@crouton-kit/crouter 0.3.82 → 0.3.84

package/dist/core/__tests__/human-node-not-supervised.test.js

@@ -5,10 +5,11 @@
 // at boot with "pi vehicle exited before the session came up".
 //
 // ROOT CAUSE: a kind:'human' row is NOT a broker-hosted agent node — it is a
-// bookkeeping row for the `crtr human` bridge. Its decision/review TUI runs in a
-// detached `crtr human _run` pane (NOT a pi engine), and the row's lifecycle is
-// driven entirely by that worker's `pushFinal` (or `human cancel`). So it never
-// records a `pi_pid` or `pi_session_id`. After the headless hard-cut made the
+// bookkeeping row for the `crtr human` bridge. Nothing runs in it: the human
+// answers from humanloop's inbox, and the row's lifecycle is driven entirely by
+// humanloop's completion handler (`crtr human _deliver`) calling `pushFinal` (or
+// `human cancel`). So it never records a `pi_pid` or `pi_session_id`. After the
+// headless hard-cut made the
 // broker the universal node host, superviseTick supervised EVERY active|idle row
 // as a broker engine: it read the human row (pid==null, session==null) as a
 // never-booted broker, waited out the boot grace, then crash'd it and fired

package/dist/core/__tests__/pid-identity-match.test.js

@@ -0,0 +1,145 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/pid-identity-match.test.ts
+//
+// Regression cover for the uncapped-revive-loop bug on Blaxel unikraft guests
+// (crouter-cloud "frozen on reconnecting", 2026-07-11): process identity is
+// `lstart#ticks`, but `lstart` is derived from the wall-clock boot epoch
+// (`/proc/stat` btime + starttime jiffies) and btime is UNSTABLE in the guest
+// (clock correction / suspend-resume). A SINGLE live broker was observed with
+// identical pid+ticks but `lstart` drifting +81s between two probes. The old
+// `identitiesMatch` compared the `lstart` base FIRST and returned false on any
+// base mismatch — so it read that still-live broker as reused/dead every
+// cycle, wedging the daemon into an uncapped revive loop that rebound the
+// node's view.sock and dropped the browser chat WS forever.
+//
+// The fix: when BOTH identities carry `#ticks`, ticks decide it ALONE (they
+// are per-boot unique, strictly finer than lstart, and — unlike lstart — do
+// not move when the wall clock does). The base is consulted only when a side
+// lacks ticks (macOS / no procfs).
+//
+// Follow-up (cross-boot false match): ticks-alone is only safe WITHIN one
+// boot — jiffies-since-boot reset and can repeat across boots. So the identity
+// base is now BOOT-SCOPED on Linux-with-procfs: it is the kernel `boot_id`
+// UUID (`<bootId>#<ticks>`), and a new-format match requires base AND ticks.
+// A legacy `lstart#ticks` row (recorded before this) still migrates cleanly:
+// when a base is NOT a boot_id UUID on either side, ticks decide alone.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { identitiesMatch, composeIdentity, makeBootIdCache } from '../canvas/pid.js';
+test('equal ticks with DIFFERENT lstart bases compare EQUAL (the btime-drift bug)', () => {
+    // Same live process, same jiffies-since-boot; only the wall-clock-anchored
+    // lstart drifted because btime shifted. Must NOT read as reuse.
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:51:45 2026#53459';
+    assert.equal(identitiesMatch(a, b), true, 'equal ticks must win over a drifting lstart base');
+});
+test('different ticks compare UNEQUAL even when lstart bases are identical (same-second reuse)', () => {
+    const a = 'Sat Jul 11 17:50:24 2026#53459';
+    const b = 'Sat Jul 11 17:50:24 2026#60536';
+    assert.equal(identitiesMatch(a, b), false, 'different ticks are proof of a reused pid');
+});
+test('identities WITHOUT ticks fall back to comparing the lstart base', () => {
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026'), true, 'no ticks, equal base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026'), false, 'no ticks, different base → reuse');
+});
+test('one side lacking ticks fails open to a base compare (transient /proc miss)', () => {
+    // A transient `/proc` read failure can record the SAME live process plain on
+    // one capture and with ticks on another. Bases agree → fail-open to match.
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:50:24 2026#53459'), true, 'coarse-vs-fine with matching base → match');
+    assert.equal(identitiesMatch('Sat Jul 11 17:50:24 2026', 'Sat Jul 11 17:51:45 2026#53459'), false, 'coarse-vs-fine with different base → reuse');
+});
+// --- boot-scoped (new-format) identities ---
+const BOOT_A = '4b0c1d2e-3f40-4152-8637-a1b2c3d4e5f6';
+const BOOT_B = '9e8d7c6b-5a40-4938-9271-fedcba098765';
+test('new-format: equal boot_id + equal ticks → match', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#53459`), true, 'same boot, same process');
+});
+test('new-format: equal ticks + DIFFERENT boot_id → NO match (cross-boot collision)', () => {
+    // Ticks reset per boot and can repeat; a different boot_id with the same
+    // ticks is a DIFFERENT process on a DIFFERENT boot. This is the exact false
+    // match the boot-scoped base closes.
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_B}#53459`), false, 'equal ticks must NOT win across boots');
+});
+test('new-format: same boot_id + DIFFERENT ticks → NO match (in-boot reuse)', () => {
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, `${BOOT_A}#60536`), false, 'reused pid within one boot');
+});
+test('migration: legacy lstart#ticks vs new bootId#ticks with equal ticks → match', () => {
+    // An in-place upgrade compares an already-recorded `lstart#ticks` row
+    // against a freshly-read `bootId#ticks`. A blanket base-mismatch verdict
+    // would false-kill the live broker; the legacy base (not a UUID) routes to
+    // ticks-alone so the live broker survives the upgrade.
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#53459', `${BOOT_A}#53459`), true, 'legacy → new migration');
+    assert.equal(identitiesMatch(`${BOOT_A}#53459`, 'Sat Jul 11 17:51:45 2026#53459'), true, 'order-independent');
+    assert.equal(identitiesMatch('Sat Jul 11 17:51:45 2026#60536', `${BOOT_A}#53459`), false, 'legacy migration still discriminates on ticks');
+});
+// --- composeIdentity composition (guards against a regression that emits the
+//     old wall-clock `lstart#ticks` on a boot_id-capable host) ---
+test('composeIdentity: procfs + boot_id host emits <bootId>#<ticks> with the base equal to the kernel boot_id', () => {
+    // The exact production-guest shape. The `deps` seam injects the boot_id and
+    // ticks so the composition is provable off-Linux (real /proc reads return
+    // null there). If composeIdentity regressed to emitting lstart#ticks, the
+    // base here would be the lstart string, not BOOT_A — this asserts it is not.
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: '53459' });
+    assert.equal(id, `${BOOT_A}#53459`, 'base must be the kernel boot_id, not the wall-clock lstart');
+    assert.equal(splitBase(id), BOOT_A);
+});
+test('composeIdentity: procfs but NO readable boot_id falls back to <lstart>#<ticks>', () => {
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: null, ticks: '53459' });
+    assert.equal(id, 'Sat Jul 11 17:51:45 2026#53459', 'no boot_id → prior lstart#ticks behavior');
+});
+test('composeIdentity: no procfs ticks emits the bare <lstart> (coarse, unchanged)', () => {
+    const id = composeIdentity(1234, 'Sat Jul 11 17:51:45 2026', { bootId: BOOT_A, ticks: null });
+    assert.equal(id, 'Sat Jul 11 17:51:45 2026', 'no ticks → bare lstart regardless of boot_id');
+});
+function splitBase(identity) {
+    const i = identity.indexOf('#');
+    return i === -1 ? identity : identity.slice(0, i);
+}
+// --- boot_id cache: a TRANSIENT read failure must be retried, never cached as
+//     permanent absence (would permanently downgrade a boot_id host to legacy
+//     lstart#ticks identities). This exercises the exact memoize used by
+//     bootIdBase. ---
+test('makeBootIdCache: a null read is negative-cached, RETRIED only after the window, then a success is cached forever', () => {
+    let calls = 0;
+    const reads = [null, BOOT_A, BOOT_B];
+    let clock = 1_000;
+    const cache = makeBootIdCache(() => {
+        const v = calls < reads.length ? reads[calls] : BOOT_B;
+        calls += 1;
+        return v;
+    }, () => clock, 100);
+    assert.equal(cache(), null, 'first read failed → null (not cached)');
+    assert.equal(calls, 1);
+    assert.equal(cache(), null, 'within the negative window → NOT re-read');
+    assert.equal(calls, 1, 'the throwing read is rate-limited, not repeated every call');
+    clock += 100; // advance past the negative-cache deadline
+    assert.equal(cache(), BOOT_A, 'after the window the failure is retried → succeeds');
+    assert.equal(calls, 2);
+    clock += 10_000;
+    assert.equal(cache(), BOOT_A, 'success is now cached → reader NOT called again');
+    assert.equal(calls, 2, 'no further reads after a successful one');
+});
+test('makeBootIdCache: a permanent no-boot_id host reads null only once per negative window (bounded, not per-call)', () => {
+    let calls = 0;
+    let clock = 1_000;
+    const cache = makeBootIdCache(() => {
+        calls += 1;
+        return null;
+    }, () => clock, 100);
+    assert.equal(cache(), null);
+    assert.equal(cache(), null);
+    assert.equal(cache(), null);
+    assert.equal(calls, 1, 'repeated calls within one window do a SINGLE read — no synchronous read storm');
+    clock += 100;
+    assert.equal(cache(), null);
+    assert.equal(calls, 2, 'one read per window — still retryable for a transient miss, but bounded');
+});
+test('malformed/empty ticks suffix is treated as ABSENT (base compare applies)', () => {
+    // A garbage suffix must never be trusted as a fine discriminator; it falls
+    // back to the base compare.
+    assert.equal(identitiesMatch('A#', 'B#'), false, 'empty suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#', 'A#'), true, 'empty suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch('A#bad', 'B#bad'), false, 'non-numeric suffix → absent ticks → bases differ');
+    assert.equal(identitiesMatch('A#bad', 'A#other'), true, 'non-numeric suffix → absent ticks → bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_A}#12#34`), true, 'multiple-# suffix is non-numeric → absent ticks → boot_id bases agree');
+    assert.equal(identitiesMatch(`${BOOT_A}#12#34`, `${BOOT_B}#12#34`), false, 'multiple-# suffix → absent ticks → boot_id bases differ');
+});

package/dist/core/__tests__/tmux-surface.test.js

@@ -17,11 +17,12 @@
 //      importers are placement.ts + tmux-chrome.ts (tmux.ts itself excluded).
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, readdirSync, statSync, mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, basename } from 'node:path';
-import { installTmuxBindings } from '../runtime/tmux-chrome.js';
+import { installTmuxBindings, legacyInboxKeyFile } from '../runtime/tmux-chrome.js';
 import { resolveKeybindings } from '../keybindings/index.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SRC_ROOT = join(__dirname, '..', '..'); // .../src
@@ -149,6 +150,8 @@ test('tmux installer remaps owned pairs and preserves occupied user bindings', (
         assert.ok(first.installed.some((pair) => pair.table === 'root' && pair.key === 'M-]'));
         assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /display-menu/);
         assert.match(tmuxBinding(socket, 'root', 'M-v') ?? '', /switch-client/);
+        // The inbox toggle installs at its default key (alt+i → M-i) in the same sweep.
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
         const remapped = installTmuxBindings(resolveKeybindings({
             'crtr.tmux.menu.open': ['alt+shift+z'],
             'crtr.tmux.menu.graph': ['shift+z'],
@@ -185,3 +188,178 @@ test('tmux installer remaps owned pairs and preserves occupied user bindings', (
         isolatedTmux(socket, ['kill-server']);
     }
 });
+test('tmux installer rebinds/disables the inbox toggle and adopts the legacy hl-owned M-i', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-inbox-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socket = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' }).stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    const priorState = process.env['XDG_STATE_HOME'];
+    const stateHome = mkdtempSync(join(tmpdir(), 'crtr-inbox-state-'));
+    process.env['TMUX'] = `${socket},1,0`;
+    process.env['XDG_STATE_HOME'] = stateHome;
+    try {
+        // Fixture: a surviving hl-owned M-i binding plus its flat inbox-key file —
+        // the arrangement crouter's key ownership replaces — with no crouter
+        // manifest yet. First reconciliation must take over M-i (crouter's inbox
+        // toggle, tracked in the manifest) rather than report it foreign.
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-i', 'run-shell', '-b', 'hl inbox toggle --quiet --tmux-socket "#{socket_path}"']);
+        const legacyKeyDir = join(stateHome, 'humanloop');
+        mkdirSync(legacyKeyDir, { recursive: true });
+        const legacyKeyFile = join(legacyKeyDir, 'inbox-key');
+        writeFileSync(legacyKeyFile, 'M-i\n');
+        const first = installTmuxBindings(resolveKeybindings());
+        assert.equal(first.ok, true, JSON.stringify(first.diagnostics));
+        // Adopted, not foreign: M-i is now crouter's inbox toggle, no occupied diag.
+        assert.ok(!first.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(first.diagnostics));
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.ok(first.installed.some((pair) => pair.table === 'root' && pair.key === 'M-i'));
+        // The obsolete flat key file is deleted by the cleanup.
+        assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
+        // Rebind to a custom key: the old M-i (crouter-owned via the manifest) is
+        // dropped and the new key carries the same inbox command.
+        const rebound = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.inbox.toggle': ['alt+j'] }));
+        assert.equal(rebound.ok, true, JSON.stringify(rebound.diagnostics));
+        assert.equal(tmuxBinding(socket, 'root', 'M-i'), null);
+        assert.match(tmuxBinding(socket, 'root', 'M-j') ?? '', /hl inbox toggle/);
+        // Disable via empty gesture list: no inbox key installed at all, no error.
+        const disabled = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.inbox.toggle': [] }));
+        assert.equal(disabled.ok, true, JSON.stringify(disabled.diagnostics));
+        assert.equal(tmuxBinding(socket, 'root', 'M-i'), null);
+        assert.equal(tmuxBinding(socket, 'root', 'M-j'), null);
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        if (priorState === undefined)
+            delete process.env['XDG_STATE_HOME'];
+        else
+            process.env['XDG_STATE_HOME'] = priorState;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});
+test('tmux installer adopts the legacy hl-owned inbox key when a crouter manifest already exists', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-inbox-upgrade-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socket = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' }).stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    const priorState = process.env['XDG_STATE_HOME'];
+    const stateHome = mkdtempSync(join(tmpdir(), 'crtr-inbox-state-'));
+    process.env['TMUX'] = `${socket},1,0`;
+    process.env['XDG_STATE_HOME'] = stateHome;
+    try {
+        // Contract: an hl-owned inbox binding not tracked in the manifest must be
+        // adopted even when a crouter manifest already exists. Force
+        // `manifest.existed = true` with a non-empty option, then seed an untracked
+        // hl-owned M-i binding + its key file.
+        isolatedTmux(socket, ['set-option', '-s', '@crtr_keybindings_manifest', '[]']);
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-i', 'run-shell', '-b', 'hl inbox toggle --quiet --tmux-socket "#{socket_path}"']);
+        const legacyKeyDir = join(stateHome, 'humanloop');
+        mkdirSync(legacyKeyDir, { recursive: true });
+        const legacyKeyFile = join(legacyKeyDir, 'inbox-key');
+        writeFileSync(legacyKeyFile, 'M-i\n');
+        const result = installTmuxBindings(resolveKeybindings());
+        assert.equal(result.ok, true, JSON.stringify(result.diagnostics));
+        // Cleanup ran despite the existing manifest: M-i is crouter's tracked inbox
+        // toggle, no occupied/foreign diagnostic, and the key file is gone.
+        assert.ok(!result.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(result.diagnostics));
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.ok(result.installed.some((pair) => pair.table === 'root' && pair.key === 'M-i'));
+        assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        if (priorState === undefined)
+            delete process.env['XDG_STATE_HOME'];
+        else
+            process.env['XDG_STATE_HOME'] = priorState;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});
+test('tmux installer removes a legacy custom inbox key recorded in the state file', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-inbox-custom-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socket = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' }).stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    const priorState = process.env['XDG_STATE_HOME'];
+    const stateHome = mkdtempSync(join(tmpdir(), 'crtr-inbox-state-'));
+    process.env['TMUX'] = `${socket},1,0`;
+    process.env['XDG_STATE_HOME'] = stateHome;
+    try {
+        // Contract: an hl-owned binding at a non-default key named by the state
+        // file must be located via that file and unbound (its value is never
+        // imported as a crouter gesture), leaving crouter's configured M-i the only
+        // installed inbox key even when a crouter manifest already exists.
+        isolatedTmux(socket, ['set-option', '-s', '@crtr_keybindings_manifest', '[]']);
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-z', 'run-shell', '-b', 'hl inbox toggle --quiet --tmux-socket "#{socket_path}"']);
+        const legacyKeyDir = join(stateHome, 'humanloop');
+        mkdirSync(legacyKeyDir, { recursive: true });
+        const legacyKeyFile = join(legacyKeyDir, 'inbox-key');
+        writeFileSync(legacyKeyFile, 'M-z\n');
+        const result = installTmuxBindings(resolveKeybindings());
+        assert.equal(result.ok, true, JSON.stringify(result.diagnostics));
+        // The orphaned custom-key binding is gone — not left as an untracked live
+        // shortcut — and was not imported into crouter's config (M-z stays unbound).
+        assert.equal(tmuxBinding(socket, 'root', 'M-z'), null, 'legacy custom key must be unbound');
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        if (priorState === undefined)
+            delete process.env['XDG_STATE_HOME'];
+        else
+            process.env['XDG_STATE_HOME'] = priorState;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});
+test('legacyInboxKeyFile resolves under the OS home when HOME and XDG_STATE_HOME are unset', () => {
+    const priorHome = process.env['HOME'];
+    const priorState = process.env['XDG_STATE_HOME'];
+    delete process.env['HOME'];
+    delete process.env['XDG_STATE_HOME'];
+    try {
+        const resolved = legacyInboxKeyFile();
+        // Must be an absolute OS-home path (via os.homedir()), never cwd-relative —
+        // otherwise cleanup would miss the real file and could delete an unrelated
+        // file under the current directory.
+        assert.ok(resolved.startsWith('/'), `expected an absolute path, got ${resolved}`);
+        assert.ok(resolved.endsWith(join('.local', 'state', 'humanloop', 'inbox-key')), resolved);
+        assert.ok(!resolved.startsWith(join(process.cwd(), '.local')), `must not resolve relative to cwd: ${resolved}`);
+    }
+    finally {
+        if (priorHome === undefined)
+            delete process.env['HOME'];
+        else
+            process.env['HOME'] = priorHome;
+        if (priorState === undefined)
+            delete process.env['XDG_STATE_HOME'];
+        else
+            process.env['XDG_STATE_HOME'] = priorState;
+    }
+});

package/dist/core/canvas/__tests__/attention.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/canvas/__tests__/attention.test.js

@@ -0,0 +1,126 @@
+// attention.test.ts — the C2 ticket-attribution contract for `attention.ts`.
+//
+// The humanloop cutover generalized crouter's per-node attention counter from
+// "pending asks" to "all pending human tickets": a count now folds in decks
+// (asks), notify decks, AND anchored reviews, all bucketed by the
+// `source.nodeId` stamp humanloop puts on every crouter-originated submission.
+// This exercises the nuanced part that regressions hide in:
+//   - a cwd shared by several nodes is scanned ONCE and its tickets split by
+//     stamp, never double-counted;
+//   - decks, notify decks, and reviews all count;
+//   - a bare-shell ticket (no nodeId stamp) belongs to no node and is excluded
+//     from the per-node map;
+//   - every requested id is present (0 when it has none).
+import { test, before, beforeEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { atomicWriteJson, deckPath } from '@crouton-kit/humanloop';
+import { createNode } from '../canvas.js';
+import { closeDb } from '../db.js';
+import { interactionsRoot } from '../../artifact.js';
+import { countTickets, ticketCountsForNodes, pendingTicketsForView } from '../attention.js';
+function meta(id, cwd, extra) {
+    return {
+        node_id: id,
+        name: id,
+        created: new Date().toISOString(),
+        cwd,
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+        ...extra,
+    };
+}
+/** Seed a deck ticket (notify is just a durable deck) under `cwd`'s
+ *  interactions root, stamped with `nodeId` when given (omit for a bare-shell
+ *  ticket with no canvas owner). */
+function seedDeck(cwd, id, nodeId) {
+    const dir = join(interactionsRoot(cwd), id);
+    mkdirSync(dir, { recursive: true });
+    atomicWriteJson(deckPath(dir), {
+        source: nodeId === undefined ? {} : { nodeId },
+        interactions: [{ id: 'q', title: id, options: [] }],
+    });
+}
+/** Seed an anchored review ticket (review.json) under `cwd`, stamped `nodeId`. */
+function seedReview(cwd, id, nodeId) {
+    const dir = join(interactionsRoot(cwd), id);
+    mkdirSync(dir, { recursive: true });
+    atomicWriteJson(join(dir, 'review.json'), {
+        schema: 'humanloop.review/v1',
+        file: join(cwd, 'src.md'),
+        output: join(dir, 'feedback.json'),
+        title: id,
+        source: { nodeId },
+        blockedSince: new Date().toISOString(),
+    });
+}
+let home;
+let sharedCwd;
+let soloCwd;
+before(() => {
+    home = mkdtempSync(join(tmpdir(), 'crtr-attention-'));
+    sharedCwd = mkdtempSync(join(tmpdir(), 'crtr-attention-shared-'));
+    soloCwd = mkdtempSync(join(tmpdir(), 'crtr-attention-solo-'));
+    process.env['CRTR_HOME'] = home;
+});
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    rmSync(interactionsRoot(sharedCwd), { recursive: true, force: true });
+    rmSync(interactionsRoot(soloCwd), { recursive: true, force: true });
+});
+after(() => {
+    closeDb();
+    for (const d of [home, sharedCwd, soloCwd])
+        rmSync(d, { recursive: true, force: true });
+    delete process.env['CRTR_HOME'];
+});
+test('ticketCountsForNodes buckets deck/review/notify by node across a shared cwd and drops bare-shell tickets', () => {
+    // Nodes a and b share one cwd; c has its own.
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    createNode(meta('c', soloCwd));
+    // Shared cwd: two tickets for a (an ask + a notify deck), one review for b,
+    // and one unattributed bare-shell deck that belongs to no node.
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedDeck(sharedCwd, 'a-notify', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    seedDeck(sharedCwd, 'bare', undefined);
+    // Solo cwd: one ask for c.
+    seedDeck(soloCwd, 'c-ask', 'c');
+    const counts = ticketCountsForNodes(['a', 'b', 'c']);
+    // a: ask + notify = 2; b: review = 1; c: ask = 1. The bare-shell ticket is
+    // excluded from every per-node bucket even though it lives in a's cwd.
+    assert.deepEqual(counts, { a: 2, b: 1, c: 1 });
+});
+test('countTickets counts only the requesting node in a shared cwd', () => {
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    seedDeck(sharedCwd, 'bare', undefined);
+    assert.equal(countTickets('a'), 1);
+    assert.equal(countTickets('b'), 1);
+});
+test('every requested id is present with 0 when it has no tickets', () => {
+    createNode(meta('a', sharedCwd));
+    createNode(meta('c', soloCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    assert.deepEqual(ticketCountsForNodes(['a', 'c']), { a: 1, c: 0 });
+});
+test('pendingTicketsForView de-dups a shared cwd to one entry summing all its tickets', () => {
+    // a is the view root; b shares a's cwd.
+    createNode(meta('a', sharedCwd));
+    createNode(meta('b', sharedCwd));
+    seedDeck(sharedCwd, 'a-ask', 'a');
+    seedReview(sharedCwd, 'b-review', 'b');
+    const items = pendingTicketsForView('a');
+    // One cwd → one entry; its count is every pending ticket in that cwd (2),
+    // not a per-node split, so the shared dir is never counted twice.
+    assert.equal(items.length, 1);
+    assert.equal(items[0].count, 2);
+});

package/dist/core/canvas/__tests__/remote-canvas-source.test.js

@@ -207,8 +207,8 @@ test('a 500 response, a non-JSON body, and a non-zero exitCode all degrade grace
     const source = new RemoteCanvasSource(server.url, 'tok');
     assert.equal(await source.getNode('http500'), null);
     assert.deepEqual(await source.listNodes(), []);
-    assert.deepEqual(await source.askCountsForView('badjson'), {});
-    assert.deepEqual(await source.askCountsForView('nonzero-exit'), {});
+    assert.deepEqual(await source.ticketCountsForView('badjson'), {});
+    assert.deepEqual(await source.ticketCountsForView('nonzero-exit'), {});
 });
 test('malformed success JSON (exit 0, wrong shape) degrades cleanly instead of returning a shape a consumer would crash on', async (t) => {
     const server = await startMockCrtrServer((args) => {
@@ -247,8 +247,8 @@ test('malformed success JSON (exit 0, wrong shape) degrades cleanly instead of r
     // `listNodes()` with a non-array `nodes` field must degrade to [], never
     // throw or return the malformed value.
     assert.deepEqual(await source.listNodes(), []);
-    // `askCountsForView()` with a non-object `counts` field must degrade to {}.
-    assert.deepEqual(await source.askCountsForView('root'), {});
+    // `ticketCountsForView()` with a non-object `counts` field must degrade to {}.
+    assert.deepEqual(await source.ticketCountsForView('root'), {});
 });
 function fullNodeRow(id, over = {}) {
     return {

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -110,7 +110,7 @@ after(() => {
  *  poisoned session-file path so the mocked `node inspect show` response can
  *  point `pi_session_file` at it (the vector a regression would follow). */
 function seedPoisonedLocalState() {
-    // A local node row + a pending ask under its cwd — poisons `asksForNodes`.
+    // A local node row + a pending ticket under its cwd — poisons `ticketCountsForNodes`.
     createNode(meta('a', { cwd: localCwd }));
     const askDir = join(interactionsRoot(localCwd), 'poison-ask');
     mkdirSync(askDir, { recursive: true });

package/dist/core/canvas/attention.d.ts

@@ -1,34 +1,36 @@
-export interface AskEntry {
+export interface TicketEntry {
     node_id: string;
     name: string;
     cwd: string;
     count: number;
 }
 /**
- * Count pending asks for the cwd of a single node.
+ * Count pending tickets for the cwd of a single node.
  * Returns 0 when the node is unknown or humanloop is unavailable.
  */
-export declare function countAsks(nodeId: string): number;
+export declare function countTickets(nodeId: string): number;
 /**
- * Pending asks for all nodes reachable in the subscription sub-DAG from
+ * Pending tickets for all nodes reachable in the subscription sub-DAG from
  * `rootId` (including root itself). De-duped by cwd: when multiple nodes
  * share a cwd the first one encountered claims the entry.
  *
  * Returns only entries with count > 0.
  */
-export declare function pendingAsksForView(rootId: string): AskEntry[];
+export declare function pendingTicketsForView(rootId: string): TicketEntry[];
 /**
- * Per-node pending ask counts for an explicit set of node ids — the batched
- * counterpart to `countAsks`, used by the nav chrome to label every visible
+ * Per-node pending ticket counts for an explicit set of node ids — the batched
+ * counterpart to `countTickets`, used by the nav chrome to label every visible
  * node in ONE pass. Groups ids by their cwd so each distinct interactions dir
- * is scanned exactly once, then buckets the decks by the `source.nodeId` stamp
- * (same attribution as `countForCwd(cwd, nodeId)`). Asks with no node stamp are
- * not attributable to any node and are excluded. Every requested id appears in
- * the result (0 when it has none). Never throws.
+ * is scanned exactly once, de-duplicates by canonical ticket dir (scanInbox
+ * already returns one summary per dir), then buckets the tickets by the
+ * `source.nodeId` stamp (same attribution as `countForCwd(cwd, nodeId)`).
+ * Tickets with no node stamp (bare-shell / unattributed) belong to no node and
+ * are excluded from the map. Every requested id appears in the result (0 when
+ * it has none). Never throws.
  */
-export declare function asksForNodes(ids: string[]): Record<string, number>;
+export declare function ticketCountsForNodes(ids: string[]): Record<string, number>;
 /**
- * Pending asks across the entire canvas — every distinct cwd among all known
+ * Pending tickets across the entire canvas — every distinct cwd among all known
  * nodes. Returns only entries with count > 0.
  */
-export declare function asksAcrossCanvas(): AskEntry[];
+export declare function ticketsAcrossCanvas(): TicketEntry[];