: string;
+        declaration_path: string;
+        namespace: string;
+        source: string;
+        action: string;
+    }[];
+    store_prefixes: {
+        store_root: string;
+        owner_dir: string;
+        repository_root: string;
+        owner_relative_path: string;
+        old_prefix: string;
+        old_rule: string;
+        effective_prefix: string;
+        nested_declaration_action: string;
+        front_door_action: string;
+    }[];
+    renames: {
+        store_root: string;
+        path: string;
+        from: string;
+        to: string;
+    }[];
+    references: {
+        store_root: string;
+        path: string;
+        kind: string;
+        from: string;
+        to: string;
+    }[];
+    dryRun: boolean;
+    blocked: boolean;
+    corpus_phase: 'not-started' | 'planned' | 'written';
+    wrote: {
+        profile_manifests: string[];
+        documents: string[];
+        corpus_consumers: string[];
+        corpus_identities: string[];
+    };
+    resumed: boolean;
+    resume_error?: string;
+}
+/** `POST /v1/daemon/admit` — opens normal daemon work after preparation. */
+export interface DaemonAdmitDTO {
+    /** True only for the request that began admission. */
+    admitted: boolean;
+    /** True when another request had already begun or completed admission. */
+    already_admitted: boolean;
+    startup_phase: StartupPhaseDTO;
+}
 export interface DaemonRestartDTO {
     accepted: boolean;
     /** The daemon that took the request and is about to hand over. */