@north-light/crouter 0.3.317 → 0.3.319

package/dist/daemon/reconcilers/broker-supervision.js

@@ -1,761 +1,4 @@
-import { statSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { getNode, isWarmSpare, subscribersOf } from '../../core/canvas/index.js';
-import { contextDir, isSafeNodeId } from '../../core/canvas/paths.js';
-import { fullName } from '../../core/canvas/labels.js';
-import { recordedPidLiveness } from '../../core/canvas/pid.js';
-import { transition } from '../../core/runtime/lifecycle.js';
-import { readFault, readLiveTurn, recordFault } from '../../core/canvas/recovery.js';
-import { nextFaultRetry } from '../../core/runtime/fault-recovery.js';
-import { fanDoctrineWake } from '../../core/runtime/close.js';
-import { headlessBrokerHost } from '../../core/runtime/host.js';
-import { reloadAuthLive } from '../../core/runtime/auth-reload.js';
-import { emitEvent } from '../../core/events/emit.js';
-import { operationIdContext } from '../../core/events/operation-id.js';
-import { hasUnseenWakeMail, resetStaleExecutionMail } from '../../core/canvas/deliveries.js';
-import { activeBackgroundBashJobs } from '../../core/bash-jobs.js';
-import { focusOf } from '../../core/runtime/placement.js';
-import { hasAttachedBrokerViewers } from '../../core/runtime/broker/client-registry.js';
-import { deliverLive } from '../../core/runtime/interactive-deliver.js';
-import { BrokerUnreachableError } from '../../core/runtime/broker-request.js';
-import { formatCard, PARK_SUMMARY_PROMPT } from '../../shared/generated-context.js';
-import { brokerThresholdsForDaemon } from '../../core/runtime/fleet.js';
-import { readConfig } from '../../core/config.js';
-import { scopedStoreExists } from '../../core/scoped-state/db.js';
-import { providerStore } from '../../core/scoped-state/paths.js';
-import { providerRevision } from '../../core/scoped-state/providers.js';
-import { beginPendingPark, consumePendingPark, pendingParkIds, pendingParkStartedAt } from '../park-pending.js';
-import { shouldParkAfterSummary } from '../park-activity.js';
-import { applyParkEvent, parkEvent } from './live-obligation.js';
-import { envNoDaemonAutostart, envTestUnattendedParkMs, parkSummaryGraceMs, envUnattendedParkMs, } from '../../shared/env.js';
-const execFileAsync = promisify(execFile);
-function liveBusy(nodeId) {
-    return readLiveTurn(nodeId)?.busy === true;
-}
-function liveTurnProgressMs(nodeId) {
-    const progressAt = readLiveTurn(nodeId)?.progressAt;
-    if (progressAt === null || progressAt === undefined)
-        return null;
-    const progressMs = Date.parse(progressAt);
-    return Number.isNaN(progressMs) ? null : progressMs;
-}
-function incarnationOf(pid, identity) {
-    return identity === null ? null : `${pid}:${identity}`;
-}
-function busySinceForIncarnation(row) {
-    const turn = readLiveTurn(row.node_id);
-    const since = turn?.busy === true && turn.progressAt !== null ? Date.parse(turn.progressAt) : Number.NaN;
-    const launchedAt = row.launched_at === null || row.launched_at === undefined ? Number.NaN : Date.parse(row.launched_at);
-    if (!Number.isFinite(since) || !Number.isFinite(launchedAt) || since < launchedAt)
-        return null;
-    return since;
-}
-export const YIELD_STALL_GRACE_MS = 3 * 60_000;
-const KILL_ESCALATE_MS = 20_000;
-export const WEDGE_QUIET_MS = 20 * 60_000;
-export const WEDGE_CPU_MAX_PERCENT = 2;
-const OVER_CAP_WARN_THROTTLE_MS = 5 * 60_000;
-export function unattendedParkMsForDaemon() {
-    // The `CRTR_UNATTENDED_PARK_MS` override wins whenever set, autostart or not.
-    const envOverride = envUnattendedParkMs();
-    if (envOverride !== undefined)
-        return envOverride;
-    // Otherwise the user-scope config value is the base (default 15 min), with the
-    // test-only override winning only when autostart is disabled.
-    const configured = readConfig('user').lifecycle.unattendedParkMs;
-    if (!envNoDaemonAutostart())
-        return configured;
-    return envTestUnattendedParkMs() ?? configured;
-}
-export function parkSummaryGraceMsForDaemon() {
-    return parkSummaryGraceMs();
-}
-export function yieldStallVerdict(piPidAlive, intent, busy, stalledFor) {
-    if (piPidAlive !== true)
-        return 'leave';
-    if (intent !== 'refresh')
-        return 'leave';
-    if (busy)
-        return 'leave';
-    if (stalledFor === null || stalledFor < YIELD_STALL_GRACE_MS)
-        return 'pending';
-    return 'kill';
-}
-export function wedgeVerdict(input) {
-    if (!input.busy)
-        return 'leave';
-    if (input.quietForMs === null || input.quietForMs < WEDGE_QUIET_MS)
-        return 'leave';
-    if (input.cpuPercent === null)
-        return 'pending';
-    if (input.hasDescendants !== false && input.cpuPercent > WEDGE_CPU_MAX_PERCENT)
-        return 'pending';
-    return 'wedged';
-}
-function parsePsTree(psOutput) {
-    const byPid = new Map();
-    const childrenOf = new Map();
-    for (const line of psOutput.split('\n')) {
-        const trimmed = line.trim();
-        if (trimmed === '')
-            continue;
-        const parts = trimmed.split(/\s+/);
-        if (parts.length < 3)
-            continue;
-        const pid = Number(parts[0]);
-        const ppid = Number(parts[1]);
-        const pcpu = Number(parts[2]);
-        if (!Number.isFinite(pid) || !Number.isFinite(ppid) || !Number.isFinite(pcpu))
-            continue;
-        byPid.set(pid, pcpu);
-        const siblings = childrenOf.get(ppid);
-        if (siblings === undefined)
-            childrenOf.set(ppid, [pid]);
-        else
-            siblings.push(pid);
-    }
-    return { byPid, childrenOf };
-}
-export function sumTreeCpu(psOutput, rootPid) {
-    const { byPid, childrenOf } = parsePsTree(psOutput);
-    if (!byPid.has(rootPid))
-        return null;
-    let total = 0;
-    const stack = [rootPid];
-    const seen = new Set();
-    while (stack.length > 0) {
-        const pid = stack.pop();
-        if (seen.has(pid))
-            continue;
-        seen.add(pid);
-        total += byPid.get(pid) ?? 0;
-        const kids = childrenOf.get(pid);
-        if (kids !== undefined)
-            stack.push(...kids);
-    }
-    return total;
-}
-export function treeHasDescendants(psOutput, rootPid) {
-    const { byPid, childrenOf } = parsePsTree(psOutput);
-    if (!byPid.has(rootPid))
-        return null;
-    return (childrenOf.get(rootPid) ?? []).length > 0;
-}
-function piAgentDir() {
-    const configured = process.env['PI_CODING_AGENT_DIR'];
-    if (configured !== undefined && configured !== '')
-        return configured === '~' || configured.startsWith('~/') ? join(homedir(), configured.slice(1)) : configured;
-    return join(homedir(), '.pi', 'agent');
-}
-function piCredentialPaths(agentDir) {
-    return [
-        join(agentDir, 'auth.json'),
-        join(agentDir, 'anthropic-credentials.json'),
-        join(agentDir, 'openai-codex-credentials.json'),
-    ];
-}
-export class BrokerSupervisionReconciler {
-    yieldStalls = new Map();
-    wedgeNotifiedAt = new Map();
-    fatalFaultNotifiedAt = new Map();
-    unattendedSince = new Map();
-    sampleTree;
-    signal;
-    knownCredentialRevision = null;
-    lastOverCapWarnAt = Number.NEGATIVE_INFINITY;
-    constructor(options = {}) {
-        this.sampleTree = options.readTreeSample ?? ((pid) => this.readTreeSample(pid));
-        this.signal = options.signal ?? ((pid, signal) => process.kill(pid, signal));
-    }
-    /** The fleet-wide preamble, run BEFORE the tick's row-list guard: an auth
-     *  reload does not depend on a successful canvas scan, and the thresholds it
-     *  returns are read once for the whole tick. */
-    async runFleetPreamble(fleet) {
-        await this.handleAuthReload(fleet);
-        return brokerThresholdsForDaemon();
-    }
-    /** The saturation notice, run LAST in the tick: the frozen split it reports
-     *  is only known once the freeze lane has spent this tick's free slots. */
-    warnIfSaturated(ctx) {
-        if (ctx.fleet.size() < ctx.thresholds.warning || !ctx.lifecycle.acceptsDetachedWork())
-            return;
-        const warning = operationIdContext.fresh(() => this.warnOverCapInTmux(ctx.fleet.size(), ctx.thresholds, ctx.frozen));
-        ctx.lifecycle.registerDetached(warning);
-    }
-    async run(now, ctx) {
-        // Resolve the unattended-park interval once per tick — it reads user
-        // config.json, so a per-broker read would add one file read per eligible
-        // broker and could apply different values within one tick after a config
-        // write (mirrors how `runFleetPreamble` snapshots the broker thresholds).
-        const unattendedParkMs = unattendedParkMsForDaemon();
-        for (const row of ctx.rows) {
-            const id = row.node_id;
-            const entry = ctx.fleet.get(id);
-            if (entry === undefined || (row.status !== 'active' && row.status !== 'idle')) {
-                this.unattendedSince.delete(id);
-                continue;
-            }
-            await operationIdContext.fresh(async () => {
-                try {
-                    this.handleYieldStall(row, entry, ctx.fleet, now);
-                    await this.handleWedgeDetection(row, entry, ctx.fleet, now);
-                    this.handleFatalFault(id);
-                    this.handleUnattendedParking(id, getNode(id), entry.pid, now, ctx, unattendedParkMs);
-                }
-                catch (err) {
-                    this.unattendedSince.delete(id);
-                    emitEvent({
-                        level: 'error',
-                        event: 'broker.supervision.failed',
-                        ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                        error: err,
-                    });
-                }
-            });
-        }
-        for (const id of this.unattendedSince.keys()) {
-            if (!ctx.fleet.has(id))
-                this.unattendedSince.delete(id);
-        }
-        // A broker that died mid-summary leaves no pending park behind: its parking
-        // turn can never settle, and the node's next clock starts from scratch.
-        for (const id of pendingParkIds()) {
-            if (!ctx.fleet.has(id))
-                consumePendingPark(id);
-        }
-        resetStaleExecutionMail(now);
-    }
-    /** Every condition that resets the unattended clock EXCEPT `isBusy` — the
-     *  node is unavailable to park, attended, or has work waiting. Short-circuits
-     *  in cost order so the common tick does no file reads it can avoid. */
-    parkResetCondition(id, row, livePid, now) {
-        if (row.pi_session_id == null
-            || row.pi_pid !== livePid
-            || row.status === 'done'
-            || row.status === 'canceled'
-            || row.status === 'dead'
-            || row.intent !== null
-            || activeBackgroundBashJobs(contextDir(id)).length > 0
-            || focusOf(id) !== null
-            || hasAttachedBrokerViewers(id))
-            return true;
-        const fault = readFault(id);
-        const activeAutoProviderRetry = fault !== null
-            && fault.retry.disposition === 'auto'
-            && fault.retry.by === 'daemon'
-            && (fault.kind === 'connection' || fault.kind === 'rate-limit' || fault.kind === 'overloaded')
-            && (fault.retry.nextAt !== undefined || nextFaultRetry(fault, now) !== null);
-        if (activeAutoProviderRetry)
-            return true;
-        return hasUnseenWakeMail(id);
-    }
-    handleUnattendedParking(id, row, livePid, now, ctx, unattendedParkMs) {
-        // An unclaimed warm-pool spare is not a conversation: the booted broker it
-        // holds IS its whole value, and nobody is meant to be attending it. Its
-        // lifetime belongs to `reapStaleSpares` (warm-pool.ts) and its own TTL, so
-        // parking one here would empty the pool every 15 minutes.
-        if (isWarmSpare(id)) {
-            this.unattendedSince.delete(id);
-            consumePendingPark(id);
-            return;
-        }
-        if (row === null) {
-            this.unattendedSince.delete(id);
-            consumePendingPark(id);
-            return;
-        }
-        const reset = this.parkResetCondition(id, row, livePid, now);
-        // A shadow parking turn owns this marker until it completes or runs out of
-        // grace. Both paths take the same main-engine activity verdict before
-        // terminalizing, so input during the summary only keeps the node live.
-        const parkingSince = pendingParkStartedAt(id);
-        if (parkingSince !== undefined) {
-            if (now - parkingSince < parkSummaryGraceMsForDaemon())
-                return;
-            const pending = consumePendingPark(id);
-            if (pending === undefined)
-                return;
-            this.unattendedSince.delete(id);
-            if (!shouldParkAfterSummary(id, row, pending))
-                return;
-            // The degraded path has no report. Status flips BEFORE the host dies (the
-            // crash-safety invariant).
-            emitEvent({
-                level: 'warn',
-                event: 'broker.park.summary_expired',
-                ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                fields: {
-                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    grace_ms: parkSummaryGraceMsForDaemon(),
-                },
-            });
-            applyParkEvent(id, 'park');
-            headlessBrokerHost.teardown(id);
-            return;
-        }
-        if (reset || liveBusy(id)) {
-            this.unattendedSince.delete(id);
-            return;
-        }
-        const since = this.unattendedSince.get(id);
-        if (since === undefined) {
-            this.unattendedSince.set(id, now);
-            return;
-        }
-        if (now - since < unattendedParkMs)
-            return;
-        this.unattendedSince.delete(id);
-        const event = parkEvent(id, row.lifecycle);
-        if (event === 'release') {
-            // A pause, not a terminal write: something can still wake this node, so
-            // its row stays wakeable while the idle broker is released. Skipping the
-            // teardown here would hold the broker process for as long as the
-            // obligation lasts — the exact leak this clock exists to close.
-            applyParkEvent(id, event);
-            headlessBrokerHost.teardown(id);
-            return;
-        }
-        if (event === 'cancel') {
-            applyParkEvent(id, event);
-            headlessBrokerHost.teardown(id);
-            return;
-        }
-        // A resident gets one isolated turn to leave a report behind. Its completion
-        // re-evaluates this verdict before terminalizing the node.
-        if (!ctx.lifecycle.acceptsDetachedWork())
-            return;
-        beginPendingPark(id, now);
-        ctx.lifecycle.registerDetached(this.requestParkSummary(id));
-    }
-    /** Deliver the parking prompt over the live broker's serialized frame loop.
-     * An unreachable broker falls through to degraded parking; either prompt route
-     * starts the same isolated turn, so a concurrent main turn stays passive. */
-    async requestParkSummary(id) {
-        try {
-            const route = await deliverLive(id, formatCard('park', {}, PARK_SUMMARY_PROMPT), {
-                origin: { type: 'runtime', kind: 'park' },
-            });
-            emitEvent({
-                level: 'info',
-                event: 'broker.park.summary_requested',
-                ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                fields: { ...(isSafeNodeId(id) ? {} : { affected_node_id: id }), route },
-            });
-        }
-        catch (err) {
-            if (consumePendingPark(id) === undefined)
-                return;
-            if (err instanceof BrokerUnreachableError) {
-                applyParkEvent(id, 'park');
-                headlessBrokerHost.teardown(id);
-                return;
-            }
-            emitEvent({
-                level: 'error',
-                event: 'broker.park.summary_failed',
-                ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                error: err,
-            });
-        }
-    }
-    async warnOverCapInTmux(count, thresholds, frozen) {
-        const now = Date.now();
-        if (now - this.lastOverCapWarnAt < OVER_CAP_WARN_THROTTLE_MS)
-            return;
-        this.lastOverCapWarnAt = now;
-        const { warning, automaticReviveCap: max } = thresholds;
-        const waiting = frozen.stalled + frozen.waitingOnMail;
-        emitEvent({
-            level: 'warn',
-            event: 'broker.capacity.warning',
-            fields: {
-                live_count: count,
-                warning_threshold: warning,
-                hard_cap: max,
-                frozen_stalled: frozen.stalled,
-                frozen_waiting_on_mail: frozen.waitingOnMail,
-            },
-        });
-        const frozenNote = waiting === 0
-            ? ''
-            : ` — ${waiting} frozen (${frozen.stalled} stalled, ${frozen.waitingOnMail} waiting on mail)`;
-        const msg = `⚠ crtrd: ${count} live brokers (warning ${warning}; hard cap ${max})${frozenNote} — possible broker leak. ps -ax | grep broker-cli.js`;
-        try {
-            const clients = await execFileAsync('tmux', ['list-clients', '-F', '#{client_name}'], {
-                encoding: 'utf8',
-                timeout: 2000,
-            });
-            if (typeof clients.stdout !== 'string')
-                return;
-            await Promise.allSettled(clients.stdout.split('\n').map(async (client) => {
-                if (client === '')
-                    return;
-                try {
-                    // `-C` keeps the client's panes painting while the warning sits in
-                    // its status line; without it every attached viewer freezes for the
-                    // full 10s. The plain retry below covers a tmux without the flag.
-                    await execFileAsync('tmux', ['display-message', '-C', '-d', '10000', '-c', client, msg], {
-                        encoding: 'utf8',
-                        timeout: 2000,
-                    });
-                }
-                catch {
-                    try {
-                        await execFileAsync('tmux', ['display-message', '-c', client, msg], {
-                            encoding: 'utf8',
-                            timeout: 2000,
-                        });
-                    }
-                    catch (err) {
-                        emitEvent({
-                            level: 'error',
-                            event: 'broker.capacity.tmux_display_failed',
-                            error: err,
-                            fields: { client },
-                        });
-                    }
-                }
-            }));
-        }
-        catch (err) {
-            emitEvent({ level: 'error', event: 'broker.capacity.tmux_list_clients_failed', error: err });
-        }
-    }
-    handleYieldStall(row, entry, fleet, now) {
-        const id = row.node_id;
-        const incarnation = incarnationOf(entry.pid, row.pi_pid_identity);
-        if (row.intent !== 'refresh' || busySinceForIncarnation(row) !== null || incarnation === null) {
-            if (incarnation !== null)
-                this.yieldStalls.delete(incarnation);
-            return;
-        }
-        let state = this.yieldStalls.get(incarnation);
-        if (state === undefined) {
-            state = { since: now };
-            this.yieldStalls.set(incarnation, state);
-            return;
-        }
-        if (yieldStallVerdict(true, row.intent, false, now - state.since) !== 'kill')
-            return;
-        const current = getNode(id);
-        if (fleet.get(id) !== entry || current?.pi_pid !== entry.pid || current.pi_pid_identity !== row.pi_pid_identity || recordedPidLiveness(entry.pid, row.pi_pid_identity) !== 'alive')
-            return;
-        if (state.termedAt === undefined) {
-            if (!this.signalYieldStall(id, entry.pid, 'SIGTERM'))
-                return;
-            state.termedAt = now;
-            emitEvent({
-                level: 'warn',
-                event: 'broker.yield_stall.sigterm',
-                ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                fields: {
-                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    pid: entry.pid,
-                    elapsed_ms: now - state.since,
-                    grace_ms: YIELD_STALL_GRACE_MS,
-                },
-            });
-        }
-        else if (now - state.termedAt >= KILL_ESCALATE_MS && this.signalYieldStall(id, entry.pid, 'SIGKILL')) {
-            emitEvent({
-                level: 'warn',
-                event: 'broker.yield_stall.sigkill',
-                ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                fields: {
-                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    pid: entry.pid,
-                    elapsed_ms: now - state.termedAt,
-                    grace_ms: KILL_ESCALATE_MS,
-                    stall_elapsed_ms: now - state.since,
-                },
-            });
-        }
-    }
-    signalYieldStall(id, pid, signal) {
-        try {
-            this.signal(pid, signal);
-            return true;
-        }
-        catch (err) {
-            emitEvent({
-                level: 'error',
-                event: 'broker.yield_stall.signal_failed',
-                ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                error: err,
-                fields: {
-                    ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                    pid,
-                    signal,
-                },
-            });
-            return false;
-        }
-    }
-    async readTreeSample(pid) {
-        try {
-            const { stdout } = await execFileAsync('ps', ['-ax', '-o', 'pid=,ppid=,pcpu='], {
-                encoding: 'utf8',
-                timeout: 2000,
-            });
-            if (typeof stdout !== 'string')
-                return null;
-            const cpuPercent = sumTreeCpu(stdout, pid);
-            const hasDescendants = treeHasDescendants(stdout, pid);
-            if (cpuPercent === null || hasDescendants === null)
-                return null;
-            return { cpuPercent, hasDescendants };
-        }
-        catch {
-            return null;
-        }
-    }
-    async handleWedgeDetection(row, entry, fleet, now) {
-        const id = row.node_id;
-        const incarnation = incarnationOf(entry.pid, row.pi_pid_identity);
-        const since = busySinceForIncarnation(row);
-        if (since === null || incarnation === null) {
-            if (incarnation !== null)
-                this.wedgeNotifiedAt.delete(incarnation);
-            return;
-        }
-        const quietForMs = now - since;
-        const sample = quietForMs >= WEDGE_QUIET_MS ? await this.sampleTree(entry.pid) : null;
-        const current = getNode(id);
-        const currentSince = current === null ? null : busySinceForIncarnation(current);
-        if (fleet.get(id) !== entry || current === null || current.pi_pid !== entry.pid || current.pi_pid_identity !== row.pi_pid_identity || currentSince !== since)
-            return;
-        const cpuPercent = sample?.cpuPercent ?? null;
-        const sampleHasDescendants = sample?.hasDescendants ?? null;
-        if (wedgeVerdict({ busy: true, quietForMs, cpuPercent, hasDescendants: sampleHasDescendants }) !== 'wedged')
-            return;
-        if (this.wedgeNotifiedAt.get(incarnation) === since)
-            return;
-        this.wedgeNotifiedAt.set(incarnation, since);
-        const name = fullName(current);
-        const minutes = Math.round((quietForMs ?? WEDGE_QUIET_MS) / 60_000);
-        const hasDescendants = sampleHasDescendants ?? true;
-        const kickSuppressionReason = !hasDescendants && recordedPidLiveness(entry.pid, row.pi_pid_identity) !== 'alive'
-            ? 'pid_identity_unproven'
-            : null;
-        let kickAttempted = false;
-        let kicked = false;
-        let label;
-        if (hasDescendants) {
-            label =
-                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                    `${minutes}+ minutes and its process is near-idle. It will NOT recover on its own — read ` +
-                    `\`crtr memory read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this ` +
-                    `node) so its turn can resume with no lost context.`;
-        }
-        else if (kickSuppressionReason !== null) {
-            label =
-                `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                    `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon did ` +
-                    `not SIGTERM the broker because its PID identity cannot be ` +
-                    `confirmed alive.`;
-        }
-        else {
-            kickAttempted = true;
-            try {
-                this.signal(entry.pid, 'SIGTERM');
-                kicked = true;
-                label =
-                    `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                        `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon sent ` +
-                        `SIGTERM to the broker and will resume a cleanly aborted session with a continuation, or start a ` +
-                        `recovery cycle if the abort cannot settle.`;
-            }
-            catch (err) {
-                emitEvent({
-                    level: 'error',
-                    event: 'broker.wedge.signal_failed',
-                    ...(isSafeNodeId(id) ? { node_id: id } : {}),
-                    error: err,
-                    fields: {
-                        ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                        pid: entry.pid,
-                        signal: 'SIGTERM',
-                    },
-                });
-                label =
-                    `Child wedged — ${name} (${id}) is alive and mid-turn but has shown NO engine progress for ` +
-                        `${minutes}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon ` +
-                        `attempted SIGTERM to the broker, but the signal call failed.`;
-            }
-        }
-        emitEvent({
-            level: 'error',
-            event: 'broker.wedge.detected',
-            ...(isSafeNodeId(id) ? { node_id: id } : {}),
-            fields: {
-                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                pid: entry.pid,
-                quiet_ms: quietForMs,
-                cpu_percent: cpuPercent,
-                has_descendants: hasDescendants,
-                kick_attempted: kickAttempted,
-                kicked,
-                ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
-            },
-        });
-        try {
-            recordFault(id, {
-                link: 'daemon→node',
-                op: 'engine wedge',
-                kind: 'wedged',
-                retry: { disposition: 'manual' },
-                message: label,
-            });
-        }
-        catch (err) {
-            emitEvent({
-                level: 'error',
-                event: 'broker.wedge.fault_record_failed',
-                ...(isSafeNodeId(id) ? { node_id: id } : { fields: { affected_node_id: id } }),
-                error: err,
-            });
-        }
-        fanDoctrineWake(id, subscribersOf(id), label, {
-            reason: 'child-wedged',
-            child: id,
-            quiet_ms: quietForMs,
-            cpu_percent: cpuPercent,
-            kick_attempted: kickAttempted,
-            kicked,
-            ...(kickSuppressionReason === null ? {} : { kick_suppression_reason: kickSuppressionReason }),
-        });
-    }
-    handleFatalFault(id) {
-        const fault = readFault(id);
-        if (fault === null) {
-            this.fatalFaultNotifiedAt.delete(id);
-            return;
-        }
-        if (fault.retry.disposition !== 'fatal' || fault.link !== 'pi→provider')
-            return;
-        if (this.fatalFaultNotifiedAt.get(id) === fault.since)
-            return;
-        this.fatalFaultNotifiedAt.set(id, fault.since);
-        const meta = getNode(id);
-        const name = meta !== null ? fullName(meta) : id;
-        const isAuth = fault.kind === 'auth';
-        const firstLine = (fault.message.split('\n')[0] ?? '').slice(0, 200);
-        const providerError = fault.providerError;
-        const providerDetail = providerError === undefined
-            ? ''
-            : ` Provider: ${providerError.provider}/${providerError.model}.` +
-                (providerError.status === undefined ? '' : ` HTTP status: ${providerError.status}.`) +
-                (providerError.errno === undefined ? '' : ` Errno: ${providerError.errno}.`) +
-                (providerError.code === undefined ? '' : ` Code: ${providerError.code}.`) +
-                (providerError.body === undefined ? '' : ` Body: ${providerError.body.slice(0, 200)}.`);
-        const terminalOverflow = fault.kind === 'context-overflow';
-        const label = terminalOverflow
-            ? `Child failed — ${name} (${id}) exceeded its model context window and is now dead. ` +
-                `Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${firstLine}`
-            : `Child hit a fatal provider fault — ${name} (${id}) got a non-retryable ${fault.kind} error and will NOT recover on its own; ` +
-                `it stays alive, and waking it clears the fault as soon as one turn completes — a wake that hits the same cause fails again. ` +
-                (isAuth
-                    ? `Its provider credential is dead — re-authenticate (\`/login\`, or re-auth crtr); the child recovers on its next wake once the auth reloads. `
-                    : ``) +
-                `Error: ${firstLine}.${providerDetail}`;
-        if (terminalOverflow) {
-            try {
-                transition(id, 'crash', {
-                    reason: 'context_overflow',
-                    outcome: {
-                        detail: {
-                            schema: 'crtr.node-outcome-detail/v1',
-                            message: fault.message,
-                            fault_kind: 'context-overflow',
-                            error_class: 'context_overflow',
-                        },
-                    },
-                });
-                headlessBrokerHost.teardown(id);
-            }
-            catch {
-                /* the terminal notice remains useful if teardown raced the broker exit */
-            }
-        }
-        emitEvent({
-            level: 'error',
-            event: 'fault.fatal.fanout',
-            ...(isSafeNodeId(id) ? { node_id: id } : {}),
-            fields: {
-                ...(isSafeNodeId(id) ? {} : { affected_node_id: id }),
-                kind: fault.kind,
-                link: fault.link,
-                terminal_overflow: terminalOverflow,
-            },
-        });
-        fanDoctrineWake(id, subscribersOf(id), label, {
-            reason: terminalOverflow ? 'child-context-overflow' : 'child-fault-fatal',
-            child: id,
-            kind: fault.kind,
-            message: firstLine,
-            ...(providerError === undefined ? {} : { provider_error: providerError }),
-        });
-    }
-    async handleAuthReload(fleet) {
-        const agentDir = piAgentDir();
-        let mtimeMs = 0;
-        for (const path of piCredentialPaths(agentDir)) {
-            try {
-                mtimeMs = Math.max(mtimeMs, statSync(path).mtimeMs);
-            }
-            catch {
-                /* not written yet — nothing to observe for this file */
-            }
-        }
-        let revision = 0;
-        const store = providerStore(agentDir);
-        if (scopedStoreExists(store))
-            revision = providerRevision(agentDir);
-        const current = `${mtimeMs}:${revision}`;
-        if (this.knownCredentialRevision === null) {
-            this.knownCredentialRevision = current;
-            return;
-        }
-        if (current === this.knownCredentialRevision)
-            return;
-        this.knownCredentialRevision = current;
-        await operationIdContext.fresh(async () => {
-            try {
-                const live = Array.from(fleet.entries(), ([id]) => id);
-                if (live.length === 0)
-                    return;
-                const results = await Promise.allSettled(live.map(async (id) => {
-                    try {
-                        await reloadAuthLive(id);
-                    }
-                    catch (err) {
-                        emitEvent({
-                            level: 'error',
-                            event: 'auth.reload.broker_failed',
-                            ...(isSafeNodeId(id) ? { node_id: id } : { fields: { broker_id: id } }),
-                            error: err,
-                        });
-                        throw err;
-                    }
-                }));
-                const ok = results.filter((r) => r.status === 'fulfilled').length;
-                emitEvent({
-                    level: 'info',
-                    event: 'auth.reload.completed',
-                    outcome: ok === live.length ? 'succeeded' : 'failed',
-                    fields: {
-                        broker_count: live.length,
-                        succeeded_count: ok,
-                        failed_count: live.length - ok,
-                    },
-                });
-            }
-            catch (err) {
-                emitEvent({ level: 'error', event: 'auth.reload.failed', error: err });
-            }
-        });
-    }
-}
+var H=Object.defineProperty;var p=(a,e)=>H(a,"name",{value:e,configurable:!0});import{statSync as V}from"node:fs";import{join as k}from"node:path";import{homedir as I}from"node:os";import{execFile as K}from"node:child_process";import{promisify as z}from"node:util";import{getNode as S,isWarmSpare as J,subscribersOf as F}from"../../core/canvas/index.js";import{contextDir as Q,isSafeNodeId as u}from"../../core/canvas/paths.js";import{fullName as O}from"../../core/canvas/labels.js";import{recordedPidLiveness as G}from"../../core/canvas/pid.js";import{transition as X}from"../../core/runtime/lifecycle.js";import{readFault as L,readLiveTurn as E,recordFault as Z}from"../../core/canvas/recovery.js";import{nextFaultRetry as ee}from"../../core/runtime/fault-recovery.js";import{fanDoctrineWake as W}from"../../core/runtime/close.js";import{headlessBrokerHost as v}from"../../core/runtime/host.js";import{reloadAuthLive as te}from"../../core/runtime/auth-reload.js";import{emitEvent as f}from"../../core/events/emit.js";import{operationIdContext as C}from"../../core/events/operation-id.js";import{hasUnseenWakeMail as ne,resetStaleExecutionMail as re}from"../../core/canvas/deliveries.js";import{activeBackgroundBashJobs as ie}from"../../core/bash-jobs.js";import{focusOf as se}from"../../core/runtime/placement.js";import{hasAttachedBrokerViewers as ae}from"../../core/runtime/broker/client-registry.js";import{deliverLive as oe}from"../../core/runtime/interactive-deliver.js";import{BrokerUnreachableError as le}from"../../core/runtime/broker-request.js";import{formatCard as de,PARK_SUMMARY_PROMPT as ce}from"../../shared/generated-context.js";import{brokerThresholdsForDaemon as ue}from"../../core/runtime/fleet.js";import{readConfig as fe}from"../../core/config.js";import{scopedStoreExists as pe}from"../../core/scoped-state/db.js";import{providerStore as me}from"../../core/scoped-state/paths.js";import{providerRevision as he}from"../../core/scoped-state/providers.js";import{beginPendingPark as _e,consumePendingPark as y,pendingParkIds as ge,pendingParkStartedAt as ke}from"../park-pending.js";import{shouldParkAfterSummary as ve}from"../park-activity.js";import{applyParkEvent as A,parkEvent as ye}from"./live-obligation.js";import{envNoDaemonAutostart as be,envTestUnattendedParkMs as we,parkSummaryGraceMs as Se,envUnattendedParkMs as Ae}from"../../shared/env.js";const N=z(K);function Ne(a){return E(a)?.busy===!0}p(Ne,"liveBusy");function ht(a){const e=E(a)?.progressAt;if(e==null)return null;const t=Date.parse(e);return Number.isNaN(t)?null:t}p(ht,"liveTurnProgressMs");function U(a,e){return e===null?null:`${a}:${e}`}p(U,"incarnationOf");function R(a){const e=E(a.node_id),t=e?.busy===!0&&e.progressAt!==null?Date.parse(e.progressAt):Number.NaN,s=a.launched_at===null||a.launched_at===void 0?Number.NaN:Date.parse(a.launched_at);return!Number.isFinite(t)||!Number.isFinite(s)||t<s?null:t}p(R,"busySinceForIncarnation");const B=3*6e4,q=2e4,D=20*6e4,Pe=2,Me=5*6e4;function Te(){const a=Ae();if(a!==void 0)return a;const e=fe("user").lifecycle.unattendedParkMs;return be()?we()??e:e}p(Te,"unattendedParkMsForDaemon");function Y(){return Se()}p(Y,"parkSummaryGraceMsForDaemon");function $e(a,e,t,s){return a!==!0||e!=="refresh"||t?"leave":s===null||s<B?"pending":"kill"}p($e,"yieldStallVerdict");function Ee(a){return!a.busy||a.quietForMs===null||a.quietForMs<D?"leave":a.cpuPercent===null||a.hasDescendants!==!1&&a.cpuPercent>Pe?"pending":"wedged"}p(Ee,"wedgeVerdict");function j(a){const e=new Map,t=new Map;for(const s of a.split(`
+`)){const i=s.trim();if(i==="")continue;const n=i.split(/\s+/);if(n.length<3)continue;const o=Number(n[0]),r=Number(n[1]),d=Number(n[2]);if(!Number.isFinite(o)||!Number.isFinite(r)||!Number.isFinite(d))continue;e.set(o,d);const c=t.get(r);c===void 0?t.set(r,[o]):c.push(o)}return{byPid:e,childrenOf:t}}p(j,"parsePsTree");function Ce(a,e){const{byPid:t,childrenOf:s}=j(a);if(!t.has(e))return null;let i=0;const n=[e],o=new Set;for(;n.length>0;){const r=n.pop();if(o.has(r))continue;o.add(r),i+=t.get(r)??0;const d=s.get(r);d!==void 0&&n.push(...d)}return i}p(Ce,"sumTreeCpu");function Re(a,e){const{byPid:t,childrenOf:s}=j(a);return t.has(e)?(s.get(e)??[]).length>0:null}p(Re,"treeHasDescendants");function De(){const a=process.env.PI_CODING_AGENT_DIR;return a!==void 0&&a!==""?a==="~"||a.startsWith("~/")?k(I(),a.slice(1)):a:k(I(),".pi","agent")}p(De,"piAgentDir");function xe(a){return[k(a,"auth.json"),k(a,"anthropic-credentials.json"),k(a,"openai-codex-credentials.json")]}p(xe,"piCredentialPaths");class _t{static{p(this,"BrokerSupervisionReconciler")}yieldStalls=new Map;wedgeNotifiedAt=new Map;fatalFaultNotifiedAt=new Map;unattendedSince=new Map;sampleTree;signal;knownCredentialRevision=null;lastOverCapWarnAt=Number.NEGATIVE_INFINITY;constructor(e={}){this.sampleTree=e.readTreeSample??(t=>this.readTreeSample(t)),this.signal=e.signal??((t,s)=>process.kill(t,s))}async runFleetPreamble(e){return await this.handleAuthReload(e),ue()}warnIfSaturated(e){if(e.fleet.size()<e.thresholds.warning||!e.lifecycle.acceptsDetachedWork())return;const t=C.fresh(()=>this.warnOverCapInTmux(e.fleet.size(),e.thresholds,e.frozen));e.lifecycle.registerDetached(t)}async run(e,t){const s=Te();for(const i of t.rows){const n=i.node_id,o=t.fleet.get(n);if(o===void 0||i.status!=="active"&&i.status!=="idle"){this.unattendedSince.delete(n);continue}await C.fresh(async()=>{try{this.handleYieldStall(i,o,t.fleet,e),await this.handleWedgeDetection(i,o,t.fleet,e),this.handleFatalFault(n),this.handleUnattendedParking(n,S(n),o.pid,e,t,s)}catch(r){this.unattendedSince.delete(n),f({level:"error",event:"broker.supervision.failed",...u(n)?{node_id:n}:{fields:{affected_node_id:n}},error:r})}})}for(const i of this.unattendedSince.keys())t.fleet.has(i)||this.unattendedSince.delete(i);for(const i of ge())t.fleet.has(i)||y(i);re(e)}parkResetCondition(e,t,s,i){if(t.pi_session_id==null||t.pi_pid!==s||t.status==="done"||t.status==="canceled"||t.status==="dead"||t.intent!==null||ie(Q(e)).length>0||se(e)!==null||ae(e))return!0;const n=L(e);return n!==null&&n.retry.disposition==="auto"&&n.retry.by==="daemon"&&(n.kind==="connection"||n.kind==="rate-limit"||n.kind==="overloaded")&&(n.retry.nextAt!==void 0||ee(n,i)!==null)?!0:ne(e)}handleUnattendedParking(e,t,s,i,n,o){if(J(e)){this.unattendedSince.delete(e),y(e);return}if(t===null){this.unattendedSince.delete(e),y(e);return}const r=this.parkResetCondition(e,t,s,i),d=ke(e);if(d!==void 0){if(i-d<Y())return;const m=y(e);if(m===void 0||(this.unattendedSince.delete(e),!ve(e,t,m)))return;f({level:"warn",event:"broker.park.summary_expired",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},grace_ms:Y()}}),A(e,"park"),v.teardown(e);return}if(r||Ne(e)){this.unattendedSince.delete(e);return}const c=this.unattendedSince.get(e);if(c===void 0){this.unattendedSince.set(e,i);return}if(i-c<o)return;this.unattendedSince.delete(e);const l=ye(e,t.lifecycle);if(l==="release"){A(e,l),v.teardown(e);return}if(l==="cancel"){A(e,l),v.teardown(e);return}n.lifecycle.acceptsDetachedWork()&&(_e(e,i),n.lifecycle.registerDetached(this.requestParkSummary(e)))}async requestParkSummary(e){try{const t=await oe(e,de("park",{},ce),{origin:{type:"runtime",kind:"park"}});f({level:"info",event:"broker.park.summary_requested",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},route:t}})}catch(t){if(y(e)===void 0)return;if(t instanceof le){A(e,"park"),v.teardown(e);return}f({level:"error",event:"broker.park.summary_failed",...u(e)?{node_id:e}:{fields:{affected_node_id:e}},error:t})}}async warnOverCapInTmux(e,t,s){const i=Date.now();if(i-this.lastOverCapWarnAt<Me)return;this.lastOverCapWarnAt=i;const{warning:n,automaticReviveCap:o}=t,r=s.stalled+s.waitingOnMail;f({level:"warn",event:"broker.capacity.warning",fields:{live_count:e,warning_threshold:n,hard_cap:o,frozen_stalled:s.stalled,frozen_waiting_on_mail:s.waitingOnMail}});const d=r===0?"":` \u2014 ${r} frozen (${s.stalled} stalled, ${s.waitingOnMail} waiting on mail)`,c=`\u26A0 crtrd: ${e} live brokers (warning ${n}; hard cap ${o})${d} \u2014 possible broker leak. ps -ax | grep broker-cli.js`;try{const l=await N("tmux",["list-clients","-F","#{client_name}"],{encoding:"utf8",timeout:2e3});if(typeof l.stdout!="string")return;await Promise.allSettled(l.stdout.split(`
+`).map(async m=>{if(m!=="")try{await N("tmux",["display-message","-C","-d","10000","-c",m,c],{encoding:"utf8",timeout:2e3})}catch{try{await N("tmux",["display-message","-c",m,c],{encoding:"utf8",timeout:2e3})}catch(_){f({level:"error",event:"broker.capacity.tmux_display_failed",error:_,fields:{client:m}})}}}))}catch(l){f({level:"error",event:"broker.capacity.tmux_list_clients_failed",error:l})}}handleYieldStall(e,t,s,i){const n=e.node_id,o=U(t.pid,e.pi_pid_identity);if(e.intent!=="refresh"||R(e)!==null||o===null){o!==null&&this.yieldStalls.delete(o);return}let r=this.yieldStalls.get(o);if(r===void 0){r={since:i},this.yieldStalls.set(o,r);return}if($e(!0,e.intent,!1,i-r.since)!=="kill")return;const d=S(n);if(!(s.get(n)!==t||d?.pi_pid!==t.pid||d.pi_pid_identity!==e.pi_pid_identity||G(t.pid,e.pi_pid_identity)!=="alive"))if(r.termedAt===void 0){if(!this.signalYieldStall(n,t.pid,"SIGTERM"))return;r.termedAt=i,f({level:"warn",event:"broker.yield_stall.sigterm",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,elapsed_ms:i-r.since,grace_ms:B}})}else i-r.termedAt>=q&&this.signalYieldStall(n,t.pid,"SIGKILL")&&f({level:"warn",event:"broker.yield_stall.sigkill",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,elapsed_ms:i-r.termedAt,grace_ms:q,stall_elapsed_ms:i-r.since}})}signalYieldStall(e,t,s){try{return this.signal(t,s),!0}catch(i){return f({level:"error",event:"broker.yield_stall.signal_failed",...u(e)?{node_id:e}:{},error:i,fields:{...u(e)?{}:{affected_node_id:e},pid:t,signal:s}}),!1}}async readTreeSample(e){try{const{stdout:t}=await N("ps",["-ax","-o","pid=,ppid=,pcpu="],{encoding:"utf8",timeout:2e3});if(typeof t!="string")return null;const s=Ce(t,e),i=Re(t,e);return s===null||i===null?null:{cpuPercent:s,hasDescendants:i}}catch{return null}}async handleWedgeDetection(e,t,s,i){const n=e.node_id,o=U(t.pid,e.pi_pid_identity),r=R(e);if(r===null||o===null){o!==null&&this.wedgeNotifiedAt.delete(o);return}const d=i-r,c=d>=D?await this.sampleTree(t.pid):null,l=S(n),m=l===null?null:R(l);if(s.get(n)!==t||l===null||l.pi_pid!==t.pid||l.pi_pid_identity!==e.pi_pid_identity||m!==r)return;const _=c?.cpuPercent??null,x=c?.hasDescendants??null;if(Ee({busy:!0,quietForMs:d,cpuPercent:_,hasDescendants:x})!=="wedged"||this.wedgeNotifiedAt.get(o)===r)return;this.wedgeNotifiedAt.set(o,r);const b=O(l),w=Math.round((d??D)/6e4),P=x??!0,g=!P&&G(t.pid,e.pi_pid_identity)!=="alive"?"pid_identity_unproven":null;let M=!1,T=!1,h;if(P)h=`Child wedged \u2014 ${b} (${n}) is alive and mid-turn but has shown NO engine progress for ${w}+ minutes and its process is near-idle. It will NOT recover on its own \u2014 read \`crtr memory read wedged-child-on-runaway-bash\` and kill the runaway SUBPROCESS (not this node) so its turn can resume with no lost context.`;else if(g!==null)h=`Child wedged \u2014 ${b} (${n}) is alive and mid-turn but has shown NO engine progress for ${w}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon did not SIGTERM the broker because its PID identity cannot be confirmed alive.`;else{M=!0;try{this.signal(t.pid,"SIGTERM"),T=!0,h=`Child wedged \u2014 ${b} (${n}) is alive and mid-turn but has shown NO engine progress for ${w}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon sent SIGTERM to the broker and will resume a cleanly aborted session with a continuation, or start a recovery cycle if the abort cannot settle.`}catch($){f({level:"error",event:"broker.wedge.signal_failed",...u(n)?{node_id:n}:{},error:$,fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,signal:"SIGTERM"}}),h=`Child wedged \u2014 ${b} (${n}) is alive and mid-turn but has shown NO engine progress for ${w}+ minutes and it has no subprocess to kill (the engine itself stalled). The daemon attempted SIGTERM to the broker, but the signal call failed.`}}f({level:"error",event:"broker.wedge.detected",...u(n)?{node_id:n}:{},fields:{...u(n)?{}:{affected_node_id:n},pid:t.pid,quiet_ms:d,cpu_percent:_,has_descendants:P,kick_attempted:M,kicked:T,...g===null?{}:{kick_suppression_reason:g}}});try{Z(n,{link:"daemon\u2192node",op:"engine wedge",kind:"wedged",retry:{disposition:"manual"},message:h})}catch($){f({level:"error",event:"broker.wedge.fault_record_failed",...u(n)?{node_id:n}:{fields:{affected_node_id:n}},error:$})}W(n,F(n),h,{reason:"child-wedged",child:n,quiet_ms:d,cpu_percent:_,kick_attempted:M,kicked:T,...g===null?{}:{kick_suppression_reason:g}})}handleFatalFault(e){const t=L(e);if(t===null){this.fatalFaultNotifiedAt.delete(e);return}if(t.retry.disposition!=="fatal"||t.link!=="pi\u2192provider"||this.fatalFaultNotifiedAt.get(e)===t.since)return;this.fatalFaultNotifiedAt.set(e,t.since);const s=S(e),i=s!==null?O(s):e,n=t.kind==="auth",o=(t.message.split(`
+`)[0]??"").slice(0,200),r=t.providerError,d=r===void 0?"":` Provider: ${r.provider}/${r.model}.`+(r.status===void 0?"":` HTTP status: ${r.status}.`)+(r.errno===void 0?"":` Errno: ${r.errno}.`)+(r.code===void 0?"":` Code: ${r.code}.`)+(r.body===void 0?"":` Body: ${r.body.slice(0,200)}.`),c=t.kind==="context-overflow",l=c?`Child failed \u2014 ${i} (${e}) exceeded its model context window and is now dead. Shrink the task or loaded context, or choose a larger-context model before spawning it again. Error: ${o}`:`Child hit a fatal provider fault \u2014 ${i} (${e}) got a non-retryable ${t.kind} error and will NOT recover on its own; it stays alive, and waking it clears the fault as soon as one turn completes \u2014 a wake that hits the same cause fails again. `+(n?"Its provider credential is dead \u2014 re-authenticate (`/login`, or re-auth crtr); the child recovers on its next wake once the auth reloads. ":"")+`Error: ${o}.${d}`;if(c)try{X(e,"crash",{reason:"context_overflow",outcome:{detail:{schema:"crtr.node-outcome-detail/v1",message:t.message,fault_kind:"context-overflow",error_class:"context_overflow"}}}),v.teardown(e)}catch{}f({level:"error",event:"fault.fatal.fanout",...u(e)?{node_id:e}:{},fields:{...u(e)?{}:{affected_node_id:e},kind:t.kind,link:t.link,terminal_overflow:c}}),W(e,F(e),l,{reason:c?"child-context-overflow":"child-fault-fatal",child:e,kind:t.kind,message:o,...r===void 0?{}:{provider_error:r}})}async handleAuthReload(e){const t=De();let s=0;for(const r of xe(t))try{s=Math.max(s,V(r).mtimeMs)}catch{}let i=0;const n=me(t);pe(n)&&(i=he(t));const o=`${s}:${i}`;if(this.knownCredentialRevision===null){this.knownCredentialRevision=o;return}o!==this.knownCredentialRevision&&(this.knownCredentialRevision=o,await C.fresh(async()=>{try{const r=Array.from(e.entries(),([l])=>l);if(r.length===0)return;const c=(await Promise.allSettled(r.map(async l=>{try{await te(l)}catch(m){throw f({level:"error",event:"auth.reload.broker_failed",...u(l)?{node_id:l}:{fields:{broker_id:l}},error:m}),m}}))).filter(l=>l.status==="fulfilled").length;f({level:"info",event:"auth.reload.completed",outcome:c===r.length?"succeeded":"failed",fields:{broker_count:r.length,succeeded_count:c,failed_count:r.length-c}})}catch(r){f({level:"error",event:"auth.reload.failed",error:r})}}))}}export{_t as BrokerSupervisionReconciler,Pe as WEDGE_CPU_MAX_PERCENT,D as WEDGE_QUIET_MS,B as YIELD_STALL_GRACE_MS,Y as parkSummaryGraceMsForDaemon,Ce as sumTreeCpu,Re as treeHasDescendants,Te as unattendedParkMsForDaemon,Ee as wedgeVerdict,$e as yieldStallVerdict};