@north-light/crouter 0.3.312 → 0.3.314

package/dist/daemon/human/sweep.js

@@ -1,70 +1,66 @@
-import { existsSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import { getRow } from '../../core/canvas/canvas.js';
-import { getReviewByBridge } from '../../core/review/store.js';
-import { emitEvent } from '../../core/events/emit.js';
-import { reviewPath } from '../../core/human/convention.js';
-import { ticketsRoot } from '../../core/human/root.js';
-import { readTicketResult } from '../../core/human/tickets.js';
-import { cancelHumanTicket, deliverTerminalResult, releaseActionDelivery, settleFeedbackCompanion } from './finish.js';
-/** No surface can open a review ticket that has no canonical row, so cancellation is its
- *  only reachable end. Boot runs this before API traffic, and a row is committed before its
- *  ticket is published, so an in-flight review is never mistaken for one of these. */
-const UNBACKED_REVIEW_REASON = 'this review predates canonical review records and cannot be opened; re-file the review';
-function isTerminalBridge(status) {
-    return status === 'done' || status === 'dead' || status === 'canceled';
-}
-/** Deliver terminal ticket results left behind before their bridge could finish. */
-export async function reconcileUndeliveredTickets() {
-    let scanned = 0;
-    let delivered = 0;
+import { existsSync, readdirSync, rmSync } from 'node:fs';
+import { reviewsRoot } from '../../core/canvas/paths.js';
+import { listBindingRequests, listRequests, listUnprojectedReviews, markProjectionError, } from '../../core/human/requests.js';
+import { projectAndRetire } from './settle.js';
+function errorText(error) { return error instanceof Error ? error.message : String(error); }
+/**
+ * The one startup repair pass for SQL-authoritative pages and reviews. It does
+ * not infer a missing notification or action delivery: settlement created both
+ * atomically. The two remaining filesystem effects retain their durable marks.
+ */
+/** Direct outbox rows are created in the settlement transaction; there is no separate ticket-delivery repair pass. */
+export async function reconcileUndeliveredTickets() { }
+export async function sweepHumanRequests(effects) {
+    let realized = 0;
+    let collected = 0;
+    let reprojected = 0;
+    let retired = 0;
     let failed = 0;
-    const root = ticketsRoot();
-    for (const entry of readdirSync(root)) {
+    for (const request of listBindingRequests()) {
         try {
-            const dir = join(root, entry);
-            if (!statSync(dir).isDirectory())
-                continue;
-            scanned += 1;
-            const canonical = getReviewByBridge(entry) !== null;
-            const ticketResult = readTicketResult(dir);
-            if (ticketResult === null) {
-                if (!canonical && existsSync(reviewPath(dir))) {
-                    await cancelHumanTicket(entry, { reason: UNBACKED_REVIEW_REASON, actor: 'system' });
-                    delivered += 1;
+            await effects.realizeReview(request.request_id);
+            realized += 1;
+        }
+        catch {
+            // A missing branch is a valid binding-recovery outcome. Its terminal row
+            // is written by realization; other failures remain visible for next boot.
+            failed += 1;
+        }
+    }
+    try {
+        const live = new Set(listRequests({ kind: 'review' }).map((request) => request.request_id));
+        if (existsSync(reviewsRoot())) {
+            for (const entry of readdirSync(reviewsRoot(), { withFileTypes: true })) {
+                if (entry.isDirectory() && !live.has(entry.name)) {
+                    rmSync(`${reviewsRoot()}/${entry.name}`, { recursive: true, force: true });
+                    collected += 1;
                 }
-                continue;
             }
-            // Canonical reviews own terminal delivery and bridge retirement. Their
-            // finisher retries only when its winning operation is explicitly repeated.
-            if (canonical)
-                continue;
-            // A terminal page ticket retires its feedback companion whether or not a
-            // reply bridge exists: inbox-only pages have no bridge row, yet the
-            // daemon can die between result publication and companion retirement.
-            await settleFeedbackCompanion(entry, ticketResult.kind === 'canceled' ? 'canceled' : 'approved');
-            // A settlement that died before enqueueing its completion action still
-            // owes that delivery; the insert is idempotent on the request id.
-            releaseActionDelivery(entry);
-            // The ROW is what carries status; `getNode` would answer from a pruned
-            // bridge's surviving meta.json with no status at all.
-            const bridge = getRow(entry);
-            if (bridge === null || isTerminalBridge(bridge.status))
-                continue;
-            if (await deliverTerminalResult(entry))
-                delivered += 1;
+        }
+    }
+    catch {
+        failed += 1;
+    }
+    for (const request of listUnprojectedReviews()) {
+        try {
+            await projectAndRetire(request, { project: effects.projectReview, retire: effects.retireCompanion });
+            reprojected += 1;
         }
         catch (error) {
+            markProjectionError(request.request_id, errorText(error));
+            failed += 1;
+        }
+    }
+    for (const request of listRequests({ state: 'settled' })) {
+        if (request.companion_node_id === null || request.companion_retired_at !== null)
+            continue;
+        try {
+            await projectAndRetire(request, { retire: effects.retireCompanion });
+            retired += 1;
+        }
+        catch {
             failed += 1;
-            emitEvent({
-                level: 'error',
-                event: 'human.delivery.reconcile_failed',
-                node_id: entry,
-                error,
-            });
         }
     }
-    const result = { scanned, delivered, failed };
-    emitEvent({ level: 'info', event: 'human.delivery.reconciled', fields: result });
-    return result;
+    return { realized, collected, reprojected, retired, failed };
 }

package/dist/daemon/manage.d.ts

@@ -1,3 +1,4 @@
+import { type HealthDTO, type StartupPhaseDTO } from '../api/index.js';
 /** Env keys that must NEVER reach the daemon process. Restarting crtrd is
  *  overwhelmingly done from inside an agent node's own bash tool (`crtr sys
  *  daemon stop && start`), which inherits that node's FULL env — its identity
@@ -39,6 +40,10 @@ export declare function sweepStrayDaemons(keepPid: number | null): number[];
 /** Replace PID 1 with the selected daemon generation. Docker keeps a container
  *  alive only while PID 1 lives, so a handover there must preserve its pid. */
 export declare function execDaemon(): Promise<never>;
+export interface SpawnDaemonOptions {
+    /** The phase that proves a daemon launched by this call is available. */
+    targetPhase?: 'ready' | 'prepared';
+}
 export interface SpawnDaemonResult {
     /** True when a new daemon process was spawned. */
     started: boolean;
@@ -52,9 +57,12 @@ export interface SpawnDaemonResult {
     serving?: false;
     /** The final `/healthz` probe failure when a live owner misses readiness. */
     probe_error?: string;
+    /** The observed phase when the daemon was available. */
+    startup_phase?: StartupPhaseDTO;
 }
-/** Make one `/healthz` observation without client-side recovery. The caller
- * owns the availability window, so this probe cannot extend it. */
+/** Make one `/healthz` observation without client-side recovery. The caller owns the availability window, so this probe cannot extend it. */
+export declare function probeDaemonHealth(timeoutMs?: number): Promise<HealthDTO>;
+/** True only when one mandatory Unix API socket probe answers the existing ready health contract. */
 export declare function probeDaemonServing(timeoutMs?: number): Promise<void>;
 /** True only when one mandatory Unix API socket probe answers `/healthz`.
  * A pidfile identifies an owner; it is never readiness. */
@@ -72,13 +80,16 @@ export interface DaemonStartupDeps extends DaemonWaitDeps {
     } | null;
     isDaemonServing?: () => Promise<boolean>;
     probeDaemonServing?: (timeoutMs: number) => Promise<void>;
+    probeDaemonHealth?: (timeoutMs: number) => Promise<HealthDTO>;
 }
-/** Thrown when the spawned daemon exited on `DAEMON_EXIT_STARTUP_BLOCKED` — a
- *  standing condition (a blocked on-disk migration) that the very next spawn
- *  would hit identically. Callers must stop retrying and surface the repair;
- *  the daemon has already written the detail to `crtrd.err`. */
+/** A live daemon has bound its repair socket but cannot serve normal work
+ *  until its corpus migration succeeds. */
 export declare class DaemonStartupBlockedError extends Error {
-    constructor(pid: number);
+    constructor(pid: number, message: string);
+}
+/** A preparation request cannot succeed unless the live daemon explicitly reports prepared. */
+export declare class DaemonNotPreparedError extends Error {
+    constructor(pid: number, startupPhase: StartupPhaseDTO | undefined);
 }
 /** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
  *  appear before reporting success. This catches the "started:true but not yet
@@ -93,7 +104,7 @@ export declare class DaemonStartupBlockedError extends Error {
  *
  *  Returns null when the spawned pid owns the pidfile; returns a different live
  *  daemon pid when startup lost the race to an already-running daemon. */
-export declare function verifyDaemonStartup(pid: number, timeoutMs?: number, deps?: DaemonStartupDeps): Promise<number | null>;
+export declare function verifyDaemonStartup(pid: number, timeoutMs?: number, deps?: DaemonStartupDeps, targetPhase?: 'ready' | 'prepared'): Promise<number | null>;
 /** Wait until a signaled daemon has exited and relinquished its pidfile. This
  *  makes a following start safe to claim the singleton rather than racing its
  *  previous owner. */
@@ -119,7 +130,7 @@ export declare function stopDaemonProcess(pid: number, timeoutMs?: number, deps?
  *
  *  If the daemon is already running, returns {started:false, existing_pid}.
  *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
-export declare function spawnDaemon(): Promise<SpawnDaemonResult>;
+export declare function spawnDaemon(opts?: SpawnDaemonOptions): Promise<SpawnDaemonResult>;
 /** Whether autostart is suppressed for this invocation. `--no-autostart` or
  *  `CRTR_NO_DAEMON_AUTOSTART=1` forces fail-loud on a cold socket (spec §7.1) —
  *  for environments that manage crtrd externally and want the diagnostic, and
@@ -134,13 +145,7 @@ export declare function spawnDaemon(): Promise<SpawnDaemonResult>;
  *  explicit `crtr sys daemon start` calls `spawnDaemon` directly and is
  *  deliberately unaffected. */
 export declare function autostartDisabled(): boolean;
-/** Why implicit autostart is currently suppressed, or null when it is free to
- *  run. Set only by a `DaemonStartupBlockedError`, which no retry can clear —
- *  an explicit `crtr sys daemon start` still calls `spawnDaemon` directly and
- *  reports the failure in full. */
-export declare function daemonAutostartSuppression(): string | null;
-/** Clear the suppression and the backoff — for a caller that has repaired the
- *  standing condition and wants autostart live again without a new process. */
+/** Reset in-process spawn backoff after a daemon is observed alive. */
 export declare function resetDaemonAutostart(): void;
 export interface EnsureDaemonDeps {
     isDaemonRunning?: () => boolean;

package/dist/daemon/manage.js

@@ -14,8 +14,7 @@ import { hostExecPath } from '../core/runtime/branded-host.js';
 // Pulled from the lean db-free pidfile module (NOT crtrd.js, whose module graph
 // reaches openDb) so the CLI daemon front door stays canvas.db-free (plan B-0).
 import { isDaemonRunning, readPidfile, isPidAlive } from './pidfile.js';
-import { DAEMON_EXIT_STARTUP_BLOCKED, DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
-import { clearDaemonStartupBlocked, daemonStartupBlocked } from './startup-block-marker.js';
+import { DAEMON_STARTUP_WINDOW_MS } from './startup-policy.js';
 import { exclusiveLockOwnerPid } from '../core/exclusive-lock.js';
 import { onDiskMigrationLockPath } from '../core/canvas/paths.js';
 import { envNoDaemonAutostart } from '../shared/env.js';
@@ -208,11 +207,18 @@ const DAEMON_VERIFY_POLL_MS = 10;
 /** A status/start readiness probe must not hang behind a daemon that accepts a
  * Unix connection but never answers it. */
 const DAEMON_HEALTH_PROBE_TIMEOUT_MS = 1_000;
-/** Make one `/healthz` observation without client-side recovery. The caller
- * owns the availability window, so this probe cannot extend it. */
-export async function probeDaemonServing(timeoutMs = DAEMON_HEALTH_PROBE_TIMEOUT_MS) {
+/** Make one `/healthz` observation without client-side recovery. The caller owns the availability window, so this probe cannot extend it. */
+export async function probeDaemonHealth(timeoutMs = DAEMON_HEALTH_PROBE_TIMEOUT_MS) {
     const probeTimeoutMs = Math.min(timeoutMs, DAEMON_HEALTH_PROBE_TIMEOUT_MS);
-    const health = await CrtrClient.forLocalSocket({ autostart: false, timeoutMs: probeTimeoutMs }).probeHealthz(probeTimeoutMs);
+    return CrtrClient.forLocalSocket({ autostart: false, timeoutMs: probeTimeoutMs }).probeHealthz(probeTimeoutMs);
+}
+/** True only when one mandatory Unix API socket probe answers the existing ready health contract. */
+export async function probeDaemonServing(timeoutMs = DAEMON_HEALTH_PROBE_TIMEOUT_MS) {
+    const health = await probeDaemonHealth(timeoutMs);
+    if (health.startup_blocked !== undefined) {
+        const pid = readPidfile() ?? process.pid;
+        throw new DaemonStartupBlockedError(pid, health.startup_blocked);
+    }
     if (!health.ok)
         throw new Error('crtrd health check reported not ready');
 }
@@ -232,16 +238,23 @@ function sleepMs(ms) {
         setTimeout(resolve, ms);
     });
 }
-/** Thrown when the spawned daemon exited on `DAEMON_EXIT_STARTUP_BLOCKED` — a
- *  standing condition (a blocked on-disk migration) that the very next spawn
- *  would hit identically. Callers must stop retrying and surface the repair;
- *  the daemon has already written the detail to `crtrd.err`. */
+/** A live daemon has bound its repair socket but cannot serve normal work
+ *  until its corpus migration succeeds. */
 export class DaemonStartupBlockedError extends Error {
-    constructor(pid) {
-        super(`daemon ${pid} exited: startup is blocked by a standing condition that retrying cannot clear. See crtrd.err, then run \`crtr sys migrate\`.`);
+    constructor(pid, message) {
+        super(`daemon ${pid} is running but normal startup is blocked: ${message}`);
         this.name = 'DaemonStartupBlockedError';
     }
 }
+/** A preparation request cannot succeed unless the live daemon explicitly reports prepared. */
+export class DaemonNotPreparedError extends Error {
+    constructor(pid, startupPhase) {
+        super(startupPhase === undefined
+            ? `daemon ${pid} is serving but did not report the prepared startup phase`
+            : `daemon ${pid} reported startup phase ${startupPhase}, not prepared`);
+        this.name = 'DaemonNotPreparedError';
+    }
+}
 /** Tiny bounded post-spawn guard: wait for the daemon pidfile and live pid to
  *  appear before reporting success. This catches the "started:true but not yet
  *  plausibly alive" race without turning startup into a retry loop.
@@ -255,7 +268,7 @@ export class DaemonStartupBlockedError extends Error {
  *
  *  Returns null when the spawned pid owns the pidfile; returns a different live
  *  daemon pid when startup lost the race to an already-running daemon. */
-export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW_MS, deps = {}) {
+export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW_MS, deps = {}, targetPhase = 'ready') {
     const read = deps.readPidfile ?? readPidfile;
     const alive = deps.isPidAlive ?? isPidAlive;
     const exited = deps.childExited;
@@ -268,6 +281,7 @@ export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW
         }
         await probeDaemonServing(remainingMs);
     });
+    const probeHealth = deps.probeDaemonHealth ?? probeDaemonHealth;
     const sleep = deps.sleepMs ?? sleepMs;
     const now = deps.now ?? Date.now;
     let owner = null;
@@ -285,18 +299,39 @@ export async function verifyDaemonStartup(pid, timeoutMs = DAEMON_STARTUP_WINDOW
                 if (exitState !== null && exitState !== undefined) {
                     if (exitState.signal !== null)
                         terminalError = new Error(`daemon ${pid} exited before becoming ready (by ${exitState.signal})`);
-                    else if (exitState.code === DAEMON_EXIT_STARTUP_BLOCKED)
-                        terminalError = new DaemonStartupBlockedError(pid);
                     else if (exitState.code !== 0)
                         terminalError = new Error(`daemon ${pid} exited before becoming ready (with exit code ${exitState.code ?? '?'})`);
-                    // A clean exit can have lost the ownership claim, so keep observing.
                     if (terminalError !== null)
                         throw terminalError;
                 }
                 throw new Error(`daemon ${pid} has no live pidfile owner`);
             }
-            await probeServing(remainingMs);
-            owner = candidate;
+            if (targetPhase === 'ready') {
+                try {
+                    await probeServing(remainingMs);
+                }
+                catch (error) {
+                    if (error instanceof DaemonStartupBlockedError)
+                        terminalError = error;
+                    throw error;
+                }
+                owner = candidate;
+                return;
+            }
+            const health = await probeHealth(remainingMs);
+            if (health.startup_phase === 'prepared') {
+                owner = candidate;
+                return;
+            }
+            if (health.startup_phase === 'blocked') {
+                terminalError = new DaemonStartupBlockedError(candidate, health.startup_blocked ?? 'on-disk migration is blocked');
+                throw terminalError;
+            }
+            if (health.startup_phase === 'ready') {
+                terminalError = new DaemonNotPreparedError(candidate, health.startup_phase);
+                throw terminalError;
+            }
+            throw new Error(`daemon ${candidate} is ${health.startup_phase ?? 'not reporting a startup phase'}; waiting for prepared`);
         },
     });
     return owner === pid ? null : owner;
@@ -371,14 +406,37 @@ export async function stopDaemonProcess(pid, timeoutMs = DAEMON_SHUTDOWN_WINDOW_
  *
  *  If the daemon is already running, returns {started:false, existing_pid}.
  *  If spawning fails (e.g. missing dist — run `npm run build` first), throws. */
-export async function spawnDaemon() {
+export async function spawnDaemon(opts = {}) {
+    const targetPhase = opts.targetPhase ?? 'ready';
     const recordedPid = readPidfile();
     if (recordedPid !== null && isPidAlive(recordedPid)) {
         try {
-            await probeDaemonServing();
-            return { started: false, existing_pid: recordedPid };
+            const health = await probeDaemonHealth();
+            if (targetPhase === 'prepared') {
+                if (health.startup_phase === 'prepared') {
+                    return { started: false, existing_pid: recordedPid, startup_phase: health.startup_phase };
+                }
+                throw new DaemonNotPreparedError(recordedPid, health.startup_phase);
+            }
+            if (health.ok) {
+                return {
+                    started: false,
+                    existing_pid: recordedPid,
+                    ...(health.startup_phase === undefined ? {} : { startup_phase: health.startup_phase }),
+                };
+            }
+            return {
+                started: false,
+                existing_pid: recordedPid,
+                running: true,
+                serving: false,
+                probe_error: health.startup_blocked ?? 'crtrd health check reported not ready',
+                ...(health.startup_phase === undefined ? {} : { startup_phase: health.startup_phase }),
+            };
         }
         catch (error) {
+            if (error instanceof DaemonNotPreparedError)
+                throw error;
             return {
                 started: false,
                 existing_pid: recordedPid,
@@ -415,7 +473,7 @@ export async function spawnDaemon() {
     // exactly instead of scanning the whole machine. crtrd-cli.ts's argv
     // parsing only looks for `--tcp`, so this extra pair of tokens is inert
     // there — it exists purely for `ps` visibility.
-    const child = spawn(hostExecPath(), [...launchArgs, '--canvas-home', crtrHome()], {
+    const child = spawn(hostExecPath(), [...launchArgs, '--canvas-home', crtrHome(), ...(targetPhase === 'prepared' ? ['--prepare'] : [])], {
         detached: true,
         stdio: ['ignore', errFd, errFd],
         env: sanitizedDaemonEnv(),
@@ -444,7 +502,7 @@ export async function spawnDaemon() {
     try {
         existingPid = await verifyDaemonStartup(pid, DAEMON_STARTUP_WINDOW_MS, {
             childExited: () => exitState,
-        });
+        }, targetPhase);
     }
     catch (error) {
         // Reap ONLY a child that is not doing the work. A child holding the on-disk
@@ -455,7 +513,7 @@ export async function spawnDaemon() {
         // corpus can legitimately outlast the window, and that daemon should be
         // allowed to finish and serve.
         const childOwnsMigrationLock = exclusiveLockOwnerPid(onDiskMigrationLockPath()) === pid;
-        if (exitState === null && !childOwnsMigrationLock) {
+        if (exitState === null && !childOwnsMigrationLock && !(error instanceof DaemonStartupBlockedError)) {
             try {
                 await stopDaemonProcess(pid, DAEMON_REAP_WINDOW_MS);
             }
@@ -464,9 +522,9 @@ export async function spawnDaemon() {
         throw error;
     }
     if (existingPid !== null) {
-        return { started: false, existing_pid: existingPid };
+        return { started: false, existing_pid: existingPid, startup_phase: targetPhase };
     }
-    return { started: true, pid };
+    return { started: true, pid, startup_phase: targetPhase };
 }
 // ensureDaemon — fire-and-forget front-door helper
 /** Whether autostart is suppressed for this invocation. `--no-autostart` or
@@ -495,24 +553,13 @@ const AUTOSTART_BACKOFF_MAX_MS = 60_000;
 let autostartInFlight = false;
 let autostartFailures = 0;
 let autostartNextAttemptAt = 0;
-let autostartBlocked = null;
 function autostartBackoffMs(failures) {
     return Math.min(AUTOSTART_BACKOFF_BASE_MS * 2 ** (failures - 1), AUTOSTART_BACKOFF_MAX_MS);
 }
-/** Why implicit autostart is currently suppressed, or null when it is free to
- *  run. Set only by a `DaemonStartupBlockedError`, which no retry can clear —
- *  an explicit `crtr sys daemon start` still calls `spawnDaemon` directly and
- *  reports the failure in full. */
-export function daemonAutostartSuppression() {
-    return autostartBlocked;
-}
-/** Clear the suppression and the backoff — for a caller that has repaired the
- *  standing condition and wants autostart live again without a new process. */
+/** Reset in-process spawn backoff after a daemon is observed alive. */
 export function resetDaemonAutostart() {
     autostartFailures = 0;
     autostartNextAttemptAt = 0;
-    autostartBlocked = null;
-    clearDaemonStartupBlocked();
 }
 /** Start the daemon if it is not already running. No-op if already up, if
  *  autostart is suppressed for this invocation, while an attempt is in flight,
@@ -525,8 +572,6 @@ export function ensureDaemon(deps = {}) {
     const now = deps.now ?? Date.now;
     if (autostartDisabled())
         return;
-    if (autostartBlocked !== null)
-        return;
     if (autostartInFlight)
         return;
     if (now() < autostartNextAttemptAt)
@@ -535,15 +580,6 @@ export function ensureDaemon(deps = {}) {
         resetDaemonAutostart();
         return;
     }
-    // The durable half of the gate. Everything above is module state, which caps
-    // exactly one process; the storm is made of many. A daemon that already
-    // proved startup is blocked left this marker in the canvas home, and it
-    // retires itself as soon as the corpus it named changes.
-    const blocked = daemonStartupBlocked();
-    if (blocked !== null) {
-        autostartBlocked = blocked;
-        return;
-    }
     autostartInFlight = true;
     void spawn().then(() => {
         autostartFailures = 0;
@@ -553,8 +589,6 @@ export function ensureDaemon(deps = {}) {
         // pre-build) must not break the calling command.
         autostartFailures += 1;
         autostartNextAttemptAt = now() + autostartBackoffMs(autostartFailures);
-        if (error instanceof DaemonStartupBlockedError)
-            autostartBlocked = error.message;
     }).finally(() => {
         autostartInFlight = false;
     });

package/dist/daemon/messaging/node-message.d.ts

@@ -14,7 +14,7 @@ export interface RuntimeMessageCard {
 }
 /**
  * Deliver one daemon-originated node message. Interactive messages use the live
- * broker when available; every other successful path is a durable inbox entry.
+ * broker when available; every other successful path is durable node mail.
  */
 export declare function deliverNodeMessage(args: {
     node_id: string;

package/dist/daemon/messaging/node-message.js

@@ -1,7 +1,7 @@
 import { getNode } from '../../core/canvas/canvas.js';
 import { cancelCronsOnWake } from '../../core/canvas/crons.js';
 import { withFreshTerminalGuard } from '../../core/canvas/canvas.js';
-import { appendInbox } from '../../core/feed/inbox.js';
+import { enqueueNodeMail } from '../../core/feed/messages.js';
 import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
 import { deliverLive } from '../../core/runtime/interactive-deliver.js';
 import { isBrokerLive } from '../../core/runtime/model-swap.js';
@@ -24,7 +24,7 @@ function guardRoutable(nodeId, body) {
 }
 /**
  * Deliver one daemon-originated node message. Interactive messages use the live
- * broker when available; every other successful path is a durable inbox entry.
+ * broker when available; every other successful path is durable node mail.
  */
 export async function deliverNodeMessage(args) {
     // A live interactive delivery has no durable append to guard, so establish
@@ -67,20 +67,17 @@ export async function deliverNodeMessage(args) {
                 throw error;
         }
     }
-    const entry = guardRoutable(args.node_id, () => appendInbox(args.node_id, {
-        from: args.from ?? null,
-        tier: args.mode === 'quiet' ? 'deferred' : 'normal',
+    const entry = guardRoutable(args.node_id, () => enqueueNodeMail(args.node_id, {
+        senderNodeId: args.from ?? null,
         kind: 'message',
         label: args.label,
-        data: { ...args.data, body: args.body },
+        bodyJson: { ...args.data, body: args.body },
+        urgency: args.mode === 'quiet' ? 'deferred' : 'normal',
+        wake: 1,
     }));
-    if (entry.tier !== 'deferred' || target.frozen_at !== null)
-        cancelCronsOnWake(args.node_id);
-    // The APPENDED entry's tier decides the wake: a quiet send to a terminal
-    // target was raised out of `deferred` by the append, and must be delivered.
     let revived = false;
     let reason;
-    if (entry.tier !== 'deferred') {
+    if (entry.urgency !== 'deferred') {
         target = getNode(args.node_id);
         if (target === null)
             deliveryUnroutable(args.node_id, 'origin_missing');
@@ -98,5 +95,5 @@ export async function deliverNodeMessage(args) {
             }
         }
     }
-    return { entry_id: entry.entry_id, via: 'inbox', revived, ...(reason === undefined ? {} : { reason }) };
+    return { entry_id: entry.messageId, via: 'inbox', revived, ...(reason === undefined ? {} : { reason }) };
 }

package/dist/daemon/park-activity.js

@@ -1,7 +1,7 @@
 import { statSync } from 'node:fs';
 import { emitEvent } from '../core/events/emit.js';
-import { hasWakeMailSince } from '../core/feed/inbox.js';
-import { isBusy } from '../core/runtime/busy.js';
+import { hasWakeMailSince } from '../core/canvas/deliveries.js';
+import { readLiveTurn } from '../core/canvas/recovery.js';
 import { parkEvent } from './reconcilers/live-obligation.js';
 /** A main-session write after parking was armed is durable evidence of live
  * input even when the turn has since settled and the viewer detached. */
@@ -23,7 +23,7 @@ export function mainSessionActivitySince(sessionFile, startedAt) {
  * the verdict cannot race a viewer, live delivery, or durable wake. */
 export function shouldParkAfterSummary(nodeId, node, pending) {
     return !pending.activity
-        && !isBusy(nodeId)
+        && readLiveTurn(nodeId)?.busy !== true
         && !mainSessionActivitySince(node.pi_session_file, pending.startedAt)
         && !hasWakeMailSince(nodeId, pending.startedAt)
         && parkEvent(nodeId, node.lifecycle) === 'park';

package/dist/daemon/reconcilers/bash-deadline.js

@@ -1,8 +1,7 @@
 import { bashJobPaths, expiredAutoBackgroundBashJobs, formatBashElapsed, stopBackgroundBashJob, } from '../../core/bash-jobs.js';
 import { isSafeNodeId } from '../../core/canvas/paths.js';
 import { contextDir } from '../../core/canvas/paths.js';
-import { cancelCronsOnWake } from '../../core/canvas/crons.js';
-import { appendInbox } from '../../core/feed/inbox.js';
+import { enqueueNodeMail } from '../../core/feed/messages.js';
 import { emitEvent } from '../../core/events/emit.js';
 import { operationIdContext } from '../../core/events/operation-id.js';
 import { isProfilePaused } from '../../core/profiles/manifest.js';
@@ -60,18 +59,18 @@ export class BashDeadlineReconciler {
         operationIdContext.fresh(() => {
             try {
                 emitEvent({ level: 'info', event: 'bash_deadline.canceled', ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}), fields: { job_id: jobId } });
-                appendInbox(nodeId, {
-                    from: null,
-                    tier: 'urgent',
+                enqueueNodeMail(nodeId, {
+                    senderNodeId: null,
+                    urgency: 'urgent',
+                    wake: 1,
                     kind: 'urgent',
                     label: 'background bash job canceled at its deadline',
-                    data: {
+                    bodyJson: {
                         body: `Background bash job ${jobId} was canceled after ${formatBashElapsed(elapsedMs)} because its background deadline passed and you did not claim it. ` +
                             `Next time, give a long command more room up front (a larger inline timeout), or claim the job with \`crtr node bash extend ${jobId} --for <duration>\` before the deadline. ` +
                             `Log: ${paths.jobLog}  Command: ${paths.cmdSh}`,
                     },
                 });
-                cancelCronsOnWake(nodeId);
             }
             catch (err) {
                 emitEvent({ level: 'error', event: 'bash_deadline.notice_failed', ...(isSafeNodeId(nodeId) ? { node_id: nodeId } : {}), error: err, fields: { job_id: jobId } });

package/dist/daemon/reconcilers/broker-supervision.d.ts

@@ -55,7 +55,7 @@ export declare class BrokerSupervisionReconciler {
     private readonly unattendedSince;
     private readonly sampleTree;
     private readonly signal;
-    private knownAuthMtimeMs;
+    private knownCredentialRevision;
     private lastOverCapWarnAt;
     constructor(options?: BrokerSupervisionOptions);
     /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth