@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/runtime/broker/daemon-ops.js

@@ -3,37 +3,70 @@
 // autostart another daemon.
 import { CrtrClient } from '../../../api/client.js';
 import { ApiError } from '../../../api/errors.js';
+import { envExecutionId } from '../../../shared/env.js';
 function daemonClient() {
     return CrtrClient.forLocalSocket({ autostart: false });
 }
+export function brokerExecutionId() {
+    const id = envExecutionId();
+    if (id === undefined || id === '')
+        throw new Error('broker launch is missing CRTR_EXECUTION_ID');
+    return id;
+}
 export function bindBrokerSession(nodeId, request) {
-    return daemonClient().bindBrokerSession(nodeId, request);
+    return daemonClient().bindBrokerSession(nodeId, { ...request, executionId: brokerExecutionId() });
 }
 export function settleBroker(nodeId, request) {
-    return daemonClient().settleBroker(nodeId, request);
+    return daemonClient().settleBroker(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
 }
 export function completeBrokerPark(nodeId, request) {
-    return daemonClient().completeBrokerPark(nodeId, request);
+    return daemonClient().completeBrokerPark(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
 }
 export function recordBrokerParkActivity(nodeId) {
-    return daemonClient().recordBrokerParkActivity(nodeId);
+    return daemonClient().recordBrokerParkActivity(nodeId, { expected_execution_id: brokerExecutionId() });
+}
+export function claimBrokerMail(nodeId, channel) {
+    return daemonClient().claimNodeMail(nodeId, { execution_id: brokerExecutionId(), channel });
+}
+export function acknowledgeBrokerMail(nodeId, deliveries) {
+    return daemonClient().acknowledgeNodeMail(nodeId, { execution_id: brokerExecutionId(), deliveries });
+}
+export function recordBrokerTurn(nodeId, request) {
+    return daemonClient().recordBrokerTurn(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
+}
+export function mutateBrokerProviderRetry(nodeId, request) {
+    return daemonClient().mutateBrokerProviderRetry(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
+}
+export function mutateBrokerFault(nodeId, request) {
+    return daemonClient().mutateBrokerFault(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
+}
+export function brokerRecovery(nodeId) {
+    return daemonClient().getBrokerRecovery(nodeId, brokerExecutionId());
+}
+/** Node-scoped fault writes are for non-broker clients such as attach transport.
+ * Broker-owned recovery mutations use the execution-fenced wrappers above. */
+export function recordNodeFault(nodeId, input) {
+    return daemonClient().recordNodeFault(nodeId, input);
 }
-export function advanceBrokerInboxCursor(nodeId, request) {
-    return daemonClient().advanceBrokerInboxCursor(nodeId, request);
+export function clearNodeFault(nodeId, opts = {}) {
+    return daemonClient().clearNodeFault(nodeId, {
+        ...(opts.link === undefined ? {} : { link: opts.link }),
+        ...(opts.preserveEpisode === undefined ? {} : { preserve_episode: opts.preserveEpisode }),
+    }).then((result) => result.cleared);
 }
 /** Fixed canvas projection for broker extension rendering. It deliberately
  * exposes no generic node/database facade. */
 export function commitBrokerModel(nodeId, request) {
-    return daemonClient().commitBrokerModel(nodeId, request);
+    return daemonClient().commitBrokerModel(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
 }
 export function brokerExtensionState(nodeId) {
     return daemonClient().brokerExtensionState(nodeId);
 }
 export function commitBrokerGeneratedName(nodeId, request) {
-    return daemonClient().commitBrokerGeneratedName(nodeId, request);
+    return daemonClient().commitBrokerGeneratedName(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
 }
 export function commitBrokerPersonaAck(nodeId, request) {
-    return daemonClient().commitBrokerPersonaAck(nodeId, request);
+    return daemonClient().commitBrokerPersonaAck(nodeId, { ...request, expected_execution_id: brokerExecutionId() });
 }
 /** Reports still use the canonical daemon report handler; this broker adapter
  * only preserves terminal structured output's idempotent finalization result. */

package/dist/core/runtime/broker/extension-abort.d.ts

@@ -2,6 +2,9 @@ interface AbortableSession {
     clearQueue(): unknown;
     abort(): Promise<unknown>;
 }
+export declare function refuseTurn(abort: () => void): void;
+export declare function wasTurnRefused(): boolean;
+export declare function clearRefusedTurn(): void;
 /** Mark one synchronous ExtensionContext.abort() call as a refresh boundary. */
 export declare function runRefreshAbort(abort: () => void): void;
 /** Bound into Pi's extension context by the broker for every session generation. */

package/dist/core/runtime/broker/extension-abort.js

@@ -5,6 +5,17 @@
 // Other aborts (notably a critical inbox entry) leave queues intact because the
 // current conversation still owns those already-handed-off messages.
 let refreshAbortScope = false;
+let refusedTurn = false;
+export function refuseTurn(abort) {
+    refusedTurn = true;
+    abort();
+}
+export function wasTurnRefused() {
+    return refusedTurn;
+}
+export function clearRefusedTurn() {
+    refusedTurn = false;
+}
 /** Mark one synchronous ExtensionContext.abort() call as a refresh boundary. */
 export function runRefreshAbort(abort) {
     refreshAbortScope = true;

package/dist/core/runtime/broker/fault-retry.d.ts

@@ -1,5 +1,6 @@
 import type { AgentSessionServices, ModelRegistry } from '@earendil-works/pi-coding-agent';
-import { readFault } from '../fault.js';
+import type { Fault } from '../../fault-classifier.js';
+import type { RecoveryFaultDTO } from '../../../api/dto/recovery.js';
 import type { BrokerSdkConfig } from '../launch.js';
 import type { BrokerToClient } from '../broker-protocol.js';
 import type { BrokerSession } from './read-ops.js';
@@ -26,12 +27,21 @@ export declare class FaultRetry {
     private providerFallbackInFlight;
     private notFoundFallbackInFlight;
     private stagedCapacityFailure;
+    private personaGateFailed;
     constructor(deps: FaultRetryDeps);
     clearTimer(): void;
     reset(): void;
+    /** A failed daemon-backed persona gate is local evidence, not a provider fault. */
+    notePersonaGateFailure(): void;
+    private state;
+    private recordFault;
+    private clearFault;
+    private sessionId;
+    private clearEpisode;
     onEvent(event: BrokerToClient): void;
-    isActiveAutoFault(fault: ReturnType<typeof readFault>): fault is NonNullable<ReturnType<typeof readFault>>;
-    publishSettledProviderFault(generation: SubscriptionGeneration): void;
+    isActiveAutoFault(fault: RecoveryFaultDTO | null): fault is RecoveryFaultDTO;
+    isActiveAutoFault(fault: Fault | null): fault is Fault;
+    publishSettledProviderFault(generation: SubscriptionGeneration): Promise<void>;
     /** Startup re-drive reads the durable episode surviving from the process this
      *  replaces. Revive deliberately clears the ordinary fault marker before this
      *  boundary, so the episode is the recovery authority. A `pending` episode
@@ -44,7 +54,7 @@ export declare class FaultRetry {
      *  it out below), so it is treated the same as "no progress" rather than
      *  blocking the ladder. Returns 'retry-armed' when the timer now owns the
      *  first turn, 'none' when the caller's default kickoff should proceed. */
-    recoverOnStartup(): 'retry-armed' | 'none';
+    recoverOnStartup(): Promise<'retry-armed' | 'none'>;
     /** True iff the branch segment strictly after `anchorEntryId` (root→leaf,
      *  anchor exclusive) contains an assistant message with non-empty content or
      *  a tool result — the two shapes a runtime card and a `content: []`
@@ -52,14 +62,13 @@ export declare class FaultRetry {
      *  branch cannot be distinguished from "no progress" here; callers treat it
      *  as no progress rather than as a positive finding. */
     private hasProgressPastAnchor;
-    schedule(): void;
+    schedule(): Promise<void>;
     private maybeSwitchProviderForRetry;
     private maybeFallbackOnUnusableModel;
     private nextEligibleFallbackRoute;
     private targetCannotFitContext;
     private stageCapacityFailure;
     private recordPendingProviderFault;
-    private sessionFile;
     private pendingEpisodeMatches;
     private faultRetryDelayMs;
     private clearAndArmFaultRetry;

package/dist/core/runtime/broker/fault-retry.js

@@ -1,8 +1,8 @@
-import { realpathSync } from 'node:fs';
 import { envModelIntent, envNodeCwd, envProfileId } from '../../../shared/env.js';
 import { isContextOverflow } from '@earendil-works/pi-ai';
 import { classify } from '../../fault-classifier.js';
-import { admitProviderRetryEpisode, clearFault, clearProviderRetryEpisode, invalidateProviderRetryEpisode, isModelNotFoundError, isProviderUnconfiguredError, readFault, readProviderRetryEpisode, recordFault, recordPendingProviderRetryFault, reopenProviderRetryEpisode, } from '../fault.js';
+import { isModelNotFoundError, isProviderUnconfiguredError } from '../fault.js';
+import { brokerRecovery, mutateBrokerFault, mutateBrokerProviderRetry } from './daemon-ops.js';
 import { extractCoolingDeadline } from '../managed-provider-cooling.js';
 import { extractProviderFailureDetails } from '../../provider-failure.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../model-routes.js';
@@ -15,6 +15,32 @@ import { endedByAbort } from '../session-cycles.js';
 import { resolveProviderCandidates } from '../../subscription-state.js';
 import { announceMessageOrigin } from '../stamp/channel.js';
 const MAX_TIMEOUT_MS = 2_147_483_647;
+function policyFault(fault) {
+    return {
+        link: fault.link,
+        op: fault.op,
+        kind: fault.kind,
+        retry: fault.retry,
+        message: fault.message,
+        since: fault.since,
+        operation_id: fault.operation_id,
+        ...(fault.anchor_entry_id === undefined ? {} : { anchorEntryId: fault.anchor_entry_id }),
+        ...(fault.provider_error === undefined ? {} : { providerError: fault.provider_error }),
+    };
+}
+function faultInput(fault) {
+    return {
+        link: fault.link,
+        op: fault.op,
+        kind: fault.kind,
+        retry: fault.retry,
+        message: fault.message,
+        ...(fault.operation_id === undefined ? {} : { operation_id: fault.operation_id }),
+        ...(fault.since === undefined ? {} : { since: fault.since }),
+        ...(fault.anchorEntryId === undefined ? {} : { anchor_entry_id: fault.anchorEntryId }),
+        ...(fault.providerError === undefined ? {} : { provider_error: fault.providerError }),
+    };
+}
 /** Owns provider fallback and daemon-driven fault retry state for one broker session. */
 export class FaultRetry {
     deps;
@@ -28,6 +54,7 @@ export class FaultRetry {
     // agent_end staging field: message_end precedes agent_end, which resets that
     // field for the ordinary provider result.
     stagedCapacityFailure = null;
+    personaGateFailed = false;
     constructor(deps) {
         this.deps = deps;
     }
@@ -42,6 +69,29 @@ export class FaultRetry {
         this.providerFallbackInFlight = null;
         this.notFoundFallbackInFlight = null;
         this.stagedCapacityFailure = null;
+        this.personaGateFailed = false;
+    }
+    /** A failed daemon-backed persona gate is local evidence, not a provider fault. */
+    notePersonaGateFailure() {
+        this.personaGateFailed = true;
+    }
+    state() {
+        return brokerRecovery(this.deps.nodeId);
+    }
+    async recordFault(input) {
+        return (await mutateBrokerFault(this.deps.nodeId, { op: 'record', input })).fault;
+    }
+    async clearFault(link, preserveEpisode = false) {
+        await mutateBrokerFault(this.deps.nodeId, { op: 'clear', ...(link === undefined ? {} : { link }), ...(preserveEpisode ? { preserve_episode: true } : {}) });
+    }
+    sessionId(session) {
+        const id = session.sessionManager.getSessionId?.();
+        return typeof id === 'string' && id !== '' ? id : null;
+    }
+    async clearEpisode(session) {
+        const sessionId = this.sessionId(session);
+        if (sessionId !== null)
+            await mutateBrokerProviderRetry(this.deps.nodeId, { op: 'clear', session_id: sessionId });
     }
     onEvent(event) {
         this.maybeSwitchProviderForRetry(event);
@@ -56,13 +106,15 @@ export class FaultRetry {
             return false;
         return fault.kind === 'connection' || fault.kind === 'rate-limit' || fault.kind === 'overloaded';
     }
-    publishSettledProviderFault(generation) {
+    async publishSettledProviderFault(generation) {
         const agentEnd = generation.stagedProviderAgentEnd;
         const watchdogAbort = generation.stagedWatchdogAbort;
         const refreshAbort = generation.stagedRefreshAbort;
         const overflowFailure = generation.stagedOverflowFailure;
         const capacityFailure = this.stagedCapacityFailure?.generation === generation ? this.stagedCapacityFailure : null;
+        const personaGateFailed = this.personaGateFailed;
         this.stagedCapacityFailure = null;
+        this.personaGateFailed = false;
         generation.stagedProviderAgentEnd = null;
         generation.stagedWatchdogAbort = false;
         generation.stagedRefreshAbort = false;
@@ -71,54 +123,52 @@ export class FaultRetry {
         // turn_end clears the ordinary marker before this settlement. A failed
         // admitted retry therefore carries from its durable episode, while an
         // initial provider failure still reads from the ordinary marker.
-        const prior = readFault(this.deps.nodeId);
-        // A persona gate runs before Pi contacts a provider. It records a typed
-        // local API transport failure, then Pi represents that thrown error as a
-        // generic provider-looking agent_end. Keep its actual boundary instead of
-        // turning it into a fatal pi→provider `other` fault.
-        if (prior?.link === 'broker↔crtrd' && prior.kind === 'connection') {
-            clearProviderRetryEpisode(this.deps.nodeId);
-            return;
-        }
-        const durableEpisode = readProviderRetryEpisode(this.deps.nodeId);
+        const initialState = await this.state();
+        const prior = initialState.fault;
+        const durableEpisode = initialState.episode;
+        const sessionId = this.sessionId(settledSession);
         const episodeFault = this.isActiveAutoFault(prior) && prior.link === 'pi→provider'
             ? prior
             : durableEpisode?.state === 'admitted' &&
-                durableEpisode.sessionFile === this.sessionFile(settledSession) &&
+                durableEpisode.session_id === sessionId &&
                 this.isActiveAutoFault(durableEpisode.fault)
                 ? durableEpisode.fault
                 : null;
         const episode = episodeFault === null
             ? null
-            : { since: episodeFault.since, anchorEntryId: episodeFault.anchorEntryId, attempt: episodeFault.retry.attempt };
+            : { since: episodeFault.since, anchorEntryId: episodeFault.anchor_entry_id, attempt: episodeFault.retry.attempt };
         const messages = Array.isArray(agentEnd?.messages) ? agentEnd.messages : [];
         const last = [...messages].reverse().find((message) => typeof message === 'object' && message !== null && message.role === 'assistant');
+        if (personaGateFailed) {
+            await this.clearEpisode(settledSession);
+            return;
+        }
         if (capacityFailure !== null || overflowFailure !== null) {
-            clearFault(this.deps.nodeId, { link: 'pi→provider' });
-            clearProviderRetryEpisode(this.deps.nodeId);
-            recordFault(this.deps.nodeId, {
+            await this.clearFault('pi→provider');
+            await this.clearEpisode(settledSession);
+            await this.recordFault({
                 link: 'pi→provider', op: 'context overflow recovery', kind: 'context-overflow', retry: { disposition: 'fatal' },
-                message: capacityFailure?.errorMessage ?? overflowFailure.errorMessage, anchorEntryId: settledSession.sessionManager.getLeafId?.() ?? undefined,
+                message: capacityFailure?.errorMessage ?? overflowFailure.errorMessage, anchor_entry_id: settledSession.sessionManager.getLeafId?.() ?? undefined,
             });
             return;
         }
         if (watchdogAbort && last?.stopReason === 'aborted') {
-            this.recordPendingProviderFault(settledSession, {
+            await this.recordPendingProviderFault(settledSession, {
                 link: 'pi→provider', op: 'generation turn', kind: 'connection',
                 retry: { disposition: 'auto', by: 'daemon', ...(episode?.attempt !== undefined ? { attempt: episode.attempt } : {}) },
                 message: typeof last.errorMessage === 'string' ? last.errorMessage : 'engine error (no errorMessage recorded)',
                 ...(episode !== null ? { since: episode.since } : {}),
-                anchorEntryId: episode?.anchorEntryId ?? settledSession.sessionManager.getLeafId?.() ?? undefined,
+                anchor_entry_id: episode?.anchorEntryId ?? settledSession.sessionManager.getLeafId?.() ?? undefined,
             });
             return;
         }
         if (last?.stopReason !== 'error') {
             if (last !== undefined)
-                clearProviderRetryEpisode(this.deps.nodeId);
+                await this.clearEpisode(settledSession);
             return;
         }
         if (refreshAbort) {
-            clearProviderRetryEpisode(this.deps.nodeId);
+            await this.clearEpisode(settledSession);
             return;
         }
         const raw = typeof last.errorMessage === 'string' ? last.errorMessage : 'engine error (no errorMessage recorded)';
@@ -126,7 +176,7 @@ export class FaultRetry {
         // and settles as an error rather than `aborted`. Something asked that turn
         // to stop, so there is no provider fault to record.
         if (endedByAbort({ stopReason: 'error', errorMessage: raw })) {
-            clearProviderRetryEpisode(this.deps.nodeId);
+            await this.clearEpisode(settledSession);
             return;
         }
         const uncompactedOverflow = isContextOverflow(last, settledSession.model?.contextWindow);
@@ -139,8 +189,8 @@ export class FaultRetry {
             ? undefined
             : { provider, model, ...failure };
         if (uncompactedOverflow) {
-            clearFault(this.deps.nodeId, { link: 'pi→provider' });
-            clearProviderRetryEpisode(this.deps.nodeId);
+            await this.clearFault('pi→provider');
+            await this.clearEpisode(settledSession);
         }
         const faultInput = {
             link: 'pi→provider', op: 'generation turn', kind: uncompactedOverflow ? 'context-overflow' : classified.kind,
@@ -155,16 +205,16 @@ export class FaultRetry {
                     : { disposition: classified.disposition },
             message: raw,
             ...(!uncompactedOverflow && classified.disposition === 'auto' && episode !== null ? { since: episode.since } : {}),
-            anchorEntryId: !uncompactedOverflow && classified.disposition === 'auto' && episode?.anchorEntryId !== undefined
+            anchor_entry_id: !uncompactedOverflow && classified.disposition === 'auto' && episode?.anchorEntryId !== undefined
                 ? episode.anchorEntryId
                 : settledSession.sessionManager.getLeafId?.() ?? undefined,
-            ...(providerError === undefined ? {} : { providerError }),
+            ...(providerError === undefined ? {} : { provider_error: providerError }),
         };
         if (faultInput.retry.disposition === 'auto')
-            this.recordPendingProviderFault(settledSession, faultInput);
+            await this.recordPendingProviderFault(settledSession, faultInput);
         else {
-            clearProviderRetryEpisode(this.deps.nodeId);
-            recordFault(this.deps.nodeId, faultInput);
+            await this.clearEpisode(settledSession);
+            await this.recordFault(faultInput);
         }
     }
     /** Startup re-drive reads the durable episode surviving from the process this
@@ -179,42 +229,42 @@ export class FaultRetry {
      *  it out below), so it is treated the same as "no progress" rather than
      *  blocking the ladder. Returns 'retry-armed' when the timer now owns the
      *  first turn, 'none' when the caller's default kickoff should proceed. */
-    recoverOnStartup() {
+    async recoverOnStartup() {
         const generation = this.deps.installedGeneration();
         if (generation === undefined)
             return 'none';
-        const episode = readProviderRetryEpisode(this.deps.nodeId);
-        const sessionFile = this.sessionFile(generation.session);
+        const episode = (await this.state()).episode;
+        const sessionId = this.sessionId(generation.session);
         // A new-cycle launch deliberately roots a new transcript branch even though
         // it reuses the same .jsonl. Its old anchor is no longer a valid recovery
         // coordinate, so mark the episode invalid rather than inferring that from
         // the shared path or letting startup re-drive into the fresh cycle.
         if (this.deps.cfg.newCycle === true) {
-            if (episode !== null && sessionFile !== null && episode.sessionFile === sessionFile) {
-                invalidateProviderRetryEpisode(this.deps.nodeId, sessionFile);
+            if (episode !== null && sessionId !== null && episode.session_id === sessionId) {
+                await mutateBrokerProviderRetry(this.deps.nodeId, { op: 'invalidate', session_id: sessionId });
             }
             return 'none';
         }
-        if (episode === null || sessionFile === null || episode.sessionFile !== sessionFile)
+        if (episode === null || sessionId === null || episode.session_id !== sessionId)
             return 'none';
         if (episode.state === 'admitted') {
-            if (episode.anchorEntryId !== null && !this.hasProgressPastAnchor(generation.session, episode.anchorEntryId)) {
-                if (!reopenProviderRetryEpisode(this.deps.nodeId, sessionFile))
+            if (episode.fault.anchor_entry_id !== undefined && !this.hasProgressPastAnchor(generation.session, episode.fault.anchor_entry_id)) {
+                if (!(await mutateBrokerProviderRetry(this.deps.nodeId, { op: 'reopen', session_id: sessionId })).applied)
                     return 'none';
             }
             else {
                 // Progress detected past the anchor (or no anchor to prove against) — the
                 // dead attempt did real work. Never roll that back; clear the episode and
                 // let the caller's default kickoff continue where it actually got to.
-                clearProviderRetryEpisode(this.deps.nodeId);
+                await this.clearEpisode(generation.session);
                 return 'none';
             }
         }
         else if (episode.state !== 'pending') {
             return 'none';
         }
-        recordFault(this.deps.nodeId, episode.fault);
-        this.schedule();
+        await this.recordFault(faultInput(policyFault(episode.fault)));
+        await this.schedule();
         return 'retry-armed';
     }
     /** True iff the branch segment strictly after `anchorEntryId` (root→leaf,
@@ -236,17 +286,17 @@ export class FaultRetry {
             return message.role === 'assistant' && Array.isArray(message.content) && message.content.length > 0;
         });
     }
-    schedule() {
+    async schedule() {
         const generation = this.deps.installedGeneration();
         const session = this.deps.currentSession();
         if (generation === undefined || session.isStreaming || this.timer !== null)
             return;
-        const fault = readFault(this.deps.nodeId);
-        // A live session without a durable transcript path still owns its ordinary
-        // in-process timer; it simply cannot survive broker death. Once a path
-        // exists, require its pending episode so admitted/invalidated retries stay
-        // inert even before a replacement broker starts.
-        if (!this.isActiveAutoFault(fault) || (this.sessionFile(session) !== null && !this.pendingEpisodeMatches(session, fault))) {
+        const state = await this.state();
+        const fault = state.fault;
+        // A live session without a durable session binding still owns its ordinary
+        // in-process timer; once one exists, require its pending episode so
+        // admitted/invalidated retries stay inert before replacement startup.
+        if (!this.isActiveAutoFault(fault) || (this.sessionId(session) !== null && !this.pendingEpisodeMatches(session, fault, state))) {
             this.clearTimer();
             return;
         }
@@ -355,7 +405,7 @@ export class FaultRetry {
             if (this.deps.installedGeneration() !== generation || this.deps.currentSession() !== candidateSession)
                 return;
             if (unconfigured)
-                clearFault(this.deps.nodeId, { link: 'pi→provider' });
+                await this.clearFault('pi→provider');
             const fallbackCard = formatCard('recovery', {}, formatModelFallbackRecovery(currentSpec, resolved, unconfigured ? 'credential' : 'not-found'));
             announceMessageOrigin(fallbackCard, { type: 'runtime', kind: 'recovery' });
             await this.deps.turnAdmission.admit((release) => operationIdContext.fresh(() => candidateSession.prompt(fallbackCard, { preflightResult: release })));
@@ -399,42 +449,31 @@ export class FaultRetry {
                 : 'All available fallback models have context windows smaller than the current conversation.',
         };
     }
-    recordPendingProviderFault(session, input) {
-        const sessionFile = this.sessionFile(session);
-        // A pathless session cannot be crash-recovered, but its live broker still
-        // owns the ordinary auto-retry timer.
-        if (sessionFile === null) {
-            recordFault(this.deps.nodeId, input);
+    async recordPendingProviderFault(session, input) {
+        const sessionId = this.sessionId(session);
+        // A session without a daemon binding cannot crash-recover, but its live
+        // broker still records its ordinary auto-retry fault.
+        if (sessionId === null) {
+            await this.recordFault(input);
             return;
         }
-        recordPendingProviderRetryFault(this.deps.nodeId, sessionFile, input);
+        await mutateBrokerProviderRetry(this.deps.nodeId, { op: 'record-pending', session_id: sessionId, input });
     }
-    sessionFile(session) {
-        if (typeof session.sessionFile !== 'string' || session.sessionFile === '')
-            return null;
-        try {
-            return realpathSync(session.sessionFile);
-        }
-        catch {
-            return session.sessionFile;
-        }
-    }
-    pendingEpisodeMatches(session, fault) {
-        const sessionFile = this.sessionFile(session);
-        const episode = readProviderRetryEpisode(this.deps.nodeId);
-        return sessionFile !== null &&
+    pendingEpisodeMatches(session, fault, state) {
+        const sessionId = this.sessionId(session);
+        const episode = state.episode;
+        return sessionId !== null &&
             episode !== null &&
             episode.state === 'pending' &&
-            episode.sessionFile === sessionFile &&
-            episode.fault.since === fault.since &&
-            episode.anchorEntryId === (fault.anchorEntryId ?? null);
+            episode.session_id === sessionId &&
+            episode.fault.fault_id === fault.fault_id;
     }
     faultRetryDelayMs(fault, now) {
         if (fault.retry.nextAt !== undefined) {
             const ms = Date.parse(fault.retry.nextAt) - now;
             return Number.isFinite(ms) ? Math.max(0, ms) : null;
         }
-        return nextFaultRetry(fault, now)?.delayMs ?? null;
+        return nextFaultRetry(policyFault(fault), now)?.delayMs ?? null;
     }
     clearAndArmFaultRetry(delayMs, generation) {
         if (this.deps.installedGeneration() !== generation)
@@ -464,7 +503,7 @@ export class FaultRetry {
         const candidateSession = generation.session;
         if (candidateSession.isStreaming)
             return;
-        const initial = readFault(this.deps.nodeId);
+        const initial = (await this.state()).fault;
         if (!this.isActiveAutoFault(initial))
             return;
         let fault = initial;
@@ -472,7 +511,7 @@ export class FaultRetry {
             const online = await this.deps.retryProbe();
             if (this.deps.installedGeneration() !== generation || this.deps.currentSession() !== candidateSession || candidateSession.isStreaming)
                 return;
-            const fresh = readFault(this.deps.nodeId);
+            const fresh = (await this.state()).fault;
             if (!this.isActiveAutoFault(fresh) || fresh.since !== initial.since)
                 return;
             if (!online) {
@@ -484,20 +523,20 @@ export class FaultRetry {
         const attempt = fault.retry.attempt ?? 0;
         const policy = policyFor(fault.kind);
         if (attempt >= policy.max) {
-            recordFault(this.deps.nodeId, markFatalOnExhaust(fault));
-            clearProviderRetryEpisode(this.deps.nodeId);
+            await this.recordFault(faultInput(markFatalOnExhaust(policyFault(fault))));
+            await this.clearEpisode(candidateSession);
             return;
         }
-        const plan = nextFaultRetry(fault, Date.now());
+        const plan = nextFaultRetry(policyFault(fault), Date.now());
         if (plan === null) {
-            recordFault(this.deps.nodeId, markFatalOnExhaust(fault));
-            clearProviderRetryEpisode(this.deps.nodeId);
+            await this.recordFault(faultInput(markFatalOnExhaust(policyFault(fault))));
+            await this.clearEpisode(candidateSession);
             return;
         }
-        if (fault.anchorEntryId !== undefined) {
+        if (fault.anchor_entry_id !== undefined) {
             try {
-                if ((candidateSession.sessionManager.getLeafId?.() ?? null) !== fault.anchorEntryId) {
-                    await candidateSession.navigateTree(fault.anchorEntryId);
+                if ((candidateSession.sessionManager.getLeafId?.() ?? null) !== fault.anchor_entry_id) {
+                    await candidateSession.navigateTree(fault.anchor_entry_id);
                     if (this.deps.installedGeneration() !== generation || this.deps.currentSession() !== candidateSession)
                         return;
                 }
@@ -508,27 +547,35 @@ export class FaultRetry {
         }
         if (this.deps.installedGeneration() !== generation || this.deps.currentSession() !== candidateSession)
             return;
-        await this.deps.turnAdmission.admit((release) => {
-            const current = readFault(this.deps.nodeId);
+        await this.deps.turnAdmission.admit(async (release) => {
+            const current = (await this.state()).fault;
             if (this.deps.installedGeneration() !== generation ||
                 this.deps.currentSession() !== candidateSession ||
                 candidateSession.isStreaming ||
                 !this.isActiveAutoFault(current) ||
                 current.since !== fault.since) {
                 release();
-                return Promise.resolve();
+                return;
             }
             // This is the admission point: all generation/session/streaming/fault
             // revalidation above has passed, and only now may the durable episode
-            // become admitted. Writing it before prompt() fails closed across a broker
-            // death in the narrow handoff to the SDK — replaying there could duplicate
-            // an already accepted recovery turn.
-            const sessionFile = this.sessionFile(candidateSession);
-            if (sessionFile !== null && !admitProviderRetryEpisode(this.deps.nodeId, sessionFile, plan.fault)) {
+            // become admitted. A rejected or failed mutation releases without
+            // calling prompt, so stale brokers never run a recovery turn.
+            const sessionId = this.sessionId(candidateSession);
+            if (sessionId === null) {
                 release();
-                return Promise.resolve();
+                return;
+            }
+            const admitted = await mutateBrokerProviderRetry(this.deps.nodeId, {
+                op: 'admit',
+                session_id: sessionId,
+                fault_id: current.fault_id,
+                retry: plan.fault.retry,
+            });
+            if (!admitted.applied) {
+                release();
+                return;
             }
-            recordFault(this.deps.nodeId, plan.fault);
             // The attempt facts are what makes a rolled-back retry legible: every
             // superseded attempt falls off the active branch, so this one card is the
             // whole visible record of the sequence, and without them a reader cannot