@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/runtime/broker/inbox.d.ts

@@ -1,26 +1,7 @@
+import type { MailEntryDTO } from '../../../api/dto/mail.js';
 import type { BrokerReportNodeDTO } from '../../../api/dto/broker-ops.js';
-import type { OperationId } from '../../events/types.js';
-export type BrokerInboxEntryId = string & {
-    readonly __brokerInboxEntryId: unique symbol;
-};
-export interface BrokerInboxEntry {
-    entry_id: BrokerInboxEntryId;
-    operation_id: OperationId;
-    ts: string;
-    from: string | null;
-    from_name?: string;
-    tier: 'critical' | 'urgent' | 'normal' | 'deferred';
-    kind: 'update' | 'urgent' | 'final' | 'message' | 'completed';
-    ref?: string;
-    label: string;
-    data?: Record<string, unknown>;
-    /** Set only by the human-ticket settlement paths; absent means an ordinary report. */
-    disposition?: 'human-answer' | 'human-canceled';
-}
-export declare function readBrokerCursor(nodeId: string): BrokerInboxEntryId | undefined;
-export declare function readBrokerInboxSince(nodeId: string, cursor?: string): BrokerInboxEntry[];
-export declare function readBrokerInboxRange(nodeId: string, after: string | undefined, through: string): BrokerInboxEntry[];
-export declare function readBrokerCanceledEntryIds(nodeId: string): Set<BrokerInboxEntryId>;
+export type BrokerInboxEntryId = string;
+export type BrokerInboxEntry = MailEntryDTO;
 /** The node id a canonical report ref points at, or undefined when the ref is
  *  absent, absolute, or not a report path. Callers use it to tell whether the
  *  report-node projection they hold can still resolve the ref. */
@@ -41,14 +22,5 @@ export interface InboxDelivery {
     cards: readonly string[];
     entries: readonly BrokerInboxEntry[];
 }
-/** Split unread entries into ordered deliveries: each human entry verbatim, and
- *  each CONTIGUOUS run of node/system entries as one card in the physical slot
- *  that run occupies. A deferred-only card is folded into the person's delivery
- *  waiting immediately behind it rather than being deliverable on its own.
- *
- *  The runs are what keep the cursor honest. Exactly one delivery goes out per
- *  cycle and the rest requeue, while a sent delivery commits the cursor across
- *  its own entries — so a delivery that spanned a person's message would commit
- *  past words this cycle never sent. A run can never span one, and node mail
- *  that arrived after a person's message now waits behind it. */
+/** Keep each person's words separate and in order; fold preceding deferred context into that same input. */
 export declare function coalesceBrokerInbox(entries: readonly BrokerInboxEntry[], reportNodes: ReadonlyMap<string, BrokerReportNodeDTO>): readonly InboxDelivery[];

package/dist/core/runtime/broker/inbox.js

@@ -1,90 +1,11 @@
-// Broker-local inbox access and rendering. The daemon owns feed delivery; a
-// broker only reads its own files and uses daemon-projected report senders.
-import { existsSync, readFileSync } from 'node:fs';
-import { inboxPath, nodeDir } from '../../canvas/paths.js';
+// Broker inbox rendering uses daemon-projected mail and file-backed report bodies.
+import { readFileSync } from 'node:fs';
+import { nodeDir } from '../../canvas/paths.js';
 import { formatInboxCard, formatInboxRefInstruction } from '../../../shared/generated-context.js';
 import { renderBirthAnnouncementBody } from '../../../shared/birth-announcement.js';
-const ENTRY_ID = /^(?!0{32}$)[0-9a-f]{32}$/;
 const BODY_MAX_LINES = 12;
 const BODY_MAX_CHARS = 1000;
 const INLINE_REPORT_MAX_CHARS = 1000;
-function entryId(value) {
-    if (typeof value !== 'string' || !ENTRY_ID.test(value))
-        throw new TypeError('entry_id must be 32 lowercase non-zero hexadecimal characters');
-    return value;
-}
-function readPhysicalInbox(nodeId) {
-    const path = inboxPath(nodeId);
-    if (!existsSync(path))
-        return [];
-    const raw = readFileSync(path, 'utf8');
-    if (raw === '')
-        return [];
-    const lines = raw.split('\n');
-    if (lines.at(-1) === '')
-        lines.pop();
-    if (lines.some((line) => line.trim() === ''))
-        throw new Error('inbox contains a blank physical line');
-    const entries = lines.map((line) => {
-        const parsed = JSON.parse(line);
-        parsed.entry_id = entryId(parsed.entry_id);
-        return parsed;
-    });
-    const seen = new Set();
-    for (const entry of entries) {
-        if (seen.has(entry.entry_id))
-            throw new Error(`duplicate inbox entry_id: ${entry.entry_id}`);
-        seen.add(entry.entry_id);
-    }
-    return entries;
-}
-function cursorPath(nodeId) {
-    return `${inboxPath(nodeId)}.cursor`;
-}
-export function readBrokerCursor(nodeId) {
-    const path = cursorPath(nodeId);
-    if (!existsSync(path))
-        return undefined;
-    const raw = readFileSync(path, 'utf8').trim();
-    return raw === '' ? undefined : entryId(raw);
-}
-export function readBrokerInboxSince(nodeId, cursor) {
-    const entries = readPhysicalInbox(nodeId);
-    if (cursor === undefined)
-        return entries;
-    const index = entries.findIndex((entry) => entry.entry_id === entryId(cursor));
-    if (index < 0)
-        throw new Error(`inbox cursor entry_id not found: ${entryId(cursor)}`);
-    return entries.slice(index + 1);
-}
-export function readBrokerInboxRange(nodeId, after, through) {
-    const entries = readPhysicalInbox(nodeId);
-    const throughId = entryId(through);
-    const throughIndex = entries.findIndex((entry) => entry.entry_id === throughId);
-    if (throughIndex < 0)
-        throw new Error(`inbox range through entry_id not found: ${throughId}`);
-    if (after === undefined)
-        return entries.slice(0, throughIndex + 1);
-    const afterId = entryId(after);
-    const afterIndex = entries.findIndex((entry) => entry.entry_id === afterId);
-    if (afterIndex < 0)
-        throw new Error(`inbox range after entry_id not found: ${afterId}`);
-    if (afterIndex >= throughIndex)
-        throw new Error(`inbox range is reversed: ${afterId} through ${throughId}`);
-    return entries.slice(afterIndex + 1, throughIndex + 1);
-}
-export function readBrokerCanceledEntryIds(nodeId) {
-    const path = `${inboxPath(nodeId)}.canceled`;
-    if (!existsSync(path))
-        return new Set();
-    const out = new Set();
-    for (const line of readFileSync(path, 'utf8').split('\n')) {
-        const value = line.trim();
-        if (value !== '')
-            out.add(entryId(value));
-    }
-    return out;
-}
 function inlineBody(entry) {
     const body = typeof entry.data?.['body'] === 'string' ? String(entry.data['body']).trim() : '';
     return body === '' || body === entry.label ? '' : body;
@@ -174,16 +95,7 @@ export function entryCards(entry) {
         return [];
     return cards.filter((card) => typeof card === 'string');
 }
-/** Split unread entries into ordered deliveries: each human entry verbatim, and
- *  each CONTIGUOUS run of node/system entries as one card in the physical slot
- *  that run occupies. A deferred-only card is folded into the person's delivery
- *  waiting immediately behind it rather than being deliverable on its own.
- *
- *  The runs are what keep the cursor honest. Exactly one delivery goes out per
- *  cycle and the rest requeue, while a sent delivery commits the cursor across
- *  its own entries — so a delivery that spanned a person's message would commit
- *  past words this cycle never sent. A run can never span one, and node mail
- *  that arrived after a person's message now waits behind it. */
+/** Keep each person's words separate and in order; fold preceding deferred context into that same input. */
 export function coalesceBrokerInbox(entries, reportNodes) {
     const deliveries = [];
     let run = [];

package/dist/core/runtime/broker/rebind.d.ts

@@ -70,6 +70,7 @@ export declare class RebindDriver {
     private removeInstalledSubscription;
     private captureSystemPrompt;
     private executeSubscriptionCallback;
+    private publishAndScheduleProviderRecovery;
     private ackTo;
 }
 export {};

package/dist/core/runtime/broker/rebind.js

@@ -5,7 +5,7 @@ import { emitEvent } from '../../events/emit.js';
 import { operationIdContext } from '../../events/operation-id.js';
 import { installPersonaTransitionGate } from '../broker-persona-guidance.js';
 import { abortSessionFromExtension } from './extension-abort.js';
-import { clearFault, invalidateProviderRetryEpisode, readFault } from '../fault.js';
+import { brokerRecovery, mutateBrokerFault, mutateBrokerProviderRetry } from './daemon-ops.js';
 const MAX_ADMITTED_REPLACEMENTS = 2;
 const REPLACEMENT_DEADLINE_MS = 30_000;
 const REPLACEMENT_DEADLINE_EXCEEDED = Symbol('replacement-deadline-exceeded');
@@ -101,15 +101,15 @@ export class RebindDriver {
             // every later rebind explicitly marks the old session's episode invalid.
             if (this.installed !== undefined) {
                 if (typeof this.sessionValue.sessionFile === 'string' && this.sessionValue.sessionFile !== '') {
-                    invalidateProviderRetryEpisode(this.deps.nodeId, this.sessionValue.sessionFile);
+                    await mutateBrokerProviderRetry(this.deps.nodeId, { op: 'invalidate', session_id: this.sessionValue.sessionManager.getSessionId() });
                 }
                 // A daemon-owned auto marker belongs to the outgoing session whether
                 // that session has a durable path or not. Retaining it lets the
                 // replacement inherit an old anchor, attempts, and backoff; fatal and
                 // manual markers stay visible.
-                const fault = readFault(this.deps.nodeId);
+                const fault = (await brokerRecovery(this.deps.nodeId)).fault;
                 if (fault?.link === 'pi→provider' && fault.retry.disposition === 'auto' && fault.retry.by === 'daemon') {
-                    clearFault(this.deps.nodeId, { link: 'pi→provider', preserveProviderRetryEpisode: true });
+                    await mutateBrokerFault(this.deps.nodeId, { op: 'clear', link: 'pi→provider', preserve_episode: true });
                 }
             }
             this.installed?.executingTools.clear();
@@ -149,7 +149,7 @@ export class RebindDriver {
                 installPersonaTransitionGate(this.deps.nodeId, {
                     agent,
                     sessionManager: candidateSession.sessionManager,
-                });
+                }, () => this.deps.faultRetry().notePersonaGateFailure());
                 agent.steeringMode = 'all';
                 agent.followUpMode = 'all';
                 installTrailingThinkingGuard(agent);
@@ -288,21 +288,30 @@ export class RebindDriver {
                 generation.stagedOverflowFailure = { errorMessage: event.errorMessage };
             if (event.type === 'agent_settled') {
                 this.agentRunActiveValue = false;
-                this.deps.faultRetry().publishSettledProviderFault(generation);
-                if (this.shutdownRequested) {
-                    this.deps.disposeAndExit('shutdown-after-settle');
-                    return;
-                }
+                void this.publishAndScheduleProviderRecovery(generation);
             }
             this.deps.toolGroups.observeToolGroupEvent(event);
             this.deps.projection().relayEvent(event, generation);
-            if (event.type === 'agent_settled')
-                this.deps.faultRetry().schedule();
         }
         catch (err) {
             emitEvent({ level: 'debug', event: 'broker.runtime.diagnostic', fields: { message: `event relay threw: ${String(err)}` } });
         }
     }
+    async publishAndScheduleProviderRecovery(generation) {
+        try {
+            await this.deps.faultRetry().publishSettledProviderFault(generation);
+            if (this.shutdownRequested) {
+                this.deps.disposeAndExit('shutdown-after-settle');
+                return;
+            }
+            await this.deps.faultRetry().schedule();
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'broker.daemon.operation.failed', node_id: this.deps.nodeId, error, fields: { operation: 'provider_fault_settlement' } });
+            if (this.shutdownRequested)
+                this.deps.disposeAndExit('shutdown-after-settle');
+        }
+    }
     ackTo(client, op, ok = true, detail, id) {
         this.deps.registry.sendFrame(client, { type: 'ack', for: op, ok, ...(detail !== undefined ? { detail } : {}), ...(id !== undefined ? { id } : {}) });
     }

package/dist/core/runtime/broker-persona-guidance.d.ts

@@ -23,5 +23,5 @@ interface PersonaTransitionSession {
     };
 }
 /** Gate each provider request on durable delivery of the current persona delta. */
-export declare function installPersonaTransitionGate(nodeId: string, session: PersonaTransitionSession): void;
+export declare function installPersonaTransitionGate(nodeId: string, session: PersonaTransitionSession, noteFailure?: () => void): void;
 export {};

package/dist/core/runtime/broker-persona-guidance.js

@@ -1,7 +1,5 @@
 import { contextDir } from '../canvas/paths.js';
-import { isDaemonTransportApiError } from '../../api/errors.js';
 import { emitEvent } from '../events/emit.js';
-import { clearFault, recordFault } from './fault.js';
 import { brokerExtensionState, commitBrokerPersonaAck } from './broker/daemon-ops.js';
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { buildSubPersonaMenu, renderConfigChangeDelta } from '../substrate/render.js';
@@ -115,7 +113,7 @@ export async function deliverPendingPersonaTransition(initialState, deliver) {
     }
 }
 /** Gate each provider request on durable delivery of the current persona delta. */
-export function installPersonaTransitionGate(nodeId, session) {
+export function installPersonaTransitionGate(nodeId, session, noteFailure = () => { }) {
     const { agent } = session;
     const previousTransform = agent.transformContext;
     agent.transformContext = async (messages, signal) => {
@@ -139,19 +137,10 @@ export function installPersonaTransitionGate(nodeId, session) {
                 for (const context of new Set([active, messages, transformed]))
                     context.push(message);
             });
-            clearFault(nodeId, { link: 'broker↔crtrd' });
             return transformed;
         }
         catch (error) {
-            if (isDaemonTransportApiError(error)) {
-                recordFault(nodeId, {
-                    link: 'broker↔crtrd',
-                    op: 'persona transition',
-                    kind: 'connection',
-                    retry: { disposition: 'manual' },
-                    message: error.message,
-                });
-            }
+            noteFailure();
             emitEvent({
                 event: 'broker.daemon.operation.failed',
                 level: 'error',

package/dist/core/runtime/broker.js

@@ -16,7 +16,7 @@
 // + model registry are real SDK construction helpers (NOT part of the swappable
 // engine seam — the fake engine receives the real, extension-loaded loader so
 // the real canvas-stophook fires session_start).
-import { envModelIntent, envNodeCwd, envProfileId } from '../../shared/env.js';
+import { envModelIntent, envNodeCwd, envNodeId, envProfileId } from '../../shared/env.js';
 import { createServer } from 'node:net';
 import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
@@ -34,8 +34,7 @@ import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
 import { resolveBundledPiPackageDir } from './pi-cli.js';
 import { captureSessionChatCapabilities } from './command-surface.js';
 import { PoolCredentialStore } from '../pool-credential-store.js';
-import { clearCleanAbort, markBusy, markCleanAbort } from './busy.js';
-import { clearFault, recordFaultForCurrentNode } from './fault.js';
+import { mutateBrokerFault, recordBrokerTurn } from './broker/daemon-ops.js';
 import { modelRequestFromConfig, selectInitialModelRoute, unregisteredConcreteModel } from '../model-routes.js';
 import { KNOWN_STREAM_WAIT_UI } from './stream-watchdog.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
@@ -121,10 +120,6 @@ export function disposeActiveSession() {
 }
 // runBroker — the broker process body (plan T4 steps 1–6)
 export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), startupTs = new Date().toISOString()) {
-    // A clean-abort certificate belongs only to the dead broker that wrote it.
-    // Fleet classification consumes it as proof that the dead broker had a turn
-    // in flight even though Pi's settled abort already cleared the busy marker.
-    clearCleanAbort(nodeId);
     // The canonical broker event source (job/log.jsonl) is bound before any other
     // work in this function — no path/env/state setup may precede it, and the
     // binder independently validates nodeId before constructing that path.
@@ -619,7 +614,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         emitEvent({ level: 'error', event: 'broker.socket.failed', error: err });
         disposeAndExit('socket-error', 1);
     });
-    server.listen(sockPath, () => {
+    server.listen(sockPath, async () => {
         // Binding view.sock is the exact inverse of a `connect ENOENT view.sock`
         // fault, so the moment the listener accepts, any socket-absence marker a
         // viewer/relay recorded during the revive→bind gap is provably stale. The
@@ -627,15 +622,25 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         // waiting for a client to reconnect — a headless node with nobody attached
         // never gets that reconnect, which is how the stale ⚠ leaked. A genuine
         // post-bind failure is re-recorded by the next failed client op.
-        clearFault(nodeId, { link: 'viewer↔broker' });
-        clearFault(nodeId, { link: 'relay↔broker' });
+        void Promise.all([
+            mutateBrokerFault(nodeId, { op: 'clear', link: 'viewer↔broker' }),
+            mutateBrokerFault(nodeId, { op: 'clear', link: 'relay↔broker' }),
+        ]).catch((error) => emitEvent({ level: 'error', event: 'broker.daemon.operation.failed', node_id: nodeId, error, fields: { operation: 'broker_socket_bound_fault_clear' } }));
         // The listener is also the broker startup boundary: a pending or
         // surviving-admitted provider episode is re-armed only once this
         // replacement can accept its normal viewer/daemon traffic. Independent of
         // the link faults cleared above — those are viewer/relay socket markers,
         // this is the provider retry episode. An invalidated record is
         // intentionally inert inside FaultRetry.
-        const recovery = faultRetry.recoverOnStartup();
+        let recovery;
+        try {
+            recovery = await faultRetry.recoverOnStartup();
+        }
+        catch (error) {
+            emitEvent({ level: 'error', event: 'broker.daemon.operation.failed', node_id: nodeId, error, fields: { operation: 'recovery_startup' } });
+            disposeAndExit('recovery-startup-failed', 1);
+            return;
+        }
         // A launch prompt delivers only after the listener is accepting, so a
         // root-spawn readiness proof and prompt admission share one boundary. This
         // includes the one continuation carried by a clean runtime-abort resume.
@@ -666,13 +671,8 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // Initialize presence to the truthful zero state at boot — this also
     // overwrites a stale attach.json a crashed prior incarnation left behind.
     registry.persistAttachState();
-    // A daemon fleet bounce gives a busy Pi a short, bounded chance to persist
-    // its aborted turn before teardown. `session.abort()` resolves only after Pi
-    // reaches idle (and thus after its message_end persistence); only then may we
-    // leave the durable clean-abort certificate that preserves the otherwise
-    // cleared evidence that this broker had a turn in flight. A timeout/rejection
-    // deliberately leaves no certificate: the surviving busy marker carries the
-    // same interrupted-turn fact through the fleet's shared SIGKILL deadline.
+    // Record teardown-aborted only after Pi persists the aborted turn.
+    // Timeout or rejection leaves the SQL interrupted-turn evidence intact.
     const ABORT_BEFORE_EXIT_MS = 2_500;
     let signalExitInFlight = false;
     const abortAndExit = async (reason) => {
@@ -699,7 +699,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                             new Promise((resolve) => { timer = setTimeout(() => resolve(false), remaining); }),
                         ]);
                         if (settled)
-                            markCleanAbort(nodeId);
+                            await recordBrokerTurn(nodeId, { event: 'closed', end_reason: 'teardown-aborted' });
                     }
                     finally {
                         if (timer !== undefined)
@@ -711,7 +711,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                 // The engine never reached an abortable persisted turn in the budget.
                 // Preserve the dirty interrupted-turn witness so recovery resumes the
                 // saved transcript and explicitly re-drives the stopped work.
-                markBusy(nodeId);
+                await recordBrokerTurn(nodeId, { event: 'interrupted' });
             }
         }
         disposeAndExit(reason);
@@ -783,6 +783,12 @@ export function snapshotMessages(session, boundaryReviewId) {
 // viable at all (tier 3) — this is NOT a fault; the caller decides what to do
 // with it (construct a model-less session at boot, or leave a running session
 // alone on a failed re-drive attempt).
+function currentBrokerNodeId() {
+    const nodeId = envNodeId();
+    if (nodeId === undefined || nodeId === '')
+        throw new Error('broker launch is missing CRTR_NODE_ID');
+    return nodeId;
+}
 async function resolveLaunchModel(services, cfg) {
     const routeRequest = modelRequestFromConfig(cfg.model, envModelIntent(), cfg.modelExact === true);
     if (routeRequest === undefined)
@@ -794,7 +800,7 @@ async function resolveLaunchModel(services, cfg) {
     };
     const unknown = unregisteredConcreteModel(routeRequest, registry, routeOptions);
     if (unknown !== undefined) {
-        recordFaultForCurrentNode({ link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `model '${unknown.request.spec}' is not registered in the serving model registry` });
+        await mutateBrokerFault(currentBrokerNodeId(), { op: 'record', input: { link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `model '${unknown.request.spec}' is not registered in the serving model registry` } });
         throw new Error(`[broker] FATAL: model '${unknown.request.spec}' is not registered in the serving model registry`);
     }
     const selection = selectInitialModelRoute(routeRequest, registry, routeOptions);
@@ -807,7 +813,7 @@ async function resolveLaunchModel(services, cfg) {
     }
     if (cfg.modelExact === true) {
         const rejection = selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason}`).join('; ');
-        recordFaultForCurrentNode({ link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` });
+        await mutateBrokerFault(currentBrokerNodeId(), { op: 'record', input: { link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` } });
         throw new Error(`[broker] FATAL: exact-consult model '${cfg.model}' is unavailable`);
     }
     emitEvent({ level: 'warn', event: 'broker.model.none_viable', fields: { rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({ provider: candidate.providerId, model: candidate.modelId, reason, route_id: candidate.routeId, credential_source: candidate.credentialSource })), rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16) } });

package/dist/core/runtime/close.d.ts

@@ -1,13 +1,7 @@
 import { type SubscriptionRef } from '../canvas/index.js';
-import { type InboxTier } from '../feed/inbox.js';
-/** Fan a lifecycle or birth notice to every given subscriber. Active subscribers
- *  receive inbox mail; passive subscribers receive passive mail. Shared by
- *  terminal-outcome paths and externally created children, so callers preserve
- *  the existing subscription's delivery mode rather than inventing a wake path.
- *
- *  `tier` defaults to a waking `normal`. A caller whose outcome is not worth
- *  starting a manager's cycle passes `deferred`, which rides the manager's next
- *  natural cycle instead. */
+import type { InboxTier } from '../feed/inbox.js';
+/** Fan a lifecycle or birth notice to every given subscriber. A passive
+ * subscription is a non-waking delivery; active subscriptions wake. */
 export declare function fanDoctrineWake(fromId: string, subscribers: readonly SubscriptionRef[], label: string, data: Record<string, unknown>, tier?: InboxTier): void;
 export interface CloseNodeResult {
     /** The focused node that was closed — the cascade root. */

package/dist/core/runtime/close.js

@@ -32,7 +32,7 @@
 // inside the closing set. A node still subscribed to by a manager outside the
 // subtree is left running — "only kill the children if they are only subscribed
 // to by the agent being closed", generalized to any depth via a fixpoint.
-import { cancelCronsOnWake, getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
+import { getNode, subscriptionsOf, subscribersOf, } from '../canvas/index.js';
 import { transition } from './lifecycle.js';
 import { requestBrokerTeardown } from './host.js';
 import { tearDownNode, reapIfEmpty } from './placement.js';
@@ -40,31 +40,20 @@ import { crtrHome, contextDir, jobDir, nodeDir, reportsDir } from '../canvas/pat
 import { discoverLifecycleHookRegistry } from '../command-hooks/discovery.js';
 import { invokeLifecycleHooks } from '../command-hooks/transport/exec-lifecycle.js';
 import { emitEvent } from '../events/emit.js';
-import { appendInbox } from '../feed/inbox.js';
-import { appendPassive } from '../feed/passive.js';
-/** Fan a lifecycle or birth notice to every given subscriber. Active subscribers
- *  receive inbox mail; passive subscribers receive passive mail. Shared by
- *  terminal-outcome paths and externally created children, so callers preserve
- *  the existing subscription's delivery mode rather than inventing a wake path.
- *
- *  `tier` defaults to a waking `normal`. A caller whose outcome is not worth
- *  starting a manager's cycle passes `deferred`, which rides the manager's next
- *  natural cycle instead. */
+import { enqueueNodeMail } from '../feed/messages.js';
+/** Fan a lifecycle or birth notice to every given subscriber. A passive
+ * subscription is a non-waking delivery; active subscriptions wake. */
 export function fanDoctrineWake(fromId, subscribers, label, data, tier = 'normal') {
     for (const sub of subscribers) {
         try {
-            const notice = { from: fromId, tier, kind: 'message', label, data };
-            if (sub.active) {
-                const entry = appendInbox(sub.node_id, notice);
-                // A wake-capable notice consumes the subscriber's cancel-on-wake
-                // deadline: the thing it was waiting for arrived. `deferred` is the
-                // exception — it never wakes a node, riding the next natural cycle
-                // instead, so the deadline it was racing must survive.
-                if (entry.tier !== 'deferred')
-                    cancelCronsOnWake(sub.node_id);
-            }
-            else
-                appendPassive(sub.node_id, notice);
+            enqueueNodeMail(sub.node_id, {
+                senderNodeId: fromId,
+                kind: 'message',
+                label,
+                bodyJson: data,
+                urgency: tier,
+                wake: sub.active ? 1 : 0,
+            });
         }
         catch {
             /* one unavailable subscriber never blocks the rest */
@@ -246,12 +235,12 @@ export function closeNode(rootId, opts = {}) {
                 //    own broker tree before the response can settle.
                 tearDownNode(id);
                 // 3) Leave the resume notice AFTER the watcher is gone, so it survives.
-                appendInbox(id, {
-                    from: null,
-                    tier: 'normal',
+                enqueueNodeMail(id, {
                     kind: 'message',
                     label: cancellationLabel(id === rootId, deadChildren),
-                    data: { reason: 'user-close', cascade_root: rootId, canceled_children: deadChildren },
+                    bodyJson: { reason: 'user-close', cascade_root: rootId, canceled_children: deadChildren },
+                    urgency: 'normal',
+                    wake: 1,
                 });
             }
             // 4) Wake any SURVIVING manager subscribed to this node — the doctrine wake.

package/dist/core/runtime/fault.d.ts

@@ -1,96 +1,6 @@
-import { type Fault, type FaultKind, type FaultLink, type FaultProviderError, type FaultRetry } from '../fault-classifier.js';
-export type { Fault, FaultKind, FaultLink, FaultRetry, FaultRetryDisposition, FaultRetryOwner } from '../fault-classifier.js';
+export type { Fault, FaultKind, FaultLink, FaultProviderError, FaultRetry, FaultRetryDisposition, FaultRetryOwner, } from '../fault-classifier.js';
 export declare const FAULT_QUIET_MS: number;
-export interface FaultRecordInput {
-    link: FaultLink;
-    op: string;
-    kind: FaultKind;
-    retry: FaultRetry;
-    message: string;
-    operation_id?: string;
-    since?: string;
-    anchorEntryId?: string;
-    providerError?: FaultProviderError;
-}
-/** A provider-retry episode outlives its broker-local timer. Its transcript
- * path and anchor are explicit coordinates, so replacement invalidation never
- * has to guess which conversation a marker belongs to. */
-export interface ProviderRetryEpisode {
-    state: 'pending' | 'admitted' | 'invalidated';
-    sessionFile: string;
-    anchorEntryId: string | null;
-    fault: Fault;
-}
-export declare function recordFault(nodeId: string, input: FaultRecordInput): void;
-/** Atomically establishes the crash-recovery authority before publishing its
- * ordinary marker, so a broker death can never leave only a retryable fault. */
-export declare function recordPendingProviderRetryFault(nodeId: string, sessionFile: string, input: FaultRecordInput): Fault | null;
-export declare function recordFaultForCurrentNode(input: FaultRecordInput): boolean;
-export declare function clearFault(nodeId: string, opts?: {
-    link?: FaultLink;
-    preserveProviderRetryEpisode?: boolean;
-}): boolean;
-export declare function clearFaultForCurrentNode(opts?: {
-    link?: FaultLink;
-}): boolean;
-export declare function readFault(nodeId: string): Fault | null;
-export declare function readProviderRetryEpisode(nodeId: string): ProviderRetryEpisode | null;
-/** Persist a newly scheduled provider retry before its broker-local timer is armed. */
-export declare function recordPendingProviderRetryEpisode(nodeId: string, episode: Omit<ProviderRetryEpisode, 'state'>): boolean;
-/** Admission is irreversible EXCEPT through a proven no-progress rollback: a
- *  broker startup that finds no assistant content or tool activity past the
- *  episode's anchor may reopen it via `reopenProviderRetryEpisode` below. Short
- *  of that proof, an admitted episode is never replayed. */
-export declare function admitProviderRetryEpisode(nodeId: string, sessionFile: string, fault: Fault): boolean;
-/** Reopens an `admitted` episode to `pending` so a surviving broker startup can
- *  re-drive it exactly like a never-admitted one. Callable only under the same
- *  no-progress proof `recoverOnStartup` establishes — the branch segment from
- *  `anchorEntryId` to the current leaf carries no assistant content and no tool
- *  activity. Guarded by the same transcript-identity coordinate `admitProviderRetryEpisode`
- *  uses, so a foreign or already-invalidated episode is never reopened. */
-export declare function reopenProviderRetryEpisode(nodeId: string, sessionFile: string): boolean;
-/** A replacement explicitly invalidates its old transcript's retry episode. */
-export declare function invalidateProviderRetryEpisode(nodeId: string, sessionFile: string): boolean;
-export declare function clearProviderRetryEpisode(nodeId: string): void;
-export declare function readFaultAsync(nodeId: string): Promise<Fault | null>;
-export interface BootFaultAttempt {
-    /** The recorded fault's operation + message (e.g. an unresolvable `--model`
-     *  spec, or a model that disappeared mid-launch), scoped to THIS attempt, or
-     *  null when none applies. A broker that fatal-crashes before it binds its
-     *  view socket leaves the launching caller with only the opaque "socket
-     *  never bound" symptom; callers append this so the real cause surfaces
-     *  instead. Only a `crtr→pi` fatal launch fault with a non-empty op and
-     *  message qualifies — never a stale marker from an earlier attempt (see
-     *  `beginBootFaultAttempt`) and never an unrelated fault kind (e.g. a
-     *  viewer↔broker connect failure racing the same boot). */
-    explanation(): string | null;
-}
-/** Snapshot fault state immediately before a broker launch begins, returning a
- *  reader that is only trustworthy for a fault recorded by THIS attempt.
- *
- *  `clearFault` can silently fail to remove a prior marker (its own removal
- *  errors are swallowed, and its result goes unchecked by callers), so rather
- *  than assume that call succeeded, this independently CONFIRMS no fault is
- *  present at the moment of launch. Other processes (a viewer, a relay) can
- *  still write THEIR OWN fault links after this snapshot, but `explanation()`
- *  only ever accepts a fatal `crtr→pi` launch fault — the one shape only a
- *  newly launched broker itself writes (`resolveLaunchModel` in `broker.ts`) —
- *  so no ACCEPTED fault can exist before this snapshot without also surviving
- *  a failed clear, which the snapshot already catches. When a stale fault
- *  survives the clear, `explanation()` fails closed (returns null) rather than
- *  risk surfacing an old, unrelated cause as if it were fresh.
- *
- *  Call this the instant before the launch call it is guarding, so the window
- *  in which an unrelated write could occur stays as small as possible. */
-export declare function beginBootFaultAttempt(nodeId: string): BootFaultAttempt;
-/** True when a raw engine error says pi could not resolve a credential for the model's
- *  provider at all. pi raises `Provider is not configured: <id>` whenever auth resolution
- *  yields nothing, and `Credential store read/modify failed for <id>` when the store itself
- *  errored — for crouter's managed providers both mean "the pool did not hand over a usable
- *  credential just now", which is frequently transient (a refresh in flight, a momentary read
- *  failure) and never something the agent can fix from inside its own turn. Classified as a
- *  plain `other` fault it is FATAL, so the node parks and every wake re-fails on the same
- *  provider; the broker instead substitutes an authenticated provider and re-drives. */
+/** True when Pi could not resolve credentials for a provider. */
 export declare function isProviderUnconfiguredError(message: string): boolean;
-/** True when a raw engine error is the provider 404 "model missing" signal. */
+/** True when a provider reports that a requested model is unavailable. */
 export declare function isModelNotFoundError(message: string): boolean;