@north-light/crouter 0.3.312 → 0.3.314

package/dist/daemon/api/handlers/node-outcomes.js

@@ -2,8 +2,10 @@
 import { setTimeout as sleep } from 'node:timers/promises';
 import { ApiError } from '../../../api/errors.js';
 import { getNode } from '../../../core/canvas/canvas.js';
-import { armOutcomeDelivery, disarmOutcomeDelivery, readOutcomeDelivery, } from '../../../core/canvas/node-outcome-deliveries.js';
+import { armExternalActionDelivery, activateArmedExternalActionDelivery, readExternalActionDelivery } from '../../../core/canvas/deliveries.js';
+import { withCanvasWrite } from '../../../core/canvas/db.js';
 import { OUTCOME_PAYLOAD_MAX_BYTES } from '../../../core/canvas/types.js';
+import { composeNodeOutcomeDocument } from '../../../core/runtime/outcome-document.js';
 import { HUMAN_ACTION_NAME_PATTERN } from '../../../core/human/action-binding.js';
 import { resolveHumanAction } from '../../../core/human-actions.js';
 import { toNodeOutcomeDTO, toOutcomeDeliveryDTO } from '../map.js';
@@ -82,6 +84,53 @@ function parseRegistration(body) {
     }
     return body['payload'] === undefined ? { action } : { action, payload: body['payload'] };
 }
+function outcomeKey(nodeId) { return `node-outcome:${nodeId}`; }
+function outcomeView(row) {
+    const adapter = row.adapter;
+    if (adapter?.adapter !== 'subprocess' || !Array.isArray(adapter.argv) || !adapter.argv.every((arg) => typeof arg === 'string') || typeof adapter.cwd !== 'string')
+        throw new Error(`outcome delivery ${row.deliveryId} has an invalid subprocess adapter`);
+    return { nodeId: row.idempotencyKey?.slice('node-outcome:'.length) ?? '', state: row.state === 'handed_off' ? 'running' : row.state === 'acknowledged' ? 'accepted' : row.state, attempt: row.attempts, actionName: row.destinationId, argv: adapter.argv, cwd: adapter.cwd, configOrigin: typeof adapter.config_origin === 'string' ? adapter.config_origin : '', payload: adapter.payload ?? null, document: null, nextAttemptAt: row.nextAttemptAt ?? 0, claimedAt: row.claimedAt, claimOwner: row.claimOwner, acceptedAt: row.acknowledgedAt, permanentFailedAt: row.failedAt, lastFailure: row.lastFailure, createdAt: row.createdAt, updatedAt: row.updatedAt };
+}
+function nodeAtOutcome(node) {
+    const reason = node.outcome_reason;
+    let status;
+    let intent;
+    if (node.outcome_kind === 'result' || reason === 'finished' || reason === 'declined') {
+        status = 'done';
+        intent = 'done';
+    }
+    else if (reason === 'parked') {
+        status = 'done';
+        intent = 'parked';
+    }
+    else if (reason === 'closed' || reason === 'retired' || reason === 'stranded' || reason === 'deadline_exceeded') {
+        status = 'canceled';
+        intent = null;
+    }
+    else {
+        status = 'dead';
+        intent = null;
+    }
+    return { ...node, status, intent, terminal_reason: reason };
+}
+function armOutcomeExternalAction(node, target, payload) {
+    return withCanvasWrite((db) => {
+        const existing = readExternalActionDelivery(outcomeKey(node.node_id));
+        if (existing !== null && existing.state !== 'armed')
+            return null;
+        armExternalActionDelivery(db, { destinationId: target.action, adapter: { adapter: 'subprocess', argv: target.argv, cwd: target.cwd, config_origin: target.configOrigin, payload: payload ?? null }, idempotencyKey: outcomeKey(node.node_id) });
+        if (node.outcome_at !== null) {
+            if (node.outcome_kind === null || node.outcome_reason === null)
+                throw new Error(`outcome latch is incomplete for node ${node.node_id}`);
+            const document = JSON.stringify(composeNodeOutcomeDocument({ node: nodeAtOutcome(node), outcome: { kind: node.outcome_kind, reason: node.outcome_reason, at: node.outcome_at, revision: node.outcome_revision, detailJson: node.outcome_detail_json ?? null }, action: { name: target.action, payload: payload ?? null }, finalReport: node.final_report }));
+            activateArmedExternalActionDelivery(db, { idempotencyKey: outcomeKey(node.node_id), label: node.node_id, bodyJson: document, supersede: false });
+        }
+        const delivery = readExternalActionDelivery(outcomeKey(node.node_id));
+        if (delivery === null)
+            throw new Error(`outcome delivery was not registered for ${node.node_id}`);
+        return outcomeView(delivery);
+    });
+}
 function resolveAction(action, cwd) {
     const resolution = resolveHumanAction(action, cwd);
     if (!('kind' in resolution))
@@ -97,14 +146,7 @@ function handlePutDelivery(ctx) {
     const node = requireNode(id);
     const request = parseRegistration(ctx.body);
     const target = resolveAction(request.action, node.cwd);
-    const delivery = armOutcomeDelivery({
-        nodeId: node.node_id,
-        actionName: request.action,
-        argv: target.argv,
-        cwd: target.cwd,
-        configOrigin: target.configOrigin,
-        ...(request.payload === undefined ? {} : { payload: request.payload }),
-    });
+    const delivery = armOutcomeExternalAction(node, { action: request.action, ...target }, request.payload);
     if (delivery === null) {
         throw new ApiError(409, 'outcome_delivery_settled', 'outcome delivery has already started or settled');
     }
@@ -113,19 +155,22 @@ function handlePutDelivery(ctx) {
 /** GET /v1/nodes/:id/outcome-delivery — inspect the one durable registration. */
 function handleGetDelivery(ctx) {
     const id = ctx.params['id'] ?? '';
-    const delivery = readOutcomeDelivery(id);
+    const delivery = readExternalActionDelivery(outcomeKey(id));
     if (delivery === null)
         throw new ApiError(404, 'outcome_delivery_not_found', `no outcome delivery for node ${id}`);
-    return { status: 200, body: toOutcomeDeliveryDTO(delivery) };
+    return { status: 200, body: toOutcomeDeliveryDTO(outcomeView(delivery)) };
 }
 /** DELETE /v1/nodes/:id/outcome-delivery — disarm only before delivery begins. */
 function handleDeleteDelivery(ctx) {
     const id = ctx.params['id'] ?? '';
-    const current = readOutcomeDelivery(id);
+    const current = readExternalActionDelivery(outcomeKey(id));
     if (current !== null && current.state !== 'armed') {
         throw new ApiError(409, 'outcome_delivery_settled', 'outcome delivery has already started or settled');
     }
-    disarmOutcomeDelivery(id);
+    if (current !== null)
+        withCanvasWrite((db) => {
+            db.prepare("DELETE FROM deliveries WHERE delivery_id = ? AND state = 'armed'").run(current.deliveryId);
+        });
     return { status: 204 };
 }
 export const nodeOutcomeRoutes = [

package/dist/daemon/api/handlers/nodes.js

@@ -16,6 +16,8 @@ import { nowIso } from '../../../core/fs-utils.js';
 import { assertLaunchModelRegistered, forkNode, spawnChildPrepared } from '../../../core/runtime/spawn.js';
 import { childrenOf, getNode, listNodes, subscribersOf, subscriptionsOf, setMessageWait, updateNode } from '../../../core/canvas/canvas.js';
 import { subtreeIds } from '../../../core/canvas/nav-model.js';
+import { withCanvasWrite } from '../../../core/canvas/db.js';
+import { unbindSession } from '../../../core/canvas/sessions.js';
 import { ticketCountsForNodes } from '../../../core/canvas/attention.js';
 import { contextDir, reportsDir } from '../../../core/canvas/paths.js';
 import { nodeArtifacts } from '../../../core/canvas/history.js';
@@ -32,8 +34,6 @@ import { renameWindow } from '../../../core/runtime/placement.js';
 import { buildLaunchSpecAsync, isProviderPinnedModelToken, normalizeModel, readMergedLaunchConfigAsync } from '../../../core/runtime/launch.js';
 import { modelRequestFromConfig } from '../../../core/model-routes.js';
 import { BrokerUnreachableError } from '../../../core/runtime/broker-request.js';
-import { readFault } from '../../../core/runtime/fault.js';
-import { activeFaultForDisplay } from '../../../core/canvas/render-source.js';
 import { isBrokerLive, persistDormantModel, setModelLive } from '../../../core/runtime/model-swap.js';
 import { boundFleet } from '../../../core/runtime/fleet.js';
 import { writeOutputSchema } from '../../../core/runtime/structured-output.js';
@@ -72,16 +72,7 @@ function edgesFor(id) {
 /** Re-read a node fresh and project its detail DTO (post-action response). */
 function detailOf(id) {
     const meta = requireMeta(id);
-    const fault = activeFaultForDisplay(meta, readFault(id));
-    return {
-        ...toNodeDetailDTO(meta, edgesFor(id)),
-        fault: fault === null ? null : {
-            link: fault.link,
-            kind: fault.kind,
-            retry: { disposition: fault.retry.disposition },
-            since: fault.since,
-        },
-    };
+    return toNodeDetailDTO(meta, edgesFor(id));
 }
 /** Count context + report files under a node (the context-roster `files`). */
 function countFiles(id) {
@@ -836,7 +827,10 @@ export async function handleConfig(ctx, deps = {}) {
                 next: 'Create the replacement directory or send an existing absolute directory.',
             });
         }
-        updateNode(id, { cwd: resolved, pi_session_id: null, pi_session_file: null });
+        withCanvasWrite(() => {
+            updateNode(id, { cwd: resolved });
+            unbindSession(id);
+        });
         return { status: 200, body: detailOf(id) };
     }
     let meta = requireMeta(id);

package/dist/daemon/api/handlers/reviews.js

@@ -1,12 +1,9 @@
 // Canonical daemon-owned review lifecycle routes. Handlers validate the full
 // wire request, delegate lifecycle work to review services, and project only
 // committed daemon state.
-import { isSafeNodeId, reviewResultPath } from '../../../core/canvas/paths.js';
-import { responsePath } from '../../../core/human/convention.js';
-import { ticketDir } from '../../../core/human/root.js';
+import { isSafeNodeId } from '../../../core/canvas/paths.js';
 import { createReview } from '../../../core/review/birth.js';
-import { readAnchorBase, getReviewByBridge, listReviews, requireVisibleReview } from '../../../core/review/store.js';
-import { ReviewOperationError } from '../../../core/review/types.js';
+import { readAnchorBase, listReviews, requireVisibleReview } from '../../../core/review/store.js';
 import { cancelReview, submitReviewApproval } from '../../review/finish.js';
 import { toFeedbackResultDTO, toReviewDTO } from '../map.js';
 import { invalidRequest as rejectRequest, objectBody, optionalString, requireParam, requiredString, } from './validate.js';
@@ -19,20 +16,9 @@ function invalidRequest(violations) {
 function requireReviewId(ctx, violations) {
     return requireParam(ctx, 'review_id', 'must be a safe review id', isSafeNodeId, violations);
 }
-function requireBridgeNodeId(ctx, violations) {
-    return requireParam(ctx, 'bridge_node_id', 'must be a safe node id', isSafeNodeId, violations);
-}
-function approvedResultPath(review) {
-    if (review.origin_kind === 'inline')
-        return reviewResultPath(review.review_id);
-    if (review.bridge_node_id === null)
-        throw new Error(`approved ticket review lacks its bridge node: ${review.review_id}`);
-    return responsePath(ticketDir(review.bridge_node_id));
-}
 function toReviewResponseDTO(review) {
-    return review.state === 'approved'
-        ? toReviewDTO(review, { result_path: approvedResultPath(review) })
-        : toReviewDTO(review);
+    const dto = toReviewDTO(review, review.state === 'approved' ? { result_path: `${review.review_dir}/result.json` } : {});
+    return { ...dto, review_dir: review.review_dir };
 }
 function parseCreate(ctx) {
     const violations = [];
@@ -158,16 +144,6 @@ function handleRead(ctx) {
         invalidRequest(violations);
     return { status: 200, body: toReviewResponseDTO(requireVisibleReview(reviewId)) };
 }
-function handleByBridge(ctx) {
-    const violations = [];
-    const bridgeNodeId = requireBridgeNodeId(ctx, violations);
-    if (violations.length > 0 || bridgeNodeId === undefined)
-        invalidRequest(violations);
-    const review = getReviewByBridge(bridgeNodeId);
-    if (review !== null)
-        return { status: 200, body: toReviewResponseDTO(review) };
-    throw new ReviewOperationError('unknown_review', 'review was not found', { received: bridgeNodeId });
-}
 async function handleSubmit(ctx) {
     const violations = [];
     const reviewId = requireReviewId(ctx, violations);
@@ -217,7 +193,6 @@ function handleDocument(ctx) {
 export const reviewRoutes = [
     { method: 'POST', pattern: '/v1/human/reviews', handler: handleCreate },
     { method: 'GET', pattern: '/v1/human/reviews', handler: handleList },
-    { method: 'GET', pattern: '/v1/human/reviews/by-bridge/:bridge_node_id', handler: handleByBridge },
     { method: 'GET', pattern: '/v1/human/reviews/:review_id', handler: handleRead },
     { method: 'POST', pattern: '/v1/human/reviews/:review_id/submit', handler: handleSubmit },
     { method: 'POST', pattern: '/v1/human/reviews/:review_id/cancel', handler: handleCancel },

package/dist/daemon/api/map.d.ts

@@ -1,5 +1,4 @@
 import type { ManagedWorktree, NodeMeta, NodeRow, NodeRuntime, SubscriptionRef } from '../../core/canvas/types.js';
-import type { OutcomeDeliveryRecord } from '../../core/canvas/node-outcome-deliveries.js';
 import type { ReviewComment, ReviewCommentEvent, ReviewErrorCode, ReviewRecord, ReviewResult } from '../../core/review/types.js';
 import { type Cron, type CronRunRecord } from '../../core/canvas/crons.js';
 import type { ProfileEntry } from '../../core/profiles/manifest.js';
@@ -7,11 +6,34 @@ import type { ReviveResult } from '../../core/runtime/revive.js';
 import type { CloseNodeResult } from '../../core/runtime/close.js';
 import { type PushResult } from '../../core/feed/feed.js';
 import type { PageFeedback, PageFeedbackComment } from '../../core/human/feedback.js';
-import type { CloseResultDTO, CronDTO, CronRunDTO, ErrorBody, NodeEdgesDTO, NodeOutcomeDTO, NodePathsDTO, NodeStatusDTO, OutcomeDeliveryDTO, NodeSummaryDTO, NodeDetailDTO, NodeWorktreeDTO, ProfileDTO, ReviewCommentDTO, ReviewCommentEventDTO, ReviewDTO, FeedbackResultDTO, PageFeedbackCommentDTO, PageFeedbackDTO, PushReportResultDTO, ReviveResultDTO, SubscriptionDTO } from '../../api/index.js';
+import type { OnDiskMigrationRunResult } from '../../migrations/runner.js';
+import type { CloseResultDTO, CronDTO, CronRunDTO, ErrorBody, NodeEdgesDTO, NodeOutcomeDTO, NodePathsDTO, NodeStatusDTO, OutcomeDeliveryDTO, NodeSummaryDTO, NodeDetailDTO, NodeWorktreeDTO, ProfileDTO, ReviewCommentDTO, ReviewCommentEventDTO, ReviewDTO, FeedbackResultDTO, PageFeedbackCommentDTO, PageFeedbackDTO, PushReportResultDTO, ReviveResultDTO, MigrateStateDTO, SubscriptionDTO } from '../../api/index.js';
+export declare function toMigrateStateDTO(result: OnDiskMigrationRunResult, options: {
+    resumed: boolean;
+    resumeError?: string;
+}): MigrateStateDTO;
 /** Project a latched outcome, or null while this node remains unsettled. */
 export declare function toNodeOutcomeDTO(node: Pick<NodeMeta, 'node_id' | 'final_report'> & NodeRuntime): NodeOutcomeDTO | null;
+/** The outcome-delivery fields exposed by the API. The delivery store supplies this projection directly. */
+export interface OutcomeDeliveryDTOInput {
+    nodeId: string;
+    state: 'armed' | 'pending' | 'running' | 'accepted' | 'permanent_failed';
+    actionName: string;
+    attempt: number;
+    nextAttemptAt: number;
+    acceptedAt: number | null;
+    permanentFailedAt: number | null;
+    lastFailure: {
+        kind: 'exit' | 'signal' | 'timeout' | 'spawn_error';
+        exitCode?: number;
+        signal?: string;
+        message?: string;
+    } | null;
+    createdAt: number;
+    updatedAt: number;
+}
 /** Project a durable delivery row without exposing its execution coordinates or stderr tail. */
-export declare function toOutcomeDeliveryDTO(row: OutcomeDeliveryRecord): OutcomeDeliveryDTO;
+export declare function toOutcomeDeliveryDTO(row: OutcomeDeliveryDTOInput): OutcomeDeliveryDTO;
 /** Project the queryable row (what `listNodes` yields) into a summary DTO. */
 export declare function toNodeSummaryDTO(row: NodeRow): NodeSummaryDTO;
 /** The subscription/child edges a detail projection needs. The handler gathers

package/dist/daemon/api/map.js

@@ -10,11 +10,12 @@
 // reasonable projections; this module is what makes them concrete, so any DTO
 // field that projection proves wrong is corrected here at the source.
 import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { outputResultPath } from '../../core/runtime/structured-output.js';
 import { ReviewOperationError as ReviewOperationErrorClass } from '../../core/review/types.js';
 import { cronSinkDisplay } from '../../core/canvas/crons.js';
 import { isProfilePaused, sanitizeProfileMetadata } from '../../core/profiles/manifest.js';
-import { contextDir, inboxPath, nodeDir, nodeMetaPath, reportsDir, reviewResultPath, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
+import { contextDir, nodeDir, nodeMetaPath, reportsDir, transcriptPath, viewSocketPath, } from '../../core/canvas/paths.js';
 import { FinalizationError } from '../../core/feed/feed.js';
 import { NodeIdConflictError } from '../../core/runtime/nodes.js';
 import { readContextTokens } from '../../core/canvas/telemetry.js';
@@ -22,8 +23,82 @@ import { CrtrError } from '../../core/errors.js';
 import { WorktreeError } from '../../core/worktree.js';
 import { ApiError } from '../../api/errors.js';
 import { ExitCode } from '../../types.js';
-import { responsePath } from '../../core/human/convention.js';
-import { ticketDir } from '../../core/human/root.js';
+export function toMigrateStateDTO(result, options) {
+    const { discovery, snapshots } = result;
+    return {
+        profiles: result.profiles,
+        stores: discovery.stores.length,
+        changed: result.changed,
+        applied: result.applied,
+        skipped: result.skipped,
+        blockers: result.blockers.map((blocker) => ({
+            kind: blocker.kind,
+            message: blocker.message,
+            ...(blocker.storeRoot === undefined ? {} : { store: blocker.storeRoot }),
+            ...(blocker.targetId === undefined ? {} : { target: blocker.targetId }),
+            ...(blocker.path === undefined ? {} : { path: blocker.path }),
+            ...(blocker.name === undefined ? {} : { name: blocker.name }),
+            ...(blocker.paths === undefined ? {} : { paths: blocker.paths }),
+        })),
+        discovery_roots: discovery.roots.map((row) => ({
+            reason: row.reason,
+            root: row.root,
+            boundary: row.boundary,
+            ...(row.detail === undefined ? {} : { detail: row.detail }),
+        })),
+        discovered_stores: discovery.stores.map((store) => ({
+            store: store.key,
+            scope: store.descriptor.scope,
+            namespace: store.descriptor.namespace,
+            mount_status: store.descriptor.mountStatus,
+            writable: store.writable,
+            reasons: [...new Set(store.discovery.map((row) => row.reason))],
+            targets: store.targets,
+            docs: snapshots.get(store.key)?.docs.length ?? 0,
+        })),
+        discovered_targets: discovery.targets.map((target) => ({
+            id: target.id,
+            kind: target.kind,
+            origin: target.origin,
+            cwd: target.target.cwd,
+            profile_id: target.target.profileId,
+            node_id: target.target.nodeId,
+            stores: target.storeKeys,
+        })),
+        repository_namespaces: result.repositories.map((row) => ({
+            repository_root: row.repositoryRoot,
+            repository_key: row.repositoryKey,
+            declaration_path: row.declarationPath,
+            namespace: row.namespace,
+            source: row.source,
+            action: row.action,
+        })),
+        store_prefixes: result.storePrefixes.map((row) => ({
+            store_root: row.storeRoot,
+            owner_dir: row.ownerDir,
+            repository_root: row.repositoryRoot,
+            owner_relative_path: row.ownerRelativePath,
+            old_prefix: row.oldPrefix,
+            old_rule: row.oldRule,
+            effective_prefix: row.effectivePrefix,
+            nested_declaration_action: row.nestedDeclarationAction,
+            front_door_action: row.frontDoorAction,
+        })),
+        renames: result.renames.map((row) => ({ store_root: row.storeRoot, path: row.path, from: row.from, to: row.to })),
+        references: result.references.map((row) => ({ store_root: row.storeRoot, path: row.path, kind: row.kind, from: row.from, to: row.to })),
+        dryRun: result.dryRun,
+        blocked: result.blocked,
+        corpus_phase: result.corpusPhase,
+        wrote: {
+            profile_manifests: result.wrote.profileManifests,
+            documents: result.wrote.documents,
+            corpus_consumers: result.wrote.corpusConsumers,
+            corpus_identities: result.wrote.corpusIdentities,
+        },
+        resumed: options.resumed,
+        ...(options.resumeError === undefined ? {} : { resume_error: options.resumeError }),
+    };
+}
 // Node projections
 /** Read the optional machine result without letting a missing or malformed sidecar obscure the durable outcome row. */
 function readStructuredResult(nodeId) {
@@ -122,6 +197,8 @@ export function toNodeSummaryDTO(row) {
         finalized_at: row.finalized_at ?? null,
         deadline_at: row.deadline_at ?? null,
         outcome: toNodeOutcomeDTO(row),
+        fault: row.fault && row.fault.link !== 'broker↔crtrd' ? { ...row.fault, link: row.fault.link } : null,
+        streaming: row.streaming ?? false,
     };
 }
 /** Project a node's spine + subscription edges (absorbs `managers`/`paths`). */
@@ -142,7 +219,6 @@ export function toNodePathsDTO(nodeId) {
         context_dir: contextDir(nodeId),
         reports_dir: reportsDir(nodeId),
         meta_path: nodeMetaPath(nodeId),
-        inbox_path: inboxPath(nodeId),
         transcript_path: transcriptPath(nodeId),
         view_socket: viewSocketPath(nodeId),
     };
@@ -197,6 +273,8 @@ export function toNodeDetailDTO(meta, edges) {
         finalized_at: meta.finalized_at ?? null,
         deadline_at: meta.deadline_at ?? null,
         outcome: toNodeOutcomeDTO(meta),
+        fault: meta.fault && meta.fault.link !== 'broker↔crtrd' ? { ...meta.fault, link: meta.fault.link } : null,
+        streaming: meta.streaming ?? false,
         creator: meta.creator ?? null,
         edges: toNodeEdgesDTO(meta, edges),
         paths: toNodePathsDTO(meta.node_id),
@@ -363,7 +441,7 @@ export function toReviewDTO(row, extras = {}) {
         review_id: row.review_id,
         origin_kind: row.origin_kind,
         origin_node_id: row.origin_node_id,
-        bridge_node_id: row.bridge_node_id,
+        review_dir: row.review_dir,
         companion_node_id: row.companion_node_id,
         file: row.file,
         state: row.state,
@@ -601,15 +679,7 @@ function reviewErrorDetails(err) {
 function terminalConflictReviewDTO(review) {
     if (review.state !== 'approved')
         return toReviewDTO(review);
-    const result_path = review.origin_kind === 'inline'
-        ? reviewResultPath(review.review_id)
-        : responsePath(ticketDir(requireBridgeNodeId(review)));
-    return toReviewDTO(review, { result_path });
-}
-function requireBridgeNodeId(review) {
-    if (review.bridge_node_id === null)
-        throw new Error(`approved ticket review lacks its bridge node: ${review.review_id}`);
-    return review.bridge_node_id;
+    return toReviewDTO(review, { result_path: join(review.review_dir, 'result.json') });
 }
 function statusForExitCode(exitCode) {
     switch (exitCode) {

package/dist/daemon/api/server.js

@@ -24,21 +24,22 @@ import { emitEvent } from '../../core/events/emit.js';
 import { envCrtrdTcp, envCrtrdToken } from '../../shared/env.js';
 import { Router } from './router.js';
 import { handleAttachUpgrade } from './bridge.js';
+import { boundDaemonControl } from '../control.js';
 import { attachRoutes } from './handlers/attach.js';
 import { bashJobRoutes } from './handlers/bash-jobs.js';
 import { brokerOperationRoutes } from './handlers/broker-ops.js';
+import { brokerRecoveryRoutes, nodeFaultRoutes } from './handlers/broker-recovery.js';
 import { canvasRoutes } from './handlers/canvas.js';
 import { chatInventoryRoutes } from './handlers/chat-inventory.js';
 import { daemonRoutes } from './handlers/daemon.js';
 import { fileRoutes } from './handlers/files.js';
 import { focusRoutes } from './handlers/focus.js';
 import { healthRoutes } from './handlers/health.js';
-import { humanRoutes } from './handlers/human.js';
 import { humanRequestRoutes } from './handlers/human-requests.js';
 import { inboxRoutes } from './handlers/inbox.js';
 import { feedbackCommentRoutes } from './handlers/feedback-comments.js';
 import { memoryRoutes } from './handlers/memory.js';
-import { messageRoutes } from './handlers/messages.js';
+import { brokerMailRoutes, messageRoutes } from './handlers/messages.js';
 import { modelAuthRoutes } from './handlers/modelauth.js';
 import { modelConfigRoutes } from './handlers/model-config.js';
 import { nodeRoutes } from './handlers/nodes.js';
@@ -62,7 +63,10 @@ function buildRouter() {
         .registerAll(nodeOutcomeRoutes)
         .registerAll(bashJobRoutes)
         .registerAll(brokerOperationRoutes)
+        .registerAll(brokerRecoveryRoutes)
+        .registerAll(nodeFaultRoutes)
         .registerAll(worktreeRoutes)
+        .registerAll(brokerMailRoutes)
         .registerAll(messageRoutes)
         .registerAll(reportRoutes)
         .registerAll(attachRoutes)
@@ -75,7 +79,6 @@ function buildRouter() {
         .registerAll(profileRoutes)
         .registerAll(modelAuthRoutes)
         .registerAll(modelConfigRoutes)
-        .registerAll(humanRoutes)
         .registerAll(reviewRoutes)
         .registerAll(reviewCommentRoutes)
         .registerAll(inboxRoutes)
@@ -135,6 +138,20 @@ function writeUnauthorized(res) {
     res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' });
     res.end(payload);
 }
+function writeStartupBlocked(res, message) {
+    res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify({ error: { code: 'startup_blocked', message } }));
+}
+function destroyUpgradeStartupBlocked(socket, message) {
+    const payload = JSON.stringify({ error: { code: 'startup_blocked', message } });
+    const response = `HTTP/1.1 503 Service Unavailable\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: ${Buffer.byteLength(payload)}\r\nconnection: close\r\n\r\n${payload}`;
+    try {
+        socket.end(response);
+    }
+    catch {
+        socket.destroy();
+    }
+}
 /** Reject an unauthorized TCP WS-upgrade attempt: this is a raw pre-upgrade
  *  socket (no `ServerResponse`), so the 401 is written as a literal HTTP
  *  response — mirroring `bridge.ts`'s `refuseUpgrade` (`end()`, not
@@ -180,13 +197,25 @@ function closeServer(server) {
  *  servers route into identical state. */
 export function createApiServer(opts = {}) {
     const router = buildRouter();
+    const brokerLaunchRoutes = new Router()
+        .registerAll(brokerOperationRoutes)
+        .registerAll(brokerRecoveryRoutes)
+        .registerAll(brokerMailRoutes);
+    const startupBlockFor = (method, pathname) => {
+        const block = boundDaemonControl()?.startupBlock() ?? null;
+        if (block === null)
+            return null;
+        const admitted = (method === 'GET' && (pathname === '/healthz' || pathname === '/v1/status'))
+            || (method === 'POST' && (pathname === '/v1/daemon/migrate' || pathname === '/v1/daemon/admit'))
+            || (block.phase === 'recovering' && brokerLaunchRoutes.match(method, pathname) !== null);
+        return admitted ? null : block;
+    };
     const sockPath = apiSocketPath();
-    // Shared request handler. The router's `handle` is total: it never throws and
-    // turns every failure (no route, bad body, handler throw) into a JSON
-    // ErrorBody. The `void` + `.catch` is belt-and-suspenders against an
-    // unexpected rejection.
+    // Shared request handler. It owns the request boundary, including URL
+    // parsing before the router can take over, so malformed wire input cannot
+    // escape Node's request listener and terminate the daemon.
     const onRequest = (req, res) => {
-        void router.handle(req, res).catch((err) => {
+        const internalFailure = (err) => {
             emitEvent({
                 event: 'api.request.failed',
                 level: 'error',
@@ -201,7 +230,32 @@ export function createApiServer(opts = {}) {
             catch {
                 /* response already gone */
             }
-        });
+        };
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        }
+        catch {
+            try {
+                res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify({ error: { code: 'invalid_request', message: 'request URL is invalid' } }));
+            }
+            catch {
+                /* response already gone */
+            }
+            return;
+        }
+        try {
+            const block = startupBlockFor((req.method ?? 'GET').toUpperCase(), url.pathname);
+            if (block !== null) {
+                writeStartupBlocked(res, block.message);
+                return;
+            }
+            void router.handle(req, res).catch(internalFailure);
+        }
+        catch (err) {
+            internalFailure(err);
+        }
     };
     // Shared upgrade handler: only `GET /v1/nodes/:id/attach` is served; every
     // other upgrade path destroys the socket, and an unhandled error destroys the
@@ -214,6 +268,11 @@ export function createApiServer(opts = {}) {
         });
         try {
             const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            const block = startupBlockFor((req.method ?? 'GET').toUpperCase(), url.pathname);
+            if (block !== null) {
+                destroyUpgradeStartupBlocked(socket, block.message);
+                return;
+            }
             const nodeId = attachNodeId(req.method ?? 'GET', url.pathname);
             if (nodeId === null) {
                 // Not an attach upgrade — no other upgrade path is served.

package/dist/daemon/control.d.ts

@@ -1,3 +1,4 @@
+import type { DaemonAdmitDTO, StartupPhaseDTO } from '../api/dto/health.js';
 /** What crtrd exposes to handlers that act on the daemon process itself. */
 export interface DaemonControl {
     /** This daemon's epoch id. */
@@ -14,6 +15,23 @@ export interface DaemonControl {
     };
     /** Register daemon-owned post-response work for shutdown draining. */
     registerDetached(work: Promise<void>): void;
+    /** Null only after normal startup completed. */
+    startupBlock(): {
+        phase: Exclude<StartupPhaseDTO, 'ready'>;
+        message: string;
+        blockerPaths: readonly string[];
+    } | null;
+    /** Admit normal work after the daemon has prepared its storage. */
+    admitStartup(): Promise<DaemonAdmitDTO>;
+    /** Re-run daemon-owned corpus migration and resume normal startup when repaired. */
+    repairMigrations(req: {
+        dryRun: boolean;
+        dirs: readonly string[];
+    }): Promise<{
+        result: import('../migrations/runner.js').OnDiskMigrationRunResult;
+        resumed: boolean;
+        resumeError?: string;
+    }>;
 }
 /** Bind this process's control surface. Called once, by `runDaemon`. */
 export declare function bindDaemonControl(control: DaemonControl): void;

package/dist/daemon/cron/disposition.d.ts

@@ -1,4 +1,5 @@
 import { type Cron } from '../../core/canvas/crons.js';
+import { type CronSinkResolution } from './sinks.js';
 export interface RunSettleContext {
     runId: string;
     startedAtIso: string;
@@ -15,5 +16,6 @@ export interface Disposition {
     delivered: string;
     /** A paused row is retained so `cron resume` can re-arm it. */
     paused: boolean;
+    obligation?: CronSinkResolution;
 }
 export declare function disposeSettledRun(c: Cron, ctx: RunSettleContext, outOfBand: boolean, selfCanceled?: boolean): Promise<Disposition>;

package/dist/daemon/cron/disposition.js

@@ -1,6 +1,6 @@
 import { getCron, setCronLastOutputHash } from '../../core/canvas/crons.js';
 import { escalateFailure, failureSummary } from './escalation.js';
-import { deliverToSink } from './sinks.js';
+import { resolveCronSink } from './sinks.js';
 export async function disposeSettledRun(c, ctx, outOfBand, selfCanceled = false) {
     const prefix = outOfBand ? 'out-of-band: ' : '';
     // A self-cancel still delivers its already-produced output; an external cancellation does not.
@@ -31,17 +31,20 @@ export async function disposeSettledRun(c, ctx, outOfBand, selfCanceled = false)
         case 'on-change':
             if (!changed)
                 return { delivered: `${prefix}unchanged — not delivered (on-change)`, paused: false };
-            return deliverOrEscalate(effective, ctx, outOfBand, prefix);
+            return resolveOrEscalate(effective, ctx, outOfBand, prefix);
         case 'always':
-            return deliverOrEscalate(effective, ctx, outOfBand, prefix);
+            return resolveOrEscalate(effective, ctx, outOfBand, prefix);
     }
 }
-async function deliverOrEscalate(c, ctx, outOfBand, prefix) {
+async function resolveOrEscalate(c, ctx, outOfBand, prefix) {
     if (ctx.stdoutHead.trim() === '') {
         return { delivered: `${prefix}empty stdout — nothing delivered`, paused: false };
     }
     try {
-        return { delivered: `${prefix}${await deliverToSink(c, ctx.stdoutHead)}`, paused: false };
+        const obligation = resolveCronSink(c, ctx.runId, ctx.stdoutHead);
+        return obligation.kind === 'none'
+            ? { delivered: `${prefix}${obligation.delivered}`, paused: false }
+            : { delivered: '', paused: false, obligation };
     }
     catch (err) {
         const why = `delivery failed: ${err.message}`;