@crouton-kit/crouter 0.3.36 → 0.3.38

package/dist/commands/sys.js

@@ -2,6 +2,7 @@
 // Replaces old config.ts + doctor.ts + update.ts command files.
 import { defineBranch } from '../core/command.js';
 import { configBranch } from './sys/config.js';
+import { daemonBranch } from './sys/daemon.js';
 import { sysDoctorLeaf } from './sys/doctor.js';
 import { sysFeedbackLeaf } from './sys/feedback.js';
 import { sysSettingsLeaf } from './sys/settings.js';
@@ -16,13 +17,13 @@ export function registerSys() {
         name: 'sys',
         rootEntry: {
             concept: 'crtr configuration, diagnostics, and self-management',
-            desc: 'config, settings, setup, doctor, sysprompt, prompt-review, promptstudio, sync, update, version, feedback',
-            useWhen: 'managing the crtr installation or opening built-in system views',
+            desc: 'config, settings, setup, doctor, sysprompt, prompt-review, promptstudio, sync, update, version, feedback, daemon',
+            useWhen: 'managing the crtr installation, the crtrd supervisor process, or opening built-in system views',
         },
         help: {
             name: 'sys',
             summary: 'crtr system configuration, settings, diagnostics, and self-management',
         },
-        children: [configBranch, sysSettingsLeaf, sysSetupLeaf, sysDoctorLeaf, sysSyspromptLeaf, promptReviewLeaf, sysPromptStudioLeaf, sysFeedbackLeaf, sysUpdateLeaf, sysVersionLeaf, sysSyncLeaf],
+        children: [configBranch, sysSettingsLeaf, sysSetupLeaf, sysDoctorLeaf, sysSyspromptLeaf, promptReviewLeaf, sysPromptStudioLeaf, sysFeedbackLeaf, sysUpdateLeaf, sysVersionLeaf, sysSyncLeaf, daemonBranch],
     });
 }

package/dist/core/__tests__/daemon-boot.test.js

@@ -262,7 +262,7 @@ test('the daemon honours an explicit CRTR_PIDFILE override', () => {
 // REGRESSION (bug #102 follow-up): with NO exit promise, the readiness loop must
 // still observe a real `connect`. A buggy `?? Promise.resolve('retry')` race lost
 // to the probe instantly, so live-broker callers (focus on an already-alive node,
-// canvas-tmux-spread) could never return true and stalled the full 30s deadline.
+// surface tmux-spread) could never return true and stalled the full 30s deadline.
 test('waitForBrokerViewSocket returns true on a live socket when given no exit promise', async () => {
     // CRTR_SOCK_DIR override keeps the AF_UNIX path short — the temp CRTR_HOME path
     // would blow past macOS's 104-byte sun_path limit (listen EINVAL).

package/dist/core/__tests__/daemon-wedge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/daemon-wedge.test.js

@@ -0,0 +1,87 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/daemon-wedge.test.ts
+//
+// Issue #110 — pid-alive WEDGED node detection. The pure decision core:
+// wedgeVerdict(busy, quietForMs, cpuPercent). No wall-clock sleeps, no ps
+// shell-outs, no fake pids — every input is injected directly, mirroring the
+// existing livenessVerdict/yieldStallVerdict suites in daemon-liveness.test.ts.
+//
+// LOCKS: (1) a routine long-running BUT ACTIVE turn (heartbeat recent, or CPU
+// non-trivial) must never verdict 'wedged' — false positives are the failure
+// mode this feature exists to avoid. (2) only busy+quiet+near-zero-CPU, all at
+// once, past the generous grace, fires. (3) a null/failed CPU sample never
+// fires on its own (fails toward 'pending', not 'wedged').
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { wedgeVerdict, WEDGE_QUIET_MS, WEDGE_CPU_MAX_PERCENT, sumTreeCpu } from '../../daemon/crtrd.js';
+test('wedgeVerdict: a node whose turn already ended is never wedged, regardless of the other signals', () => {
+    assert.equal(wedgeVerdict({ busy: false, quietForMs: null, cpuPercent: null }), 'leave');
+    assert.equal(wedgeVerdict({ busy: false, quietForMs: 10 * 60 * 60_000, cpuPercent: 0 }), 'leave');
+});
+test('wedgeVerdict: a busy node with an unreadable heartbeat is left alone (not enough evidence)', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: null, cpuPercent: null }), 'leave');
+});
+test('wedgeVerdict: routine turns — even long ones — never trip before the grace elapses', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: 0, cpuPercent: 0 }), 'leave', 'just started');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: 5 * 60_000, cpuPercent: 0 }), 'leave', 'a routine multi-minute tool call');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS - 1, cpuPercent: 0 }), 'leave', 'just under the grace, even with 0% cpu');
+});
+test('wedgeVerdict: past the grace with NO cpu corroboration only pends — never fires on time alone', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: null }), 'pending', 'cpu sample failed/unavailable — never treated as confirmation');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 10, cpuPercent: null }), 'pending', 'no amount of extra quiet time substitutes for the corroborating signal');
+});
+test('wedgeVerdict: a long-quiet turn that is STILL VISIBLY WORKING (real cpu) is exonerated, not wedged', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: WEDGE_CPU_MAX_PERCENT + 0.1 }), 'pending', 'cpu just above the ceiling — a genuinely churning long build — must not fire');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS * 3, cpuPercent: 40 }), 'pending', 'clearly-active cpu never fires regardless of how quiet the heartbeat looks');
+});
+test('wedgeVerdict: fires ONLY when busy + quiet-past-grace + near-zero cpu all corroborate', () => {
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS, cpuPercent: 0 }), 'wedged');
+    assert.equal(wedgeVerdict({ busy: true, quietForMs: WEDGE_QUIET_MS + 60_000, cpuPercent: WEDGE_CPU_MAX_PERCENT }), 'wedged', 'at the cpu ceiling (inclusive)');
+});
+// ---------------------------------------------------------------------------
+// sumTreeCpu (pure) — process-tree CPU sampling. Review fix for issue #110:
+// sampling only the broker pid false-fired on a broker awaiting a busy CHILD
+// subprocess. These lock the tree-sum behavior directly, independent of any
+// `ps` shell-out.
+// ---------------------------------------------------------------------------
+test('sumTreeCpu: a busy CHILD subprocess exonerates an idle broker (the false-positive this fixes)', () => {
+    const ps = [
+        '  100     1  0.0', // broker, idle
+        '  200   100 85.0', // child of the broker, busy
+    ].join('\n');
+    assert.equal(sumTreeCpu(ps, 100), 85.0);
+});
+test('sumTreeCpu: broker + all descendants idle sums to ~0 (the real wedge is still detected)', () => {
+    const ps = [
+        '  100     1  0.0',
+        '  200   100  0.0',
+        '  201   100  0.0',
+    ].join('\n');
+    assert.equal(sumTreeCpu(ps, 100), 0);
+});
+test('sumTreeCpu: sums across multiple generations (grandchild busy)', () => {
+    const ps = [
+        '  100     1  0.0', // broker
+        '  200   100  0.0', // child, idle
+        '  300   200 40.0', // grandchild, busy
+    ].join('\n');
+    assert.equal(sumTreeCpu(ps, 100), 40.0);
+});
+test('sumTreeCpu: root pid absent from the ps output returns null (can\'t measure)', () => {
+    const ps = [
+        '  200     1  0.0',
+        '  300   200 10.0',
+    ].join('\n');
+    assert.equal(sumTreeCpu(ps, 100), null);
+});
+test('sumTreeCpu: malformed/blank lines are skipped; empty output returns null', () => {
+    const ps = [
+        '',
+        '   ',
+        'garbage line not ps shaped',
+        '  100     1  5.0',
+        '  bad   100  1.0',
+    ].join('\n');
+    assert.equal(sumTreeCpu(ps, 100), 5.0);
+    assert.equal(sumTreeCpu('', 100), null);
+    assert.equal(sumTreeCpu('   \n  \n', 100), null);
+});

package/dist/core/__tests__/hearth-bootstrap.test.js

@@ -91,7 +91,7 @@ test('every crtr invocation targets the baked binary by absolute path, never a b
         assert.match(script, /'\/usr\/local\/bin\/crtr' --json sys version/);
         assert.match(script, /'\/usr\/local\/bin\/crtr' surface web -h/);
         assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve -h/);
-        assert.match(script, /'\/usr\/local\/bin\/crtr' canvas daemon start/);
+        assert.match(script, /'\/usr\/local\/bin\/crtr' sys daemon start/);
         assert.match(script, /'\/usr\/local\/bin\/crtr' surface web serve --host 0\.0\.0\.0/);
         // No bare `crtr <subcommand>` invocation anywhere — only the `command -v
         // crtr` shadow-detection probe and human-readable error-message text are
@@ -123,7 +123,7 @@ test('mkdirs the tmpfs CRTR_SOCK_DIR/CRTR_PIDFILE dirs strictly before the daemo
     assert.doesNotMatch(script, /CRTR_CANVAS_DB=/);
     assert.match(script, /unset CRTR_CANVAS_DB/);
     const mkdirIdx = indexOf(script, '/run/crtr/socks');
-    const daemonStartIdx = indexOf(script, "'/usr/local/bin/crtr' canvas daemon start");
+    const daemonStartIdx = indexOf(script, "'/usr/local/bin/crtr' sys daemon start");
     assert.ok(mkdirIdx < daemonStartIdx, 'tmpfs mkdir must precede daemon start');
     const mkdirLine = script.split('\n').find((line) => line.startsWith('mkdir -p') && line.includes('/run/crtr/socks'));
     assert.ok(mkdirLine, 'expected a single mkdir line covering the tmpfs dirs');

package/dist/core/__tests__/history-inbox.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/history-inbox.test.js

@@ -0,0 +1,105 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/history-inbox.test.ts
+//
+// Locks in the invariants of the `inbox` history source: it stays opt-in
+// (never part of the default corpus), its refs resolve/round-trip as
+// `<node>:inbox/NNNNNN`, direct-message bodies stay full/unclipped, and the
+// sender (`from`) is visible in both the read body and the artifact title.
+import { test, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createNode } from '../canvas/canvas.js';
+import { closeDb } from '../canvas/db.js';
+import { appendInbox } from '../feed/inbox.js';
+import { buildCorpus, resolveRef } from '../canvas/history.js';
+let home;
+function node(id, cwd) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    };
+}
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-history-inbox-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('default history excludes inbox; --type inbox includes it, with full sender-attributed bodies', () => {
+    const cwd = '/tmp/hist-work';
+    createNode(node('sender-1', cwd));
+    const receiver = createNode(node('receiver-1', cwd));
+    const longBody = 'a'.repeat(4000); // well past any old label-clip length
+    appendInbox(receiver.node_id, {
+        from: 'sender-1',
+        tier: 'urgent',
+        kind: 'message',
+        label: 'first line of a long message',
+        data: { body: longBody },
+    });
+    // (a) default corpus (no explicit types) excludes inbox entirely.
+    const defaultCorpus = buildCorpus({ nodes: [receiver.node_id] }, {});
+    assert.equal(defaultCorpus.some((a) => a.source === 'inbox'), false, 'inbox is opt-in, not part of the default corpus');
+    // (b) explicit --type inbox includes it.
+    const inboxCorpus = buildCorpus({ nodes: [receiver.node_id] }, { types: ['inbox'] });
+    assert.equal(inboxCorpus.length, 1, 'exactly the one appended entry');
+    const artifact = inboxCorpus[0];
+    assert.equal(artifact.source, 'inbox');
+    // (c) ref resolves as <node>:inbox/000000 and round-trips through resolveRef.
+    const expectedRef = `${receiver.node_id}:inbox/000000`;
+    assert.equal(artifact.ref, expectedRef);
+    const resolved = resolveRef(expectedRef);
+    assert.ok(resolved !== null, 'ref resolves back to the entry');
+    assert.equal(resolved.source, 'inbox');
+    // (d) the direct-message body is full/unclipped in both the corpus artifact
+    // and the resolveRef read path.
+    assert.ok(artifact.loadBody().includes(longBody), 'corpus artifact body is unclipped');
+    assert.ok(resolved.body.includes(longBody), 'resolveRef body is unclipped');
+    // (e) the sender is visible — in the read body (not just resolvable via the
+    // node the inbox belongs to) and in the artifact title used by list rows.
+    assert.ok(resolved.body.includes('from: sender-1'), 'read body names the sender');
+    assert.ok(artifact.title.includes('sender-1'), 'artifact title names the sender for list/search rows');
+});
+test('a spilled message body is read RAW — a leading frontmatter-shaped block is not stripped', () => {
+    const cwd = '/tmp/hist-work-3';
+    createNode(node('sender-3', cwd));
+    const receiver = createNode(node('receiver-3', cwd));
+    // Long enough to force the spill-to-messages/ path (past BODY_MAX_CHARS),
+    // and starts with a block that LOOKS like crouter report frontmatter but
+    // isn't one — a spilled message has no frontmatter contract, so this must
+    // survive intact, unlike a report ref (which always has real frontmatter
+    // stripped by fileBodyLoader).
+    const body = '---\nfoo: bar\n---\n' + 'a'.repeat(4000);
+    appendInbox(receiver.node_id, {
+        from: 'sender-3',
+        tier: 'normal',
+        kind: 'message',
+        label: 'first line',
+        data: { body },
+    });
+    const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
+    assert.ok(resolved !== null);
+    assert.ok(resolved.body.includes('---\nfoo: bar\n---'), 'leading frontmatter-shaped block is preserved, not stripped');
+});
+test('a null-from (system) inbox entry reads as "system", not blank or thrown', () => {
+    const cwd = '/tmp/hist-work-2';
+    const receiver = createNode(node('receiver-2', cwd));
+    appendInbox(receiver.node_id, { from: null, tier: 'normal', kind: 'update', label: 'system note' });
+    const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
+    assert.ok(resolved !== null);
+    assert.ok(resolved.body.includes('from: system'), 'null sender renders as "system"');
+});

package/dist/core/__tests__/kickoff.test.js

@@ -58,7 +58,7 @@ test('drainBearings consumes the yield note + advances the cursor exactly once',
     assert.equal(b2.yieldMsg, null);
     assert.equal(b2.unreadDigest, null);
 });
-test('the feed block frames awaiting workers as alive + auto-waking, so a fresh revive has no reason to peek', () => {
+test('the feed block frames awaiting workers as alive + auto-waking, so a fresh revive has no reason to poll', () => {
     const parent = createNode(node('p1'));
     const child = createNode(node('c1')); // status 'active' by default
     subscribe(parent.node_id, child.node_id); // parent awaits child
@@ -66,7 +66,7 @@ test('the feed block frames awaiting workers as alive + auto-waking, so a fresh
     // The roster names the live child...
     assert.ok(msg.includes(child.node_id), 'awaiting roster lists the live child');
     // ...and asserts aliveness + the automatic wake at the source, so the node
-    // does not burn a turn confirming with `feed read`/`feed peek`.
+    // has nothing to check, poll, or verify separately.
     assert.ok(/alive and running/.test(msg), 'states the worker is alive and running');
     assert.ok(/wake you the moment/.test(msg), 'states the wake is automatic on push');
     assert.ok(/still working, not stalled/.test(msg), 'frames the empty feed as expected, not a problem');
@@ -101,7 +101,7 @@ test('a fresh revive is pointed at its subscriptions\' on-disk report history (c
     assert.ok(!msg.includes(newer), 'absolute report paths not rendered');
     assert.ok(/canvas history read <ref>/.test(msg), 'points at one-report expansion');
     assert.ok(/canvas history show <node-id> --type report/.test(msg), 'points at full per-node expansion');
-    assert.ok(/feed read --all/.test(msg), 'points at the cursor-independent full-history replay');
+    assert.ok(/canvas history show <node-id> --type inbox/.test(msg), 'points at the cursor-independent full-history replay');
 });
 test('buildReviveKickoff is pure — building twice eats nothing', () => {
     const id = 'n2';

package/dist/core/__tests__/revive.test.js

@@ -34,7 +34,8 @@ import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { createNode } from '../canvas/canvas.js';
+import { createNode, subscribe } from '../canvas/canvas.js';
+import { readInboxSince } from '../feed/inbox.js';
 import { closeDb } from '../canvas/db.js';
 import { buildPiArgv } from '../runtime/launch.js';
 import { headlessBrokerHost } from '../runtime/host.js';
@@ -298,3 +299,40 @@ test('reviveNode crashes and clears pid when launch/preflight throws', async ()
         await h.dispose();
     }
 });
+// ---------------------------------------------------------------------------
+// Crash-to-dead doctrine wake — a launch-refusal marks the node dead; a
+// manager waiting dormant on it must be told, or it hangs forever (the
+// daemon no longer supervises a dead node). Mirrors closeNode's step-4 fan-out.
+// ---------------------------------------------------------------------------
+test('reviveNode fans a doctrine wake to subscribers when launch/preflight throws (crash-to-dead)', async () => {
+    const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-crashwake' });
+    const originalLaunch = headlessBrokerHost.launch;
+    try {
+        const root = h.spawnRoot('crash-wake suite root');
+        const sessionFile = join(home, 'sessions', 'crtr-revive-crashwake.jsonl');
+        mkdirSync(join(home, 'sessions'), { recursive: true });
+        writeFileSync(sessionFile, '{}\n', 'utf8');
+        const M = h.fabricateBrokerNode({
+            parent: root,
+            status: 'active',
+            intent: null,
+            pi_pid: deadPid(),
+            pi_session_id: 'uuid-3',
+            pi_session_file: sessionFile,
+        });
+        // spawnChild-equivalent auto-subscription — done explicitly since this node
+        // was fabricated directly, not spawned through the CLI.
+        subscribe(root, M, true);
+        headlessBrokerHost.launch = (_nodeId, _inv, _opts) => { throw new Error('boom'); };
+        assert.throws(() => reviveNode(M, { resume: true }), /refusing to revive/i);
+        assert.equal(h.node(M).status, 'dead', 'failed revive marks the node dead');
+        const entries = readInboxSince(root, undefined);
+        const notice = entries.find((e) => e.data?.['reason'] === 'child-crashed' && e.data?.['child'] === M);
+        assert.ok(notice !== undefined, 'the surviving parent got a doctrine wake for the dead child');
+        assert.equal(notice.from, M, 'the notice is attributed to the crashed child');
+    }
+    finally {
+        headlessBrokerHost.launch = originalLaunch;
+        await h.dispose();
+    }
+});

package/dist/core/canvas/canvas.js

@@ -21,7 +21,7 @@ import { ensureHome, ensureNodeDirs, nodeMetaPath, nodeDir, nodesRoot, jobDir, }
 /** The identity keys meta.json persists. Listed explicitly so no runtime field
  *  can ever leak onto disk even when a fully-hydrated NodeMeta is handed in. */
 const IDENTITY_KEYS = [
-    'node_id', 'name', 'description', 'cycles', 'created', 'cwd', 'host_kind', 'kind', 'mode',
+    'node_id', 'name', 'description', 'cycles', 'created', 'cwd', 'host_kind', 'profile_id', 'kind', 'mode',
     'lifecycle', 'persona_ack', 'parent', 'spawned_by', 'fork_from', 'passive_default',
     'pi_session_id', 'pi_session_file', 'model_override', 'launch',
 ];
@@ -101,13 +101,13 @@ function writeMeta(meta) {
  *  state. A fresh insert takes the schema defaults for runtime. */
 function upsertRow(meta) {
     openDb()
-        .prepare(`INSERT INTO nodes (node_id, name, kind, mode, lifecycle, cwd, host_kind, parent, created)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        .prepare(`INSERT INTO nodes (node_id, name, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, created)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(node_id) DO UPDATE SET
          name=excluded.name, kind=excluded.kind, mode=excluded.mode,
          lifecycle=excluded.lifecycle, cwd=excluded.cwd, host_kind=excluded.host_kind,
-         parent=excluded.parent`)
-        .run(meta.node_id, meta.name, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.parent ?? null, meta.created);
+         profile_id=excluded.profile_id, parent=excluded.parent`)
+        .run(meta.node_id, meta.name, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.profile_id ?? null, meta.parent ?? null, meta.created);
 }
 /** Seed a node's row at BIRTH: identity columns + runtime columns taken from the
  *  incoming meta (defaults: status='active', the rest null). The only writer
@@ -116,17 +116,17 @@ function upsertRow(meta) {
 function seedRow(meta) {
     openDb()
         .prepare(`INSERT INTO nodes
-         (node_id, name, kind, mode, lifecycle, cwd, host_kind, parent, created,
+         (node_id, name, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, created,
           status, intent, pi_pid, "window", tmux_session, pane)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(node_id) DO UPDATE SET
          name=excluded.name, kind=excluded.kind, mode=excluded.mode,
          lifecycle=excluded.lifecycle, cwd=excluded.cwd, host_kind=excluded.host_kind,
-         parent=excluded.parent,
+         profile_id=excluded.profile_id, parent=excluded.parent,
          status=excluded.status, intent=excluded.intent, pi_pid=excluded.pi_pid,
          "window"=excluded."window", tmux_session=excluded.tmux_session,
          pane=excluded.pane`)
-        .run(meta.node_id, meta.name, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.parent ?? null, meta.created, meta.status ?? 'active', meta.intent ?? null, meta.pi_pid ?? null, meta.window ?? null, meta.tmux_session ?? null, meta.pane ?? null);
+        .run(meta.node_id, meta.name, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.profile_id ?? null, meta.parent ?? null, meta.created, meta.status ?? 'active', meta.intent ?? null, meta.pi_pid ?? null, meta.window ?? null, meta.tmux_session ?? null, meta.pane ?? null);
 }
 function rowFrom(r) {
     return {
@@ -138,6 +138,7 @@ function rowFrom(r) {
         status: r['status'],
         cwd: r['cwd'],
         host_kind: r['host_kind'] ?? null,
+        profile_id: r['profile_id'] ?? null,
         parent: r['parent'] ?? null,
         created: r['created'],
         intent: r['intent'] ?? null,

package/dist/core/canvas/db.js

@@ -349,6 +349,16 @@ CREATE TABLE IF NOT EXISTS canvas_meta (
 );
 `);
 }
+/** v11 — additive identity column `profile_id`: the profile-directory id
+ *  (`<slug>-<id>`) a node runs under, chosen once at spawn (inherited from the
+ *  spawner, or `--profile`). Durable IDENTITY mirrored from meta.json like
+ *  `cwd`/`host_kind` (NOT runtime like `pane`), so it survives an index rebuild
+ *  via the `IDENTITY_KEYS`/`upsertRow` path. Defaults NULL (root/no-profile);
+ *  no data backfill. Additive, forward-only. */
+function addProfileIdColumn(db) {
+    const columns = nodeColumns(db);
+    addNodeColumnIfMissing(db, columns, 'profile_id', `ALTER TABLE nodes ADD COLUMN profile_id TEXT;`);
+}
 /** The ordered migration list. Index `i` is migration version `i + 1`; the db's
  *  `user_version` tracks how many have been applied. Append only. */
 export const MIGRATIONS = [
@@ -362,6 +372,7 @@ export const MIGRATIONS = [
     /* v8 */ addHostKindColumn,
     /* v9 */ migrateWakeupsToTriggers,
     /* v10 */ addCanvasMetaTable,
+    /* v11 */ addProfileIdColumn,
 ];
 /** Bring `db` up to the latest schema version. Reads `user_version`, runs each
  *  pending migration in order, and bumps `user_version` after each so the work

package/dist/core/canvas/history.d.ts

@@ -1,5 +1,5 @@
 import type { NodeStatus } from './types.js';
-export type HistorySource = 'report' | 'doc' | 'roadmap' | 'meta';
+export type HistorySource = 'report' | 'doc' | 'roadmap' | 'meta' | 'inbox';
 /** One searchable unit of the episodic record: a report, a context doc, a
  *  node's roadmap, or a node's meta (name/description/kind). */
 export interface HistoryArtifact {

package/dist/core/canvas/history.js

@@ -12,7 +12,7 @@
 import { statSync, readdirSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { getNode, listNodes, view } from './canvas.js';
-import { contextDir, reportsDir, nodeDir } from './paths.js';
+import { contextDir, reportsDir, nodeDir, inboxPath } from './paths.js';
 import { readTextIfExists, walkFiles, pathExists } from '../fs-utils.js';
 import { parseFrontmatterGeneric } from '../frontmatter.js';
 /** The cwd the caller means by default: the calling node's cwd (resolved from
@@ -126,6 +126,68 @@ function docArtifact(row, desc, abs) {
         loadBody: load,
     };
 }
+/** Every entry ever appended to a node's inbox.jsonl, oldest first, cursor-
+ *  independent (the cursor only gates the live wake path, not this read).
+ *  Empty when the node has no inbox file yet. */
+function allInboxEntries(nodeId) {
+    const raw = readTextIfExists(inboxPath(nodeId));
+    if (raw === null)
+        return [];
+    return raw
+        .split('\n')
+        .filter((l) => l.trim() !== '')
+        .map((l) => JSON.parse(l));
+}
+/** One inbox entry's full content: a direct message or system alert's
+ *  un-clipped body — dereferenced from its spilled ref file when the inline
+ *  preview clipped, else the inline body itself — or, for a push pointer
+ *  (which carries no body of its own), its kind/label plus the sender-side
+ *  report path it points to.
+ *
+ *  A spilled ref (message/system notice too long to inline) is arbitrary
+ *  text with no crouter frontmatter contract — read it RAW, unlike a report
+ *  ref, which always carries the `---\n...\n---` header stripped by
+ *  fileBodyLoader. The presence of an inline `data.body` preview is what
+ *  distinguishes the two: only a spilled message/notice ever carries one
+ *  (a push pointer's entry has no `data` field at all). */
+function inboxEntryBody(e) {
+    const meta = [`from: ${e.from ?? 'system'}`, `tier: ${e.tier}`].join('\n');
+    const header = `[${e.kind}] ${e.label}`;
+    const inlinePreview = typeof e.data?.['body'] === 'string' ? e.data['body'].trim() : '';
+    const isSpilledMessage = typeof e.data?.['body'] === 'string';
+    const full = e.ref !== undefined
+        ? isSpilledMessage
+            ? (readTextIfExists(e.ref) ?? '')
+            : fileBodyLoader(e.ref).load()
+        : inlinePreview;
+    const hasBody = full !== '' && full !== e.label;
+    const parts = [meta, header];
+    if (e.ref !== undefined)
+        parts.push(`ref: ${e.ref}`);
+    if (hasBody)
+        parts.push(full);
+    return parts.join('\n\n');
+}
+function inboxArtifact(row, desc, entry, index) {
+    const relpath = `inbox/${String(index).padStart(6, '0')}`;
+    const body = inboxEntryBody(entry);
+    return {
+        ref: `${row.node_id}:${relpath}`,
+        nodeId: row.node_id,
+        relpath,
+        source: 'inbox',
+        ts: entry.ts,
+        tsMs: toMs(entry.ts),
+        title: `[${entry.kind}] from ${entry.from ?? 'system'}: ${entry.label}`,
+        nodeName: row.name,
+        nodeKind: row.kind,
+        nodeStatus: row.status,
+        nodeCwd: row.cwd,
+        nodeDesc: desc,
+        path: null,
+        loadBody: () => body,
+    };
+}
 function metaArtifact(row, desc) {
     const body = `${row.name}\n${desc}\n${row.kind}`;
     return {
@@ -189,7 +251,9 @@ export function buildCorpus(scope, corpus) {
             return false;
         return true;
     });
-    // --report-kind implies type=report.
+    // --report-kind implies type=report. `inbox` is opt-in only — never part of
+    // the default set — since a node's raw inbox history is unbounded diagnostic
+    // detail, not curated past work.
     const wantReportKind = corpus.reportKind;
     const types = corpus.types !== undefined && corpus.types.length > 0
         ? corpus.types
@@ -199,7 +263,7 @@ export function buildCorpus(scope, corpus) {
     const want = new Set(types);
     const out = [];
     for (const row of survivors) {
-        const desc = want.has('meta') || want.has('report') || want.has('doc') || want.has('roadmap')
+        const desc = want.has('meta') || want.has('report') || want.has('doc') || want.has('roadmap') || want.has('inbox')
             ? nodeDescOf(row.node_id)
             : '';
         if (want.has('meta'))
@@ -224,6 +288,9 @@ export function buildCorpus(scope, corpus) {
                 out.push(a);
             }
         }
+        if (want.has('inbox')) {
+            allInboxEntries(row.node_id).forEach((entry, i) => out.push(inboxArtifact(row, desc, entry, i)));
+        }
     }
     // Time window on artifact ts.
     return out.filter((a) => {
@@ -274,6 +341,22 @@ export function resolveRef(ref) {
             path: null,
         };
     }
+    if (relpath.startsWith('inbox/')) {
+        const index = Number(relpath.slice('inbox/'.length));
+        const entry = allInboxEntries(nodeId)[index];
+        if (entry === undefined)
+            return null;
+        return {
+            nodeId,
+            relpath,
+            source: 'inbox',
+            ts: entry.ts,
+            nodeName: node.name,
+            body: inboxEntryBody(entry),
+            raw: null,
+            path: null,
+        };
+    }
     if (relpath.includes('..') || relpath.startsWith('/')) {
         throw new Error(`illegal relpath in ref: ${relpath}`);
     }
@@ -321,6 +404,7 @@ export function nodeArtifacts(nodeId, types) {
         status: node.status,
         cwd: node.cwd,
         host_kind: node.host_kind ?? null,
+        profile_id: node.profile_id ?? null,
         parent: node.parent ?? null,
         created: node.created,
         intent: node.intent ?? null,
@@ -329,6 +413,7 @@ export function nodeArtifacts(nodeId, types) {
         tmux_session: node.tmux_session ?? null,
         pane: node.pane ?? null,
     };
+    // `inbox` is opt-in only, same as buildCorpus — must be requested explicitly.
     const want = new Set(types !== undefined && types.length > 0 ? types : ['report', 'doc', 'roadmap']);
     const desc = node.description ?? '';
     const out = [];
@@ -349,6 +434,9 @@ export function nodeArtifacts(nodeId, types) {
             out.push(a);
         }
     }
+    if (want.has('inbox')) {
+        allInboxEntries(nodeId).forEach((entry, i) => out.push(inboxArtifact(row, desc, entry, i)));
+    }
     return out;
 }
 /** Bounded per-cwd aggregate for the branch `-h` `<corpus>` block. Counts files

package/dist/core/canvas/paths.d.ts

@@ -26,6 +26,12 @@ export declare function nodeDir(nodeId: string): string;
 export declare function contextDir(nodeId: string): string;
 export declare function jobDir(nodeId: string): string;
 export declare function reportsDir(nodeId: string): string;
+/** Overflow store for inbox entries whose inline body exceeds the digest's
+ *  bounded preview (a direct `node msg`, a daemon trigger/deadline notice, a
+ *  close/cancel doctrine wake) — the full body spills here, mirroring how a
+ *  push's body always lives in a file, never inline; the inbox entry then
+ *  carries `ref` at this path, same as a push pointer. */
+export declare function messagesDir(nodeId: string): string;
 export declare function nodeMetaPath(nodeId: string): string;
 export declare function inboxPath(nodeId: string): string;
 /** Passive-subscription accumulator. Pushes from publishers this node subscribes

package/dist/core/canvas/paths.js

@@ -7,6 +7,7 @@
 //       context/                roadmap.md, initial-prompt.md, explore-*.md, artifacts
 //       job/                    log.jsonl, telemetry.json
 //       reports/                append-only push history (<ts>-<kind>.md)
+//       messages/               overflow bodies for inbox entries too long to inline
 //       inbox.jsonl             messages + coalesced subscription feed
 //       transcript.jsonl        mirror/pointer of the pi session
 //       session.ptr             pi session id/path
@@ -73,6 +74,14 @@ export function jobDir(nodeId) {
 export function reportsDir(nodeId) {
     return join(nodeDir(nodeId), 'reports');
 }
+/** Overflow store for inbox entries whose inline body exceeds the digest's
+ *  bounded preview (a direct `node msg`, a daemon trigger/deadline notice, a
+ *  close/cancel doctrine wake) — the full body spills here, mirroring how a
+ *  push's body always lives in a file, never inline; the inbox entry then
+ *  carries `ref` at this path, same as a push pointer. */
+export function messagesDir(nodeId) {
+    return join(nodeDir(nodeId), 'messages');
+}
 export function nodeMetaPath(nodeId) {
     return join(nodeDir(nodeId), 'meta.json');
 }

package/dist/core/canvas/status-glyph.js

@@ -44,6 +44,7 @@ export function hangingLabel(kind) {
         case 'connection': return 'down';
         case 'auth': return 'auth';
         case 'protocol': return 'protocol';
+        case 'wedged': return 'wedged';
         default: return 'other';
     }
 }