@north-light/crouter 0.3.170 → 0.3.172

package/dist/core/__tests__/tmux-surface.test.js

@@ -199,44 +199,44 @@ test('tmux installer remaps owned pairs and preserves occupied user bindings', (
         // item name between the previous group and the header).
         assert.ok((defaultMenu.match(/'' "-#\[bold\]/g) ?? []).length >= 3, defaultMenu);
         assert.ok(defaultMenu.indexOf('promote to orchestrator') > defaultMenu.indexOf('-#[bold]Lifecycle'));
-        assert.match(defaultMenu, /"create ›" i .*display-menu.*idea.*bug/);
+        assert.match(defaultMenu, /"create ›" c .*display-menu.*idea.*bug/);
         assert.match(defaultMenu, /"Alt\+C to close" M-c refresh-client/);
         const explore = defaultMenu.indexOf('-#[bold]Explore');
         const currentNode = defaultMenu.indexOf('-#[bold]Current node');
         const lifecycle = defaultMenu.indexOf('-#[bold]Lifecycle');
         const system = defaultMenu.indexOf('-#[bold]System');
-        for (const item of ['resume node', 'graph view', 'focus manager', 'show ›', 'view settings ›']) {
+        for (const item of ['find node', 'canvas graph', 'go to manager', 'inspect ›', 'display ›']) {
             assert.ok(defaultMenu.indexOf(item) > explore && defaultMenu.indexOf(item) < currentNode, `${item} belongs in Explore`);
         }
-        assert.match(defaultMenu, /"show ›" s .*display-menu.*metadata.*context \+ reports/);
-        for (const item of ['background bash command', 'copy node id']) {
+        assert.match(defaultMenu, /"inspect ›" i .*display-menu.*metadata.*context \+ reports/);
+        for (const item of ['background running bash', 'copy node id']) {
             assert.ok(defaultMenu.indexOf(item) > currentNode && defaultMenu.indexOf(item) < lifecycle, `${item} belongs to the current node`);
         }
         assert.ok(defaultMenu.indexOf('fork into idle root') > lifecycle && defaultMenu.indexOf('fork into idle root') < system, 'fork belongs in Lifecycle');
-        assert.match(defaultMenu, /"view settings ›" w .*display-menu.*fold finished tool calls/);
-        assert.match(defaultMenu, /"attach ›" a .*display-menu.*search profile files/);
+        assert.match(defaultMenu, /"display ›" z .*display-menu.*fold finished tool calls/);
+        assert.match(defaultMenu, /"attach viewer ›" a .*display-menu.*search profile files/);
+        // File review is reachable from the top-level menu and alt+shift+R only:
+        // its attach-submenu selector ships unbound, so the row must not render.
+        assert.doesNotMatch(defaultMenu, /"review a file" r /);
         assert.match(defaultMenu, /send-keys -l/);
         assert.match(defaultMenu, /crtr\.attach\.profile-files/, 'the menu path must work while the profile-files direct binding is disabled by default');
-        // Matched with its selector, so the Explore group's "view settings ›" item
-        // (selector `w`) cannot satisfy this assertion by substring.
-        assert.ok(defaultMenu.indexOf('settings p ') > system, 'settings belongs in System');
+        // Matched with its selector, so the Explore group's "display ›" item
+        // cannot satisfy this assertion by substring.
+        assert.ok(defaultMenu.indexOf('settings , ') > system, 'settings belongs in System');
         assert.ok(defaultMenu.indexOf('create ›') > system, 'create belongs in System');
-        assert.match(tmuxBinding(socket, 'root', 'M-v') ?? '', /switch-client/);
         // The inbox toggle installs at its default key (alt+i → M-i) in the same sweep.
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
         const attachMenuDisabled = Object.fromEntries(ATTACH_CONTROL_BINDINGS.map(({ menuId }) => [menuId, []]));
         const withoutAttach = installTmuxBindings(resolveKeybindings(attachMenuDisabled));
         assert.equal(withoutAttach.ok, true, JSON.stringify(withoutAttach.diagnostics));
         const menuWithoutAttach = tmuxBinding(socket, 'root', 'M-c') ?? '';
-        assert.doesNotMatch(menuWithoutAttach, /attach ›/, 'an empty attach submenu must hide its opener');
+        assert.doesNotMatch(menuWithoutAttach, /attach viewer ›/, 'an empty attach submenu must hide its opener');
         assert.doesNotMatch(menuWithoutAttach, /search profile files/);
         const remapped = installTmuxBindings(resolveKeybindings({
             'crtr.tmux.menu.open': ['alt+shift+z'],
             'crtr.tmux.menu.graph': ['shift+z'],
             'crtr.tmux.menu-global.fold-tools': ['alt+shift+f'],
             'crtr.tmux.node.next': [],
-            'crtr.tmux.view.next': ['alt+z > n'],
-            'crtr.tmux.view.previous': ['alt+z > p'],
         }));
         assert.equal(remapped.ok, true, JSON.stringify(remapped.diagnostics));
         assert.equal(tmuxBinding(socket, 'root', 'M-c'), null);
@@ -247,16 +247,12 @@ test('tmux installer remaps owned pairs and preserves occupied user bindings', (
         assert.match(foldTools, /fold-tools/);
         assert.doesNotMatch(foldTools, /#\{pane_id\}/);
         const menu = tmuxBinding(socket, 'root', 'M-S-Z') ?? '';
-        assert.match(menu, /graph view/);
+        assert.match(menu, /canvas graph/);
         assert.match(menu, /Z/);
         assert.match(menu, /"Alt\+Shift\+Z to close" M-S-Z refresh-client/);
-        const prefix = tmuxBinding(socket, 'root', 'M-z') ?? '';
-        assert.match(prefix, /switch-client/);
         const again = installTmuxBindings(resolveKeybindings({
             'crtr.tmux.menu.open': ['alt+shift+y'],
             'crtr.tmux.node.next': [],
-            'crtr.tmux.view.next': ['alt+z > n'],
-            'crtr.tmux.view.previous': ['alt+z > p'],
         }));
         assert.equal(again.ok, true, JSON.stringify(again.diagnostics));
         isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-S-Z', 'display-message', 'user-owned']);
@@ -297,11 +293,11 @@ test('tmux installer replaces an untracked stale crouter menu even when a partia
         ]);
         const stale = tmuxBinding(socket, 'root', 'M-c') ?? '';
         assert.match(stale, /crtr canvas chord/);
-        assert.doesNotMatch(stale, /background bash command/);
+        assert.doesNotMatch(stale, /background running bash/);
         const result = installTmuxBindings(resolveKeybindings());
         assert.equal(result.ok, true, JSON.stringify(result.diagnostics));
         assert.ok(!result.diagnostics.some((d) => d.bindingId === 'crtr.tmux.menu.open'), JSON.stringify(result.diagnostics));
-        assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /background bash command/);
+        assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /background running bash/);
     }
     finally {
         if (priorTmux === undefined)
@@ -340,7 +336,7 @@ test('tmux installer rebinds/disables the inbox toggle and adopts the legacy hl-
         assert.equal(first.ok, true, JSON.stringify(first.diagnostics));
         // Adopted, not foreign: M-i is now crouter's inbox toggle, no occupied diag.
         assert.ok(!first.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(first.diagnostics));
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
         assert.ok(first.installed.some((pair) => pair.table === 'root' && pair.key === 'M-i'));
         // The obsolete flat key file is deleted by the cleanup.
         assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
@@ -349,7 +345,7 @@ test('tmux installer rebinds/disables the inbox toggle and adopts the legacy hl-
         const rebound = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.inbox.toggle': ['alt+j'] }));
         assert.equal(rebound.ok, true, JSON.stringify(rebound.diagnostics));
         assert.equal(tmuxBinding(socket, 'root', 'M-i'), null);
-        assert.match(tmuxBinding(socket, 'root', 'M-j') ?? '', /hl inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-j') ?? '', /crtr human inbox toggle/);
         // Disable via empty gesture list: no inbox key installed at all, no error.
         const disabled = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.inbox.toggle': [] }));
         assert.equal(disabled.ok, true, JSON.stringify(disabled.diagnostics));
@@ -399,7 +395,7 @@ test('tmux installer adopts the legacy hl-owned inbox key when a crouter manifes
         // Cleanup ran despite the existing manifest: M-i is crouter's tracked inbox
         // toggle, no occupied/foreign diagnostic, and the key file is gone.
         assert.ok(!result.diagnostics.some((d) => d.bindingId === 'crtr.tmux.inbox.toggle'), JSON.stringify(result.diagnostics));
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
         assert.ok(result.installed.some((pair) => pair.table === 'root' && pair.key === 'M-i'));
         assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
     }
@@ -446,7 +442,7 @@ test('tmux installer removes a legacy custom inbox key recorded in the state fil
         // The orphaned custom-key binding is gone — not left as an untracked live
         // shortcut — and was not imported into crouter's config (M-z stays unbound).
         assert.equal(tmuxBinding(socket, 'root', 'M-z'), null, 'legacy custom key must be unbound');
-        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /hl inbox toggle/);
+        assert.match(tmuxBinding(socket, 'root', 'M-i') ?? '', /crtr human inbox toggle/);
         assert.equal(existsSync(legacyKeyFile), false, 'legacy inbox-key file should be removed');
     }
     finally {

package/dist/core/asset-root.d.ts

@@ -0,0 +1,7 @@
+/** The source or runtime directory containing every shipped asset tree.
+ *
+ * `import.meta.url` names the module when loaded directly, but names the
+ * attach viewer bundle when esbuild inlines this module. Walking to the
+ * directory marked by the built-in assets preserves one resolution rule for
+ * both loading contexts. */
+export declare function assetRoot(): string;

package/dist/core/asset-root.js

@@ -0,0 +1,18 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** The source or runtime directory containing every shipped asset tree.
+ *
+ * `import.meta.url` names the module when loaded directly, but names the
+ * attach viewer bundle when esbuild inlines this module. Walking to the
+ * directory marked by the built-in assets preserves one resolution rule for
+ * both loading contexts. */
+export function assetRoot() {
+    for (let current = dirname(fileURLToPath(import.meta.url));; current = dirname(current)) {
+        if (existsSync(join(current, 'builtin-memory')) && existsSync(join(current, 'builtin-pi-packages')))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            throw new Error(`cannot locate crouter assets from ${import.meta.url}`);
+    }
+}

package/dist/core/broker-client/client.d.ts

@@ -16,12 +16,6 @@ export interface BrokerClientOptions {
      *  to attach a remote node instead; every method behaves identically either
      *  way. */
     transport?: Transport;
-    /** Re-emit a `data` frame that matches no in-flight request as a generic
-     *  `frame` event. OFF by default: the attach viewer's frame router would
-     *  mis-handle a stray `data` frame as a pi `AgentSessionEvent`. The operator
-     *  view (`core/view/stream-local.ts`) passes read-op replies through to its
-     *  own consumer and is the one caller that needs `true`. */
-    emitUnmatchedDataFrames?: boolean;
 }
 /** The reconnect supervisor's give-up predicate (extracted pure so it is
  *  testable without a socket or TUI). After a broker close the viewer KEEPS
@@ -51,7 +45,6 @@ export interface BrokerClient {
 export declare class BrokerClient extends EventEmitter {
     private readonly nodeId;
     private readonly transport;
-    private readonly emitUnmatchedDataFrames;
     private closeEmitted;
     /** Tracks live connect↔close state so {@link request} can fail fast on a
      *  dead/absent connection rather than parking a promise the reply will

package/dist/core/broker-client/client.js

@@ -1,7 +1,7 @@
 // client.ts — THE broker protocol client. Every Node process that talks to a
 // node's broker over `view.sock` uses this one class: the `crtr surface attach`
-// viewer, `core/view/stream-local`, `auth-reload`, `model-swap`, and the
-// human-prompt dequeue path. (The browser has its own module under
+// viewer, `auth-reload`, `model-swap`, and the human-prompt dequeue path.
+// (The browser has its own module under
 // `clients/web/web-client/` until that is made isomorphic — see the target
 // architecture note; `daemon/api/bridge.ts` is a byte relay, not a client.)
 //
@@ -57,7 +57,6 @@ export function reconnectShouldGiveUp(row) {
 export class BrokerClient extends EventEmitter {
     nodeId;
     transport;
-    emitUnmatchedDataFrames;
     closeEmitted = false;
     /** Tracks live connect↔close state so {@link request} can fail fast on a
      *  dead/absent connection rather than parking a promise the reply will
@@ -76,7 +75,6 @@ export class BrokerClient extends EventEmitter {
     constructor(nodeId, options = {}) {
         super();
         this.nodeId = nodeId;
-        this.emitUnmatchedDataFrames = options.emitUnmatchedDataFrames ?? false;
         this.transport = options.transport ?? new SocketTransport(nodeId);
         this.transport.on('connect', () => {
             this.closeEmitted = false;
@@ -148,9 +146,8 @@ export class BrokerClient extends EventEmitter {
         // would otherwise treat a `data` frame as an AgentSessionEvent). A `data`
         // frame is ALWAYS a reply, so by default it is swallowed unconditionally —
         // even a late post-timeout one (no pending entry) is dropped, never leaked
-        // to the router; `emitUnmatchedDataFrames` opts a caller into seeing those.
-        // An `error` is correlated only when its `id` matches an in-flight request;
-        // an uncorrelated error still flows through.
+        // to the router. An `error` is correlated only when its `id` matches an
+        // in-flight request; an uncorrelated error still flows through.
         if (frame.type === 'data') {
             const entry = typeof frame.id === 'string' ? this.pending.get(frame.id) : undefined;
             if (entry) {
@@ -158,9 +155,6 @@ export class BrokerClient extends EventEmitter {
                 clearTimeout(entry.timer);
                 entry.resolve(frame);
             }
-            else if (this.emitUnmatchedDataFrames) {
-                this.emit('frame', frame);
-            }
             return;
         }
         if (frame.type === 'error' && typeof frame.id === 'string' && this.pending.has(frame.id)) {

package/dist/core/broker-client/transport-relay.d.ts

@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { ClientToBroker } from '../runtime/broker-protocol.js';
 import { type Transport } from './transport.js';
-/** A resolved remote canvas target — see `core/view/remote-canvas-target.ts` for how
+/** A resolved remote canvas target — see `core/remote-canvas-target.ts` for how
  *  this is assembled from config (`relayTokenRef`) plus the 0600 secrets store
  *  via `resolveRemoteCanvasTarget`. This transport itself never takes the
  *  token from argv — `canvas config add --relay-token -` is the only accepted
@@ -29,9 +29,8 @@ export declare class RelayTransport extends EventEmitter implements Transport {
     destroy(): void;
     private onMessage;
     private onError;
-    /** WS close codes mirror the SAME semantics the browser relay client
-     *  (`clients/web/web-client/broker-client.ts`'s `onclose` / `src/web/
-     *  transport-stream.ts`'s `classifyClose`): 1008 invalid id, or a 1011 whose
+    /** WS close codes mirror the browser relay client's semantics: 1008 invalid
+     *  id, or a 1011 whose
      *  REASON starts with "no running broker"/"no node " (the relay's exact
      *  wording — `src/clients/web/server.ts`), are the terminal "gone" signals —
      *  surfaced as BrokerUnavailableError so the reconnect supervisor's normal

package/dist/core/broker-client/transport-relay.js

@@ -13,7 +13,7 @@
 //
 // The relay token is the SAME in-guest credential model-auth-front already
 // gates on; holding it is the in-guest trust tier, not a new one. Callers
-// must keep it off argv/shell history (see `core/view/remote-canvas-target.ts`) — this
+// must keep it off argv/shell history (see `core/remote-canvas-target.ts`) — this
 // transport only ever sends it as a request header, never logs it.
 import { EventEmitter } from 'node:events';
 import { WebSocket } from 'ws';
@@ -132,9 +132,8 @@ export class RelayTransport extends EventEmitter {
         this.emitError(new Error(`relay transport error: ${err.message}`));
         // 'close' follows 'error'; teardown converges there.
     }
-    /** WS close codes mirror the SAME semantics the browser relay client
-     *  (`clients/web/web-client/broker-client.ts`'s `onclose` / `src/web/
-     *  transport-stream.ts`'s `classifyClose`): 1008 invalid id, or a 1011 whose
+    /** WS close codes mirror the browser relay client's semantics: 1008 invalid
+     *  id, or a 1011 whose
      *  REASON starts with "no running broker"/"no node " (the relay's exact
      *  wording — `src/clients/web/server.ts`), are the terminal "gone" signals —
      *  surfaced as BrokerUnavailableError so the reconnect supervisor's normal

package/dist/core/canvas/__tests__/attention.test.js

@@ -4,7 +4,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { atomicWriteJson, deckPath } from '@crouton-kit/humanloop';
+import { atomicWriteJson, deckPath } from '../../human/convention.js';
 import { createNode } from '../canvas.js';
 import { closeDb } from '../db.js';
 import { nodeDir } from '../paths.js';

package/dist/core/canvas/__tests__/remote-canvas-source.test.js

@@ -1,6 +1,6 @@
 // remote-canvas-source.test.ts — `RemoteCanvasSource` (`../remote-canvas-source.ts`)
 // over its real wire contract: a POST to `/__crtr/source` carrying
-// `{kind:'exec', bin, args}` (see `../../view/transport-remote.ts`), bearer-
+// `{kind:'exec', bin, args}` (see `../remote-transport.ts`), bearer-
 // authed. Mirrors `src/core/broker-client/__tests__/transport-relay.test.ts`'s
 // `startMockRelay` shape — a plain `node:http` server standing in for the
 // remote canvas's `/__crtr/source` endpoint, recording every request so

package/dist/core/canvas/__tests__/remote-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/{view/__tests__/transport-remote.test.js → canvas/__tests__/remote-transport.test.js}

@@ -1,4 +1,4 @@
-// transport-remote.test.ts — `createRemoteExec` (`../transport-remote.ts`), the
+// remote-transport.test.ts — `createRemoteExec` (`../remote-transport.ts`), the
 // Node-side POST transport `RemoteCanvasSource` shells every remote read
 // through. Covers the one thing a bare `fetch(...)` with no
 // AbortController/timeout doesn't give you for free: a hung endpoint fails
@@ -8,7 +8,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createServer } from 'node:http';
-import { createRemoteExec } from '../transport-remote.js';
+import { createRemoteExec } from '../remote-transport.js';
 function startStalledServer() {
     return new Promise((resolve) => {
         // Accept the connection but never write a response — the request just

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -19,7 +19,7 @@ import { createServer } from 'node:http';
 import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { atomicWriteJson, deckPath } from '@crouton-kit/humanloop';
+import { atomicWriteJson, deckPath } from '#core/human/convention';
 import { RemoteCanvasSource } from '../remote-canvas-source.js';
 import { dashboardRowsAllFromSource, enrichRowsFromSource, loadPreviewFromSource, renderForestFromSource } from '../render.js';
 import { createNode } from '../canvas.js';

package/dist/core/canvas/attention.js

@@ -5,8 +5,8 @@
 // node, so storage identity and attribution come from the canvas graph rather
 // than duplicated attribution fields in deck/review data.
 import { basename } from 'node:path';
-import { scanInbox } from '@crouton-kit/humanloop';
-import { nodesRoot } from './paths.js';
+import { scanInbox } from '../human/scan.js';
+import { filterTerminalReviewTickets } from '../review/ticket-filter.js';
 import { getNode, listNodes, view } from './canvas.js';
 function askingNodeId(ticketDir) {
     const bridge = getNode(basename(ticketDir));
@@ -38,14 +38,14 @@ function ticketCounts() {
     }
     const counts = new Map();
     try {
-        for (const ticket of scanInbox([nodesRoot()])) {
+        for (const ticket of filterTerminalReviewTickets(scanInbox())) {
             const nodeId = askingNodeId(ticket.dir);
             if (nodeId !== null)
                 counts.set(nodeId, (counts.get(nodeId) ?? 0) + 1);
         }
     }
     catch {
-        // Humanloop unavailable or an absent root has no display consequence.
+        // An unavailable ticket store or absent root has no display consequence.
     }
     ticketCountCache = { at: Date.now(), counts };
     return counts;

package/dist/core/canvas/canvas.d.ts

@@ -295,10 +295,8 @@ export interface DeleteNodeResult {
  *  GCs its edges) and remove its on-disk `nodes/<id>/` dir. The single-node
  *  analogue of {@link pruneNodes}, for IMMEDIATE reaping — e.g. an empty node the
  *  user closed or detached from. An open managed worktree is never deleted: its
- *  node retains the ownership needed for `node worktree close`. Nor is a node
- *  with a LIVE (`armed`/`pending`) follow-up human-work receipt — its report payload
- *  is still needed for delivery (integrated-review Major-2). Pure persisted-
- *  state removal: the caller MUST have already torn down the broker engine +
+ *  node retains the ownership needed for `node worktree close`. Pure persisted-state
+ *  removal: the caller MUST have already torn down the broker engine +
  *  viewer (this does not signal any process). The node row and its FK-coupled
  *  state are removed in one canvas write boundary. Best-effort dir removal
  *  follows the commit. */
@@ -334,14 +332,11 @@ export declare function pruneNodes(opts: {
  *
  *  Protected (never a prune candidate, regardless of recency rank): any
  *  non-terminal node — status active|idle — REGARDLESS of `pi_pid` liveness,
- *  a node with an open managed worktree, and a node with a LIVE
- *  (`armed`/`pending`) follow-up human-work receipt. A crashed-but-non-terminal row
+ *  or a node with an open managed worktree. A crashed-but-non-terminal row
  *  (dead pid, status still active/idle) must survive for daemon crash-recovery
- *  to resume, an open worktree must retain its node ownership until
- *  `node worktree close`, and a live consult receipt's report payload is still
- *  needed for delivery (integrated-review Major-2); none of the three is
- *  eligible for count-based pruning. The caller ($CRTR_NODE_ID) is also always
- *  protected.
+ *  to resume, and an open worktree must retain its node ownership until
+ *  `node worktree close`; neither is eligible for count-based pruning. The caller
+ *  ($CRTR_NODE_ID) is also always protected.
  *
  *  Algorithm: order ALL nodes by recency DESC (telemetry.json mtime, falling back
  *  to `created`); `target = max(maxNodes, protectedCount)`; delete every node

package/dist/core/canvas/canvas.js

@@ -22,8 +22,8 @@ import { ensureHome, ensureNodeDirs, nodeMetaPath, nodeDir, nodesRoot, jobDir, }
  *  can ever leak onto disk even when a fully-hydrated NodeMeta is handed in. */
 const IDENTITY_KEYS = [
     'node_id', 'name', 'description', 'icon', 'cycles', 'created', 'cwd', 'host_kind', 'profile_id', 'kind', 'mode',
-    'lifecycle', 'persona_ack', 'parent', 'spawned_by', 'fork_from', 'human_work_target', 'private_fork_phase',
-    'private_fork_recipe', 'passive_default', 'pi_session_id', 'pi_session_file', 'cycle_pending', 'model_override',
+    'lifecycle', 'persona_ack', 'parent', 'spawned_by', 'fork_from', 'review_binding', 'passive_default', 'pi_session_id',
+    'pi_session_file', 'cycle_pending', 'model_override',
     'launch', 'managed_worktree',
 ];
 /** Project any node object down to its durable-identity subset. */
@@ -713,36 +713,17 @@ export function rebuildIndex() {
 function hasOpenManagedWorktree(nodeId) {
     return getNode(nodeId)?.managed_worktree?.state === 'open';
 }
-/** True when this node still carries a LIVE (`armed`/`pending`) follow-up human-work
- *  receipt (design-followup-consult-v2.md §B.4; integrated-review Major-2).
- *  An `armed` fork has not yet committed its final report; a `pending` fork
- *  HAS committed it (promoted atomically inside `commitCanonicalFinal`'s own
- *  transaction) but the receipt has not yet been acknowledged by
- *  `submitFollowUpResult` — in both cases the node's on-disk report payload
- *  (`reports/<final_report>` once pending) is still needed for delivery, so
- *  neither status may ever be pruned/deleted out from under it. Queried via
- *  raw SQL against the `consult_outbox` table directly (not the
- *  `human-work-outbox.ts` peer module) to avoid a canvas.ts↔human-work-outbox.ts
- *  import cycle — that module itself imports `getNode` from here. */
-function hasLiveFollowUpReceipt(nodeId) {
-    const r = openDb()
-        .prepare("SELECT 1 FROM consult_outbox WHERE node_id = ? AND work_kind = 'follow_up' AND status IN ('armed', 'pending') LIMIT 1")
-        .get(nodeId);
-    return r !== undefined;
-}
 /** Hard-delete ONE node: drop its row (the edges→nodes FK, ON DELETE CASCADE,
  *  GCs its edges) and remove its on-disk `nodes/<id>/` dir. The single-node
  *  analogue of {@link pruneNodes}, for IMMEDIATE reaping — e.g. an empty node the
  *  user closed or detached from. An open managed worktree is never deleted: its
- *  node retains the ownership needed for `node worktree close`. Nor is a node
- *  with a LIVE (`armed`/`pending`) follow-up human-work receipt — its report payload
- *  is still needed for delivery (integrated-review Major-2). Pure persisted-
- *  state removal: the caller MUST have already torn down the broker engine +
+ *  node retains the ownership needed for `node worktree close`. Pure persisted-state
+ *  removal: the caller MUST have already torn down the broker engine +
  *  viewer (this does not signal any process). The node row and its FK-coupled
  *  state are removed in one canvas write boundary. Best-effort dir removal
  *  follows the commit. */
 export function deleteNode(nodeId) {
-    if (hasOpenManagedWorktree(nodeId) || hasLiveFollowUpReceipt(nodeId))
+    if (hasOpenManagedWorktree(nodeId))
         return { deleted: false };
     const result = withCanvasWrite((db) => {
         db.prepare('DELETE FROM nodes WHERE node_id = ?').run(nodeId);
@@ -802,7 +783,7 @@ export function pruneNodes(opts) {
         status: r['status'],
         created: r['created'],
     }));
-    const candidates = [...terminal, ...stale].filter((node) => !hasOpenManagedWorktree(node.node_id) && !hasLiveFollowUpReceipt(node.node_id));
+    const candidates = [...terminal, ...stale].filter((node) => !hasOpenManagedWorktree(node.node_id));
     if (dryRun || candidates.length === 0)
         return { pruned: candidates, dryRun };
     deletePrunedNodes(candidates);
@@ -850,14 +831,11 @@ function recencyMs(nodeId, created) {
  *
  *  Protected (never a prune candidate, regardless of recency rank): any
  *  non-terminal node — status active|idle — REGARDLESS of `pi_pid` liveness,
- *  a node with an open managed worktree, and a node with a LIVE
- *  (`armed`/`pending`) follow-up human-work receipt. A crashed-but-non-terminal row
+ *  or a node with an open managed worktree. A crashed-but-non-terminal row
  *  (dead pid, status still active/idle) must survive for daemon crash-recovery
- *  to resume, an open worktree must retain its node ownership until
- *  `node worktree close`, and a live consult receipt's report payload is still
- *  needed for delivery (integrated-review Major-2); none of the three is
- *  eligible for count-based pruning. The caller ($CRTR_NODE_ID) is also always
- *  protected.
+ *  to resume, and an open worktree must retain its node ownership until
+ *  `node worktree close`; neither is eligible for count-based pruning. The caller
+ *  ($CRTR_NODE_ID) is also always protected.
  *
  *  Algorithm: order ALL nodes by recency DESC (telemetry.json mtime, falling back
  *  to `created`); `target = max(maxNodes, protectedCount)`; delete every node
@@ -882,7 +860,7 @@ export function pruneToLimit(opts) {
         status: r.status,
         created: r.created,
         recency: recencyMs(r.node_id, r.created),
-        protected: r.status === 'active' || r.status === 'idle' || hasOpenManagedWorktree(r.node_id) || hasLiveFollowUpReceipt(r.node_id),
+        protected: r.status === 'active' || r.status === 'idle' || hasOpenManagedWorktree(r.node_id),
     }))
         .sort((a, b) => b.recency - a.recency);
     const protectedCount = ranked.filter((r) => r.protected).length;