@north-light/crouter 0.3.317 → 0.3.319

package/dist/daemon/crtrd.js

@@ -1,854 +1,8 @@
-// crtrd — the thin supervisor daemon. One instance per canvas.
-//
-// Sole responsibility: supervise engine exit and revive nodes. No orchestration
-// logic lives here. The daemon is a process-lifecycle watcher.
-//
-// Model (daemon-epoch broker ownership): EVERY node runs on a detached headless
-// broker process that crtrd itself spawned and holds a ChildProcess handle for.
-// The fleet registry's entry IS the node's liveness — no pid probe, no grace
-// clock. A broker's real `exit` event enqueues an exit-policy job on the
-// daemon's serial work lane (never inline on the Node event callback), where
-// classifyDeadNode — one pure 8-row policy table over durable row state —
-// decides forget / dormant / respawn / boot-failure. The row-driven tick
-// classifies disconnected rows through the same table. Every broker's argv is
-// stamped `--epoch <id>`: at boot the census reaps every prior-epoch broker
-// (no adoption), and at shutdown the daemon tears its whole fleet down, so no
-// broker ever outlives the daemon epoch that launched it. A tmux pane, when
-// present, is only a VIEWER of the engine and never hosts it; a viewer window
-// closing is not a node death.
-//
-// §H refresh-authority: a stale in-process stophook (pi extensions never reload,
-// so a days-old resident carries an old hook) can leave intent='refresh' on a
-// LIVE engine forever — the hook never calls shutdown, so no exit event arrives.
-// The daemon is the authority: when intent='refresh' persists on a fleet-owned
-// live engine whose turn is over, past a grace, it force-kills the engine itself
-// (handleYieldStall); the resulting exit-policy job respawns it fresh.
-//
-// An engine whose turn ends with stopReason 'error' (e.g. a provider outage
-// exhausted the SDK retry budget) is left parked by the stophook ("stay alive
-// for re-steering") — but a headless node has no human to re-steer it, so the
-// broker stays alive and status stays 'active'. The daemon is the authority here
-// too: when a live, not-busy node with no pending intent has a session file that
-// is quiet past the recovery window and whose last assistant message stops with
-// 'error', the daemon keeps the live broker parked and retries it via the
-// inbox-based fault-recovery pass; no out-of-band launch is needed.
-// An exit-policy respawn requests a cycle for an interrupted busy turn and a
-// strict resume otherwise. reviveNode centrally arbitrates either preference
-// against durable pending-refresh state.
-//
-// Single-instance guarantee
-//   A snapshot-conditioned canvas claim authorizes exactly one daemon to bind
-//   its event source. The PID file is a readiness mirror for external managers,
-//   scoped by CRTR_PIDFILE in managed deployments and crtrHome()/crtrd.pid
-//   otherwise. Shutdown quiesces admitted work, removes only this invocation's
-//   mirror, and then releases its exact claim.
-import { writeFileSync, readFileSync, rmSync, mkdirSync, } from 'node:fs';
-import { dirname } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { crtrHome } from '../core/canvas/paths.js';
-import { listNodeMemoryTargets, listNodes, } from '../core/canvas/index.js';
-import { createApiServer } from './api/server.js';
-import { reconcileUndeliveredTickets } from './human/sweep.js';
-import { resetHandedOffDeliveries } from '../core/canvas/deliveries.js';
-import { sweepReviews } from './review/sweep.js';
-import { pidfilePath } from './pidfile.js';
-import { rendererWarning } from '../core/runtime/package-health.js';
-import { DEFAULT_INTERVAL_MS } from './supervise-cadence.js';
-import { BrokerSupervisionReconciler } from './reconcilers/broker-supervision.js';
-import { ControllerDeathReconciler } from './reconcilers/controller-death.js';
-import { NodeLifecycleReconciler } from './reconcilers/node-lifecycle/tick.js';
-import { NodeDeadlineReconciler } from './reconcilers/node-deadline.js';
-import { CronLaneReconciler } from './reconcilers/cron-lane.js';
-import { DeliveryLaneReconciler } from './reconcilers/delivery-lane.js';
-import { migrateLegacyExecutionIdentities } from '../core/canvas/executions.js';
-import { PendingReviewSubmitReconciler } from './reconcilers/pending-review-submit.js';
-import { StorageMaintenanceReconciler } from './reconcilers/storage-maintenance.js';
-import { BashDeadlineReconciler } from './reconcilers/bash-deadline.js';
-import { captureLivenessSnapshot, capturePidCommand, captureTeardownSnapshot, isPidAlive, isAnyPidAlive, killProcessTreePids, } from '../core/canvas/pid.js';
-import { bindFleet, boundFleet } from '../core/runtime/fleet.js';
-import { bindDaemonControl, clearDaemonControl } from './control.js';
-import { execDaemon, spawnDaemon } from './manage.js';
-import { reconcileAndMigrateBoot } from '../core/canvas/boot.js';
-import { resolveInstallId } from '../core/canvas/install-id.js';
-import { setInstallId } from '../core/runtime/nodes.js';
-import { claimDaemonOwnership, releaseDaemonOwnership } from '../core/canvas/daemon-owner.js';
-import { migrate, openDb } from '../core/canvas/db.js';
-import { prewarmRecentRecipes, reapStaleSpares } from '../core/runtime/warm-pool.js';
-import { DaemonFleet } from './fleet.js';
-import { BOOT_MIGRATIONS } from './boot-migrations.js';
-import { emitEvent } from '../core/events/emit.js';
-import { operationIdContext } from '../core/events/operation-id.js';
-import { bindDaemonEventSource } from '../core/events/source.js';
-import { activateOnDiskMigrations, MigrationBlockedError, runForcedOnDiskMigrations } from '../migrations/activation.js';
-import { profilesRoot, withProfileManifestLock } from '../core/profiles/manifest.js';
-import { runProfileManifestMigrations } from '../migrations/profile-manifests.js';
-import { convertLegacyProviderStore, convertLegacyScopedStore } from '../core/scoped-state/migrate.js';
-import { userScopeRoot } from '../core/scope.js';
-import { piAgentDir } from '../core/runtime/package-health.js';
-// A broker DECLARES its owning canvas in argv at spawn (host.ts launch:
-// `broker-cli.js --canvas-home <home> --epoch <id> <nodeId>`), so ownership is
-// an exact match on this daemon's own canvas home — no path inference. An
-// untagged broker-cli process (a foreign install, a test harness spawning
-// brokers directly) is NOT ours to count or kill; its own canvas' daemon
-// supervises it. Without this scope the startup census would SIGTERM every
-// broker on the machine — a test-fixture daemon in a temp CRTR_HOME would
-// slaughter the real fleet while the real daemon symmetrically reaped the
-// fixture's brokers.
-export function brokerCommandDeclaresCanvasHome(command, home) {
-    return command.includes(` --canvas-home ${home} `);
-}
-// Startup epoch census (design flow C step 1): before this daemon writes its
-// readiness mirror, reap every broker of a PRIOR epoch on its own canvas.
-// Ownership is never adopted across epochs — a prior daemon's ChildProcess
-// handles died with it, so its brokers are unsupervisable; tear them down and
-// let the next supervision tick classify their rows through the policy table.
-// A broker whose argv carries NO `--epoch` tag is a legacy-generation
-// broker and gets the same verdict (reap): it predates epoch ownership.
-/** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
- *  for a legacy/untagged broker (which the census treats as prior-epoch). */
-export function brokerCommandEpoch(command) {
-    const m = / --epoch (\S+) /.exec(command);
-    return m?.[1] ?? null;
-}
-// How long a SIGTERMed prior-epoch broker gets to exit gracefully before the
-// census escalates to a SIGKILL of its captured process tree.
-const PRIOR_EPOCH_TERM_GRACE_MS = 5_000;
-const CENSUS_POLL_MS = 150;
-async function reapPriorEpochBrokers(epoch) {
-    const snapshot = captureLivenessSnapshot();
-    if (snapshot === null) {
-        emitEvent({
-            level: 'error',
-            event: 'daemon.census.snapshot_failed',
-            fields: { invariant: 'prior-epoch brokers are reaped before readiness' },
-        });
-        throw new Error('prior-epoch broker census could not capture the process table');
-    }
-    const home = crtrHome();
-    const victims = [];
-    for (const [pid, processInfo] of snapshot.processes) {
-        const command = processInfo.command;
-        if (processInfo.zombie || !command.includes('broker-cli.js'))
-            continue;
-        if (!brokerCommandDeclaresCanvasHome(command, home))
-            continue;
-        if (brokerCommandEpoch(command) === epoch)
-            continue;
-        const nodeId = command.trim().split(/\s+/).at(-1) ?? '';
-        if (nodeId === '' || nodeId.endsWith('broker-cli.js'))
-            continue;
-        victims.push({ pid, nodeId });
-    }
-    // SIGTERM each victim. The snapshot identifies it, but only a fresh command
-    // read authorizes signaling: the pid may have been reused since the capture.
-    // The teardown snapshot (tree + identities) is taken BEFORE the SIGTERM so a
-    // survivor's whole tree can be SIGKILLed without re-walking a dead root.
-    let sigtermed = 0;
-    const signaled = [];
-    for (const victim of victims) {
-        const command = capturePidCommand(victim.pid);
-        if (command === null || !command.includes('broker-cli.js'))
-            continue;
-        if (!brokerCommandDeclaresCanvasHome(command, home))
-            continue;
-        if (brokerCommandEpoch(command) === epoch)
-            continue;
-        if (command.trim().split(/\s+/).at(-1) !== victim.nodeId)
-            continue;
-        const snap = captureTeardownSnapshot(victim.pid, null);
-        if (snap.reused)
-            continue; // positively a different process now — never signal
-        try {
-            process.kill(victim.pid, 'SIGTERM');
-        }
-        catch {
-            continue; // already gone — nothing was signaled
-        }
-        sigtermed++;
-        signaled.push({ pid: victim.pid, snap });
-    }
-    // Bounded graceful wait, then SIGKILL each survivor's captured tree.
-    const deadline = Date.now() + PRIOR_EPOCH_TERM_GRACE_MS;
-    while (Date.now() < deadline && signaled.some((s) => isAnyPidAlive(s.snap.tree.length > 0 ? s.snap.tree : [s.pid]))) {
-        await new Promise((resolve) => setTimeout(resolve, CENSUS_POLL_MS));
-    }
-    let sigkilled = 0;
-    for (const s of signaled) {
-        const tree = s.snap.tree.length > 0 ? s.snap.tree : [s.pid];
-        if (!isAnyPidAlive(tree))
-            continue;
-        killProcessTreePids(tree, 'SIGKILL', s.snap.identities);
-        sigkilled++;
-    }
-    if (sigkilled > 0)
-        await new Promise((resolve) => setTimeout(resolve, CENSUS_POLL_MS));
-    // Only a fresh full table sample proves a prior writer is gone.
-    const finalSnapshot = captureLivenessSnapshot();
-    if (finalSnapshot === null) {
-        emitEvent({
-            level: 'error',
-            event: 'daemon.census.snapshot_failed',
-            fields: { invariant: 'prior-epoch brokers are reaped before readiness', stage: 'final' },
-        });
-        throw new Error('prior-epoch broker census could not capture the final process table');
-    }
-    const survivors = [];
-    for (const [pid, processInfo] of finalSnapshot.processes) {
-        const command = processInfo.command;
-        if (processInfo.zombie || !command.includes('broker-cli.js'))
-            continue;
-        if (!brokerCommandDeclaresCanvasHome(command, home))
-            continue;
-        if (brokerCommandEpoch(command) === epoch)
-            continue;
-        survivors.push(pid);
-    }
-    if (survivors.length > 0) {
-        throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${survivors.join(', ')}`);
-    }
-    emitEvent({
-        level: 'info',
-        event: 'daemon.census.completed',
-        fields: { prior_epoch_brokers: victims.length, sigtermed, sigkilled },
-    });
-}
-// Daemon-shutdown fleet teardown (invariant 2: no broker outlives the daemon
-// epoch that launched it). SIGTERM every live entry, race each handle's real
-// exit against ONE shared bounded grace, then SIGKILL each survivor's captured
-// process tree. Rows are deliberately NOT rewritten here — the next daemon's
-// supervision tick classifies them through the policy table, so clean shutdown
-// and crash converge on one recovery path.
-const FLEET_TEARDOWN_GRACE_MS = 5_000;
-async function teardownFleet(fleet) {
-    const entries = Array.from(fleet.entries());
-    if (entries.length === 0)
-        return;
-    // Capture each broker's teardown snapshot (tree + identities) BEFORE the
-    // SIGTERM — a survivor's whole tree must be SIGKILLable without re-walking a
-    // dead root (the kernel reparents children the instant the broker exits).
-    const items = entries.map(([, entry]) => ({
-        pid: entry.pid,
-        snap: captureTeardownSnapshot(entry.pid, null),
-        exited: entry.handle.exited,
-    }));
-    for (const item of items) {
-        if (item.snap.reused)
-            continue; // positively a different process now — never signal
-        try {
-            process.kill(item.pid, 'SIGTERM');
-        }
-        catch {
-            /* already gone */
-        }
-    }
-    // ONE shared unref'd grace timer races every handle's real exit event: the
-    // whole teardown is bounded by FLEET_TEARDOWN_GRACE_MS, not grace × fleet.
-    const timeout = new Promise((resolve) => {
-        const t = setTimeout(resolve, FLEET_TEARDOWN_GRACE_MS);
-        t.unref();
-    });
-    await Promise.allSettled(items.map((item) => Promise.race([item.exited.then(() => { }), timeout])));
-    const sigkilled = [];
-    for (const item of items) {
-        if (!isPidAlive(item.pid))
-            continue;
-        killProcessTreePids(item.snap.tree.length > 0 ? item.snap.tree : [item.pid], 'SIGKILL', item.snap.identities);
-        sigkilled.push(item);
-    }
-    // A signal only requests termination. The handle's exit promise is the
-    // authoritative proof that each escalated broker has exited, so cleanup must
-    // not release its daemon ownership claim before these promises settle.
-    await Promise.all(sigkilled.map((item) => item.exited));
-    emitEvent({
-        level: 'info',
-        event: 'daemon.fleet_teardown.completed',
-        fields: { brokers: items.length, sigkilled: sigkilled.length },
-    });
-}
-// Pidfile
-function writePidfile() {
-    // Ensure the pidfile parent exists before writing.
-    mkdirSync(dirname(pidfilePath()), { recursive: true });
-    writeFileSync(pidfilePath(), String(process.pid), 'utf8');
-}
-function isMissingPathError(error) {
-    return typeof error === 'object' && error !== null && error.code === 'ENOENT';
-}
-/** Inspect the readiness mirror and unlink it only while it names `pid`. */
-function removeOwnedPidfileMirror(pid) {
-    const path = pidfilePath();
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf8');
-    }
-    catch (error) {
-        if (isMissingPathError(error))
-            return;
-        throw error;
-    }
-    if (raw.trim() !== String(pid)) {
-        throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${pid})`);
-    }
-    try {
-        rmSync(path);
-    }
-    catch (error) {
-        if (isMissingPathError(error))
-            return;
-        throw error;
-    }
-}
-const directTickLifecycle = {
-    acceptsDetachedWork: () => true,
-    registerDetached: (work) => {
-        void work.catch(() => { });
-    },
-};
-const brokerSupervision = new BrokerSupervisionReconciler();
-const controllerDeath = new ControllerDeathReconciler();
-const nodeLifecycle = new NodeLifecycleReconciler();
-const nodeDeadline = new NodeDeadlineReconciler();
-const cronLane = new CronLaneReconciler();
-const deliveryLane = new DeliveryLaneReconciler();
-const pendingReviewSubmit = new PendingReviewSubmitReconciler();
-const storageMaintenance = new StorageMaintenanceReconciler();
-const bashDeadline = new BashDeadlineReconciler();
-/** Supervision tick over the daemon's current live set. */
-export async function superviseTick(now = Date.now(), lifecycle = directTickLifecycle) {
-    const fleet = boundFleet();
-    // Auth reload must precede the row-list guard: it is fleet-wide and does not
-    // depend on a successful canvas scan.
-    const thresholds = await brokerSupervision.runFleetPreamble(fleet);
-    let rows;
-    // A terminal row that still holds a process is the Terminating state, and the
-    // lifecycle tick is the only pass that owes it anything.
-    let terminating;
-    try {
-        // Human bridge rows have no broker engine and participate in none of the
-        // recurring row-driven reconciler passes.
-        rows = listNodes({ status: ['active', 'idle'] }).filter((row) => row.kind !== 'human');
-        terminating = listNodes({ status: ['done', 'canceled', 'dead'], withRecordedPidOrFrozen: true })
-            .filter((row) => row.kind !== 'human');
-    }
-    catch (err) {
-        emitEvent({ level: 'error', event: 'canvas.node_list.failed', error: err });
-        return;
-    }
-    await brokerSupervision.run(now, { rows, fleet, lifecycle });
-    controllerDeath.run(now, { rows });
-    const frozen = await nodeLifecycle.run(now, { rows: [...rows, ...terminating], fleet });
-    // The universal backstop: a node past its deadline with no outcome is
-    // canceled and terminalized here, after the lifecycle pass has had its say.
-    nodeDeadline.run(now);
-    cronLane.run(now, { lifecycle });
-    deliveryLane.run(now, { lifecycle });
-    pendingReviewSubmit.run(now, { lifecycle });
-    storageMaintenance.run(now, { lifecycle, fleet });
-    await bashDeadline.run(now, { rows });
-    // Last: the saturation figure is only true once the freeze lane has spent
-    // this tick's free slots.
-    brokerSupervision.warnIfSaturated({ fleet, lifecycle, thresholds, frozen });
-}
-/** Start the supervisor loop after winning the authoritative canvas claim.
- *
- *  A losing claimant stays unbound and returns an inert async teardown so its
- *  process exits cleanly. A winner returns the one serialized teardown that
- *  quiesces admitted work, removes its readiness mirror, and releases its exact
- *  claim. */
-export async function runDaemon(opts = {}) {
-    const ownership = claimDaemonOwnership(randomBytes(16).toString('hex'));
-    if (!ownership.claimed) {
-        // A losing claim isn't always a singleton race: `own_identity_indeterminate`
-        // and `incumbent_malformed` are claim-integrity failures with a different
-        // root cause than a live incumbent. "already running" is reserved for the
-        // one reason that's actually true — `incumbent_alive` — so the other
-        // reasons stay diagnosable instead of masquerading as a normal race.
-        if (ownership.reason === 'incumbent_alive') {
-            process.stderr.write(`[crtrd] already running (pid ${ownership.incumbentPid ?? '?'})\n`);
-        }
-        else {
-            const details = [
-                ownership.incumbentPid !== undefined ? `pid ${ownership.incumbentPid}` : undefined,
-                ownership.verdict !== undefined ? `verdict ${ownership.verdict}` : undefined,
-            ].filter((d) => d !== undefined);
-            const suffix = details.length > 0 ? ` (${details.join(', ')})` : '';
-            process.stderr.write(`[crtrd] claim lost: ${ownership.reason}${suffix}\n`);
-        }
-        return async () => { };
-    }
-    const claim = ownership.claim;
-    try {
-        await reapPriorEpochBrokers(claim.token);
-        runProfileManifestMigrations(profilesRoot(), { dryRun: false, withLock: withProfileManifestLock });
-        convertLegacyScopedStore({ kind: 'user', root: userScopeRoot() });
-        await convertLegacyProviderStore(piAgentDir());
-        migrate(openDb());
-    }
-    catch (migrationError) {
-        try {
-            const { released } = releaseDaemonOwnership(claim);
-            if (!released)
-                throw new Error('daemon ownership claim was not released');
-        }
-        catch (cleanupError) {
-            throw new AggregateError([migrationError, cleanupError], 'daemon startup failed and cleanup also failed');
-        }
-        throw migrationError;
-    }
-    let admissionOpen = true;
-    let interval;
-    let laneTail = Promise.resolve();
-    let tickQueued = false;
-    let intervalTimer;
-    let fleet;
-    const detached = new Set();
-    let mirrorComplete = false;
-    let claimComplete = false;
-    let cleanupInFlight;
-    let apiServer;
-    let apiServerClosed = false;
-    let startup = {
-        phase: 'initializing',
-        message: 'daemon startup is initializing its on-disk memory migration and normal services are unavailable',
-        blockerPaths: [],
-    };
-    // This slot is occupied before the repair socket binds, and remains occupied
-    // through normal startup. A request never receives another request's report.
-    let migrationInFlight = 'initial startup activation';
-    let resume = null;
-    function startupBlock() {
-        return startup.phase === 'ready' ? null : { phase: startup.phase, message: startup.message, blockerPaths: startup.blockerPaths };
-    }
-    function registerDetached(work) {
-        detached.add(work);
-        void work.finally(() => {
-            detached.delete(work);
-        }).catch(() => { });
-    }
-    const tickLifecycle = {
-        acceptsDetachedWork: () => admissionOpen,
-        registerDetached,
-    };
-    async function cleanupAttempt() {
-        try {
-            admissionOpen = false;
-            if (intervalTimer !== undefined) {
-                clearInterval(intervalTimer);
-                intervalTimer = undefined;
-            }
-            // Quiesce the serial work lane. enqueue drops new jobs once admission
-            // closes, so the tail is final apart from an append that raced the flag
-            // — the re-check loop absorbs exactly that boundary. laneTail never
-            // rejects (enqueue attaches the rejection handler on every append).
-            let tail;
-            do {
-                tail = laneTail;
-                await tail;
-            } while (tail !== laneTail);
-            while (detached.size > 0) {
-                await Promise.allSettled([...detached]);
-            }
-            // Fleet teardown (invariant 2): SIGTERM every live broker, bounded
-            // grace, SIGKILL survivors' trees — no broker outlives the epoch that
-            // launched it. The SIGTERMs land as real exit events whose policy jobs
-            // the closed lane DROPS, so teardown can never respawn what it kills.
-            if (fleet !== undefined) {
-                await teardownFleet(fleet);
-                fleet.dispose();
-            }
-            // Tear down the API server before releasing the pidfile mirror + claim.
-            // Guarded so a double-cleanup is a no-op (close() is itself double-safe).
-            if (apiServer !== undefined && !apiServerClosed) {
-                apiServerClosed = true;
-                await apiServer.close();
-            }
-            if (!mirrorComplete) {
-                removeOwnedPidfileMirror(process.pid);
-                mirrorComplete = true;
-            }
-            if (mirrorComplete && !claimComplete) {
-                const { released } = releaseDaemonOwnership(claim);
-                if (!released)
-                    throw new Error('daemon ownership claim was not released');
-                claimComplete = true;
-            }
-        }
-        finally {
-            clearDaemonControl();
-            process.off('SIGINT', onSigint);
-            process.off('SIGTERM', onSigterm);
-            process.off('exit', onExit);
-        }
-    }
-    // Handover — the daemon replaces ITSELF (POST /v1/daemon/restart)
-    //
-    // The routine reason to restart crtrd is to put a newly selected runtime
-    // generation in service, and the routine caller is an agent's bash tool. A
-    // client-driven `stop` makes that caller a victim of its own command: the
-    // shutdown tears down every broker of this epoch (invariant 2), including the
-    // one running the command, so the tool call dies without a result and the
-    // resumed agent re-issues it. Owning the restart here inverts that — the API
-    // handler answers first, this grace lets the answer settle into the caller's
-    // transcript as a real tool result, and only then does teardown begin.
-    //
-    // The grace covers: response flush → the CLI process printing and exiting →
-    // pi persisting the tool result. It is NOT a correctness fallback; a broker
-    // SIGTERMed mid-turn still gets `abortAndExit`'s own bounded persistence
-    // window, and the successor's supervision tick resolves it either way.
-    const HANDOVER_ACK_GRACE_MS = 1_000;
-    let handoverArmed = false;
-    /** Arm the handover. Idempotent: a retry while one is already scheduled
-     *  reports the same grace and schedules nothing new, so a caller that repeats
-     *  the request cannot stack teardowns. */
-    function requestHandover() {
-        if (handoverArmed)
-            return { graceMs: HANDOVER_ACK_GRACE_MS };
-        handoverArmed = true;
-        operationIdContext.fresh(() => {
-            emitEvent({
-                level: 'info',
-                event: 'daemon.handover.armed',
-                fields: { pid: process.pid, grace_ms: HANDOVER_ACK_GRACE_MS },
-            });
-        });
-        // Deliberately NOT unref'd: this timer is the only thing that must keep the
-        // process alive once the answer is out.
-        setTimeout(() => {
-            void performHandover();
-        }, HANDOVER_ACK_GRACE_MS);
-        return { graceMs: HANDOVER_ACK_GRACE_MS };
-    }
-    /** Quiesce exactly as a SIGTERM would, then start the successor.
-     *  Ordering is forced: the successor's claim can only be won after this
-     *  daemon has released its own. PID 1 is replaced in place so a container
-     *  does not stop between daemon generations; ordinary hosts spawn and exit. */
-    async function performHandover() {
-        try {
-            await requestCleanup();
-        }
-        catch (error) {
-            const detail = error instanceof Error ? error.stack ?? error.message : String(error);
-            process.stderr.write(`[crtrd] handover cleanup failed:\n${detail}\n`);
-            process.exit(1);
-        }
-        try {
-            if (process.pid === 1) {
-                await execDaemon();
-            }
-            const spawned = await spawnDaemon();
-            operationIdContext.fresh(() => {
-                emitEvent({
-                    level: 'info',
-                    event: 'daemon.handover.completed',
-                    fields: {
-                        predecessor_pid: process.pid,
-                        successor_pid: spawned.pid ?? spawned.existing_pid ?? null,
-                        spawned: spawned.started,
-                    },
-                });
-            });
-        }
-        catch (error) {
-            // The canvas is now daemonless. Loud, and recoverable: the next front-door
-            // command's ensureDaemon() starts one, and every torn-down node is
-            // reclassified by that daemon's supervision tick.
-            operationIdContext.fresh(() => {
-                emitEvent({ level: 'error', event: 'daemon.handover.successor_failed', error });
-            });
-            const detail = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`[crtrd] handover successor failed to start: ${detail}\n`);
-            process.exit(1);
-        }
-        process.exit(0);
-    }
-    function requestCleanup() {
-        if (cleanupInFlight !== undefined)
-            return cleanupInFlight;
-        const attempt = cleanupAttempt();
-        cleanupInFlight = attempt;
-        void attempt.then(() => {
-            if (cleanupInFlight === attempt)
-                cleanupInFlight = undefined;
-        }, () => {
-            if (cleanupInFlight === attempt)
-                cleanupInFlight = undefined;
-        });
-        return attempt;
-    }
-    async function handleSignal(signal) {
-        try {
-            await requestCleanup();
-            process.exit(0);
-        }
-        catch (error) {
-            process.exitCode = 1;
-            const detail = error instanceof Error ? error.stack ?? `${error.name}: ${error.message}` : String(error);
-            process.stderr.write(`[crtrd] ${signal} cleanup failed:\n${detail}\n`);
-            process.exit(1);
-        }
-    }
-    function onSigint() {
-        void handleSignal('SIGINT');
-    }
-    function onSigterm() {
-        void handleSignal('SIGTERM');
-    }
-    function onExit() {
-        void requestCleanup().catch(() => { });
-    }
-    /** The serial work lane (design D-3): supervision ticks, exit-policy jobs,
-     *  and matured backoff respawns run strictly one at a time, so policy never
-     *  interleaves with a tick's row reads. `laneTail` never rejects — every append attaches the rejection
-     *  handler. Once admission closes, new jobs are DROPPED (not queued): a
-     *  shutdown SIGTERM fans exit events across the whole fleet, and running
-     *  their policy jobs would respawn brokers mid-teardown. */
-    function enqueue(job) {
-        if (!admissionOpen)
-            return;
-        laneTail = laneTail.then(job).then(() => { }, (err) => {
-            operationIdContext.fresh(() => {
-                emitEvent({ level: 'error', event: 'daemon.lane_job.failed', error: err });
-            });
-        });
-    }
-    /** Enqueue a supervision tick, collapsed to at most ONE queued tick: the
-     *  interval keeps firing while a long lane drains (a census, a slow exit
-     *  policy), and queuing every missed beat would burst-run ticks back-to-back
-     *  once the lane frees. */
-    function enqueueTick() {
-        if (!admissionOpen || tickQueued)
-            return;
-        tickQueued = true;
-        enqueue(async () => {
-            tickQueued = false;
-            if (!admissionOpen)
-                return;
-            try {
-                await superviseTick(Date.now(), tickLifecycle);
-            }
-            catch (error) {
-                operationIdContext.fresh(() => {
-                    emitEvent({ level: 'error', event: 'daemon.tick.failed', error });
-                });
-            }
-        });
-    }
-    let admissionFailure = null;
-    async function admitStartup() {
-        if (admissionFailure !== null) {
-            const message = admissionFailure instanceof Error ? admissionFailure.message : String(admissionFailure);
-            throw { status: 500, code: 'admission_failed', message: `daemon admission previously failed: ${message}` };
-        }
-        if (startup.phase === 'ready') {
-            return { admitted: false, already_admitted: true, startup_phase: 'ready' };
-        }
-        if (startup.phase !== 'prepared' && startup.phase !== 'recovering') {
-            throw {
-                status: 409,
-                code: 'not_prepared',
-                message: startup.message,
-            };
-        }
-        const admitted = startup.phase === 'prepared';
-        try {
-            await resumeStartup();
-            startup = { phase: 'ready', message: '', blockerPaths: [] };
-            return admitted
-                ? { admitted: true, already_admitted: false, startup_phase: 'ready' }
-                : { admitted: false, already_admitted: true, startup_phase: 'ready' };
-        }
-        catch (error) {
-            admissionFailure = error;
-            const message = error instanceof Error ? error.message : String(error);
-            throw { status: 500, code: 'admission_failed', message: `daemon admission failed: ${message}` };
-        }
-    }
-    async function repairMigrations(req) {
-        if (migrationInFlight !== null) {
-            throw {
-                status: 409,
-                code: 'migration_in_progress',
-                message: `on-disk migration is already running (${migrationInFlight})`,
-            };
-        }
-        migrationInFlight = 'repair';
-        try {
-            const result = await runForcedOnDiskMigrations({
-                dryRun: req.dryRun,
-                explicitDirs: req.dirs,
-                nodes: listNodeMemoryTargets(),
-            });
-            if (req.dryRun || !result.finalVerificationSucceeded || startup.phase !== 'blocked') {
-                return { result, resumed: false };
-            }
-            if (opts.prepare) {
-                startup = {
-                    phase: 'prepared',
-                    message: 'daemon storage is prepared and normal services are unavailable until admission',
-                    blockerPaths: [],
-                };
-                return { result, resumed: false };
-            }
-            try {
-                await resumeStartup();
-                startup = { phase: 'ready', message: '', blockerPaths: [] };
-                return { result, resumed: true };
-            }
-            catch (error) {
-                const resumeError = error instanceof Error ? error.message : String(error);
-                // The route must flush this result before cleanup closes its connection.
-                setTimeout(() => { void requestCleanup().catch(() => { }); }, 1_000);
-                return { result, resumed: false, resumeError };
-            }
-        }
-        finally {
-            migrationInFlight = null;
-        }
-    }
-    async function completeStartup() {
-        interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
-        const epoch = claim.token;
-        fleet = new DaemonFleet({ epoch, enqueue });
-        bindFleet(fleet);
-        startup = {
-            phase: 'recovering',
-            message: 'daemon startup recovery is running and normal services are unavailable',
-            blockerPaths: [],
-        };
-        operationIdContext.fresh(() => {
-            emitEvent({
-                level: 'info',
-                event: 'daemon.started',
-                fields: { pid: process.pid, interval_ms: interval },
-            });
-        });
-        const installId = resolveInstallId();
-        setInstallId(installId);
-        operationIdContext.fresh(() => {
-            emitEvent({ level: 'info', event: 'daemon.install_id.resolved', fields: { install_id: installId } });
-        });
-        operationIdContext.fresh(() => {
-            let warning;
-            try {
-                warning = rendererWarning();
-            }
-            catch {
-                return;
-            }
-            if (warning !== null) {
-                emitEvent({
-                    level: 'warn',
-                    event: 'daemon.startup.warning',
-                    fields: { stage: 'termrender', warning: warning.slice(0, 2_048) },
-                });
-            }
-        });
-        await operationIdContext.fresh(async () => {
-            await sweepReviews();
-            await reconcileUndeliveredTickets();
-            resetHandedOffDeliveries(Date.now());
-        });
-        operationIdContext.fresh(() => {
-            const { reconcile, migrated } = reconcileAndMigrateBoot(migrateLegacyExecutionIdentities);
-            if (reconcile.changed) {
-                emitEvent({
-                    level: 'info',
-                    event: 'daemon.boot_change.reconciled',
-                    fields: {
-                        cleared_count: reconcile.cleared.length,
-                        same_boot_proven: reconcile.sameBootProven,
-                    },
-                });
-            }
-            if (migrated.length > 0) {
-                emitEvent({
-                    level: 'info',
-                    event: 'daemon.pid_identity.migrated',
-                    fields: { migrated_count: migrated.length },
-                });
-            }
-        });
-        operationIdContext.fresh(() => {
-            for (const migration of BOOT_MIGRATIONS) {
-                const result = migration.apply();
-                if (result.changed) {
-                    emitEvent({
-                        level: 'info',
-                        event: 'daemon.boot_migration.applied',
-                        fields: { migration: migration.id, ...result.summary },
-                    });
-                }
-            }
-        });
-        enqueue(() => { reapStaleSpares(); prewarmRecentRecipes(); });
-        intervalTimer = setInterval(enqueueTick, interval);
-        enqueueTick();
-    }
-    function resumeStartup() {
-        return resume ??= completeStartup().catch((error) => {
-            startup = {
-                phase: 'initializing',
-                message: 'daemon startup recovery failed and normal services are unavailable',
-                blockerPaths: [],
-            };
-            throw error;
-        });
-    }
-    try {
-        process.on('SIGINT', onSigint);
-        process.on('SIGTERM', onSigterm);
-        process.on('exit', onExit);
-        // Bind restricted diagnostics and repair before the socket can accept a
-        // request. No normal route is admitted until `startup` becomes ready.
-        bindDaemonEventSource();
-        const epoch = claim.token;
-        bindDaemonControl({ epoch, requestHandover, registerDetached, startupBlock, admitStartup, repairMigrations });
-        writePidfile();
-        // The socket is the repair boundary, not readiness. A rejected bind still
-        // enters this catch and releases this invocation's pidfile and ownership.
-        apiServer = createApiServer({ tcp: opts.tcp });
-        await apiServer.ready;
-        try {
-            await activateOnDiskMigrations({ nodes: listNodeMemoryTargets() });
-        }
-        catch (error) {
-            migrationInFlight = null;
-            if (error instanceof MigrationBlockedError) {
-                startup = {
-                    phase: 'blocked',
-                    message: error.message,
-                    blockerPaths: error.blockerPaths,
-                };
-                return requestCleanup;
-            }
-            throw error;
-        }
-        try {
-            if (opts.prepare) {
-                startup = {
-                    phase: 'prepared',
-                    message: 'daemon storage is prepared and normal services are unavailable until admission',
-                    blockerPaths: [],
-                };
-            }
-            else {
-                await resumeStartup();
-                startup = { phase: 'ready', message: '', blockerPaths: [] };
-            }
-        }
-        finally {
-            migrationInFlight = null;
-        }
-        return requestCleanup;
-    }
-    catch (startupError) {
-        try {
-            await requestCleanup();
-        }
-        catch (cleanupError) {
-            throw new AggregateError([startupError, cleanupError], 'daemon startup failed and cleanup also failed');
-        }
-        throw startupError;
-    }
-}
-export default runDaemon;
+var ie=Object.defineProperty;var o=(t,i)=>ie(t,"name",{value:i,configurable:!0});import{writeFileSync as oe,readFileSync as ae,rmSync as se,mkdirSync as ce}from"node:fs";import{dirname as de}from"node:path";import{randomBytes as le}from"node:crypto";import{crtrHome as me}from"../core/canvas/paths.js";import{listNodeMemoryTargets as B,listNodes as j}from"../core/canvas/index.js";import{createApiServer as pe}from"./api/server.js";import{reconcileUndeliveredTickets as fe}from"./human/sweep.js";import{resetHandedOffDeliveries as ue}from"../core/canvas/deliveries.js";import{sweepReviews as he}from"./review/sweep.js";import{pidfilePath as I}from"./pidfile.js";import{rendererWarning as ge}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as ve}from"./supervise-cadence.js";import{BrokerSupervisionReconciler as we}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as ye}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as Se}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as ke}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as be}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as _e}from"./reconcilers/delivery-lane.js";import{migrateLegacyExecutionIdentities as Ee}from"../core/canvas/executions.js";import{PendingReviewSubmitReconciler as Pe}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as Re}from"./reconcilers/storage-maintenance.js";import{BashDeadlineReconciler as De}from"./reconcilers/bash-deadline.js";import{captureLivenessSnapshot as z,capturePidCommand as Ie,captureTeardownSnapshot as H,isPidAlive as Te,isAnyPidAlive as W,killProcessTreePids as K}from"../core/canvas/pid.js";import{bindFleet as Me,boundFleet as xe}from"../core/runtime/fleet.js";import{bindDaemonControl as Le,clearDaemonControl as Ae}from"./control.js";import{execDaemon as Ce,spawnDaemon as $e}from"./manage.js";import{reconcileAndMigrateBoot as Oe}from"../core/canvas/boot.js";import{resolveInstallId as Fe}from"../core/canvas/install-id.js";import{setInstallId as Ge}from"../core/runtime/nodes.js";import{claimDaemonOwnership as Ne,releaseDaemonOwnership as U}from"../core/canvas/daemon-owner.js";import{migrate as Be,openDb as je}from"../core/canvas/db.js";import{prewarmRecentRecipes as ze,reapStaleSpares as He}from"../core/runtime/warm-pool.js";import{DaemonFleet as We}from"./fleet.js";import{BOOT_MIGRATIONS as Ke}from"./boot-migrations.js";import{emitEvent as u}from"../core/events/emit.js";import{operationIdContext as g}from"../core/events/operation-id.js";import{bindDaemonEventSource as Ue}from"../core/events/source.js";import{activateOnDiskMigrations as Ve,MigrationBlockedError as qe,runForcedOnDiskMigrations as Qe}from"../migrations/activation.js";import{profilesRoot as Je,withProfileManifestLock as Xe}from"../core/profiles/manifest.js";import{runProfileManifestMigrations as Ye}from"../migrations/profile-manifests.js";import{convertLegacyProviderStore as Ze,convertLegacyScopedStore as er}from"../core/scoped-state/migrate.js";import{userScopeRoot as rr}from"../core/scope.js";import{piAgentDir as tr}from"../core/runtime/package-health.js";function T(t,i){return t.includes(` --canvas-home ${i} `)}o(T,"brokerCommandDeclaresCanvasHome");function M(t){return/ --epoch (\S+) /.exec(t)?.[1]??null}o(M,"brokerCommandEpoch");const nr=5e3,V=150;async function ir(t){const i=z();if(i===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const s=me(),c=[];for(const[a,p]of i.processes){const d=p.command;if(p.zombie||!d.includes("broker-cli.js")||!T(d,s)||M(d)===t)continue;const S=d.trim().split(/\s+/).at(-1)??"";S===""||S.endsWith("broker-cli.js")||c.push({pid:a,nodeId:S})}let f=0;const n=[];for(const a of c){const p=Ie(a.pid);if(p===null||!p.includes("broker-cli.js")||!T(p,s)||M(p)===t||p.trim().split(/\s+/).at(-1)!==a.nodeId)continue;const d=H(a.pid,null);if(!d.reused){try{process.kill(a.pid,"SIGTERM")}catch{continue}f++,n.push({pid:a.pid,snap:d})}}const v=Date.now()+nr;for(;Date.now()<v&&n.some(a=>W(a.snap.tree.length>0?a.snap.tree:[a.pid]));)await new Promise(a=>setTimeout(a,V));let h=0;for(const a of n){const p=a.snap.tree.length>0?a.snap.tree:[a.pid];W(p)&&(K(p,"SIGKILL",a.snap.identities),h++)}h>0&&await new Promise(a=>setTimeout(a,V));const w=z();if(w===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const y=[];for(const[a,p]of w.processes){const d=p.command;p.zombie||!d.includes("broker-cli.js")||T(d,s)&&M(d)!==t&&y.push(a)}if(y.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${y.join(", ")}`);u({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:c.length,sigtermed:f,sigkilled:h}})}o(ir,"reapPriorEpochBrokers");const or=5e3;async function ar(t){const i=Array.from(t.entries());if(i.length===0)return;const s=i.map(([,n])=>({pid:n.pid,snap:H(n.pid,null),exited:n.handle.exited}));for(const n of s)if(!n.snap.reused)try{process.kill(n.pid,"SIGTERM")}catch{}const c=new Promise(n=>{setTimeout(n,or).unref()});await Promise.allSettled(s.map(n=>Promise.race([n.exited.then(()=>{}),c])));const f=[];for(const n of s)Te(n.pid)&&(K(n.snap.tree.length>0?n.snap.tree:[n.pid],"SIGKILL",n.snap.identities),f.push(n));await Promise.all(f.map(n=>n.exited)),u({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:s.length,sigkilled:f.length}})}o(ar,"teardownFleet");function sr(){ce(de(I()),{recursive:!0}),oe(I(),String(process.pid),"utf8")}o(sr,"writePidfile");function q(t){return typeof t=="object"&&t!==null&&t.code==="ENOENT"}o(q,"isMissingPathError");function cr(t){const i=I();let s;try{s=ae(i,"utf8")}catch(c){if(q(c))return;throw c}if(s.trim()!==String(t))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${t})`);try{se(i)}catch(c){if(q(c))return;throw c}}o(cr,"removeOwnedPidfileMirror");const dr={acceptsDetachedWork:o(()=>!0,"acceptsDetachedWork"),registerDetached:o(t=>{t.catch(()=>{})},"registerDetached")},x=new we,lr=new ye,mr=new Se,pr=new ke,fr=new be,ur=new _e,hr=new Pe,gr=new Re,vr=new De;async function wr(t=Date.now(),i=dr){const s=xe(),c=await x.runFleetPreamble(s);let f,n;try{f=j({status:["active","idle"]}).filter(h=>h.kind!=="human"),n=j({status:["done","canceled","dead"],withRecordedPidOrFrozen:!0}).filter(h=>h.kind!=="human")}catch(h){u({level:"error",event:"canvas.node_list.failed",error:h});return}await x.run(t,{rows:f,fleet:s,lifecycle:i}),lr.run(t,{rows:f});const v=await mr.run(t,{rows:[...f,...n],fleet:s});pr.run(t),fr.run(t,{lifecycle:i}),ur.run(t,{lifecycle:i}),hr.run(t,{lifecycle:i}),gr.run(t,{lifecycle:i,fleet:s}),await vr.run(t,{rows:f}),x.warnIfSaturated({fleet:s,lifecycle:i,thresholds:c,frozen:v})}o(wr,"superviseTick");async function yr(t={}){const i=Ne(le(16).toString("hex"));if(!i.claimed){if(i.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${i.incumbentPid??"?"})
+`);else{const e=[i.incumbentPid!==void 0?`pid ${i.incumbentPid}`:void 0,i.verdict!==void 0?`verdict ${i.verdict}`:void 0].filter(l=>l!==void 0),r=e.length>0?` (${e.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${i.reason}${r}
+`)}return async()=>{}}const s=i.claim;try{await ir(s.token),Ye(Je(),{dryRun:!1,withLock:Xe}),er({kind:"user",root:rr()}),await Ze(tr()),Be(je())}catch(e){try{const{released:r}=U(s);if(!r)throw new Error("daemon ownership claim was not released")}catch(r){throw new AggregateError([e,r],"daemon startup failed and cleanup also failed")}throw e}let c=!0,f,n=Promise.resolve(),v=!1,h,w;const y=new Set;let a=!1,p=!1,d,S,L=!1,m={phase:"initializing",message:"daemon startup is initializing its on-disk memory migration and normal services are unavailable",blockerPaths:[]},_="initial startup activation",Q=null;function J(){return m.phase==="ready"?null:{phase:m.phase,message:m.message,blockerPaths:m.blockerPaths}}o(J,"startupBlock");function A(e){y.add(e),e.finally(()=>{y.delete(e)}).catch(()=>{})}o(A,"registerDetached");const X={acceptsDetachedWork:o(()=>c,"acceptsDetachedWork"),registerDetached:A};async function Y(){try{c=!1,h!==void 0&&(clearInterval(h),h=void 0);let e;do e=n,await e;while(e!==n);for(;y.size>0;)await Promise.allSettled([...y]);if(w!==void 0&&(await ar(w),w.dispose()),S!==void 0&&!L&&(L=!0,await S.close()),a||(cr(process.pid),a=!0),a&&!p){const{released:r}=U(s);if(!r)throw new Error("daemon ownership claim was not released");p=!0}}finally{Ae(),process.off("SIGINT",O),process.off("SIGTERM",F),process.off("exit",G)}}o(Y,"cleanupAttempt");const P=1e3;let C=!1;function Z(){return C?{graceMs:P}:(C=!0,g.fresh(()=>{u({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:P}})}),setTimeout(()=>{ee()},P),{graceMs:P})}o(Z,"requestHandover");async function ee(){try{await k()}catch(e){const r=e instanceof Error?e.stack??e.message:String(e);process.stderr.write(`[crtrd] handover cleanup failed:
+${r}
+`),process.exit(1)}try{process.pid===1&&await Ce();const e=await $e();g.fresh(()=>{u({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:e.pid??e.existing_pid??null,spawned:e.started}})})}catch(e){g.fresh(()=>{u({level:"error",event:"daemon.handover.successor_failed",error:e})});const r=e instanceof Error?e.message:String(e);process.stderr.write(`[crtrd] handover successor failed to start: ${r}
+`),process.exit(1)}process.exit(0)}o(ee,"performHandover");function k(){if(d!==void 0)return d;const e=Y();return d=e,e.then(()=>{d===e&&(d=void 0)},()=>{d===e&&(d=void 0)}),e}o(k,"requestCleanup");async function $(e){try{await k(),process.exit(0)}catch(r){process.exitCode=1;const l=r instanceof Error?r.stack??`${r.name}: ${r.message}`:String(r);process.stderr.write(`[crtrd] ${e} cleanup failed:
+${l}
+`),process.exit(1)}}o($,"handleSignal");function O(){$("SIGINT")}o(O,"onSigint");function F(){$("SIGTERM")}o(F,"onSigterm");function G(){k().catch(()=>{})}o(G,"onExit");function R(e){c&&(n=n.then(e).then(()=>{},r=>{g.fresh(()=>{u({level:"error",event:"daemon.lane_job.failed",error:r})})}))}o(R,"enqueue");function N(){!c||v||(v=!0,R(async()=>{if(v=!1,!!c)try{await wr(Date.now(),X)}catch(e){g.fresh(()=>{u({level:"error",event:"daemon.tick.failed",error:e})})}}))}o(N,"enqueueTick");let E=null;async function re(){if(E!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${E instanceof Error?E.message:String(E)}`};if(m.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(m.phase!=="prepared"&&m.phase!=="recovering")throw{status:409,code:"not_prepared",message:m.message};const e=m.phase==="prepared";try{return await D(),m={phase:"ready",message:"",blockerPaths:[]},e?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(r){throw E=r,{status:500,code:"admission_failed",message:`daemon admission failed: ${r instanceof Error?r.message:String(r)}`}}}o(re,"admitStartup");async function te(e){if(_!==null)throw{status:409,code:"migration_in_progress",message:`on-disk migration is already running (${_})`};_="repair";try{const r=await Qe({dryRun:e.dryRun,explicitDirs:e.dirs,nodes:B()});if(e.dryRun||!r.finalVerificationSucceeded||m.phase!=="blocked")return{result:r,resumed:!1};if(t.prepare)return m={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:r,resumed:!1};try{return await D(),m={phase:"ready",message:"",blockerPaths:[]},{result:r,resumed:!0}}catch(l){const b=l instanceof Error?l.message:String(l);return setTimeout(()=>{k().catch(()=>{})},1e3),{result:r,resumed:!1,resumeError:b}}}finally{_=null}}o(te,"repairMigrations");async function ne(){f=t.intervalMs??ve;const e=s.token;w=new We({epoch:e,enqueue:R}),Me(w),m={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},g.fresh(()=>{u({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:f}})});const r=Fe();Ge(r),g.fresh(()=>{u({level:"info",event:"daemon.install_id.resolved",fields:{install_id:r}})}),g.fresh(()=>{let l;try{l=ge()}catch{return}l!==null&&u({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:l.slice(0,2048)}})}),await g.fresh(async()=>{await he(),await fe(),ue(Date.now())}),g.fresh(()=>{const{reconcile:l,migrated:b}=Oe(Ee);l.changed&&u({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:l.cleared.length,same_boot_proven:l.sameBootProven}}),b.length>0&&u({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:b.length}})}),g.fresh(()=>{for(const l of Ke){const b=l.apply();b.changed&&u({level:"info",event:"daemon.boot_migration.applied",fields:{migration:l.id,...b.summary}})}}),R(()=>{He(),ze()}),h=setInterval(N,f),N()}o(ne,"completeStartup");function D(){return Q??=ne().catch(e=>{throw m={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},e})}o(D,"resumeStartup");try{process.on("SIGINT",O),process.on("SIGTERM",F),process.on("exit",G),Ue();const e=s.token;Le({epoch:e,requestHandover:Z,registerDetached:A,startupBlock:J,admitStartup:re,repairMigrations:te}),sr(),S=pe({tcp:t.tcp}),await S.ready;try{await Ve({nodes:B()})}catch(r){if(_=null,r instanceof qe)return m={phase:"blocked",message:r.message,blockerPaths:r.blockerPaths},k;throw r}try{t.prepare?m={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await D(),m={phase:"ready",message:"",blockerPaths:[]})}finally{_=null}return k}catch(e){try{await k()}catch(r){throw new AggregateError([e,r],"daemon startup failed and cleanup also failed")}throw e}}o(yr,"runDaemon");var lt=yr;export{T as brokerCommandDeclaresCanvasHome,M as brokerCommandEpoch,lt as default,yr as runDaemon,wr as superviseTick};