@north-light/crouter 0.3.170 → 0.3.172

package/dist/core/__tests__/human-deliver.test.js

@@ -1,49 +1,27 @@
 // Run with: node --import tsx/esm --test src/core/__tests__/human-deliver.test.ts
 //
-// Unit C1 — crouter as a humanloop producer + completion bridge. These tests
-// pin the two crouter boundaries the hard cut leaves behind:
-//   1. ask/review ENQUEUE only — they create a bridge node, write a minimal
-//      run.json, submit to humanloop, and return immediately. No pane/pid.
-//   2. `_deliver` is the registered completion handler — it turns a humanloop
-//      completion event into the existing `pushFinal` delivery (deck/review) or
-//      a quiet bridge finalization (canceled), idempotently.
-//
-// Everything crosses the real humanloop package boundary: fixtures are the
-// canonical `response.json` union that humanloop's strict `readTicketResult`
-// decodes. Tickets live under a root REGISTERED to owner 'crouter' (the
-// delivery contract), isolated via a temp XDG_STATE_HOME + HOME + CRTR_HOME.
+// Crouter creates bridge tickets, while crtrd owns terminal ticket delivery.
 import { test, describe, before, after, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync, realpathSync, readFileSync, existsSync, symlinkSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, resolve, basename } from 'node:path';
+import { join, resolve } from 'node:path';
 import { Readable } from 'node:stream';
-import { registerInboxRoot, submitDeck, validateDeck, claimTicket, completeDeck, cancelTicket, readTicketResult, atomicWriteJson, } from '@crouton-kit/humanloop';
-import { spawnNode } from '../runtime/nodes.js';
+import { createApiServer } from '../../daemon/api/server.js';
+import { cancelHumanTicket, deliverTerminalResult, resolveDeckTicket } from '../../daemon/human/finish.js';
+import { humanAsk, humanNotify } from '../../commands/human/prompts.js';
+import { runCli } from '../command.js';
 import { getNode, listNodes, closeDb } from '../canvas/index.js';
 import { readInboxSince } from '../feed/inbox.js';
-import { humanAsk, humanReview, humanNotify } from '../../commands/human/prompts.js';
-import { runCli } from '../command.js';
 import { resolveRef } from '../canvas/history.js';
-import { humanDeliver } from '../../commands/human/queue.js';
-import { createApiServer } from '../../daemon/api/server.js';
-import { trustedCrouterVisualHandler } from '../../daemon/api/handlers/human.js';
 import { apiSocketPath, nodeDir } from '../canvas/paths.js';
+import { spawnNode } from '../runtime/nodes.js';
 import { resolveRoot } from '../../build-root.js';
-// ---------------------------------------------------------------------------
-// Isolated environment
-// ---------------------------------------------------------------------------
-let home; // CRTR_HOME (canvas db) + HOME (os.homedir → interactionsRoot)
-let stateHome; // XDG_STATE_HOME (humanloop root registry)
-let root; // canonical registered interaction root, owner 'crouter'
+import { validateDeck } from '../human/deck-schema.js';
+import { ticketDir } from '../human/root.js';
+import { readTicketResult, submitDeck } from '../human/tickets.js';
+let home;
 let priorHome;
-// Since the crtrd-API re-plumb the producer + completion leaves are thin CLI
-// forwarders: `ask`/`review` create their bridge node through
-// `cliClient().createHumanBridge`, and `_deliver` forwards the completion event
-// to crtrd, which owns the pushFinal/finalize delivery. Stand up a real
-// in-process `createApiServer()` bound to the isolated CRTR_HOME's socket so the
-// full leaf → client → server → handler path runs against the genuine seam —
-// never an autostarted subprocess daemon, never a mock client.
 let server;
 async function waitForSocket(path) {
     for (let i = 0; i < 200; i++) {
@@ -53,13 +31,6 @@ async function waitForSocket(path) {
     }
     throw new Error(`api socket never bound at ${path}`);
 }
-const ISO = '2026-07-10T12:00:00.000Z';
-/** A benign direct-exec handler so humanloop's completion dispatch during the
- *  submit/cancel race is a fast no-op — the crouter delivery is exercised by
- *  calling `_deliver` in-process, not through this subprocess. */
-function benignHandler() {
-    return { command: process.execPath, args: ['-e', ''] };
-}
 async function withPipedStdin(body, fn) {
     const original = process.stdin;
     const stdin = Readable.from([Buffer.from(body)]);
@@ -82,38 +53,22 @@ async function withMutedStdout(fn) {
         process.stdout.write = originalWrite;
     }
 }
-/** Register `dir` (created fresh) as an owner-'crouter' root and return its
- *  canonical path. */
-function registerRoot(dir) {
-    return registerInboxRoot({ root: dir, owner: 'crouter', handler: benignHandler() }).root;
-}
-/** Create a subscribed parent + a terminal human bridge child; return both ids.
- *  The parent is auto-subscribed to the bridge at spawn, so a `pushFinal` from
- *  the bridge fans into the parent's inbox — the sole answer route. */
 function bridgeUnder() {
     const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
     const bridge = spawnNode({ kind: 'human', parent, cwd: home, name: 'human-ask', lifecycle: 'terminal' }).node_id;
     return { parent, bridge };
 }
-/** Materialize an interaction dir under the registered root with a run.json. */
-function seedTicket(id, mode, jobId) {
-    const dir = join(root, id);
-    mkdirSync(dir, { recursive: true });
-    atomicWriteJson(join(dir, 'run.json'), { mode, ...(jobId !== undefined ? { job_id: jobId } : {}) });
-    return dir;
-}
-function completionEvent(dir, kind) {
-    return {
-        schema: 'humanloop.completion/v1',
-        root,
+function submitBridgeDeck(bridge) {
+    const dir = ticketDir(bridge);
+    submitDeck({
         dir,
-        ticketId: dir.split('/').pop(),
-        kind,
-        outcome: kind === 'canceled' ? 'canceled' : 'resolved',
-        responsePath: join(dir, 'response.json'),
-    };
+        deck: validateDeck({
+            title: 'Ship it?',
+            interactions: [{ id: 'question', title: 'Ship it?', subtitle: 'Decide whether to ship now so the release can proceed.', options: [], allowFreetext: true }],
+        }),
+    });
+    return dir;
 }
-/** Read the report body a subscriber inbox pointer references. */
 function reportBody(ref) {
     const resolved = resolveRef(ref);
     if (resolved === null || resolved.source !== 'report')
@@ -126,18 +81,15 @@ before(() => {
 beforeEach(async () => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-deliver-home-'));
-    stateHome = mkdtempSync(join(tmpdir(), 'crtr-deliver-state-'));
-    const rootDir = mkdtempSync(join(tmpdir(), 'crtr-deliver-root-'));
     process.env['CRTR_HOME'] = home;
     process.env['HOME'] = home;
-    process.env['XDG_STATE_HOME'] = stateHome;
     delete process.env['CRTR_NODE_ID'];
-    root = registerRoot(realpathSync(rootDir));
     server = createApiServer();
     await waitForSocket(apiSocketPath());
 });
 afterEach(async () => {
     await server?.close();
+    rmSync(home, { recursive: true, force: true });
 });
 after(() => {
     closeDb();
@@ -146,314 +98,88 @@ after(() => {
     else
         delete process.env['HOME'];
     delete process.env['CRTR_HOME'];
-    delete process.env['XDG_STATE_HOME'];
     delete process.env['CRTR_NODE_ID'];
 });
-// ---------------------------------------------------------------------------
-// (a) ask/review enqueue immediately — no pane/pid; run.json captures fork provenance
-// ---------------------------------------------------------------------------
-test('Visual handler trusts sealed sibling runtime generations across a daemon roll', () => {
-    const currentGeneration = 'a'.repeat(64);
-    const retainedGeneration = 'b'.repeat(64);
-    const current = {
-        command: '/home/.crouter/host/crouter',
-        args: [`/home/.crouter/runtime/generations/${currentGeneration}/dist/cli.js`, 'human', '_visual'],
-    };
-    const retained = {
-        command: '/opt/bin/node',
-        args: [`/home/.crouter/runtime/generations/${retainedGeneration}/dist/cli.js`, 'human', '_visual'],
-    };
-    assert.equal(trustedCrouterVisualHandler(retained, current), true);
-    assert.equal(trustedCrouterVisualHandler({ ...retained, command: '/tmp/python' }, current), false);
-    assert.equal(trustedCrouterVisualHandler({ ...retained, args: ['/tmp/cli.js', 'human', '_visual'] }, current), false);
-    assert.equal(trustedCrouterVisualHandler({ ...retained, args: [retained.args[0], 'human', '_deliver'] }, current), false);
-});
 describe('enqueue is producer-only', () => {
     test('ask requires and preserves an explicit title instead of deriving one from the body', async () => {
         const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
         process.env['CRTR_NODE_ID'] = parent;
         await assert.rejects(() => humanAsk.run({ question: 'This first line must never become the title.' }), /require a non-empty --title/);
-        const r = (await humanAsk.run({ title: 'Release decision', subtitle: 'Decide whether to release now so the launch can proceed.', question: 'This first line must never become the title.' }));
-        assert.equal(typeof r['job_id'], 'string');
-        assert.equal(typeof r['dir'], 'string');
-        assert.equal(typeof r['follow_up'], 'string');
-        for (const forbidden of ['pane_id', 'render_pane_id', 'pid', 'worker_pid']) {
-            assert.ok(!(forbidden in r), `ask result must not expose ${forbidden}`);
-        }
-        const deck = JSON.parse(readFileSync(join(r['dir'], 'deck.json'), 'utf8'));
+        const result = (await humanAsk.run({ title: 'Release decision', subtitle: 'Decide whether to release now so the launch can proceed.', question: 'This first line must never become the title.' }));
+        assert.equal(typeof result['job_id'], 'string');
+        assert.equal(typeof result['dir'], 'string');
+        for (const forbidden of ['pane_id', 'render_pane_id', 'pid', 'worker_pid'])
+            assert.ok(!(forbidden in result), `ask result must not expose ${forbidden}`);
+        const deck = JSON.parse(readFileSync(join(result['dir'], 'deck.json'), 'utf8'));
         assert.equal(deck.title, 'Release decision');
         assert.equal(deck.interactions[0]?.title, 'Release decision');
         assert.equal(deck.interactions[0]?.subtitle, 'Decide whether to release now so the launch can proceed.');
         assert.equal(deck.interactions[0]?.body, 'This first line must never become the title.');
         assert.equal(deck.interactions[0]?.kind, 'decision');
-        const structured = (await humanAsk.run({
-            deck: {
-                title: 'Structured decision',
-                interactions: [
-                    { id: 'default', title: 'Default', subtitle: 'Choose the default so the release can proceed.', options: [] },
-                    { id: 'context', kind: 'context', title: 'Context', subtitle: 'Read this context so the decision is informed.', options: [] },
-                ],
-            },
-        }));
-        const structuredDeck = JSON.parse(readFileSync(join(structured['dir'], 'deck.json'), 'utf8'));
-        assert.deepEqual(structuredDeck.interactions.map((interaction) => interaction.kind), ['decision', 'context']);
-        const deckDir = mkdtempSync(join(tmpdir(), 'crtr-context-file-deck-'));
-        assert.notEqual(resolve(process.cwd()), deckDir, 'the CLI caller cwd must differ from the deck directory');
-        const deckPath = join(deckDir, 'deck.json');
-        writeFileSync(join(deckDir, 'body.md'), 'The body came from beside the deck JSON.');
-        writeFileSync(deckPath, JSON.stringify({
-            title: 'Context file body',
-            interactions: [{
-                    id: 'decision',
-                    title: 'Use the deck',
-                    subtitle: 'Use the deck body so the person can decide with its context.',
-                    bodyPath: 'body.md',
-                    options: [{ id: 'yes', label: 'Yes' }],
-                }],
-        }));
-        const nodesBeforeContextFile = new Set(listNodes().map((node) => node.node_id));
+        const deckDirectory = mkdtempSync(join(tmpdir(), 'crtr-context-file-deck-'));
+        assert.notEqual(resolve(process.cwd()), deckDirectory, 'the CLI caller cwd must differ from the deck directory');
+        const deckPath = join(deckDirectory, 'deck.json');
+        writeFileSync(join(deckDirectory, 'body.md'), 'The body came from beside the deck JSON.');
+        writeFileSync(deckPath, JSON.stringify({ title: 'Context file body', interactions: [{ id: 'decision', title: 'Use the deck', subtitle: 'Use the deck body so the person can decide with its context.', bodyPath: 'body.md', options: [{ id: 'yes', label: 'Yes' }] }] }));
+        const nodesBefore = new Set(listNodes().map((node) => node.node_id));
         await withMutedStdout(() => withPipedStdin('', async () => {
             await runCli(await resolveRoot('human'), ['node', 'crtr', 'human', 'ask', '--context-file', deckPath]);
         }));
-        const contextFileBridge = listNodes().find((node) => !nodesBeforeContextFile.has(node.node_id));
-        assert.ok(contextFileBridge, 'the real CLI invocation created a human bridge');
-        const contextFileDeck = JSON.parse(readFileSync(join(nodeDir(contextFileBridge.node_id), 'deck.json'), 'utf8'));
-        assert.equal(contextFileDeck.interactions[0]?.body, 'The body came from beside the deck JSON.');
-        assert.equal(contextFileDeck.interactions[0]?.bodyPath, undefined);
-        await assert.rejects(() => humanAsk.run({
-            deck: {
-                title: 'Absolute path',
-                interactions: [{
-                        id: 'decision',
-                        title: 'Reject absolute path',
-                        subtitle: 'Reject the invalid path so the documented deck boundary remains intact.',
-                        bodyPath: join(deckDir, 'body.md'),
-                        options: [{ id: 'yes', label: 'Yes' }],
-                    }],
-            },
-        }, { providedParams: new Set(['deck']), contextFilePaths: new Map([['deck', deckPath]]) }), /absolute paths are unsupported/);
-        const rc = JSON.parse(readFileSync(join(r['dir'], 'run.json'), 'utf8'));
-        assert.equal(rc['mode'], 'ask');
-        assert.equal(rc['job_id'], r['job_id']);
-        assert.deepEqual(rc['conversation_fork'] && {
-            status: rc['conversation_fork']['status'],
-            reason: rc['conversation_fork']['reason'],
-        }, { status: 'unavailable', reason: 'broker_unavailable' });
-        const bridge = getNode(r['job_id']);
-        assert.equal(bridge?.kind, 'human');
-        assert.equal(bridge?.parent, parent);
-    });
-    test('review returns immediately and writes run.json = {mode:review, job_id}', async () => {
-        const parent = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'asker' }).node_id;
-        process.env['CRTR_NODE_ID'] = parent;
-        const md = join(home, 'plan.md');
-        writeFileSync(md, '# Plan\n\nline\n');
-        const r = (await humanReview.run({ file: md, subtitle: 'Review this plan so implementation can begin safely.' }));
-        assert.equal(typeof r['job_id'], 'string');
-        assert.ok(!('pane_id' in r) && !('render_pane_id' in r), 'no pane fields');
-        const rc = JSON.parse(readFileSync(join(r['dir'], 'run.json'), 'utf8'));
-        assert.deepEqual(rc, { mode: 'review', job_id: r['job_id'] });
+        const bridge = listNodes().find((node) => !nodesBefore.has(node.node_id));
+        assert.ok(bridge, 'the real CLI invocation created a human bridge');
+        const contextDeck = JSON.parse(readFileSync(join(nodeDir(bridge.node_id), 'deck.json'), 'utf8'));
+        assert.equal(contextDeck.interactions[0]?.body, 'The body came from beside the deck JSON.');
+        assert.equal(contextDeck.interactions[0]?.bodyPath, undefined);
     });
 });
-// ---------------------------------------------------------------------------
-// (b) deck _deliver: pushFinal exactly once, parent inbox gets the answer
-// ---------------------------------------------------------------------------
-describe('_deliver: deck', () => {
-    test('pushFinals the readable answer once and wakes the subscribed parent', async () => {
+describe('terminal ticket delivery', () => {
+    test('resolveDeckTicket pushFinals the readable answer once and wakes the subscribed parent', async () => {
         const { parent, bridge } = bridgeUnder();
-        const dir = seedTicket(bridge, 'ask', bridge);
-        const deckResult = {
-            schema: 'humanloop.response/v2',
-            kind: 'deck',
-            responses: [{ id: 'question', freetext: 'yes, ship' }],
-            summary: 'Ship it?: yes, ship',
-            completedAt: ISO,
-        };
-        writeFileSync(join(dir, 'response.json'), JSON.stringify(deckResult));
-        const out = (await humanDeliver.run({ body: JSON.stringify(completionEvent(dir, 'deck')) }));
-        assert.equal(out.delivered, true);
-        // Bridge finalized.
+        const dir = submitBridgeDeck(bridge);
+        const result = await resolveDeckTicket(bridge, [{ id: 'question', freetext: 'yes, ship' }]);
+        assert.equal(result.kind, 'deck');
         closeDb();
         assert.equal(getNode(bridge)?.status, 'done');
-        // Parent inbox has exactly one final pointer carrying the human's words —
-        // the summary, not a serialized envelope — plus the metadata path.
-        const finals = readInboxSince(parent).filter((e) => e.from === bridge && e.kind === 'final');
+        const finals = readInboxSince(parent).filter((entry) => entry.from === bridge && entry.kind === 'final');
         assert.equal(finals.length, 1, 'exactly one pushFinal reached the parent');
         const body = reportBody(finals[0].ref);
-        assert.equal(body.split('\n')[0], deckResult.summary, 'the answer leads the report');
-        assert.ok(body.includes(join(dir, 'response.json')), 'the canonical response path is one path away');
-        assert.ok(!body.includes('humanloop.response/v2'), 'no serialized envelope is inlined');
+        assert.equal(body.split('\n')[0], 'Ship it?: yes, ship');
+        assert.ok(body.includes(join(dir, 'response.json')));
+        assert.ok(!body.includes('humanloop.response/v2'));
     });
-    // (c) replay idempotent
-    test('a second _deliver is idempotent — no second push, still delivered', async () => {
+    test('a replay against a terminal bridge is a no-op', async () => {
         const { parent, bridge } = bridgeUnder();
-        const dir = seedTicket(bridge, 'ask', bridge);
-        writeFileSync(join(dir, 'response.json'), JSON.stringify({ schema: 'humanloop.response/v2', kind: 'deck', responses: [{ id: 'q', freetext: 'x' }], summary: 'q: x', completedAt: ISO }));
-        const ev = JSON.stringify(completionEvent(dir, 'deck'));
-        await humanDeliver.run({ body: ev });
-        const replay = (await humanDeliver.run({ body: ev }));
-        assert.equal(replay.delivered, true);
+        submitBridgeDeck(bridge);
+        await resolveDeckTicket(bridge, [{ id: 'question', freetext: 'yes' }]);
+        assert.equal(await deliverTerminalResult(bridge), true);
         closeDb();
-        const finals = readInboxSince(parent).filter((e) => e.from === bridge && e.kind === 'final');
+        const finals = readInboxSince(parent).filter((entry) => entry.from === bridge && entry.kind === 'final');
         assert.equal(finals.length, 1, 'replay after a terminal bridge pushes nothing further');
     });
-});
-// ---------------------------------------------------------------------------
-// (d) review _deliver: delivered == readable anchored comments + record path
-// ---------------------------------------------------------------------------
-describe('_deliver: review', () => {
-    test('pushes readable anchored comments plus the feedback-record path', async () => {
-        const { parent, bridge } = bridgeUnder();
-        const dir = seedTicket(bridge, 'review', bridge);
-        const md = realpathSync(home) + '/spec.md';
-        writeFileSync(md, '# spec\n');
-        const feedback = {
-            file: md,
-            submitted: true,
-            approved: false,
-            comments: [{ id: 'c1', line: 1, endLine: 1, lineText: '# spec', comment: 'tighten', createdAt: ISO }],
-            submittedAt: ISO,
-            savedAt: ISO,
-        };
-        writeFileSync(join(dir, 'response.json'), JSON.stringify({ schema: 'humanloop.review-response/v1', kind: 'review', result: feedback, completedAt: ISO }));
-        // The output projection humanloop writes: the bare FeedbackResult.
-        const projection = join(dir, 'feedback.json');
-        writeFileSync(projection, JSON.stringify(feedback));
-        const out = (await humanDeliver.run({ body: JSON.stringify(completionEvent(dir, 'review')) }));
-        assert.equal(out.delivered, true);
-        closeDb();
-        const finals = readInboxSince(parent).filter((e) => e.from === bridge && e.kind === 'final');
-        assert.equal(finals.length, 1);
-        const delivered = reportBody(finals[0].ref);
-        assert.ok(delivered.includes('1 comment on ' + md), 'the comment count and file lead the report');
-        assert.ok(delivered.includes('tighten'), 'the human\'s comment text is inline');
-        assert.ok(delivered.includes(join(dir, 'response.json')), 'the full feedback record is one path away');
-        assert.ok(!delivered.includes('"savedAt"'), 'no serialized FeedbackResult is inlined');
-        assert.deepEqual(JSON.parse(readFileSync(projection, 'utf8')), feedback, 'the output projection file is untouched');
-    });
-});
-// ---------------------------------------------------------------------------
-// (e) canceled _deliver: bridge finalized, deferred note skips the actor
-// ---------------------------------------------------------------------------
-describe('_deliver: canceled', () => {
-    test('finalizes the bridge and sends a deferred no-answer note to non-actor subscribers only', async () => {
-        // Two subscribers: the actor (who canceled) and another waiter.
+    test('cancelHumanTicket finishes the bridge and notifies non-actor subscribers', async () => {
         const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
         const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-ask', lifecycle: 'terminal' }).node_id;
         const other = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'other' }).node_id;
-        // `other` also subscribes to the bridge.
         const { subscribe } = await import('../canvas/canvas.js');
         subscribe(other, bridge, true);
-        const dir = seedTicket(bridge, 'ask', bridge);
-        writeFileSync(join(dir, 'response.json'), JSON.stringify({ schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: ISO, reason: 'stale', actor }));
-        const out = (await humanDeliver.run({ body: JSON.stringify(completionEvent(dir, 'canceled')) }));
-        assert.equal(out.delivered, true);
-        closeDb();
-        assert.equal(getNode(bridge)?.status, 'done', 'canceled bridge finalized');
-        // Actor (who canceled) gets no note; the other waiter does.
-        assert.equal(readInboxSince(actor).length, 0, 'the cancelling actor is not messaged');
-        const otherNotes = readInboxSince(other);
-        assert.equal(otherNotes.length, 1, 'the other waiter gets one deferred note');
-        assert.equal(otherNotes[0].tier, 'deferred');
-        assert.match(otherNotes[0].label, /canceled/);
-    });
-});
-// ---------------------------------------------------------------------------
-// (e2) REGRESSION (Unit X DEFECT F) — a completion event whose root/dir carry an
-// UNRESOLVED symlinked path component still delivers.
-//
-// Humanloop's registry stores every root realpath-canonicalized, but its
-// `dispatchCompletion` only `resolve()`s the dir into the event (not realpath),
-// and crouter's own `human cancel` hands `cancelTicket` a CRTR_HOME-derived dir
-// that is likewise not realpath'd. On any host whose interaction path has a
-// symlinked component (macOS `/tmp`→`/private/tmp`, `/var`→`/private/var`) the
-// event thus carries `/tmp/…` while the registry holds `/private/tmp/…`. Before
-// the fix, `_deliver` compared those with a plain `resolve()` and spuriously
-// threw `interaction dir is not a direct child of the event root` (exit 2) →
-// humanloop wrote delivery-error.json and NO delivery.json, and the cancel
-// completion was never acknowledged. The deck-SUBMIT path dodged this only
-// because the controller's dir already comes from scanning the realpath'd root.
-// `_deliver` now realpath-canonicalizes both sides, so any caller's event
-// delivers regardless of symlinked components.
-// ---------------------------------------------------------------------------
-describe('_deliver: symlinked event paths (DEFECT F regression)', () => {
-    test('delivers a canceled completion whose root/dir carry an unresolved symlink', async () => {
-        // A symlink whose target is the registered root's PARENT, so `symRoot`
-        // realpath-resolves to the registered (realpath'd) `root` but is a distinct
-        // string with an unresolved symlink component — exactly humanloop's event shape.
-        const linkParent = mkdtempSync(join(tmpdir(), 'crtr-deliver-link-'));
-        const link = join(linkParent, 'lnk');
-        symlinkSync(dirname(root), link);
-        const symRoot = join(link, basename(root));
-        assert.notEqual(symRoot, root, 'symRoot is a distinct string');
-        assert.equal(realpathSync(symRoot), root, 'but realpath-resolves to the registered root');
-        const actor = spawnNode({ kind: 'general', parent: null, cwd: home, name: 'actor' }).node_id;
-        const bridge = spawnNode({ kind: 'human', parent: actor, cwd: home, name: 'human-ask', lifecycle: 'terminal' }).node_id;
-        const dir = seedTicket(bridge, 'ask', bridge); // real (realpath'd) dir on disk
-        writeFileSync(join(dir, 'response.json'), JSON.stringify({ schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: ISO, actor }));
-        // The event carries the SYMLINKED root/dir/responsePath (non-realpath), the
-        // way dispatchCompletion + `human cancel` build it on a symlinked host.
-        const symDir = join(symRoot, bridge);
-        const event = {
-            schema: 'humanloop.completion/v1',
-            root: symRoot,
-            dir: symDir,
-            ticketId: bridge,
-            kind: 'canceled',
-            outcome: 'canceled',
-            responsePath: join(symDir, 'response.json'),
-        };
-        const out = (await humanDeliver.run({ body: JSON.stringify(event) }));
-        assert.equal(out.delivered, true, 'the cancel completion delivers (no exit-2 rejection)');
-        closeDb();
-        assert.equal(getNode(bridge)?.status, 'done', 'the bridge is finalized exactly once');
-        assert.equal(readInboxSince(actor).length, 0, 'the cancelling actor is not messaged');
-    });
-});
-// ---------------------------------------------------------------------------
-// (f) submit/cancel race via humanloop primitives → one outcome; crouter converges
-// ---------------------------------------------------------------------------
-describe('submit/cancel race', () => {
-    test('one canonical outcome wins and _deliver converges the bridge to a single terminal state', async () => {
-        const { bridge } = bridgeUnder();
-        const dir = join(root, bridge);
-        mkdirSync(dir, { recursive: true });
-        atomicWriteJson(join(dir, 'run.json'), { mode: 'ask', job_id: bridge });
-        const deck = validateDeck({ title: 'Go?', interactions: [{ id: 'q', title: 'Go?', subtitle: 'Decide whether to proceed so the work can continue.', options: [], allowFreetext: true }] });
-        submitDeck({ root, id: bridge, deck });
-        const claim = claimTicket(dir);
-        assert.ok(claim !== null, 'claimed the fresh ticket');
-        // Race an answer against a cancellation on the same exclusive publish.
-        const [completed, canceled] = await Promise.allSettled([
-            completeDeck(dir, [{ id: 'q', freetext: 'go' }], claim.token),
-            cancelTicket(dir, { reason: 'changed mind', actor: 'someone' }),
-        ]);
-        // Exactly one canonical final marker exists on disk.
-        const result = readTicketResult(dir);
-        assert.ok(result !== null, 'a single canonical response.json won');
-        assert.ok(result.kind === 'deck' || result.kind === 'canceled');
-        // Whatever won, at most one side reports a win.
-        const wonDeck = completed.status === 'fulfilled' && completed.value.won === true;
-        const wonCancel = canceled.status === 'fulfilled' && canceled.value.status === 'canceled';
-        assert.ok(!(wonDeck && wonCancel), 'submit and cancel cannot both win');
-        // Feed the winning outcome to crouter; the bridge reaches exactly one terminal state.
-        const out = (await humanDeliver.run({ body: JSON.stringify(completionEvent(dir, result.kind)) }));
-        assert.equal(out.delivered, true);
+        submitBridgeDeck(bridge);
+        await cancelHumanTicket(bridge, { reason: 'stale', actor });
         closeDb();
-        assert.equal(getNode(bridge)?.status, 'done', 'bridge converged to one terminal outcome');
+        assert.equal(getNode(bridge)?.status, 'done');
+        assert.equal(readInboxSince(actor).length, 0, 'the canceling actor is not messaged');
+        const notes = readInboxSince(other);
+        assert.equal(notes.length, 1, 'the other waiter gets one deferred note');
+        assert.equal(notes[0].tier, 'deferred');
+        assert.match(notes[0].label, /canceled/);
     });
 });
-// ---------------------------------------------------------------------------
-// (g) notify creates no node
-// ---------------------------------------------------------------------------
-describe('notify', () => {
-    test('enqueues a durable deck and creates no canvas node', async () => {
-        const before = listNodes().length;
-        const r = (await humanNotify.run({ title: 'Build done', subtitle: 'The build passed, so the change is ready to review.' }));
-        assert.equal(r['queued'], true);
-        assert.equal(typeof r['dir'], 'string');
-        assert.ok(existsSync(join(r['dir'], 'deck.json')), 'notify wrote a durable deck');
-        closeDb();
-        assert.equal(listNodes().length, before, 'notify created no node');
-    });
+test('notify enqueues a durable deck and creates no canvas node', async () => {
+    const before = listNodes().length;
+    const result = (await humanNotify.run({ title: 'Build done', subtitle: 'The build passed, so the change is ready to review.' }));
+    assert.equal(result['queued'], true);
+    assert.equal(typeof result['dir'], 'string');
+    assert.ok(existsSync(join(result['dir'], 'deck.json')));
+    assert.ok(readTicketResult(result['dir']) === null);
+    closeDb();
+    assert.equal(listNodes().length, before);
 });

package/dist/core/__tests__/inline-memory-refs.test.js

@@ -3,8 +3,8 @@
 // Load-bearing shared-contract regression for the inline memory-reference
 // token grammar (spec §4.1): `src/core/memory/inline-ref-grammar.ts` is the
 // SINGLE implementation the broker, terminal attach viewer, and web composer
-// all consume. This file (Wave C1) covers the grammar/caret/browser-barrel
-// cases. Wave C4 extends it (below, in its own `describe`) with the
+// all consume. This file (Wave C1) covers the grammar/caret cases. Wave C4
+// extends it (below, in its own `describe`) with the
 // corpus/inventory/guidance cases: `buildRefInventory`'s precedence dedup,
 // both-kinds/gated/slash:false referenceability, INDEX naming, and
 // metadata-only output, plus `buildGuidance`'s exact-match resolution,
@@ -113,16 +113,6 @@ test('findRefTokenAtCaret: caret at start of a leading token', () => {
     const caret = findRefTokenAtCaret(text, 1); // right after the slash
     assert.deepEqual(caret, { start: 0, end: 4, surfacePrefix: '/' });
 });
-test('browser barrel (src/web/index.ts) re-exports the identical grammar', async () => {
-    const barrel = await import('../../web/index.js');
-    assert.equal(barrel.findRefTokens, findRefTokens, 'must be the same function, not a mirrored copy');
-    assert.equal(barrel.formatRefToken, formatRefToken);
-    assert.equal(barrel.findRefTokenAtCaret, findRefTokenAtCaret);
-    // And it behaves identically when driven through the barrel.
-    const [tok] = barrel.findRefTokens('read /dev before starting');
-    assert.equal(tok.candidate, 'dev');
-    assert.equal(barrel.formatRefToken('taste/foo'), '/taste:foo');
-});
 // ---------------------------------------------------------------------------
 // Wave C4 — buildGuidance: pure over (text, names), no filesystem/corpus
 // involved. See the fixture-backed buildRefInventory suite below for the

package/dist/core/__tests__/memory-resolver-precedence.test.js

@@ -1,11 +1,10 @@
-// Regression matrix for `resolveMemoryDoc`'s precedence rule: scopes/sources
-// are visited NEAREST-FIRST, and the first source with ANY hit — by identity,
-// direct physical path, or bare-leaf fallback — wins outright. A farther
-// source's match, even an EXACT identity match, must never be consulted once
-// a nearer source has answered by any means. This locks in the fix for the
-// regression where a global identity-first scan let a farther-scope doc named
-// exactly `AGENTS` shadow a nearer worktree's own `AGENTS.md` (whose explicit
-// frontmatter `name` had since diverged from the physical filename).
+// Regression matrix for `resolveMemoryDoc`'s precedence rule: exact identity
+// and direct physical-path matches are resolved NEAREST-FIRST across the whole
+// scope stack before bare-leaf fallback is considered. This prevents a nested
+// doc's coincidental leaf from hiding a farther canonical identity while still
+// ensuring a nearer worktree's own physical `AGENTS.md` beats a farther doc
+// named exactly `AGENTS`, even when the nearer file's explicit frontmatter
+// identity has diverged from its physical filename.
 //
 // Fixture shape: two nested project scopes on disk —
 //   root/.crouter/memory/...       (farther project scope)
@@ -149,19 +148,17 @@ test('--kind skips a nearer wrong-kind (frontmatter-less, kind-defaulted) doc an
         process.chdir(prevCwd);
     }
 });
-test('two docs sharing a path-derived leaf name across scopes: nearest wins even over a farther EXACT identity match', () => {
+test('an exact identity match beats a nearer document reached only by leaf fallback', () => {
     process.chdir(child);
     resetScopeCache();
     try {
         // Nearest scope's doc lives at "sub/shared.md" (derived name "sub/shared",
         // leaf "shared"); the farther scope's doc lives at top-level "shared.md"
-        // (derived name "shared", an EXACT identity match for the bare query).
-        // Precedence-as-outer-loop means the nearer source's mere leaf-fallback
-        // hit must still beat the farther source's exact identity hit.
+        // (derived name "shared", an exact identity match for the bare query).
         const doc = resolveMemoryDoc('shared');
-        assert.equal(doc.path, join(child, '.crouter', 'memory', 'sub', 'shared.md'));
-        assert.equal(doc.name, 'sub/shared');
-        assert.match(doc.body, /CHILD SUB SHARED BODY/);
+        assert.equal(doc.path, join(root, '.crouter', 'memory', 'shared.md'));
+        assert.equal(doc.name, 'shared');
+        assert.match(doc.body, /ROOT SHARED BODY/);
     }
     finally {
         process.chdir(prevCwd);

package/dist/core/__tests__/migration.test.js

@@ -18,6 +18,12 @@ const PRE_TOOL_GUIDE_CANVAS_EXTENSION_NAMES = [
     'canvas-goal-capture', 'canvas-passive-context', 'canvas-context-intro',
     'canvas-doc-substrate', 'canvas-structured-output', 'canvas-bash-valve',
 ];
+const REVIEW_BOUNDARY_CANVAS_EXTENSION_NAMES = [
+    'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
+    'canvas-goal-capture', 'canvas-passive-context', 'canvas-review-boundary',
+    'canvas-context-intro', 'canvas-tool-guide', 'canvas-doc-substrate',
+    'canvas-structured-output', 'canvas-bash-valve',
+];
 let home;
 async function waitForPath(path) {
     for (;;) {
@@ -74,6 +80,10 @@ test('opening a fresh home migrates to the latest user_version', () => {
     const db = openDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
 });
+test('a persisted review-boundary canvas prefix is not treated as custom extensions', () => {
+    const persisted = REVIEW_BOUNDARY_CANVAS_EXTENSION_NAMES.map((name) => `/old-generation/pi-extensions/${name}.js`);
+    assert.deepEqual(customExtensionPaths(persisted), []);
+});
 test('a v14 canvas normalizes historical canvas paths while retaining custom launch extras', () => {
     const metaPath = join(home, 'nodes', 'saved', 'meta.json');
     mkdirSync(join(home, 'nodes', 'saved'), { recursive: true });