@crouton-kit/crouter 0.3.35 → 0.3.37

package/dist/core/__tests__/history-inbox.test.js

@@ -0,0 +1,105 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/history-inbox.test.ts
+//
+// Locks in the invariants of the `inbox` history source: it stays opt-in
+// (never part of the default corpus), its refs resolve/round-trip as
+// `<node>:inbox/NNNNNN`, direct-message bodies stay full/unclipped, and the
+// sender (`from`) is visible in both the read body and the artifact title.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { appendInbox } from '../feed/inbox.js';
+import { buildCorpus, resolveRef } from '../canvas/history.js';
+let home;
+function node(id, cwd) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-history-inbox-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('default history excludes inbox; --type inbox includes it, with full sender-attributed bodies', () => {
+    const cwd = '/tmp/hist-work';
+    createNode(node('sender-1', cwd));
+    const receiver = createNode(node('receiver-1', cwd));
+    const longBody = 'a'.repeat(4000); // well past any old label-clip length
+    appendInbox(receiver.node_id, {
+        from: 'sender-1',
+        tier: 'urgent',
+        kind: 'message',
+        label: 'first line of a long message',
+        data: { body: longBody },
+    });
+    // (a) default corpus (no explicit types) excludes inbox entirely.
+    const defaultCorpus = buildCorpus({ nodes: [receiver.node_id] }, {});
+    assert.equal(defaultCorpus.some((a) => a.source === 'inbox'), false, 'inbox is opt-in, not part of the default corpus');
+    // (b) explicit --type inbox includes it.
+    const inboxCorpus = buildCorpus({ nodes: [receiver.node_id] }, { types: ['inbox'] });
+    assert.equal(inboxCorpus.length, 1, 'exactly the one appended entry');
+    const artifact = inboxCorpus[0];
+    assert.equal(artifact.source, 'inbox');
+    // (c) ref resolves as <node>:inbox/000000 and round-trips through resolveRef.
+    const expectedRef = `${receiver.node_id}:inbox/000000`;
+    assert.equal(artifact.ref, expectedRef);
+    const resolved = resolveRef(expectedRef);
+    assert.ok(resolved !== null, 'ref resolves back to the entry');
+    assert.equal(resolved.source, 'inbox');
+    // (d) the direct-message body is full/unclipped in both the corpus artifact
+    // and the resolveRef read path.
+    assert.ok(artifact.loadBody().includes(longBody), 'corpus artifact body is unclipped');
+    assert.ok(resolved.body.includes(longBody), 'resolveRef body is unclipped');
+    // (e) the sender is visible — in the read body (not just resolvable via the
+    // node the inbox belongs to) and in the artifact title used by list rows.
+    assert.ok(resolved.body.includes('from: sender-1'), 'read body names the sender');
+    assert.ok(artifact.title.includes('sender-1'), 'artifact title names the sender for list/search rows');
+});
+test('a spilled message body is read RAW — a leading frontmatter-shaped block is not stripped', () => {
+    const cwd = '/tmp/hist-work-3';
+    createNode(node('sender-3', cwd));
+    const receiver = createNode(node('receiver-3', cwd));
+    // Long enough to force the spill-to-messages/ path (past BODY_MAX_CHARS),
+    // and starts with a block that LOOKS like crouter report frontmatter but
+    // isn't one — a spilled message has no frontmatter contract, so this must
+    // survive intact, unlike a report ref (which always has real frontmatter
+    // stripped by fileBodyLoader).
+    const body = '---\nfoo: bar\n---\n' + 'a'.repeat(4000);
+    appendInbox(receiver.node_id, {
+        from: 'sender-3',
+        tier: 'normal',
+        kind: 'message',
+        label: 'first line',
+        data: { body },
+    });
+    const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
+    assert.ok(resolved !== null);
+    assert.ok(resolved.body.includes('---\nfoo: bar\n---'), 'leading frontmatter-shaped block is preserved, not stripped');
+});
+test('a null-from (system) inbox entry reads as "system", not blank or thrown', () => {
+    const cwd = '/tmp/hist-work-2';
+    const receiver = createNode(node('receiver-2', cwd));
+    appendInbox(receiver.node_id, { from: null, tier: 'normal', kind: 'update', label: 'system note' });
+    const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
+    assert.ok(resolved !== null);
+    assert.ok(resolved.body.includes('from: system'), 'null sender renders as "system"');
+});

package/dist/core/__tests__/kickoff.test.js

@@ -58,7 +58,7 @@ test('drainBearings consumes the yield note + advances the cursor exactly once',
     assert.equal(b2.yieldMsg, null);
     assert.equal(b2.unreadDigest, null);
 });
-test('the feed block frames awaiting workers as alive + auto-waking, so a fresh revive has no reason to peek', () => {
+test('the feed block frames awaiting workers as alive + auto-waking, so a fresh revive has no reason to poll', () => {
     const parent = createNode(node('p1'));
     const child = createNode(node('c1')); // status 'active' by default
     subscribe(parent.node_id, child.node_id); // parent awaits child
@@ -66,7 +66,7 @@ test('the feed block frames awaiting workers as alive + auto-waking, so a fresh
     // The roster names the live child...
     assert.ok(msg.includes(child.node_id), 'awaiting roster lists the live child');
     // ...and asserts aliveness + the automatic wake at the source, so the node
-    // does not burn a turn confirming with `feed read`/`feed peek`.
+    // has nothing to check, poll, or verify separately.
     assert.ok(/alive and running/.test(msg), 'states the worker is alive and running');
     assert.ok(/wake you the moment/.test(msg), 'states the wake is automatic on push');
     assert.ok(/still working, not stalled/.test(msg), 'frames the empty feed as expected, not a problem');
@@ -101,7 +101,7 @@ test('a fresh revive is pointed at its subscriptions\' on-disk report history (c
     assert.ok(!msg.includes(newer), 'absolute report paths not rendered');
     assert.ok(/canvas history read <ref>/.test(msg), 'points at one-report expansion');
     assert.ok(/canvas history show <node-id> --type report/.test(msg), 'points at full per-node expansion');
-    assert.ok(/feed read --all/.test(msg), 'points at the cursor-independent full-history replay');
+    assert.ok(/canvas history show <node-id> --type inbox/.test(msg), 'points at the cursor-independent full-history replay');
 });
 test('buildReviveKickoff is pure — building twice eats nothing', () => {
     const id = 'n2';

package/dist/core/__tests__/revive.test.js

@@ -34,7 +34,8 @@ import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { createNode } from '../canvas/canvas.js';
+import { createNode, subscribe } from '../canvas/canvas.js';
+import { readInboxSince } from '../feed/inbox.js';
 import { closeDb } from '../canvas/db.js';
 import { buildPiArgv } from '../runtime/launch.js';
 import { headlessBrokerHost } from '../runtime/host.js';
@@ -298,3 +299,40 @@ test('reviveNode crashes and clears pid when launch/preflight throws', async ()
         await h.dispose();
     }
 });
+// ---------------------------------------------------------------------------
+// Crash-to-dead doctrine wake — a launch-refusal marks the node dead; a
+// manager waiting dormant on it must be told, or it hangs forever (the
+// daemon no longer supervises a dead node). Mirrors closeNode's step-4 fan-out.
+// ---------------------------------------------------------------------------
+test('reviveNode fans a doctrine wake to subscribers when launch/preflight throws (crash-to-dead)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-crashwake' });
+    const originalLaunch = headlessBrokerHost.launch;
+    try {
+        const root = h.spawnRoot('crash-wake suite root');
+        const sessionFile = join(home, 'sessions', 'crtr-revive-crashwake.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, '{}\n', 'utf8');
+        const M = h.fabricateBrokerNode({
+            parent: root,
+            status: 'active',
+            intent: null,
+            pi_pid: deadPid(),
+            pi_session_id: 'uuid-3',
+            pi_session_file: sessionFile,
+        });
+        // spawnChild-equivalent auto-subscription — done explicitly since this node
+        // was fabricated directly, not spawned through the CLI.
+        subscribe(root, M, true);
+        headlessBrokerHost.launch = (_nodeId, _inv, _opts) => { throw new Error('boom'); };
+        assert.throws(() => reviveNode(M, { resume: true }), /refusing to revive/i);
+        assert.equal(h.node(M).status, 'dead', 'failed revive marks the node dead');
+        const entries = readInboxSince(root, undefined);
+        const notice = entries.find((e) => e.data?.['reason'] === 'child-crashed' && e.data?.['child'] === M);
+        assert.ok(notice !== undefined, 'the surviving parent got a doctrine wake for the dead child');
+        assert.equal(notice.from, M, 'the notice is attributed to the crashed child');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        await h.dispose();
+    }
+});

package/dist/core/canvas/history.d.ts

@@ -1,5 +1,5 @@
 import type { NodeStatus } from './types.js';
-export type HistorySource = 'report' | 'doc' | 'roadmap' | 'meta';
+export type HistorySource = 'report' | 'doc' | 'roadmap' | 'meta' | 'inbox';
 /** One searchable unit of the episodic record: a report, a context doc, a
  *  node's roadmap, or a node's meta (name/description/kind). */
 export interface HistoryArtifact {

package/dist/core/canvas/history.js

@@ -12,7 +12,7 @@
 import { statSync, readdirSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { getNode, listNodes, view } from './canvas.js';
-import { contextDir, reportsDir, nodeDir } from './paths.js';
+import { contextDir, reportsDir, nodeDir, inboxPath } from './paths.js';
 import { readTextIfExists, walkFiles, pathExists } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 /** The cwd the caller means by default: the calling node's cwd (resolved from
@@ -126,6 +126,68 @@ function docArtifact(row, desc, abs) {
         loadBody: load,
     };
 }
+/** Every entry ever appended to a node's inbox.jsonl, oldest first, cursor-
+ *  independent (the cursor only gates the live wake path, not this read).
+ *  Empty when the node has no inbox file yet. */
+function allInboxEntries(nodeId) {
+    const raw = readTextIfExists(inboxPath(nodeId));
+    if (raw === null)
+        return [];
+    return raw
+        .split('\n')
+        .filter((l) => l.trim() !== '')
+        .map((l) => JSON.parse(l));
+}
+/** One inbox entry's full content: a direct message or system alert's
+ *  un-clipped body — dereferenced from its spilled ref file when the inline
+ *  preview clipped, else the inline body itself — or, for a push pointer
+ *  (which carries no body of its own), its kind/label plus the sender-side
+ *  report path it points to.
+ *
+ *  A spilled ref (message/system notice too long to inline) is arbitrary
+ *  text with no crouter frontmatter contract — read it RAW, unlike a report
+ *  ref, which always carries the `---\n...\n---` header stripped by
+ *  fileBodyLoader. The presence of an inline `data.body` preview is what
+ *  distinguishes the two: only a spilled message/notice ever carries one
+ *  (a push pointer's entry has no `data` field at all). */
+function inboxEntryBody(e) {
+    const meta = [`from: ${e.from ?? 'system'}`, `tier: ${e.tier}`].join('\n');
+    const header = `[${e.kind}] ${e.label}`;
+    const inlinePreview = typeof e.data?.['body'] === 'string' ? e.data['body'].trim() : '';
+    const isSpilledMessage = typeof e.data?.['body'] === 'string';
+    const full = e.ref !== undefined
+        ? isSpilledMessage
+            ? (readTextIfExists(e.ref) ?? '')
+            : fileBodyLoader(e.ref).load()
+        : inlinePreview;
+    const hasBody = full !== '' && full !== e.label;
+    const parts = [meta, header];
+    if (e.ref !== undefined)
+        parts.push(`ref: ${e.ref}`);
+    if (hasBody)
+        parts.push(full);
+    return parts.join('\n\n');
+}
+function inboxArtifact(row, desc, entry, index) {
+    const relpath = `inbox/${String(index).padStart(6, '0')}`;
+    const body = inboxEntryBody(entry);
+    return {
+        ref: `${row.node_id}:${relpath}`,
+        nodeId: row.node_id,
+        relpath,
+        source: 'inbox',
+        ts: entry.ts,
+        tsMs: toMs(entry.ts),
+        title: `[${entry.kind}] from ${entry.from ?? 'system'}: ${entry.label}`,
+        nodeName: row.name,
+        nodeKind: row.kind,
+        nodeStatus: row.status,
+        nodeCwd: row.cwd,
+        nodeDesc: desc,
+        path: null,
+        loadBody: () => body,
+    };
+}
 function metaArtifact(row, desc) {
     const body = `${row.name}\n${desc}\n${row.kind}`;
     return {
@@ -189,7 +251,9 @@ export function buildCorpus(scope, corpus) {
             return false;
         return true;
     });
-    // --report-kind implies type=report.
+    // --report-kind implies type=report. `inbox` is opt-in only — never part of
+    // the default set — since a node's raw inbox history is unbounded diagnostic
+    // detail, not curated past work.
     const wantReportKind = corpus.reportKind;
     const types = corpus.types !== undefined && corpus.types.length > 0
         ? corpus.types
@@ -199,7 +263,7 @@ export function buildCorpus(scope, corpus) {
     const want = new Set(types);
     const out = [];
     for (const row of survivors) {
-        const desc = want.has('meta') || want.has('report') || want.has('doc') || want.has('roadmap')
+        const desc = want.has('meta') || want.has('report') || want.has('doc') || want.has('roadmap') || want.has('inbox')
             ? nodeDescOf(row.node_id)
             : '';
         if (want.has('meta'))
@@ -224,6 +288,9 @@ export function buildCorpus(scope, corpus) {
                 out.push(a);
             }
         }
+        if (want.has('inbox')) {
+            allInboxEntries(row.node_id).forEach((entry, i) => out.push(inboxArtifact(row, desc, entry, i)));
+        }
     }
     // Time window on artifact ts.
     return out.filter((a) => {
@@ -274,6 +341,22 @@ export function resolveRef(ref) {
             path: null,
         };
     }
+    if (relpath.startsWith('inbox/')) {
+        const index = Number(relpath.slice('inbox/'.length));
+        const entry = allInboxEntries(nodeId)[index];
+        if (entry === undefined)
+            return null;
+        return {
+            nodeId,
+            relpath,
+            source: 'inbox',
+            ts: entry.ts,
+            nodeName: node.name,
+            body: inboxEntryBody(entry),
+            raw: null,
+            path: null,
+        };
+    }
     if (relpath.includes('..') || relpath.startsWith('/')) {
         throw new Error(`illegal relpath in ref: ${relpath}`);
     }
@@ -329,6 +412,7 @@ export function nodeArtifacts(nodeId, types) {
         tmux_session: node.tmux_session ?? null,
         pane: node.pane ?? null,
     };
+    // `inbox` is opt-in only, same as buildCorpus — must be requested explicitly.
     const want = new Set(types !== undefined && types.length > 0 ? types : ['report', 'doc', 'roadmap']);
     const desc = node.description ?? '';
     const out = [];
@@ -349,6 +433,9 @@ export function nodeArtifacts(nodeId, types) {
             out.push(a);
         }
     }
+    if (want.has('inbox')) {
+        allInboxEntries(nodeId).forEach((entry, i) => out.push(inboxArtifact(row, desc, entry, i)));
+    }
     return out;
 }
 /** Bounded per-cwd aggregate for the branch `-h` `<corpus>` block. Counts files

package/dist/core/canvas/paths.d.ts

@@ -26,6 +26,12 @@ export declare function nodeDir(nodeId: string): string;
 export declare function contextDir(nodeId: string): string;
 export declare function jobDir(nodeId: string): string;
 export declare function reportsDir(nodeId: string): string;
+/** Overflow store for inbox entries whose inline body exceeds the digest's
+ *  bounded preview (a direct `node msg`, a daemon trigger/deadline notice, a
+ *  close/cancel doctrine wake) — the full body spills here, mirroring how a
+ *  push's body always lives in a file, never inline; the inbox entry then
+ *  carries `ref` at this path, same as a push pointer. */
+export declare function messagesDir(nodeId: string): string;
 export declare function nodeMetaPath(nodeId: string): string;
 export declare function inboxPath(nodeId: string): string;
 /** Passive-subscription accumulator. Pushes from publishers this node subscribes

package/dist/core/canvas/paths.js

@@ -7,6 +7,7 @@
 //       context/                roadmap.md, initial-prompt.md, explore-*.md, artifacts
 //       job/                    log.jsonl, telemetry.json
 //       reports/                append-only push history (<ts>-<kind>.md)
+//       messages/               overflow bodies for inbox entries too long to inline
 //       inbox.jsonl             messages + coalesced subscription feed
 //       transcript.jsonl        mirror/pointer of the pi session
 //       session.ptr             pi session id/path
@@ -73,6 +74,14 @@ export function jobDir(nodeId) {
 export function reportsDir(nodeId) {
     return join(nodeDir(nodeId), 'reports');
 }
+/** Overflow store for inbox entries whose inline body exceeds the digest's
+ *  bounded preview (a direct `node msg`, a daemon trigger/deadline notice, a
+ *  close/cancel doctrine wake) — the full body spills here, mirroring how a
+ *  push's body always lives in a file, never inline; the inbox entry then
+ *  carries `ref` at this path, same as a push pointer. */
+export function messagesDir(nodeId) {
+    return join(nodeDir(nodeId), 'messages');
+}
 export function nodeMetaPath(nodeId) {
     return join(nodeDir(nodeId), 'meta.json');
 }

package/dist/core/canvas/status-glyph.js

@@ -44,6 +44,7 @@ export function hangingLabel(kind) {
         case 'connection': return 'down';
         case 'auth': return 'auth';
         case 'protocol': return 'protocol';
+        case 'wedged': return 'wedged';
         default: return 'other';
     }
 }

package/dist/core/fault-classifier.d.ts

@@ -1,5 +1,5 @@
-export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa';
-export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'other';
+export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa' | 'daemon→node';
+export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'other' | 'wedged';
 export type FaultRetryDisposition = 'auto' | 'manual' | 'fatal';
 export type FaultRetryOwner = 'sdk' | 'daemon' | 'client';
 export interface FaultRetry {

package/dist/core/feed/inbox.d.ts

@@ -1,11 +1,10 @@
 export type InboxTier = 'critical' | 'urgent' | 'normal' | 'deferred';
 export type InboxKind = 'update' | 'urgent' | 'final' | 'message' | 'completed';
-/** A single inbox entry — a pointer, not a copy of the content. */
+/** A single inbox entry: a push pointer (`ref` to a report, no inline body),
+ *  or a direct message/system notice (short bodies inline via `data.body`;
+ *  bodies too long to inline spill to `messages/` and carry both `ref` and a
+ *  bounded inline preview). */
 export interface InboxEntry {
-    /** Short stable handle for addressing this entry from the CLI (`feed message
-     *  <id>`). Set when the entry carries an inline body too long to fully inline
-     *  in the digest, so the receiver can read the full text back by id. */
-    id?: string;
     /** ISO 8601 timestamp of delivery. */
     ts: string;
     /** Node id of the sender, or null for system-generated entries. */
@@ -14,7 +13,9 @@ export interface InboxEntry {
     tier: InboxTier;
     /** Semantic kind of the push event. */
     kind: InboxKind;
-    /** Absolute path to the report file, when this entry is a push pointer. */
+    /** Absolute path to the sender-side report file (push pointer) or, for a
+     *  direct message/system notice too long to inline, the spilled body file
+     *  under `messages/`. */
     ref?: string;
     /** First ~80 chars of the body's first line — enough to decide if it matters. */
     label: string;
@@ -26,8 +27,6 @@ export interface InboxEntry {
  * Fills `ts` (current ISO time). Returns the completed entry.
  */
 export declare function appendInbox(nodeId: string, entry: Omit<InboxEntry, 'ts'>): InboxEntry;
-/** Find one inbox entry by its short `id` handle (see `feed message <id>`). */
-export declare function readInboxEntryById(nodeId: string, id: string): InboxEntry | undefined;
 /**
  * Return all inbox entries strictly after `cursorIso`.
  * When `cursorIso` is undefined, returns every entry in the file.
@@ -42,10 +41,6 @@ export declare function readCursor(nodeId: string): string | undefined;
  * Persist a new cursor ISO for a node's inbox (atomic tmp+rename).
  */
 export declare function writeCursor(nodeId: string, iso: string): void;
-/** True when an entry's inline body is long enough that the digest will clip it
- *  — the trigger for minting an addressable `id` so the full text stays
- *  recoverable via `feed message <id>`. */
-export declare function bodyExceedsPreview(e: Pick<InboxEntry, 'data' | 'label'>): boolean;
 /** Clip a body to a bounded preview, reporting whether anything was dropped. */
 export declare function clipBody(body: string): {
     text: string;

package/dist/core/feed/inbox.js

@@ -1,16 +1,18 @@
 // Per-node inbox.jsonl primitive for the pi-native canvas runtime.
 //
-// An inbox entry is a lightweight POINTER (~30 tokens), never content.
-// The report body lives in nodes/<id>/reports/; the inbox line carries only
-// enough to find it and decide whether to dereference.
+// An inbox entry is a lightweight pointer for a push (~30 tokens, body lives
+// in nodes/<id>/reports/) or carries a direct message inline. A direct
+// message short enough to inline stays entirely in the jsonl line; one that
+// would clip spills its full body to nodes/<id>/messages/ and the entry
+// carries `ref` to it alongside a bounded inline preview.
 //
 // Layout:
 //   nodes/<id>/inbox.jsonl          — one JSON line per entry, append-only
 //   nodes/<id>/inbox.jsonl.cursor   — ISO 8601 of last-read entry (sidecar)
 import { appendFileSync, existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, } from 'node:fs';
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { inboxPath } from '../canvas/index.js';
+import { inboxPath, messagesDir } from '../canvas/index.js';
 // ---------------------------------------------------------------------------
 // Cursor sidecar path
 // ---------------------------------------------------------------------------
@@ -20,16 +22,42 @@ function cursorPath(nodeId) {
 // ---------------------------------------------------------------------------
 // Append
 // ---------------------------------------------------------------------------
+/** Spill an oversized inline body to a durable file — the SAME atomic
+ *  tmp+rename pattern a push report uses — and return its absolute path.
+ *  Called only when the body would clip in the digest; short bodies never
+ *  touch disk beyond the jsonl line itself. */
+function writeMessageBody(nodeId, ts, body) {
+    const dir = messagesDir(nodeId);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const stamp = ts.replace(/[^0-9]/g, '');
+    const finalPath = join(dir, `${stamp}-${randomUUID().slice(0, 6)}.md`);
+    const tmpPath = `${finalPath}.tmp`;
+    writeFileSync(tmpPath, body, 'utf8');
+    renameSync(tmpPath, finalPath);
+    return finalPath;
+}
 /**
  * Atomically append one inbox entry to `nodes/<nodeId>/inbox.jsonl`.
  * Fills `ts` (current ISO time). Returns the completed entry.
  */
 export function appendInbox(nodeId, entry) {
     const full = { ts: new Date().toISOString(), ...entry };
-    // A message that carries an inline body the digest will clip needs a stable
-    // handle so the receiver can read the full text back (`feed message <id>`).
-    if (full.id === undefined && bodyExceedsPreview(full))
-        full.id = randomUUID().slice(0, 8);
+    // A push pointer already carries `ref` (the report file) — its body lives
+    // there, never inline. A direct message / system notice has no ref yet: when
+    // its inline body would clip in the digest, spill the FULL text to a durable
+    // file (same atomic tmp+rename as a report) and point `ref` at it, exactly
+    // like a push, then keep only the bounded preview inline. A short body is
+    // left fully inline, untouched — uniform with how a push's body always
+    // lives in a file, never inline, dereferenced by reading `ref`.
+    if (full.ref === undefined) {
+        const body = inlineBody(full);
+        const { text, clipped } = clipBody(body);
+        if (clipped) {
+            full.ref = writeMessageBody(nodeId, full.ts, body);
+            full.data = { ...full.data, body: text };
+        }
+    }
     const line = JSON.stringify(full) + '\n';
     // Ensure the parent directory exists (inbox.jsonl lives directly under the
     // node dir, which ensureNodeDirs creates — but guard anyway for callers that
@@ -46,10 +74,6 @@ export function appendInbox(nodeId, entry) {
 // ---------------------------------------------------------------------------
 // Read
 // ---------------------------------------------------------------------------
-/** Find one inbox entry by its short `id` handle (see `feed message <id>`). */
-export function readInboxEntryById(nodeId, id) {
-    return readInboxSince(nodeId, undefined).find((e) => e.id === id);
-}
 /**
  * Return all inbox entries strictly after `cursorIso`.
  * When `cursorIso` is undefined, returns every entry in the file.
@@ -108,13 +132,6 @@ function inlineBody(e) {
     const body = typeof e.data?.['body'] === 'string' ? e.data['body'].trim() : '';
     return body === '' || body === e.label ? '' : body;
 }
-/** True when an entry's inline body is long enough that the digest will clip it
- *  — the trigger for minting an addressable `id` so the full text stays
- *  recoverable via `feed message <id>`. */
-export function bodyExceedsPreview(e) {
-    const body = inlineBody(e);
-    return body !== '' && clipBody(body).clipped;
-}
 /** Clip a body to a bounded preview, reporting whether anything was dropped. */
 export function clipBody(body) {
     let text = body;
@@ -135,10 +152,11 @@ export function clipBody(body) {
  *
  * A push pointer (has a `ref`) stays a pointer — the body lives in the report
  * file, dereferenced on demand by reading that path. A direct `node msg` or
- * system alert has NO report to dereference; its full body lives in the
- * inbox.jsonl entry itself (`data.body`), so we inline a bounded preview. When
- * that preview clips, the entry carries a short `id` and we point at the CLI
- * command that reads the full body back from the jsonl (`feed message <id>`).
+ * system alert without a `ref` inlines its full body (already bounded — a
+ * clipping body is spilled to a file and `ref`'d at append time, see
+ * appendInbox). When an entry DOES carry both an inline preview and a `ref`
+ * (the clipped case), the tail points at the ref path, same shape as a push —
+ * read the file for the rest, no special dereference verb.
  */
 function renderEntry(e) {
     const body = inlineBody(e);
@@ -149,11 +167,9 @@ function renderEntry(e) {
     }
     const { text, clipped } = clipBody(body);
     const indented = text.split('\n').map((l) => `    ${l}`).join('\n');
-    const more = clipped
-        ? (e.id !== undefined
-            ? `\n    … (clipped — full message: \`crtr feed message ${e.id}\`)`
-            : '\n    … (body clipped)')
-        : '';
+    const more = e.ref !== undefined
+        ? `\n    … (full body: ${e.ref})`
+        : clipped ? '\n    … (body clipped)' : '';
     return `  [${e.kind}]\n${indented}${more}`;
 }
 /**

package/dist/core/hearth/providers/blaxel-bootstrap.js

@@ -129,7 +129,7 @@ export function buildBootstrapScript(opts) {
     }
     appendOauthAdapterCachePrime(lines, opts.guestHome);
     // Tmpfs sock/pidfile dirs are already mkdir'd above, before this line.
-    lines.push(`${shellQuote(BAKED_CRTR_PATH)} canvas daemon start </dev/null >>"$HOME/.crtr-runtime/daemon.log" 2>&1`);
+    lines.push(`${shellQuote(BAKED_CRTR_PATH)} sys daemon start </dev/null >>"$HOME/.crtr-runtime/daemon.log" 2>&1`);
     if (opts.isFirstProvision) {
         lines.push('home_node_output="$(', `${shellQuote(BAKED_CRTR_PATH)} --json node new --root --kind general --name home <<'SEED'`, 'Hearth home seed for the Blaxel home backend.', 'SEED', ')"', "home_node_id=\"$(node -e 'const o = JSON.parse(process.argv[1]); process.stdout.write(String(o.node_id ?? o.nodeId ?? o.id ?? \"\"));' \"$home_node_output\")\"", 'if [ -z "$home_node_id" ]; then', '  printf "failed to parse home node id from crtr node new output\n%s\n" "$home_node_output" >&2', '  exit 1', 'fi', 'printf "__HEARTH_NODE_ID__=%s\n" "$home_node_id"', 
         // The provisioner polls this file (background exec stdout is not captured).