@north-light/crouter 0.3.312 → 0.3.313

package/dist/daemon/reconcilers/broker-supervision.js

@@ -8,15 +8,14 @@ import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { recordedPidLiveness } from '../../core/canvas/pid.js';
 import { transition } from '../../core/runtime/lifecycle.js';
-import { isBusy, busySince } from '../../core/runtime/busy.js';
-import { readFault, recordFault } from '../../core/runtime/fault.js';
+import { readFault, readLiveTurn, recordFault } from '../../core/canvas/recovery.js';
 import { nextFaultRetry } from '../../core/runtime/fault-recovery.js';
 import { fanDoctrineWake } from '../../core/runtime/close.js';
 import { headlessBrokerHost } from '../../core/runtime/host.js';
 import { reloadAuthLive } from '../../core/runtime/auth-reload.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
-import { hasUnseenWakeMail } from '../../core/feed/inbox.js';
+import { hasUnseenWakeMail, resetStaleExecutionMail } from '../../core/canvas/deliveries.js';
 import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
@@ -25,18 +24,32 @@ import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
 import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.js';
 import { brokerThresholdsForDaemon } from '../../core/runtime/fleet.js';
 import { readConfig } from '../../core/config.js';
+import { scopedStoreExists } from '../../core/scoped-state/db.js';
+import { providerStore } from '../../core/scoped-state/paths.js';
+import { providerRevision } from '../../core/scoped-state/providers.js';
 import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
 import { shouldParkAfterSummary } from '../park-activity.js';
 import { applyParkEvent, parkEvent } from './live-obligation.js';
 import { envNoDaemonAutostart, envTestUnattendedParkMs, parkSummaryGraceMs, envUnattendedParkMs, } from '../../shared/env.js';
 const execFileAsync = promisify(execFile);
+function liveBusy(nodeId) {
+    return readLiveTurn(nodeId)?.busy === true;
+}
+function liveTurnProgressMs(nodeId) {
+    const progressAt = readLiveTurn(nodeId)?.progressAt;
+    if (progressAt === null || progressAt === undefined)
+        return null;
+    const progressMs = Date.parse(progressAt);
+    return Number.isNaN(progressMs) ? null : progressMs;
+}
 function incarnationOf(pid, identity) {
     return identity === null ? null : `${pid}:${identity}`;
 }
 function busySinceForIncarnation(row) {
-    const since = busySince(row.node_id);
+    const turn = readLiveTurn(row.node_id);
+    const since = turn?.busy === true && turn.progressAt !== null ? Date.parse(turn.progressAt) : Number.NaN;
     const launchedAt = row.launched_at === null || row.launched_at === undefined ? Number.NaN : Date.parse(row.launched_at);
-    if (since === null || !Number.isFinite(launchedAt) || since < launchedAt)
+    if (!Number.isFinite(since) || !Number.isFinite(launchedAt) || since < launchedAt)
         return null;
     return since;
 }
@@ -131,13 +144,17 @@ export function treeHasDescendants(psOutput, rootPid) {
         return null;
     return (childrenOf.get(rootPid) ?? []).length > 0;
 }
-function piCredentialPaths() {
-    const env = process.env['PI_CODING_AGENT_DIR'];
-    const agentDir = env !== undefined && env !== '' ? env : join(homedir(), '.pi', 'agent');
+function piAgentDir() {
+    const configured = process.env['PI_CODING_AGENT_DIR'];
+    if (configured !== undefined && configured !== '')
+        return configured === '~' || configured.startsWith('~/') ? join(homedir(), configured.slice(1)) : configured;
+    return join(homedir(), '.pi', 'agent');
+}
+function piCredentialPaths(agentDir) {
     return [
         join(agentDir, 'auth.json'),
-        join(agentDir, 'anthropic-subscriptions.json'),
-        join(agentDir, 'openai-codex-subscriptions.json'),
+        join(agentDir, 'anthropic-credentials.json'),
+        join(agentDir, 'openai-codex-credentials.json'),
     ];
 }
 export class BrokerSupervisionReconciler {
@@ -147,7 +164,7 @@ export class BrokerSupervisionReconciler {
     unattendedSince = new Map();
     sampleTree;
     signal;
-    knownAuthMtimeMs = null;
+    knownCredentialRevision = null;
     lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
     constructor(options = {}) {
         this.sampleTree = options.readTreeSample ?? ((pid) => this.readTreeSample(pid));
@@ -209,6 +226,7 @@ export class BrokerSupervisionReconciler {
             if (!ctx.fleet.has(id))
                 consumePendingPark(id);
         }
+        resetStaleExecutionMail(now);
     }
     /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
      *  node is unavailable to park, attended, or has work waiting. Short-circuits
@@ -278,7 +296,7 @@ export class BrokerSupervisionReconciler {
             headlessBrokerHost.teardown(id);
             return;
         }
-        if (reset || isBusy(id)) {
+        if (reset || liveBusy(id)) {
             this.unattendedSince.delete(id);
             return;
         }
@@ -682,8 +700,9 @@ export class BrokerSupervisionReconciler {
         });
     }
     async handleAuthReload(fleet) {
+        const agentDir = piAgentDir();
         let mtimeMs = 0;
-        for (const path of piCredentialPaths()) {
+        for (const path of piCredentialPaths(agentDir)) {
             try {
                 mtimeMs = Math.max(mtimeMs, statSync(path).mtimeMs);
             }
@@ -691,15 +710,18 @@ export class BrokerSupervisionReconciler {
                 /* not written yet — nothing to observe for this file */
             }
         }
-        if (mtimeMs === 0)
-            return;
-        if (this.knownAuthMtimeMs === null) {
-            this.knownAuthMtimeMs = mtimeMs;
+        let revision = 0;
+        const store = providerStore(agentDir);
+        if (scopedStoreExists(store))
+            revision = providerRevision(agentDir);
+        const current = `${mtimeMs}:${revision}`;
+        if (this.knownCredentialRevision === null) {
+            this.knownCredentialRevision = current;
             return;
         }
-        if (mtimeMs === this.knownAuthMtimeMs)
+        if (current === this.knownCredentialRevision)
             return;
-        this.knownAuthMtimeMs = mtimeMs;
+        this.knownCredentialRevision = current;
         await operationIdContext.fresh(async () => {
             try {
                 const live = Array.from(fleet.entries(), ([id]) => id);

package/dist/daemon/reconcilers/controller-death.js

@@ -1,25 +1,13 @@
-import { getRow } from '../../core/canvas/index.js';
+import { liveControllerWaits } from '../../core/canvas/waits.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
-import { appendControllerDeathNotice } from '../../core/feed/inbox.js';
+import { enqueueControllerDeathNotice } from '../../core/feed/messages.js';
 export class ControllerDeathReconciler {
     run(now, ctx) {
-        void now; // no time-gating here — the death check is already-controller-status-driven; the param is kept for six-way call-site uniformity, matching every other reconciler's run(now, ctx) shape.
-        // Settle every wait whose controller has ended, independent of the waiter's
-        // current status. Active and focused terminal nodes own a live inbox
-        // watcher; an idle-released node is revived by the node-lifecycle tick.
-        for (const row of ctx.rows) {
-            const current = getRow(row.node_id);
-            const controllerId = current?.waiting_for;
-            if (controllerId === null || controllerId === undefined)
-                continue;
-            // Read-gate before the write boundary: only a dead controller warrants a
-            // notice. appendControllerDeathNotice re-checks liveness inside its
-            // transaction, so this gate cannot misfire.
-            const controller = getRow(controllerId);
-            if (controller !== null && (controller.status === 'active' || controller.status === 'idle'))
-                continue;
+        void now;
+        void ctx;
+        for (const wait of liveControllerWaits()) {
             operationIdContext.fresh(() => {
-                appendControllerDeathNotice(row.node_id, controllerId);
+                enqueueControllerDeathNotice(wait.nodeId, wait.controllerId);
             });
         }
     }

package/dist/daemon/reconcilers/delivery-lane.d.ts

@@ -0,0 +1,9 @@
+import type { DetachedWorkLifecycle } from './broker-supervision.js';
+export declare const deliveryDaemonInstanceId: `${string}-${string}-${string}-${string}-${string}`;
+export interface DeliveryLaneContext {
+    lifecycle: DetachedWorkLifecycle;
+}
+/** The one daemon lane for every configured external action. Node-inbox rows are claimed by their destination. */
+export declare class DeliveryLaneReconciler {
+    run(now: number, ctx: DeliveryLaneContext): void;
+}

package/dist/daemon/reconcilers/delivery-lane.js

@@ -0,0 +1,130 @@
+import { randomUUID } from 'node:crypto';
+import { rmSync } from 'node:fs';
+import { claimExternalActionDelivery, dueExternalActionDeliveries, messageBodyForDelivery, settleDelivery } from '../../core/canvas/deliveries.js';
+import { getNode } from '../../core/canvas/canvas.js';
+import { emitEvent } from '../../core/events/emit.js';
+import { operationIdContext } from '../../core/events/operation-id.js';
+import { createPageRequest, getRequest } from '../../core/human/requests.js';
+import { synthesizedPageDocument, writeSynthesizedPage } from '../../core/human/page-synth.js';
+import { preparePage } from '../../core/human/page-authoring.js';
+import { resolvePageComponents } from '../../core/config.js';
+import { spawnChild } from '../../core/runtime/spawn.js';
+import { runDelivery } from '../delivery/run-delivery.js';
+export const deliveryDaemonInstanceId = randomUUID();
+function adapterFor(delivery) {
+    if (delivery.adapter === null || typeof delivery.adapter['adapter'] !== 'string') {
+        throw new Error(`delivery ${delivery.deliveryId} has no adapter`);
+    }
+    return delivery.adapter;
+}
+function failed(delivery, owner, message) {
+    settleDelivery(delivery.deliveryId, delivery.attempts, owner, {
+        state: 'permanent_failed', failure: { kind: 'spawn_error', message },
+    }, Date.now());
+}
+async function deliverSpawn(delivery, owner, adapter) {
+    const existing = getNode(adapter.nodeId);
+    if (existing !== null) {
+        if (existing.frozen_at !== null || existing.pi_session_id !== null || existing.status === 'idle' || existing.status === 'done' || existing.status === 'canceled') {
+            settleDelivery(delivery.deliveryId, delivery.attempts, owner, { state: 'acknowledged' }, Date.now());
+            return;
+        }
+        failed(delivery, owner, existing.status === 'dead'
+            ? `cron spawn ${adapter.nodeId} recorded a failed birth`
+            : `cron spawn ${adapter.nodeId} found an incomplete birth`);
+        return;
+    }
+    try {
+        await spawnChild({
+            nodeId: adapter.nodeId, kind: adapter.kind, cwd: adapter.cwd, prompt: adapter.prompt,
+            ...(adapter.root ? { root: true, rootLifecycle: adapter.rootLifecycle } : { parent: adapter.parent }),
+            readiness: 'launch', profile: adapter.profile, wakeOrigin: adapter.wakeOrigin,
+        });
+        settleDelivery(delivery.deliveryId, delivery.attempts, owner, { state: 'acknowledged' }, Date.now());
+    }
+    catch (error) {
+        failed(delivery, owner, `cron spawn ${adapter.nodeId} failed: ${error instanceof Error ? error.message : String(error)}`);
+        operationIdContext.fresh(() => emitEvent({ level: 'error', event: 'delivery.cron_spawn_failed', node_id: adapter.nodeId, error, fields: { delivery_id: delivery.deliveryId } }));
+    }
+}
+function preparedCronPage(adapter, stdout) {
+    const synthesized = writeSynthesizedPage(synthesizedPageDocument(adapter.title, adapter.summary, stdout, false));
+    try {
+        return preparePage({
+            sourceFile: synthesized.path,
+            source: { sessionName: adapter.sessionName, ...(adapter.profileName === null ? {} : { profileName: adapter.profileName }) },
+            productKinds: resolvePageComponents(),
+            delivery: { placement: 'inline', inbox: true, reply: false },
+        });
+    }
+    finally {
+        rmSync(synthesized.dir, { recursive: true, force: true });
+    }
+}
+function deliverHuman(delivery, owner, adapter, body) {
+    if (getRequest(adapter.requestId) !== null) {
+        settleDelivery(delivery.deliveryId, delivery.attempts, owner, { state: 'acknowledged' }, Date.now());
+        return;
+    }
+    const stdout = typeof body?.['stdout'] === 'string'
+        ? body['stdout']
+        : null;
+    if (stdout === null) {
+        failed(delivery, owner, `cron human ${adapter.requestId} has no frozen stdout`);
+        return;
+    }
+    try {
+        createPageRequest({ request_id: adapter.requestId, prepared: preparedCronPage(adapter, stdout) });
+        settleDelivery(delivery.deliveryId, delivery.attempts, owner, { state: 'acknowledged' }, Date.now());
+    }
+    catch (error) {
+        failed(delivery, owner, `cron human ${adapter.requestId} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function deliverExternal(delivery, owner) {
+    const adapter = adapterFor(delivery);
+    const body = messageBodyForDelivery(delivery.deliveryId);
+    if (body === null) {
+        failed(delivery, owner, `delivery ${delivery.deliveryId} has no message body`);
+        return;
+    }
+    if (adapter.adapter === 'subprocess') {
+        await runDelivery({ argv: adapter.argv, cwd: adapter.cwd, document: body, attempt: delivery.attempts }, (settlement) => {
+            settleDelivery(delivery.deliveryId, delivery.attempts, owner, settlement, Date.now());
+        });
+        return;
+    }
+    if (adapter.adapter === 'cron_spawn') {
+        await deliverSpawn(delivery, owner, adapter);
+        return;
+    }
+    deliverHuman(delivery, owner, adapter, body);
+}
+/** The one daemon lane for every configured external action. Node-inbox rows are claimed by their destination. */
+export class DeliveryLaneReconciler {
+    run(now, ctx) {
+        if (!ctx.lifecycle.acceptsDetachedWork())
+            return;
+        let due;
+        try {
+            due = dueExternalActionDeliveries(now);
+        }
+        catch (error) {
+            operationIdContext.fresh(() => emitEvent({ level: 'error', event: 'delivery.scan_failed', error }));
+            return;
+        }
+        for (const candidate of due) {
+            try {
+                const claimed = claimExternalActionDelivery(candidate.deliveryId, now, deliveryDaemonInstanceId);
+                if (claimed === null)
+                    continue;
+                ctx.lifecycle.registerDetached(deliverExternal(claimed, deliveryDaemonInstanceId).catch((error) => {
+                    operationIdContext.fresh(() => emitEvent({ level: 'error', event: 'delivery.failed', error, fields: { delivery_id: claimed.deliveryId } }));
+                }));
+            }
+            catch (error) {
+                operationIdContext.fresh(() => emitEvent({ level: 'error', event: 'delivery.claim_failed', error, fields: { delivery_id: candidate.deliveryId } }));
+            }
+        }
+    }
+}

package/dist/daemon/reconcilers/live-obligation.js

@@ -1,12 +1,12 @@
 import { newestReportRef, hasActiveLiveSubscription, hasLiveMessageWait, hasLiveSubscriber, hasPendingCronWake, subscribersOf, } from '../../core/canvas/index.js';
 import { fullName } from '../../core/canvas/labels.js';
 import { countTickets } from '../../core/canvas/attention.js';
-import { hasUnseenWakeMail, readCursor, readInboxSince } from '../../core/feed/inbox.js';
+import { hasUnseenWakeMail } from '../../core/canvas/deliveries.js';
 import { readOutputRequest } from '../../core/runtime/structured-output.js';
 import { focusOf } from '../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
 import { fanDoctrineWake } from '../../core/runtime/close.js';
-import { readFault } from '../../core/runtime/fault.js';
+import { readFault } from '../../core/canvas/recovery.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 /** Durable work that requires a node to remain automatically wakeable. */
 export function hasLiveObligation(nodeId) {
@@ -56,7 +56,7 @@ export function parkEvent(nodeId, lifecycle) {
         return 'release';
     if (lifecycle === 'resident')
         return hasUnseenWakeMail(nodeId) ? 'release' : 'park';
-    if (readInboxSince(nodeId, readCursor(nodeId)).length > 0)
+    if (hasUnseenWakeMail(nodeId))
         return 'release';
     return hasLiveSubscriber(nodeId) ? 'release' : 'cancel';
 }

package/dist/daemon/reconcilers/node-deadline.js

@@ -4,7 +4,7 @@ import { isProfilePaused } from '../../core/profiles/manifest.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
 import { errorClassFromFault } from '../../core/fault-classifier.js';
 import { fanDoctrineWake } from '../../core/runtime/close.js';
-import { readFault } from '../../core/runtime/fault.js';
+import { readFault } from '../../core/canvas/recovery.js';
 import { requestBrokerTeardown } from '../../core/runtime/host.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 /** Enforce absolute spawn deadlines independently of the tick's live-row scan. */

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.d.ts

@@ -39,7 +39,7 @@ export declare function compareThaw(a: ThawEntry, b: ThawEntry): number;
 export declare class FreezeLaneReconciler {
     private readonly relaunchState;
     /** End a stuck-delivery episode the tick decided is over — the node's profile
-     *  paused, or nothing wake-worthy is left in its inbox. */
+     * paused, or it has no wake-worthy mail left. */
     endEpisode(nodeId: string): void;
     run(now: number, ctx: FreezeLaneContext): Promise<FrozenCounts>;
     private enact;

package/dist/daemon/reconcilers/node-lifecycle/freeze-lane.js

@@ -13,16 +13,14 @@ import { fullName } from '../../../core/canvas/labels.js';
 import { isSafeNodeId } from '../../../core/canvas/paths.js';
 import { emitEvent } from '../../../core/events/emit.js';
 import { operationIdContext } from '../../../core/events/operation-id.js';
-import { readCursor } from '../../../core/feed/inbox.js';
+import { acknowledgedNodeMailCount } from '../../../core/canvas/deliveries.js';
 import { fanDoctrineWake } from '../../../core/runtime/close.js';
 import { transition } from '../../../core/runtime/lifecycle.js';
 import { reviveNode } from '../../../core/runtime/revive.js';
 import { hasPendingWake } from '../live-obligation.js';
-// Idle-release/inbox retry cap (2026-07-10 diagnosis, round 2): the SAME
-// livelock shape as the stranded-relaunch case, but on the pass that resumes a
-// dormant idle-released node when its inbox gains an unseen entry. The counter
-// is keyed on inbox-cursor progress, not row-state residency or pid liveness: a
-// transiently-live broker does not prove that delivery completed.
+// Idle-release delivery retry cap. The counter is keyed on acknowledged
+// delivery progress, not row-state residency or pid liveness: a transiently
+// live broker does not prove that a destination received its mail.
 const IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS = 6;
 const IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS = 10 * 60_000;
 const IDLE_RELEASE_RELAUNCH_BASE_MS = 20_000;
@@ -57,7 +55,7 @@ export function compareThaw(a, b) {
 export class FreezeLaneReconciler {
     relaunchState = new Map();
     /** End a stuck-delivery episode the tick decided is over — the node's profile
-     *  paused, or nothing wake-worthy is left in its inbox. */
+     * paused, or it has no wake-worthy mail left. */
     endEpisode(nodeId) {
         this.relaunchState.delete(nodeId);
     }
@@ -118,10 +116,10 @@ export class FreezeLaneReconciler {
     }
     async enactIdleRelease(now, row) {
         const id = row.node_id;
-        const cursorNow = readCursor(id);
+        const acknowledgedCount = acknowledgedNodeMailCount(id);
         const prior = this.relaunchState.get(id);
-        const cursorChanged = prior === undefined || prior.cursor !== cursorNow;
-        const attempts = cursorChanged ? 0 : prior.attempts;
+        const deliveryProgressed = prior === undefined || prior.acknowledgedCount !== acknowledgedCount;
+        const attempts = deliveryProgressed ? 0 : prior.attempts;
         if (attempts >= IDLE_RELEASE_RELAUNCH_MAX_ATTEMPTS) {
             this.relaunchState.delete(id);
             emitEvent({
@@ -148,7 +146,7 @@ export class FreezeLaneReconciler {
                 `dead until you revive it — \`crtr node lifecycle revive ${id}\`.`, { reason: 'child-crashed', child: id });
             return 'skipped';
         }
-        const lastAttempt = cursorChanged ? undefined : prior?.lastAttempt;
+        const lastAttempt = deliveryProgressed ? undefined : prior?.lastAttempt;
         const backoff = Math.min(IDLE_RELEASE_RELAUNCH_BASE_MS * 2 ** attempts, IDLE_RELEASE_RELAUNCH_MAX_BACKOFF_MS);
         if (lastAttempt !== undefined && now - lastAttempt < backoff)
             return 'skipped';
@@ -157,7 +155,7 @@ export class FreezeLaneReconciler {
         // actually happened advances the episode toward exhaustion.
         if ((await reviveNode(id, { resume: true, capacity: 'freeze' })).outcome === 'frozen')
             return 'frozen';
-        this.relaunchState.set(id, { cursor: cursorNow, attempts: attempts + 1, lastAttempt: now });
+        this.relaunchState.set(id, { acknowledgedCount, attempts: attempts + 1, lastAttempt: now });
         emitEvent({
             level: 'info',
             event: 'broker.revive.idle_release',

package/dist/daemon/reconcilers/node-lifecycle/tick.js

@@ -7,12 +7,12 @@
 // to the freeze lane, which orders them by tier and spends the free slots in
 // that order. Splitting the phases is what makes the tier order mean anything —
 // a single interleaved pass would give slots out in row-creation order.
-import { clearFrozen, clearRecordedPid, getNode, } from '../../../core/canvas/index.js';
+import { clearFrozen, endLiveExecution, getNode, } from '../../../core/canvas/index.js';
 import { isSafeNodeId } from '../../../core/canvas/paths.js';
 import { recordedPidLiveness } from '../../../core/canvas/pid.js';
 import { emitEvent } from '../../../core/events/emit.js';
 import { operationIdContext } from '../../../core/events/operation-id.js';
-import { hasCleanAbort, isBusy } from '../../../core/runtime/busy.js';
+import { readInterruptedTurn } from '../../../core/canvas/recovery.js';
 import { isProfilePaused } from '../../../core/profiles/manifest.js';
 import { classifyDeadNode } from '../../fleet.js';
 import { applyParkEvent, hasPendingWake, parkEvent } from '../live-obligation.js';
@@ -51,7 +51,7 @@ export class NodeLifecycleReconciler {
             if (handleTerminatingRow(row, ctx.fleet.has(id)))
                 return;
             if (row.pi_pid != null && recordedPidLiveness(row.pi_pid, row.pi_pid_identity) === 'dead') {
-                clearRecordedPid(id);
+                endLiveExecution(id, { reason: 'observed-dead' });
             }
             if (row.frozen_at != null)
                 candidates.push({ row, enact: 'thaw' });
@@ -114,11 +114,11 @@ export class NodeLifecycleReconciler {
         // its marker without failure or launch, and retaining the PID lets the
         // second recognize the same dead row for ordinary recovery.
         if (!ctx.fleet.hasProfilePauseInterruption(id))
-            clearRecordedPid(id);
+            endLiveExecution(id, { reason: 'observed-dead' });
         // 7. The invariant-5 policy table, on the same inputs an exit event gives
         //    it. 8. A verdict that needs no broker is enacted right here, because it
         //    costs no slot; a respawn becomes a candidate for the freeze lane.
-        const action = classifyDeadNode(getNode(id), isBusy(id) || hasCleanAbort(id), hasPendingWake(id));
+        const action = classifyDeadNode(getNode(id), readInterruptedTurn(id)?.interrupted === true, hasPendingWake(id));
         if (action === 'respawn-fresh' || action === 'respawn-cycle' || action === 'respawn-resume') {
             candidates.push({ row, enact: 'policy' });
             return;

package/dist/daemon/reconcilers/node-lifecycle/wants-execution.js

@@ -1,4 +1,4 @@
-import { hasUnseenWakeMail } from '../../../core/feed/inbox.js';
+import { hasUnseenWakeMail } from '../../../core/canvas/deliveries.js';
 /** Whether the lifecycle tick must ensure this row has an engine. The durable
  * message handler calls this after appending its entry: that append makes the
  * idle branch's unseen-wake-mail check true for a wake-capable entry. */

package/dist/daemon/reconcilers/pending-review-submit.js

@@ -8,7 +8,7 @@
 // never coming.
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
-import { listSubmitRequestedReviews } from '../../core/review/store.js';
+import { listSubmitRequestedRequests } from '../../core/human/requests.js';
 import { completeRequestedSubmit } from '../review/finish.js';
 export class PendingReviewSubmitReconciler {
     run(now, ctx) {
@@ -17,7 +17,7 @@ export class PendingReviewSubmitReconciler {
             return;
         let pending;
         try {
-            pending = listSubmitRequestedReviews();
+            pending = listSubmitRequestedRequests();
         }
         catch (error) {
             operationIdContext.fresh(() => {
@@ -26,7 +26,7 @@ export class PendingReviewSubmitReconciler {
             return;
         }
         for (const review of pending) {
-            ctx.lifecycle.registerDetached(completeRequestedSubmit(review.review_id, { atCompanionTurnEnd: false }).then(() => { }, (error) => {
+            ctx.lifecycle.registerDetached(completeRequestedSubmit(review.request_id, { atCompanionTurnEnd: false }).then(() => { }, (error) => {
                 operationIdContext.fresh(() => {
                     emitEvent({ level: 'error', event: 'review.deferred_submit.failed', error });
                 });

package/dist/daemon/reconcilers/storage-maintenance.d.ts

@@ -12,17 +12,11 @@ export interface StorageMaintenanceContext {
  * managed-worktree reconciliation gets its start-up pass. */
 export declare class StorageMaintenanceReconciler {
     private lastSpareSweepAt;
-    private lastGhostSweepAt;
     private focusGcInFlight;
     private readonly worktreeSweep;
     run(now: number, ctx: StorageMaintenanceContext): void;
-    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
-     * focused, or closed — every one of those resolves the node through meta.json —
-     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
-    private reapGhostRows;
-    /** Milliseconds since meta/telemetry was last written. Inbox activity is
-     * deliberately excluded: children can keep writing a dead manager's inbox. */
-    private msSinceDiskActivity;
+    /** Milliseconds since terminal state, launch/settlement, or disposable telemetry changed. Inbox activity is deliberately excluded: children can keep writing a dead manager's inbox. */
+    private msSinceTerminalActivity;
     /** Reap only physical placement residue of terminal nodes. The durable row,
      * graph, and on-disk state remain available for a later manual revive. */
     private reapDeadResidue;

package/dist/daemon/reconcilers/storage-maintenance.js

@@ -1,7 +1,7 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { closeFocusRow, getFocusById, listFocuses, listNodes, reapGhostRows, } from '../../core/canvas/index.js';
-import { isSafeNodeId, jobDir, nodeDir } from '../../core/canvas/paths.js';
+import { closeFocusRow, getFocusById, listFocuses, listNodes, } from '../../core/canvas/index.js';
+import { isSafeNodeId, jobDir } from '../../core/canvas/paths.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
 import { listLivePanesAsync, tearDownNode } from '../../core/runtime/placement.js';
@@ -11,13 +11,11 @@ import { ManagedWorktreeSweepReconciler } from './managed-worktree-sweep.js';
 // placement is reaped. A fresh crash keeps its pane for inspection.
 export const DEAD_REAP_GRACE_MS = 10 * 60_000;
 const SPARE_SWEEP_INTERVAL_MS = 60 * 1000;
-const GHOST_SWEEP_INTERVAL_MS = 60 * 1000;
 /** Recurring storage cleanup. The in-memory throttle clocks intentionally reset
  * on daemon boot, so the first tick runs every full sweep — which is also how
  * managed-worktree reconciliation gets its start-up pass. */
 export class StorageMaintenanceReconciler {
     lastSpareSweepAt = Number.NEGATIVE_INFINITY;
-    lastGhostSweepAt = Number.NEGATIVE_INFINITY;
     focusGcInFlight = false;
     worktreeSweep = new ManagedWorktreeSweepReconciler();
     run(now, ctx) {
@@ -28,49 +26,21 @@ export class StorageMaintenanceReconciler {
         // observes the post-reap state this ordering exists to give it.
         this.reapDeadResidue(now);
         this.scheduleFocusGc(ctx);
-        this.reapGhostRows(now);
         this.gcWarmPool(now);
         // Registers detached async Git work and returns immediately: this lane is
         // called un-awaited from a 2-second supervision tick and must not block it.
         this.worktreeSweep.run(now, ctx);
     }
-    /** Drop rows whose on-disk node dir is gone. Such a row can never be revived,
-     * focused, or closed — every one of those resolves the node through meta.json —
-     * so it sits in the roster jamming the surfaces that try. One readdir per sweep. */
-    reapGhostRows(now) {
-        if (now - this.lastGhostSweepAt < GHOST_SWEEP_INTERVAL_MS)
-            return;
-        this.lastGhostSweepAt = now;
-        operationIdContext.fresh(() => {
-            try {
-                const reaped = reapGhostRows();
-                if (reaped.length > 0) {
-                    emitEvent({
-                        level: 'info',
-                        event: 'canvas.ghost_rows.reaped',
-                        outcome: 'succeeded',
-                        fields: { reaped_count: reaped.length, reaped_ids: reaped },
-                    });
-                }
-            }
-            catch (err) {
-                emitEvent({ level: 'error', event: 'canvas.ghost_rows.reap_failed', error: err });
-            }
-        });
-    }
-    /** Milliseconds since meta/telemetry was last written. Inbox activity is
-     * deliberately excluded: children can keep writing a dead manager's inbox. */
-    msSinceDiskActivity(nodeId, now) {
-        let latest = 0;
-        for (const path of [join(nodeDir(nodeId), 'meta.json'), join(jobDir(nodeId), 'telemetry.json')]) {
-            try {
-                const mtime = statSync(path).mtimeMs;
-                if (mtime > latest)
-                    latest = mtime;
-            }
-            catch {
-                /* absent — contributes nothing */
-            }
+    /** Milliseconds since terminal state, launch/settlement, or disposable telemetry changed. Inbox activity is deliberately excluded: children can keep writing a dead manager's inbox. */
+    msSinceTerminalActivity(row, now) {
+        const timestamps = [row.created, row.launched_at, row.last_settled_at, row.finalized_at, row.outcome_at]
+            .map((value) => value === null || value === undefined ? Number.NaN : Date.parse(value));
+        let latest = Math.max(0, ...timestamps.filter(Number.isFinite));
+        try {
+            latest = Math.max(latest, statSync(join(jobDir(row.node_id), 'telemetry.json')).mtimeMs);
+        }
+        catch {
+            /* telemetry is disposable */
         }
         return latest === 0 ? Number.POSITIVE_INFINITY : now - latest;
     }
@@ -91,7 +61,7 @@ export class StorageMaintenanceReconciler {
             if (row.pane == null && row.window == null && row.tmux_session == null)
                 continue;
             try {
-                if (this.msSinceDiskActivity(row.node_id, now) < DEAD_REAP_GRACE_MS)
+                if (this.msSinceTerminalActivity(row, now) < DEAD_REAP_GRACE_MS)
                     continue;
             }
             catch (err) {

package/dist/daemon/review/companion.js

@@ -3,25 +3,19 @@
 // Two facts, both already maintained by the runtime, and neither one enough
 // alone:
 //
-//  - MID-TURN — the `<jobDir>/busy` marker AND-ed with a live broker pid, the
-//    canonical "pi is inside a turn" signal (`core/runtime/busy.ts`). A stale
-//    marker from a crashed broker reads false through the AND.
+//  - MID-TURN — the recovery store's live-turn witness. A cleared turn reads
+//    false without consulting a node-local runtime file.
 //  - QUEUED — an undelivered non-deferred inbox entry. Comments are pushed to
 //    the companion as inbox messages, so the ordinary rhythm is: the human
 //    comments, the entry lands, the companion's turn starts a moment later.
 //    Between those two moments the busy marker is cold while the companion is
 //    unmistakably about to work, and submitting into that gap kills the edit
 //    the wait exists to protect.
-import { getNode } from '../../core/canvas/canvas.js';
-import { isPidAlive } from '../../core/canvas/pid.js';
-import { hasUnseenWakeMail } from '../../core/feed/inbox.js';
-import { isBusy } from '../../core/runtime/busy.js';
+import { readLiveTurn } from '../../core/canvas/recovery.js';
+import { hasUnseenWakeMail } from '../../core/canvas/deliveries.js';
 /** Is the companion inside a turn right now? */
 export function companionMidTurn(nodeId) {
-    const node = getNode(nodeId);
-    if (node === null || !isPidAlive(node.pi_pid))
-        return false;
-    return isBusy(nodeId);
+    return readLiveTurn(nodeId)?.busy ?? false;
 }
 /** Does the companion hold work it has not yet consumed? A deferred entry is
  *  excluded for the same reason the settlement policy excludes it: it never