@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/runtime/fault.js

@@ -1,427 +1,17 @@
-import { envNodeId } from '../../shared/env.js';
-import { isRecord } from '../../shared/predicates.js';
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { jobDir } from '../canvas/paths.js';
-import { errorClassFromFault, } from '../fault-classifier.js';
-import { emitEvent } from '../events/emit.js';
-import { operationIdContext, validateOperationId } from '../events/operation-id.js';
 export const FAULT_QUIET_MS = 5 * 60_000;
-const MESSAGE_CAP = 500;
-function faultPath(nodeId) {
-    return join(jobDir(nodeId), 'fault');
-}
-function providerRetryPath(nodeId) {
-    return join(jobDir(nodeId), 'provider-retry');
-}
-function canonicalSessionFile(sessionFile) {
-    try {
-        return realpathSync(sessionFile);
-    }
-    catch {
-        return sessionFile;
-    }
-}
-function clampMessage(message) {
-    return message.slice(0, MESSAGE_CAP);
-}
-function faultPriority(fault) {
-    if (fault.link === 'pi→provider' && fault.retry.disposition === 'auto' && fault.retry.by === 'daemon')
-        return 3;
-    if (fault.retry.disposition === 'fatal')
-        return 2;
-    return 1;
-}
-const faultLinks = ['pi→provider', 'viewer↔broker', 'relay↔broker', 'viewer↔crtrd', 'broker↔crtrd', 'daemon→node', 'crtr→pi'];
-const faultKinds = ['rate-limit', 'overloaded', 'connection', 'auth', 'protocol', 'context-overflow', 'other', 'wedged', 'model-not-found'];
-function parseProviderError(value) {
-    if (!isRecord(value) || typeof value.provider !== 'string' || value.provider === '' || typeof value.model !== 'string' || value.model === '')
-        return undefined;
-    const status = typeof value.status === 'number' && Number.isFinite(value.status) ? value.status : undefined;
-    const code = typeof value.code === 'string' || typeof value.code === 'number' ? value.code : undefined;
-    const errno = typeof value.errno === 'string' ? value.errno : undefined;
-    const body = typeof value.body === 'string' ? value.body : undefined;
-    const causes = Array.isArray(value.causes)
-        ? value.causes.flatMap((item) => {
-            if (!isRecord(item))
-                return [];
-            const cause = {
-                ...(typeof item.message === 'string' ? { message: item.message } : {}),
-                ...(typeof item.status === 'number' && Number.isFinite(item.status) ? { status: item.status } : {}),
-                ...(typeof item.code === 'string' || typeof item.code === 'number' ? { code: item.code } : {}),
-                ...(typeof item.errno === 'string' ? { errno: item.errno } : {}),
-                ...(typeof item.body === 'string' ? { body: item.body } : {}),
-            };
-            return Object.keys(cause).length === 0 ? [] : [cause];
-        })
-        : undefined;
-    return {
-        provider: value.provider,
-        model: value.model,
-        ...(status === undefined ? {} : { status }),
-        ...(code === undefined ? {} : { code }),
-        ...(errno === undefined ? {} : { errno }),
-        ...(body === undefined ? {} : { body }),
-        ...(causes === undefined || causes.length === 0 ? {} : { causes }),
-    };
-}
-function parseFault(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (!faultLinks.includes(parsed.link))
-            return null;
-        if (typeof parsed.op !== 'string' || parsed.op === '')
-            return null;
-        if (!faultKinds.includes(parsed.kind))
-            return null;
-        if (typeof parsed.message !== 'string' || typeof parsed.since !== 'string')
-            return null;
-        const operationId = validateOperationId(parsed.operation_id);
-        const retryRaw = parsed.retry;
-        if (retryRaw === undefined)
-            return null;
-        if (retryRaw.disposition !== 'auto' && retryRaw.disposition !== 'manual' && retryRaw.disposition !== 'fatal')
-            return null;
-        if (retryRaw.by !== undefined && retryRaw.by !== 'sdk' && retryRaw.by !== 'daemon' && retryRaw.by !== 'client')
-            return null;
-        if (retryRaw.attempt !== undefined && typeof retryRaw.attempt !== 'number')
-            return null;
-        if (retryRaw.max !== undefined && typeof retryRaw.max !== 'number')
-            return null;
-        if (retryRaw.nextAt !== undefined && typeof retryRaw.nextAt !== 'string')
-            return null;
-        if (parsed.anchorEntryId !== undefined && (typeof parsed.anchorEntryId !== 'string' || parsed.anchorEntryId === ''))
-            return null;
-        const providerError = parsed.providerError === undefined ? undefined : parseProviderError(parsed.providerError);
-        if (parsed.providerError !== undefined && providerError === undefined)
-            return null;
-        return {
-            link: parsed.link,
-            op: parsed.op,
-            kind: parsed.kind,
-            retry: {
-                disposition: retryRaw.disposition,
-                ...(retryRaw.by === undefined ? {} : { by: retryRaw.by }),
-                ...(retryRaw.attempt === undefined ? {} : { attempt: retryRaw.attempt }),
-                ...(retryRaw.max === undefined ? {} : { max: retryRaw.max }),
-                ...(retryRaw.nextAt === undefined ? {} : { nextAt: retryRaw.nextAt }),
-            },
-            message: parsed.message,
-            since: parsed.since,
-            operation_id: operationId,
-            ...(parsed.anchorEntryId === undefined ? {} : { anchorEntryId: parsed.anchorEntryId }),
-            ...(providerError === undefined ? {} : { providerError }),
-        };
-    }
-    catch {
-        return null;
-    }
-}
-function currentFault(nodeId) {
-    try {
-        return parseFault(readFileSync(faultPath(nodeId), 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function currentProviderRetryEpisode(nodeId) {
-    try {
-        const parsed = JSON.parse(readFileSync(providerRetryPath(nodeId), 'utf8'));
-        if (parsed.state !== 'pending' && parsed.state !== 'admitted' && parsed.state !== 'invalidated')
-            return null;
-        if (typeof parsed.sessionFile !== 'string' || parsed.sessionFile === '')
-            return null;
-        if (parsed.anchorEntryId !== null && typeof parsed.anchorEntryId !== 'string')
-            return null;
-        const fault = parseFault(JSON.stringify(parsed.fault));
-        if (fault === null ||
-            fault.link !== 'pi→provider' ||
-            fault.retry.disposition !== 'auto' ||
-            fault.retry.by !== 'daemon' ||
-            (fault.anchorEntryId ?? null) !== parsed.anchorEntryId)
-            return null;
-        return { state: parsed.state, sessionFile: canonicalSessionFile(parsed.sessionFile), anchorEntryId: parsed.anchorEntryId, fault };
-    }
-    catch {
-        return null;
-    }
-}
-function writeFault(nodeId, fault) {
-    try {
-        mkdirSync(jobDir(nodeId), { recursive: true });
-        writeFileSync(faultPath(nodeId), JSON.stringify(fault));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function writeProviderRetryEpisode(nodeId, episode) {
-    try {
-        mkdirSync(jobDir(nodeId), { recursive: true });
-        writeFileSync(providerRetryPath(nodeId), JSON.stringify(episode));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function resolvedMarker(nodeId, fault) {
-    const current = currentFault(nodeId);
-    if (current === null)
-        return fault;
-    if (current.link === fault.link && current.kind === fault.kind) {
-        const retry = { ...current.retry, ...fault.retry };
-        if (fault.retry.disposition === 'fatal' && !('nextAt' in fault.retry)) {
-            delete retry.nextAt;
-        }
-        return { ...fault, since: current.since, anchorEntryId: current.anchorEntryId ?? fault.anchorEntryId, retry };
-    }
-    return faultPriority(current) > faultPriority(fault) ? null : fault;
-}
-function updateMarker(nodeId, fault) {
-    const resolved = resolvedMarker(nodeId, fault);
-    return resolved !== null && writeFault(nodeId, resolved) ? resolved : null;
-}
-function resolveOperationId(explicit) {
-    if (explicit !== undefined)
-        return validateOperationId(explicit);
-    const current = operationIdContext.current();
-    if (current !== undefined)
-        return current;
-    return operationIdContext.fresh((operationId) => operationId);
-}
-function storedFault(input) {
-    return {
-        link: input.link,
-        op: input.op,
-        kind: input.kind,
-        retry: input.retry,
-        message: clampMessage(input.message),
-        since: input.since ?? new Date().toISOString(),
-        operation_id: resolveOperationId(input.operation_id),
-        ...(typeof input.anchorEntryId === 'string' && input.anchorEntryId !== '' ? { anchorEntryId: input.anchorEntryId } : {}),
-        ...(input.providerError === undefined ? {} : { providerError: input.providerError }),
-    };
-}
-function emitRecordedFault(nodeId, fault) {
-    emitEvent({
-        level: fault.retry.disposition === 'fatal' ? 'error' : 'warn',
-        event: 'fault.recorded',
-        operation_id: fault.operation_id,
-        node_id: nodeId,
-        error_class: errorClassFromFault(fault),
-        fields: {
-            link: fault.link,
-            op: fault.op,
-            kind: fault.kind,
-            retry: fault.retry,
-            message: fault.message,
-            ...(fault.anchorEntryId === undefined ? {} : { anchor_entry_id: fault.anchorEntryId }),
-            ...(fault.providerError === undefined ? {} : { provider_error: fault.providerError }),
-        },
-    });
-}
-export function recordFault(nodeId, input) {
-    const fault = storedFault(input);
-    emitRecordedFault(nodeId, fault);
-    updateMarker(nodeId, fault);
-}
-/** Atomically establishes the crash-recovery authority before publishing its
- * ordinary marker, so a broker death can never leave only a retryable fault. */
-export function recordPendingProviderRetryFault(nodeId, sessionFile, input) {
-    const fault = storedFault(input);
-    emitRecordedFault(nodeId, fault);
-    const marker = resolvedMarker(nodeId, fault);
-    if (marker === null)
-        return null;
-    if (!writeProviderRetryEpisode(nodeId, {
-        state: 'pending',
-        sessionFile: canonicalSessionFile(sessionFile),
-        anchorEntryId: marker.anchorEntryId ?? null,
-        fault: marker,
-    }))
-        return null;
-    return writeFault(nodeId, marker) ? marker : null;
-}
-export function recordFaultForCurrentNode(input) {
-    const nodeId = envNodeId();
-    if (nodeId === undefined || nodeId.trim() === '')
-        return false;
-    if (!existsSync(jobDir(nodeId)))
-        return false;
-    try {
-        recordFault(nodeId, input);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function clearFault(nodeId, opts) {
-    try {
-        const current = currentFault(nodeId);
-        if (current === null)
-            return false;
-        if (opts?.link !== undefined && current.link !== opts.link)
-            return false;
-        rmSync(faultPath(nodeId));
-        const episode = currentProviderRetryEpisode(nodeId);
-        // turn_end precedes agent_settled. An admitted retry keeps its durable
-        // coordinate while the broker classifies an error settlement; an invalidated
-        // coordinate also remains durable so replacement startup cannot replay it.
-        if (opts?.preserveProviderRetryEpisode !== true &&
-            episode?.fault.since === current.since &&
-            episode.state === 'pending')
-            rmSync(providerRetryPath(nodeId), { force: true });
-        const operationId = resolveOperationId();
-        emitEvent({
-            level: 'info',
-            event: 'fault.cleared',
-            operation_id: operationId,
-            node_id: nodeId,
-            error_class: errorClassFromFault(current),
-            fields: {
-                cleared_fault_operation_id: current.operation_id,
-                link: current.link,
-                op: current.op,
-                kind: current.kind,
-                retry: current.retry,
-                message: current.message,
-                since: current.since,
-                ...(current.anchorEntryId === undefined ? {} : { anchor_entry_id: current.anchorEntryId }),
-            },
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function clearFaultForCurrentNode(opts) {
-    const nodeId = envNodeId();
-    if (nodeId === undefined || nodeId.trim() === '')
-        return false;
-    if (!existsSync(jobDir(nodeId)))
-        return false;
-    return clearFault(nodeId, opts);
-}
-export function readFault(nodeId) {
-    return currentFault(nodeId);
-}
-export function readProviderRetryEpisode(nodeId) {
-    return currentProviderRetryEpisode(nodeId);
-}
-/** Persist a newly scheduled provider retry before its broker-local timer is armed. */
-export function recordPendingProviderRetryEpisode(nodeId, episode) {
-    return writeProviderRetryEpisode(nodeId, { ...episode, sessionFile: canonicalSessionFile(episode.sessionFile), state: 'pending' });
-}
-/** Admission is irreversible EXCEPT through a proven no-progress rollback: a
- *  broker startup that finds no assistant content or tool activity past the
- *  episode's anchor may reopen it via `reopenProviderRetryEpisode` below. Short
- *  of that proof, an admitted episode is never replayed. */
-export function admitProviderRetryEpisode(nodeId, sessionFile, fault) {
-    const current = currentProviderRetryEpisode(nodeId);
-    if (current === null ||
-        current.state !== 'pending' ||
-        current.sessionFile !== canonicalSessionFile(sessionFile) ||
-        current.fault.since !== fault.since ||
-        current.anchorEntryId !== (fault.anchorEntryId ?? null))
-        return false;
-    return writeProviderRetryEpisode(nodeId, {
-        state: 'admitted',
-        sessionFile: current.sessionFile,
-        anchorEntryId: current.anchorEntryId,
-        fault,
-    });
-}
-/** Reopens an `admitted` episode to `pending` so a surviving broker startup can
- *  re-drive it exactly like a never-admitted one. Callable only under the same
- *  no-progress proof `recoverOnStartup` establishes — the branch segment from
- *  `anchorEntryId` to the current leaf carries no assistant content and no tool
- *  activity. Guarded by the same transcript-identity coordinate `admitProviderRetryEpisode`
- *  uses, so a foreign or already-invalidated episode is never reopened. */
-export function reopenProviderRetryEpisode(nodeId, sessionFile) {
-    const current = currentProviderRetryEpisode(nodeId);
-    if (current === null || current.state !== 'admitted' || current.sessionFile !== canonicalSessionFile(sessionFile))
-        return false;
-    return writeProviderRetryEpisode(nodeId, { ...current, state: 'pending' });
-}
-/** A replacement explicitly invalidates its old transcript's retry episode. */
-export function invalidateProviderRetryEpisode(nodeId, sessionFile) {
-    const current = currentProviderRetryEpisode(nodeId);
-    if (current === null || current.sessionFile !== canonicalSessionFile(sessionFile) || current.state === 'invalidated')
-        return false;
-    return writeProviderRetryEpisode(nodeId, { ...current, state: 'invalidated' });
-}
-export function clearProviderRetryEpisode(nodeId) {
-    try {
-        rmSync(providerRetryPath(nodeId), { force: true });
-    }
-    catch {
-        /* best-effort */
-    }
-}
-export async function readFaultAsync(nodeId) {
-    return readFault(nodeId);
-}
-/** Snapshot fault state immediately before a broker launch begins, returning a
- *  reader that is only trustworthy for a fault recorded by THIS attempt.
- *
- *  `clearFault` can silently fail to remove a prior marker (its own removal
- *  errors are swallowed, and its result goes unchecked by callers), so rather
- *  than assume that call succeeded, this independently CONFIRMS no fault is
- *  present at the moment of launch. Other processes (a viewer, a relay) can
- *  still write THEIR OWN fault links after this snapshot, but `explanation()`
- *  only ever accepts a fatal `crtr→pi` launch fault — the one shape only a
- *  newly launched broker itself writes (`resolveLaunchModel` in `broker.ts`) —
- *  so no ACCEPTED fault can exist before this snapshot without also surviving
- *  a failed clear, which the snapshot already catches. When a stale fault
- *  survives the clear, `explanation()` fails closed (returns null) rather than
- *  risk surfacing an old, unrelated cause as if it were fresh.
- *
- *  Call this the instant before the launch call it is guarding, so the window
- *  in which an unrelated write could occur stays as small as possible. */
-export function beginBootFaultAttempt(nodeId) {
-    const preLaunchClear = readFault(nodeId) === null;
-    return {
-        explanation() {
-            if (!preLaunchClear)
-                return null;
-            const fault = readFault(nodeId);
-            if (fault === null)
-                return null;
-            if (fault.link !== 'crtr\u2192pi' || fault.retry.disposition !== 'fatal')
-                return null;
-            const op = fault.op.trim();
-            const message = fault.message.trim();
-            if (op === '' || message === '')
-                return null;
-            return `${op}: ${message}`;
-        },
-    };
-}
-/** True when a raw engine error says pi could not resolve a credential for the model's
- *  provider at all. pi raises `Provider is not configured: <id>` whenever auth resolution
- *  yields nothing, and `Credential store read/modify failed for <id>` when the store itself
- *  errored — for crouter's managed providers both mean "the pool did not hand over a usable
- *  credential just now", which is frequently transient (a refresh in flight, a momentary read
- *  failure) and never something the agent can fix from inside its own turn. Classified as a
- *  plain `other` fault it is FATAL, so the node parks and every wake re-fails on the same
- *  provider; the broker instead substitutes an authenticated provider and re-drives. */
+/** True when Pi could not resolve credentials for a provider. */
 export function isProviderUnconfiguredError(message) {
-    const m = message ?? '';
-    if (/provider is not configured\b/i.test(m))
+    const value = message ?? '';
+    if (/provider is not configured\b/i.test(value))
         return true;
-    return /credential store (?:read|modify) failed\b/i.test(m);
+    return /credential store (?:read|modify) failed\b/i.test(value);
 }
-/** True when a raw engine error is the provider 404 "model missing" signal. */
+/** True when a provider reports that a requested model is unavailable. */
 export function isModelNotFoundError(message) {
-    const m = message ?? '';
-    if (/not_found_error/i.test(m))
+    const value = message ?? '';
+    if (/not_found_error/i.test(value))
         return true;
-    if (/model[^.]{0,40}(not\s*found|does not exist|is not available|unavailable)|(no such|unknown) model/i.test(m))
+    if (/model[^.]{0,40}(not\s*found|does not exist|is not available|unavailable)|(no such|unknown) model/i.test(value))
         return true;
-    return /\b404\b/.test(m) && /not\s*found|not available|does not exist/i.test(m);
+    return /\b404\b/.test(value) && /not\s*found|not available|does not exist/i.test(value);
 }

package/dist/core/runtime/kickoff.d.ts

@@ -32,17 +32,14 @@ export declare function hasRetainedReports(nodeId: string): boolean;
 export interface ReviveBearings {
     /** The one-shot yield note left by the prior self, pending boot confirmation. */
     yieldMsg: string | null;
-    /** Coalesced digest of unread reports, or null when the feed was empty. The
-     *  cursor now records the last physically covered entry. */
+    /** Coalesced wake mail, held by the execution until the turn settles. */
     unreadDigest: string | null;
     /** Persona-transition framing to surface when the node's role changed while
      *  it was away. The drift remains pending until context-intro completes. */
     driftGuidance: string | null;
 }
-/** Capture revive bearings for `meta`: read the pending yield note, advance the
- *  feed cursor past unread reports, and capture external persona framing.
- *  Revive paths call it once, then pass the result to the pure kickoff builder. */
-export declare function drainBearings(meta: NodeMeta): ReviveBearings;
+/** Claim wake mail for this launch without acknowledging it before a turn. */
+export declare function drainBearings(meta: NodeMeta, executionId: string): ReviveBearings;
 /** Assemble the auto-injected first message for a FRESH revive of `meta` from its
  *  already-drained `bearings` (see drainBearings) plus pure on-disk reads of the
  *  node's goal, roadmap, and context dir, framed so the revived node can rebuild

package/dist/core/runtime/kickoff.js

@@ -25,7 +25,8 @@ import { activeBackgroundBashJobs, bashJobCommandLine, formatBashElapsed } from
 import { readRoadmap, roadmapPath } from './roadmap.js';
 import { buildWakeBearings } from './bearings.js';
 import { personaDrift } from './persona.js';
-import { readInboxSince, readCursor, writeCursor, coalesce, } from '../feed/inbox.js';
+import { coalesce, nodeMailEntry } from '../feed/inbox.js';
+import { claimKickoffMail } from '../canvas/deliveries.js';
 import { formatCard } from '../../shared/generated-context.js';
 /** The runtime-restart continuation exactly as delivered. `revive.ts` injects
  *  it as the prompt of a strict resume that follows a cleanly aborted turn. */
@@ -105,20 +106,14 @@ export function hasRetainedReports(nodeId) {
     const dir = reportsDir(nodeId);
     return existsSync(dir) && readdirSync(dir).some((file) => file.endsWith('.md'));
 }
-/** Capture revive bearings for `meta`: read the pending yield note, advance the
- *  feed cursor past unread reports, and capture external persona framing.
- *  Revive paths call it once, then pass the result to the pure kickoff builder. */
-export function drainBearings(meta) {
+/** Claim wake mail for this launch without acknowledging it before a turn. */
+export function drainBearings(meta, executionId) {
     const nodeId = meta.node_id;
     // The note stays on disk until session_start confirms this launch.
     const yieldMsg = readYieldMessage(nodeId);
-    // Drain the feed: read the physically ordered suffix after the cursor, then
-    // record its final entry so only later physical entries remain unread.
-    const cursorEntryId = readCursor(nodeId);
-    const entries = readInboxSince(nodeId, cursorEntryId);
+    const entries = claimKickoffMail(nodeId, executionId).map(nodeMailEntry);
     let unreadDigest = null;
     if (entries.length > 0) {
-        writeCursor(nodeId, entries.at(-1).entry_id);
         // The launch argv carries one message. Keep coalescing card-free runs, but
         // start a new batch at each entry with cards. A batch's cards are therefore
         // directly ahead of its coalesced text, so they cannot leap an earlier body.
@@ -144,8 +139,8 @@ export function drainBearings(meta) {
     return { yieldMsg, unreadDigest, driftGuidance };
 }
 // Fresh-revive catch-up bug: on a refresh-yield (resume:false) the old
-// conversation is gone AND the physical inbox cursor already covers everything
-// drained pre-yield, so the revived node loses sight of reports its
+// conversation is gone AND earlier deliveries are already acknowledged,
+// so the revived node loses sight of reports its
 // subscriptions pushed BEFORE the yield. The bodies are never lost — they persist
 // at reports/<ts>-<kind>.md forever — but a fresh revive needs a bounded index
 // that says history exists and how to expand it, not every path preloaded.
@@ -181,7 +176,7 @@ function reportHistorySources(nodeId) {
 }
 /** Render the <feed> block PURELY: the live "awaiting" roster (a read), the
  *  already-drained unread digest (from drainBearings), and a progressive index
- *  to on-disk report history. No cursor write. */
+ *  to on-disk report history. No delivery mutation. */
 function feedBlock(nodeId, unreadDigest) {
     // Awaiting = active subscriptions whose publisher is still live (active|idle).
     const awaiting = subscriptionsOf(nodeId)
@@ -206,18 +201,17 @@ function feedBlock(nodeId, unreadDigest) {
         lines.push('Awaiting 0 nodes.');
         lines.push('', unreadDigest ?? '(no unread reports)');
     }
-    // Catch-up history. The unread digest above only covers what arrived after the
-    // physical cursor; on a refresh-revive it already covers everything drained
-    // pre-yield, so preserve the breadcrumb without preloading every old report.
+    // Include a bounded history index because acknowledged reports are absent
+    // from the unread digest after a refresh.
     const history = reportHistorySources(nodeId);
     if (history.length > 0) {
         const visible = history.slice(0, REPORT_HISTORY_SOURCE_CAP);
         const hidden = history.length - visible.length;
         const total = history.reduce((sum, h) => sum + h.count, 0);
-        lines.push('', `Report history on disk (collapsed): ${total} report${total === 1 ? '' : 's'} across ${history.length} subscribed node${history.length === 1 ? '' : 's'}. This is a catch-up index for reports your cursor already passed; read only what matters.`, ...visible.map((h) => {
+        lines.push('', `Report history on disk (collapsed): ${total} report${total === 1 ? '' : 's'} across ${history.length} subscribed node${history.length === 1 ? '' : 's'}. This is a catch-up index for earlier reports; read only what matters.`, ...visible.map((h) => {
             const ref = `${h.nodeId}:reports/${h.latest}`;
             return `  - ${h.name} (${h.nodeId}): ${h.count} report${h.count === 1 ? '' : 's'}; latest ${reportKind(h.latest)}: ${ref}`;
-        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr node inspect artifacts <node-id> --type report` for that node\'s full report list; `crtr node inspect artifacts <node-id> --type inbox` for cursor-independent inbox history including full message bodies.');
+        }), ...(hidden > 0 ? [`  - … ${hidden} more subscribed node${hidden === 1 ? '' : 's'} with reports hidden`] : []), 'Expand: `crtr canvas history read <ref>` for one listed report; `crtr node inspect artifacts <node-id> --type report` for that node\'s full report list; `crtr node inspect artifacts <node-id> --type inbox` for retained inbox history including full message bodies.');
     }
     return `<feed>\n${lines.join('\n')}\n</feed>`;
 }

package/dist/core/runtime/launch.js

@@ -1,7 +1,7 @@
 // The launch spec — how a node becomes (or comes back as) a running pi process.
 //
 // pi-only. No claude branch — we are a super-opinionated system. A node's
-// LaunchSpec (persisted in meta.json) is the canonical recipe the daemon
+// LaunchSpec (stored with the node in SQL) is the canonical recipe the daemon
 // replays to revive it faithfully: `--session <path>` (the saved conversation's
 // absolute .jsonl) to wake a done/idle node — a refresh-yield reuses the SAME
 // path plus `--crtr-new-cycle`, resetting the session tree's leaf and rooting a

package/dist/core/runtime/lifecycle.js

@@ -31,7 +31,9 @@
 // unknown-node/illegal-move/already-finalized-cancel branching — stays here;
 // only the raw conditional UPDATE lives in canvas.ts, keeping every `.prepare(`
 // inside `core/canvas/`).
-import { getNode, cancelCronsOnWake, composeOutcomeDeliveryDocument, readOutcomeDelivery, transitionStatusIntent } from '../canvas/index.js';
+import { getNode, cancelCronsOnWake, transitionStatusIntent } from '../canvas/index.js';
+import { readExternalActionDelivery } from '../canvas/deliveries.js';
+import { composeNodeOutcomeDocument } from './outcome-document.js';
 const ANY = '*';
 const TERMINAL_REASONS = {
     finish: 'finished',
@@ -95,6 +97,37 @@ function detailJson(detail) {
         return serialized;
     return JSON.stringify({ schema: 'crtr.node-outcome-detail/v1', truncated: true, ...(message === undefined ? {} : { message }) });
 }
+function armedOutcomeAction(nodeId) {
+    const delivery = readExternalActionDelivery(`node-outcome:${nodeId}`);
+    if (delivery === null || delivery.state !== 'armed')
+        return null;
+    const adapter = delivery.adapter;
+    if (adapter?.adapter !== 'subprocess' || !Array.isArray(adapter.argv) || !adapter.argv.every((entry) => typeof entry === 'string') || typeof adapter.cwd !== 'string') {
+        throw new Error(`outcome delivery ${delivery.deliveryId} has an invalid subprocess adapter`);
+    }
+    return { name: delivery.destinationId, payload: adapter.payload ?? null };
+}
+function nodeAtOutcome(node, reason) {
+    let status;
+    let intent;
+    if (reason === 'finished' || reason === 'declined') {
+        status = 'done';
+        intent = 'done';
+    }
+    else if (reason === 'parked') {
+        status = 'done';
+        intent = 'parked';
+    }
+    else if (reason === 'closed' || reason === 'retired' || reason === 'stranded' || reason === 'deadline_exceeded') {
+        status = 'canceled';
+        intent = null;
+    }
+    else {
+        status = 'dead';
+        intent = null;
+    }
+    return { ...node, status, intent, terminal_reason: reason };
+}
 /** Enact a lifecycle event on a node: validate the from-status against the
  *  table, then write status+intent in ONE atomic statement (so they can never
  *  disagree). Returns the hydrated node view after the write.
@@ -121,13 +154,13 @@ export function transition(nodeId, event, opts) {
     const outcomeDetailJson = detailJson(opts?.outcome?.detail);
     let documentJson;
     if (recordsOutcome && current !== null && current.outcome_at === null) {
-        const delivery = readOutcomeDelivery(nodeId);
-        if (delivery?.state === 'armed') {
-            documentJson = composeOutcomeDeliveryDocument({
-                nodeId,
+        const action = armedOutcomeAction(nodeId);
+        if (action !== null) {
+            documentJson = JSON.stringify(composeNodeOutcomeDocument({
+                node: nodeAtOutcome(current, outcomeReason),
                 outcome: { kind: 'failure', reason: outcomeReason, at: outcomeAt, revision: (current.outcome_revision ?? 0) + 1, detailJson: outcomeDetailJson },
-                action: { name: delivery.actionName, payload: delivery.payload },
-            });
+                action,
+            }));
         }
     }
     // A committed canonical result is protected from a concurrent close.

package/dist/core/runtime/placement.js

@@ -24,7 +24,7 @@
 //     tmux half, the bindings owner, and tmux chrome.
 import { envNodeId } from '../../shared/env.js';
 import { getNode, fullName, deleteNode, listNodes, subscribersOf, openFocusRow, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses as listFocusRows, } from '../canvas/index.js';
-import { nodeHasAssistantMessage, isStreaming } from '../canvas/render-source.js';
+import { nodeHasAssistantMessage } from '../canvas/render-source.js';
 import { headlessBrokerHost } from './host.js';
 import { fanDoctrineWake } from './close.js';
 import { paneExists, paneLocation, closePane, currentTmux, switchClient, selectWindow, selectLayout, selectPane, getPaneOption, setPaneOption, respawnPaneSync, windowOfPane, renameWindow, } from './tmux-driver.js';
@@ -331,7 +331,7 @@ function isEmptyNode(nodeId) {
     const m = getNode(nodeId);
     if (m === null)
         return false;
-    if (isStreaming(nodeId, getNode(nodeId)?.pi_pid ?? null))
+    if (m.streaming === true)
         return false;
     return !nodeHasAssistantMessage(m.pi_session_file);
 }