@crouton-kit/crouter 0.3.82 → 0.3.83

package/dist/core/__tests__/pid-identity-match.test.js

@@ -0,0 +1,83 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/pid-identity-match.test.ts
+//
+// Regression cover for the uncapped-revive-loop bug on Blaxel unikraft guests
+// (crouter-cloud "frozen on reconnecting", 2026-07-11): process identity is
+// `lstart#ticks`, but `lstart` is derived from the wall-clock boot epoch
+// (`/proc/stat` btime + starttime jiffies) and btime is UNSTABLE in the guest
+// (clock correction / suspend-resume). A SINGLE live broker was observed with
+// identical pid+ticks but `lstart` drifting +81s between two probes. The old
+// `identitiesMatch` compared the `lstart` base FIRST and returned false on any
+// base mismatch — so it read that still-live broker as reused/dead every
+// cycle, wedging the daemon into an uncapped revive loop that rebound the
+// node's view.sock and dropped the browser chat WS forever.
+//
+// The fix: when BOTH identities carry `#ticks`, ticks decide it ALONE (they
+// are per-boot unique, strictly finer than lstart, and — unlike lstart — do
+// not move when the wall clock does). The base is consulted only when a side
+// lacks ticks (macOS / no procfs).
+//
+// Follow-up (cross-boot false match): ticks-alone is only safe WITHIN one
+// boot — jiffies-since-boot reset and can repeat across boots. So the identity
+// base is now BOOT-SCOPED on Linux-with-procfs: it is the kernel `boot_id`
+// UUID (`<bootId>#<ticks>`), and a new-format match requires base AND ticks.
+// A legacy `lstart#ticks` row (recorded before this) still migrates cleanly:
+// when a base is NOT a boot_id UUID on either side, ticks decide alone.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { identitiesMatch } from '../canvas/pid.js';
+test('equal ticks with DIFFERENT lstart bases compare EQUAL (the btime-drift bug)', () => {
+    // Same live process, same jiffies-since-boot; only the wall-clock-anchored
+    // lstart drifted because btime shifted. Must NOT read as reuse.
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:51:45 2026#53459';
+    assert.equal(identitiesMatch(a, b), true, 'equal ticks must win over a drifting lstart base');
+});
+test('different ticks compare UNEQUAL even when lstart bases are identical (same-second reuse)', () => {
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:50:24 2026#60536';
+    assert.equal(identitiesMatch(a, b), false, 'different ticks are proof of a reused pid');
+});
+test('identities WITHOUT ticks fall back to comparing the lstart base', () => {
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026'), true, 'no ticks, equal base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026'), false, 'no ticks, different base → reuse');
+});
+test('one side lacking ticks fails open to a base compare (transient /proc miss)', () => {
+    // A transient `/proc` read failure can record the SAME live process plain on
+    // one capture and with ticks on another. Bases agree → fail-open to match.
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026#53459'), true, 'coarse-vs-fine with matching base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026#53459'), false, 'coarse-vs-fine with different base → reuse');
+});
+// --- boot-scoped (new-format) identities ---
+const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
+const BOOT_B = '9e8d7c6b-5a40-4938-9271-fedcba098765';
+test('new-format: equal boot_id + equal ticks → match', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#53459`), true, 'same boot, same process');
+});
+test('new-format: equal ticks + DIFFERENT boot_id → NO match (cross-boot collision)', () => {
+    // Ticks reset per boot and can repeat; a different boot_id with the same
+    // ticks is a DIFFERENT process on a DIFFERENT boot. This is the exact false
+    // match the boot-scoped base closes.
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_B}#53459`), false, 'equal ticks must NOT win across boots');
+});
+test('new-format: same boot_id + DIFFERENT ticks → NO match (in-boot reuse)', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#60536`), false, 'reused pid within one boot');
+});
+test('migration: legacy lstart#ticks vs new bootId#ticks with equal ticks → match', () => {
+    // An in-place upgrade compares an already-recorded `lstart#ticks` row
+    // against a freshly-read `bootId#ticks`. A blanket base-mismatch verdict
+    // would false-kill the live broker; the legacy base (not a UUID) routes to
+    // ticks-alone so the live broker survives the upgrade.
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#53459', `${BOOT_A}#53459`), true, 'legacy → new migration');
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, 'Sat Jul 11 17:51:45 2026#53459'), true, 'order-independent');
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#60536', `${BOOT_A}#53459`), false, 'legacy migration still discriminates on ticks');
+});
+test('malformed/empty ticks suffix is treated as ABSENT (base compare applies)', () => {
+    // A garbage suffix must never be trusted as a fine discriminator; it falls
+    // back to the base compare.
+    assert.equal(identitiesMatch('A#', 'B#'), false, 'empty suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#', 'A#'), true, 'empty suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch('A#bad', 'B#bad'), false, 'non-numeric suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#bad', 'A#other'), true, 'non-numeric suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_A}#12#34`), true, 'multiple-# suffix is non-numeric → absent ticks → boot_id bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_B}#12#34`), false, 'multiple-# suffix → absent ticks → boot_id bases differ');
+});

package/dist/core/canvas/__tests__/attention.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/canvas/__tests__/attention.test.js

@@ -0,0 +1,126 @@
+// attention.test.ts — the C2 ticket-attribution contract for `attention.ts`.
+//
+// The humanloop cutover generalized crouter's per-node attention counter from
+// "pending asks" to "all pending human tickets": a count now folds in decks
+// (asks), notify decks, AND anchored reviews, all bucketed by the
+// `source.nodeId` stamp humanloop puts on every crouter-originated submission.
+// This exercises the nuanced part that regressions hide in:
+//   - a cwd shared by several nodes is scanned ONCE and its tickets split by
+//     stamp, never double-counted;
+//   - decks, notify decks, and reviews all count;
+//   - a bare-shell ticket (no nodeId stamp) belongs to no node and is excluded
+//     from the per-node map;
+//   - every requested id is present (0 when it has none).
+import { test, before, beforeEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { atomicWriteJson, deckPath } from '@crouton-kit/humanloop';
+import { createNode } from '../canvas.js';
+import { closeDb } from '../db.js';
+import { interactionsRoot } from '../../artifact.js';
+import { countTickets, ticketCountsForNodes, pendingTicketsForView } from '../attention.js';
+function meta(id, cwd, extra) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...extra,
+    };
+}
+/** Seed a deck ticket (notify is just a durable deck) under `cwd`'s
+ *  interactions root, stamped with `nodeId` when given (omit for a bare-shell
+ *  ticket with no canvas owner). */
+function seedDeck(cwd, id, nodeId) {
+    const dir = join(interactionsRoot(cwd), id);
+    mkdirSync(dir, { recursive: true });
+    atomicWriteJson(deckPath(dir), {
+        source: nodeId === undefined ? {} : { nodeId },
+        interactions: [{ id: 'q', title: id, options: [] }],
+    });
+}
+/** Seed an anchored review ticket (review.json) under `cwd`, stamped `nodeId`. */
+function seedReview(cwd, id, nodeId) {
+    const dir = join(interactionsRoot(cwd), id);
+    mkdirSync(dir, { recursive: true });
+    atomicWriteJson(join(dir, 'review.json'), {
+        schema: 'humanloop.review/v1',
+        file: join(cwd, 'src.md'),
+        output: join(dir, 'feedback.json'),
+        title: id,
+        source: { nodeId },
+        blockedSince: new Date().toISOString(),
+    });
+}
+let home;
+let sharedCwd;
+let soloCwd;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-attention-'));
+    sharedCwd = mkdtempSync(join(tmpdir(), 'crtr-attention-shared-'));
+    soloCwd = mkdtempSync(join(tmpdir(), 'crtr-attention-solo-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(interactionsRoot(sharedCwd), { recursive: true, force: true });
+    rmSync(interactionsRoot(soloCwd), { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    for (const d of [home, sharedCwd, soloCwd])
+        rmSync(d, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('ticketCountsForNodes buckets deck/review/notify by node across a shared cwd and drops bare-shell tickets', () => {
+    // Nodes a and b share one cwd; c has its own.
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    createNode(meta('c', soloCwd));
+    // Shared cwd: two tickets for a (an ask + a notify deck), one review for b,
+    // and one unattributed bare-shell deck that belongs to no node.
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedDeck(sharedCwd, 'a-notify', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    seedDeck(sharedCwd, 'bare', undefined);
+    // Solo cwd: one ask for c.
+    seedDeck(soloCwd, 'c-ask', 'c');
+    const counts = ticketCountsForNodes(['a', 'b', 'c']);
+    // a: ask + notify = 2; b: review = 1; c: ask = 1. The bare-shell ticket is
+    // excluded from every per-node bucket even though it lives in a's cwd.
+    assert.deepEqual(counts, { a: 2, b: 1, c: 1 });
+});
+test('countTickets counts only the requesting node in a shared cwd', () => {
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    seedDeck(sharedCwd, 'bare', undefined);
+    assert.equal(countTickets('a'), 1);
+    assert.equal(countTickets('b'), 1);
+});
+test('every requested id is present with 0 when it has no tickets', () => {
+    createNode(meta('a', sharedCwd));
+    createNode(meta('c', soloCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    assert.deepEqual(ticketCountsForNodes(['a', 'c']), { a: 1, c: 0 });
+});
+test('pendingTicketsForView de-dups a shared cwd to one entry summing all its tickets', () => {
+    // a is the view root; b shares a's cwd.
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    const items = pendingTicketsForView('a');
+    // One cwd → one entry; its count is every pending ticket in that cwd (2),
+    // not a per-node split, so the shared dir is never counted twice.
+    assert.equal(items.length, 1);
+    assert.equal(items[0].count, 2);
+});

package/dist/core/canvas/__tests__/remote-canvas-source.test.js

@@ -207,8 +207,8 @@ test('a 500 response, a non-JSON body, and a non-zero exitCode all degrade grace
     const source = new RemoteCanvasSource(server.url, 'tok');
     assert.equal(await source.getNode('http500'), null);
     assert.deepEqual(await source.listNodes(), []);
-    assert.deepEqual(await source.askCountsForView('badjson'), {});
-    assert.deepEqual(await source.askCountsForView('nonzero-exit'), {});
+    assert.deepEqual(await source.ticketCountsForView('badjson'), {});
+    assert.deepEqual(await source.ticketCountsForView('nonzero-exit'), {});
 });
 test('malformed success JSON (exit 0, wrong shape) degrades cleanly instead of returning a shape a consumer would crash on', async (t) => {
     const server = await startMockCrtrServer((args) => {
@@ -247,8 +247,8 @@ test('malformed success JSON (exit 0, wrong shape) degrades cleanly instead of r
     // `listNodes()` with a non-array `nodes` field must degrade to [], never
     // throw or return the malformed value.
     assert.deepEqual(await source.listNodes(), []);
-    // `askCountsForView()` with a non-object `counts` field must degrade to {}.
-    assert.deepEqual(await source.askCountsForView('root'), {});
+    // `ticketCountsForView()` with a non-object `counts` field must degrade to {}.
+    assert.deepEqual(await source.ticketCountsForView('root'), {});
 });
 function fullNodeRow(id, over = {}) {
     return {

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -110,7 +110,7 @@ after(() => {
  *  poisoned session-file path so the mocked `node inspect show` response can
  *  point `pi_session_file` at it (the vector a regression would follow). */
 function seedPoisonedLocalState() {
-    // A local node row + a pending ask under its cwd — poisons `asksForNodes`.
+    // A local node row + a pending ticket under its cwd — poisons `ticketCountsForNodes`.
     createNode(meta('a', { cwd: localCwd }));
     const askDir = join(interactionsRoot(localCwd), 'poison-ask');
     mkdirSync(askDir, { recursive: true });

package/dist/core/canvas/attention.d.ts

@@ -1,34 +1,36 @@
-export interface AskEntry {
+export interface TicketEntry {
     node_id: string;
     name: string;
     cwd: string;
     count: number;
 }
 /**
- * Count pending asks for the cwd of a single node.
+ * Count pending tickets for the cwd of a single node.
  * Returns 0 when the node is unknown or humanloop is unavailable.
  */
-export declare function countAsks(nodeId: string): number;
+export declare function countTickets(nodeId: string): number;
 /**
- * Pending asks for all nodes reachable in the subscription sub-DAG from
+ * Pending tickets for all nodes reachable in the subscription sub-DAG from
  * `rootId` (including root itself). De-duped by cwd: when multiple nodes
  * share a cwd the first one encountered claims the entry.
  *
  * Returns only entries with count > 0.
  */
-export declare function pendingAsksForView(rootId: string): AskEntry[];
+export declare function pendingTicketsForView(rootId: string): TicketEntry[];
 /**
- * Per-node pending ask counts for an explicit set of node ids — the batched
- * counterpart to `countAsks`, used by the nav chrome to label every visible
+ * Per-node pending ticket counts for an explicit set of node ids — the batched
+ * counterpart to `countTickets`, used by the nav chrome to label every visible
  * node in ONE pass. Groups ids by their cwd so each distinct interactions dir
- * is scanned exactly once, then buckets the decks by the `source.nodeId` stamp
- * (same attribution as `countForCwd(cwd, nodeId)`). Asks with no node stamp are
- * not attributable to any node and are excluded. Every requested id appears in
- * the result (0 when it has none). Never throws.
+ * is scanned exactly once, de-duplicates by canonical ticket dir (scanInbox
+ * already returns one summary per dir), then buckets the tickets by the
+ * `source.nodeId` stamp (same attribution as `countForCwd(cwd, nodeId)`).
+ * Tickets with no node stamp (bare-shell / unattributed) belong to no node and
+ * are excluded from the map. Every requested id appears in the result (0 when
+ * it has none). Never throws.
  */
-export declare function asksForNodes(ids: string[]): Record<string, number>;
+export declare function ticketCountsForNodes(ids: string[]): Record<string, number>;
 /**
- * Pending asks across the entire canvas — every distinct cwd among all known
+ * Pending tickets across the entire canvas — every distinct cwd among all known
  * nodes. Returns only entries with count > 0.
  */
-export declare function asksAcrossCanvas(): AskEntry[];
+export declare function ticketsAcrossCanvas(): TicketEntry[];

package/dist/core/canvas/attention.js

@@ -1,13 +1,16 @@
-// attention.ts — pending human-ask counters across the canvas.
+// attention.ts — pending human-ticket counters across the canvas.
 //
-// Human asks are stored per-cwd, not per-node (interactionsRoot is keyed by
-// the cwd the agent ran in, same pattern as humanloop's human list command).
-// A cwd can be shared by multiple nodes, so we de-dup on cwd before summing to
-// avoid counting the same pending ask N times.
+// A "ticket" is any pending humanloop interaction: a deck (ask), a notify deck,
+// or an anchored review. `scanInbox` returns the sealed deck/review summary
+// union (notify is a durable deck), so every count here is "all pending human
+// tickets", not just asks. Tickets are stored per-cwd, not per-node
+// (interactionsRoot is keyed by the cwd the agent ran in), so a cwd shared by
+// multiple nodes is de-duped before summing to avoid counting the same pending
+// ticket N times.
 //
 // All public functions are best-effort: scanInbox failures return 0 / empty.
-// Callers are display code (dashboard, attention queue) that must not blow up
-// on a cold canvas or missing humanloop state.
+// Callers are display code (dashboard, attention queue, attach chrome) that must
+// not blow up on a cold canvas or missing humanloop state.
 import { scanInbox } from '@crouton-kit/humanloop';
 import { interactionsRoot } from '../artifact.js';
 import { getNode, listNodes, view } from './canvas.js';
@@ -15,21 +18,21 @@ import { getNode, listNodes, view } from './canvas.js';
 // Helpers
 // ---------------------------------------------------------------------------
 /**
- * Count pending asks for a single cwd root. Never throws.
+ * Count pending tickets for a single cwd root. Never throws.
  *
- * When `nodeId` is given, count only asks raised by THAT node — humanloop
- * stamps `deck.source.nodeId` with the originating CRTR_NODE_ID, so two nodes
- * sharing a cwd no longer pollute each other's count. Asks with no stamp
- * (legacy, or raised outside a canvas node) are not attributable to any node
- * and are excluded from the per-node count. Read via a cast so this doesn't
- * hard-depend on a humanloop type bump.
+ * When `nodeId` is given, count only tickets raised by THAT node — humanloop
+ * stamps `source.nodeId` (deck AND review submissions alike) with the
+ * originating CRTR_NODE_ID, so two nodes sharing a cwd no longer pollute each
+ * other's count. Tickets with no stamp (raised from a bare shell, or outside a
+ * canvas node) are not attributable to any node and are excluded from the
+ * per-node count.
  */
 function countForCwd(cwd, nodeId) {
     try {
         const items = scanInbox([interactionsRoot(cwd)]);
         if (nodeId === undefined)
             return items.length;
-        return items.filter((i) => i.source?.nodeId === nodeId).length;
+        return items.filter((i) => i.source.nodeId === nodeId).length;
     }
     catch {
         // humanloop not installed, or interactions dir doesn't exist — both fine.
@@ -40,23 +43,23 @@ function countForCwd(cwd, nodeId) {
 // Public API
 // ---------------------------------------------------------------------------
 /**
- * Count pending asks for the cwd of a single node.
+ * Count pending tickets for the cwd of a single node.
  * Returns 0 when the node is unknown or humanloop is unavailable.
  */
-export function countAsks(nodeId) {
+export function countTickets(nodeId) {
     const node = getNode(nodeId);
     if (node === null)
         return 0;
     return countForCwd(node.cwd, nodeId);
 }
 /**
- * Pending asks for all nodes reachable in the subscription sub-DAG from
+ * Pending tickets for all nodes reachable in the subscription sub-DAG from
  * `rootId` (including root itself). De-duped by cwd: when multiple nodes
  * share a cwd the first one encountered claims the entry.
  *
  * Returns only entries with count > 0.
  */
-export function pendingAsksForView(rootId) {
+export function pendingTicketsForView(rootId) {
     // view() returns children only (excludes root), so prepend root.
     const ids = [rootId, ...view(rootId)];
     const seen = new Map(); // cwd → entry
@@ -78,15 +81,17 @@ export function pendingAsksForView(rootId) {
     return Array.from(seen.values()).filter((e) => e.count > 0);
 }
 /**
- * Per-node pending ask counts for an explicit set of node ids — the batched
- * counterpart to `countAsks`, used by the nav chrome to label every visible
+ * Per-node pending ticket counts for an explicit set of node ids — the batched
+ * counterpart to `countTickets`, used by the nav chrome to label every visible
  * node in ONE pass. Groups ids by their cwd so each distinct interactions dir
- * is scanned exactly once, then buckets the decks by the `source.nodeId` stamp
- * (same attribution as `countForCwd(cwd, nodeId)`). Asks with no node stamp are
- * not attributable to any node and are excluded. Every requested id appears in
- * the result (0 when it has none). Never throws.
+ * is scanned exactly once, de-duplicates by canonical ticket dir (scanInbox
+ * already returns one summary per dir), then buckets the tickets by the
+ * `source.nodeId` stamp (same attribution as `countForCwd(cwd, nodeId)`).
+ * Tickets with no node stamp (bare-shell / unattributed) belong to no node and
+ * are excluded from the map. Every requested id appears in the result (0 when
+ * it has none). Never throws.
  */
-export function asksForNodes(ids) {
+export function ticketCountsForNodes(ids) {
     const counts = {};
     for (const id of ids)
         counts[id] = 0;
@@ -110,7 +115,7 @@ export function asksForNodes(ids) {
         }
         const want = new Set(cwdIds);
         for (const i of items) {
-            const nid = i.source?.nodeId;
+            const nid = i.source.nodeId;
             if (nid !== undefined && want.has(nid))
                 counts[nid] = (counts[nid] ?? 0) + 1;
         }
@@ -118,10 +123,10 @@ export function asksForNodes(ids) {
     return counts;
 }
 /**
- * Pending asks across the entire canvas — every distinct cwd among all known
+ * Pending tickets across the entire canvas — every distinct cwd among all known
  * nodes. Returns only entries with count > 0.
  */
-export function asksAcrossCanvas() {
+export function ticketsAcrossCanvas() {
     const rows = listNodes();
     const seen = new Map(); // cwd → entry
     for (const row of rows) {

package/dist/core/canvas/boot.d.ts

@@ -7,6 +7,7 @@ export interface BootIdentity {
      *  discriminator only, used when `bootId` is null on either side. */
     bootEpochMs: number;
 }
+export declare function readKernelBootId(): string | null;
 /** Identity of the CURRENT OS boot. `now` is injectable for tests. */
 export declare function currentBootIdentity(now?: number): BootIdentity;
 /** Pure decision core: does `current` belong to a DIFFERENT boot than the

package/dist/core/canvas/boot.js

@@ -47,7 +47,7 @@ import { openDb } from './db.js';
  *  dangerous direction. The production target (Linux microVM guests) never
  *  reaches this branch; there `boot_id` is exact. */
 const BOOT_EPOCH_TOLERANCE_MS = 60_000;
-function readKernelBootId() {
+export function readKernelBootId() {
     try {
         const id = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
         return id.length > 0 ? id : null;

package/dist/core/canvas/browse/app.js

@@ -84,8 +84,8 @@ export async function runBrowse(opts = {}) {
     let childIds;
     let tree;
     let totalNodes;
-    // Remote-only: pending-ask counts per node, merged from one
-    // `askCountsForView` call per forest root (RemoteCanvasSource.askCountsForView
+    // Remote-only: pending human-ticket counts per node, merged from one
+    // `ticketCountsForView` call per forest root (RemoteCanvasSource.ticketCountsForView
     // already shells a single `canvas attention map --view <root>` per root, same
     // cost class as the per-node `subscriptionsOf` fan-out this snapshot already
     // does below) — fetched once per snapshot rebuild, not per flush/keystroke, so
@@ -105,7 +105,7 @@ export async function runBrowse(opts = {}) {
         tree = buildTree(rows, rootIds, (id) => childIds.get(id) ?? []);
         totalNodes = tree.nodes.size;
         if (isRemote) {
-            const maps = await Promise.all(rootIds.map((root) => source.askCountsForView(root).catch(() => ({}))));
+            const maps = await Promise.all(rootIds.map((root) => source.ticketCountsForView(root).catch(() => ({}))));
             remoteAskCounts = Object.assign({}, ...maps);
         }
     };

package/dist/core/canvas/pid.d.ts

@@ -20,24 +20,50 @@ export declare function isPidAlive(pid: number | null | undefined): boolean;
  *  drift from this rule (review Major #1, Round 2 of the pid-reuse-liveness
  *  fix).
  *
- *  The hazard this closes: `composeIdentity` appends the `#<ticks>` Linux
- *  discriminator only when `/proc/<pid>/stat` happens to be readable at
- *  capture time — so the SAME live process can be recorded plain `lstart` on
- *  one capture and `lstart#ticks` on another (a transient `/proc` read
- *  failure, or capturing on a platform/container without procfs). A naive
- *  `===` then reads that as a reuse (different string) and reports `dead` for
- *  a broker that never actually died — the false-DEAD direction, which can
- *  make `reviveNode`'s double-launch guard wrongly relaunch a SECOND broker
- *  onto a still-live session.
+ *  Two hazards this closes, both in the false-DEAD direction (the dangerous
+ *  one — a false DEAD lets `reviveNode`'s double-launch guard relaunch a
+ *  SECOND broker onto a still-live session):
  *
- *  Rule: split both on `#`. Bases (`lstart`) differ → definitely NOT a match
- *  (different process, or the same pid reused in a different second). Bases
- *  match and BOTH carry a `#ticks` suffix → match iff the suffixes are equal
- *  (this still catches genuine same-second reuse, the case `procStartTicks`
- *  exists for). Bases match and EITHER lacks the suffix → coarse-vs-fine,
- *  can't distinguish → MATCH (fail-open to same-process, matching this
- *  module's universal discipline: only a POSITIVE mismatch counts as reuse,
- *  never an absence of evidence). */
+ *  1. `composeIdentity` appends the `#<ticks>` Linux discriminator only when
+ *     `/proc/<pid>/stat` happens to be readable at capture time — so the SAME
+ *     live process can be recorded plain `lstart` on one capture and
+ *     `lstart#ticks` on another (a transient `/proc` read failure, or
+ *     capturing on a platform/container without procfs). A naive `===` reads
+ *     that as a reuse (different string) and reports `dead` for a broker that
+ *     never died.
+ *  2. `lstart` is NOT stable for a live process on every host. It is derived
+ *     from `/proc/stat` btime (wall-clock boot epoch) + starttime jiffies, so
+ *     a clock correction / suspend-resume shifts btime and re-anchors the
+ *     SAME live process's `lstart` by seconds between two captures. Observed
+ *     on Blaxel unikraft guests: pid+ticks identical across probes, `lstart`
+ *     drifting +81s — a base-first compare then reads the live home-node
+ *     broker as reused/dead every cycle, driving an uncapped revive loop.
+ *
+ *  A third hazard the base itself once carried: `ticks` (jiffies-since-boot)
+ *  RESET on every boot and can repeat across boots, so ticks-alone is only
+ *  safe WITHIN one boot. `composeIdentity` therefore boot-SCOPES the base on
+ *  Linux-with-procfs — the base IS the kernel `boot_id` UUID — so a
+ *  new-format identity is `<bootId>#<ticks>` and equality means same boot AND
+ *  same process. This closes the cross-boot false match at the root, without
+ *  plumbing boot reconciliation ahead of every caller.
+ *
+ *  Rule: split both on `#`.
+ *   - BOTH sides carry `#ticks` AND both bases are `boot_id` UUIDs
+ *     (new-format vs new-format): match iff base AND ticks are equal. A
+ *     different boot_id with equal ticks is NOT a match (the cross-boot
+ *     collision).
+ *   - BOTH sides carry `#ticks` but a base is NOT a boot_id UUID on EITHER
+ *     side — a LEGACY `lstart#ticks` row recorded before this repo boot-scoped
+ *     the base, or a Linux host that has procfs ticks but no readable boot_id:
+ *     ticks DECIDE it alone (the prior landed semantics). This is a NARROW
+ *     format-migration path so an in-place upgrade never false-kills a live
+ *     broker whose row still holds `lstart#ticks`; it is NOT a general
+ *     fallback — new-format vs new-format always demands base+ticks above.
+ *   - EITHER side lacks a valid `#ticks` suffix (macOS / no procfs / transient
+ *     `/proc` miss / malformed suffix): fall back to the coarse base —
+ *     matching iff the bases agree (fail-open to same-process, matching this
+ *     module's universal discipline: only a POSITIVE mismatch counts as reuse,
+ *     never an absence of evidence). */
 export declare function identitiesMatch(a: string, b: string): boolean;
 /** Three-valued liveness verdict for a RECORDED node pid, identity-guarded
  *  against PID REUSE using the launch-time baseline (`pi_pid_identity`,