@north-light/crouter 0.3.172 → 0.3.174

package/dist/commands/sys/setup.js

@@ -11,19 +11,17 @@ import { defineLeaf } from '../../core/command.js';
 export const BROKER_LIMIT_OVERRIDE_PRECEDENCE = 'Valid CRTR_WARN_LIVE_BROKERS and CRTR_MAX_LIVE_BROKERS environment overrides take precedence over their corresponding configured limits.';
 export const sysSetupLeaf = defineLeaf({
     name: 'setup',
-    description: 'manage providers, setup dependencies and keys, crouter keybindings, and broker limits',
-    whenToUse: 'you want to bootstrap this machine or change setup-owned settings: manage configured model providers, install vendored pi plugins or system dependencies, save an Exa API key, edit crouter-owned keybindings, or set broker warning and automatic-revive limits.',
+    description: 'bootstrap a fresh machine — provider login, companion packages, system dependencies, Exa key',
+    whenToUse: 'you are setting up crouter on a machine for the first time and need credentials and installs in place. Use sys settings to change configuration on an installed machine, and sys config set for scriptable edits.',
     help: {
         name: 'sys setup',
-        summary: 'open the multi-tab setup wizard for providers, dependencies, keys, keybindings, and broker limits',
+        summary: 'run the first-run installer: provider login, companion packages, system dependencies, Exa key',
         inputNote: 'No input parameters.',
         output: [],
         outputKind: 'object',
         effects: [
-            'Opens a pi-tui wizard whose first tab logs in to a model provider (pi\'s real OAuth/API-key flow, same as in-app /login) so a fresh install has credentials before running any node.',
-            'Collects companion package installs, system dependency installs, API keys, sparse user overrides for crouter-owned keybindings, and user-scope broker limits across the remaining tabs.',
-            'Saves validated keybinding changes atomically in the user config and refreshes crouter-owned tmux bindings without overwriting occupied user keys.',
-            `Saves positive-integer broker warning and automatic-revive hard-cap values under user config brokerThresholds; crtrd reads them on its next supervision tick. ${BROKER_LIMIT_OVERRIDE_PRECEDENCE}`,
+            'Opens a four-step pi-tui installer. Step one logs in to a model provider (pi\'s real OAuth/API-key flow, same as in-app /login) so a fresh install has credentials before running any node.',
+            'The remaining steps collect companion package installs, system dependency installs, and an Exa API key, then confirm them all at once.',
             'Runs the bundled pi CLI to install the selected companion packages, writes EXA_API_KEY to ~/.crouter/exa.key when provided, and prints a summary.',
             'The companion-package list includes crtr marketplace plugins (currently `capture`), checked by default and installed into the user scope when left checked. An unreachable marketplace is reported as skipped rather than failing setup.',
             'On every invocation (best-effort, idempotent), refreshes crouter-owned tmux bindings and registers known nodes\' interaction roots so resolved tickets can call back into the asking node. The inbox popup toggle is a crouter-owned keybinding, editable on the keybindings tab.',

package/dist/commands/sys.js

@@ -5,6 +5,7 @@ import { daemonBranch } from './sys/daemon.js';
 import { sysDoctorLeaf } from './sys/doctor.js';
 import { sysFeedbackLeaf } from './sys/feedback.js';
 import { sysLogsLeaf } from './sys/logs.js';
+import { sysSettingsLeaf } from './sys/settings.js';
 import { sysSetupLeaf } from './sys/setup.js';
 import { supportBranch } from './sys/support.js';
 import { sysSyspromptLeaf } from './sys/sysprompt.js';
@@ -16,13 +17,13 @@ export function registerSys() {
         name: 'sys',
         rootEntry: {
             concept: 'crtr configuration, diagnostics, and self-management',
-            desc: 'config, setup, doctor, sysprompt, prompt-review, sync, update, version, feedback, logs, support, daemon',
+            desc: 'settings, config, setup, doctor, sysprompt, prompt-review, sync, update, version, feedback, logs, support, daemon',
             useWhen: 'managing the crtr installation, inspecting diagnostics, or operating the crtrd supervisor process',
         },
         help: {
             name: 'sys',
             summary: 'crtr system configuration, settings, diagnostics, and self-management',
         },
-        children: [configBranch, sysSetupLeaf, sysDoctorLeaf, sysSyspromptLeaf, promptReviewLeaf, sysFeedbackLeaf, sysLogsLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysSyncBranch, daemonBranch],
+        children: [sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, sysSyspromptLeaf, promptReviewLeaf, sysFeedbackLeaf, sysLogsLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysSyncBranch, daemonBranch],
     });
 }

package/dist/core/__tests__/broker-extension-canvas-db-boundary.test.js

@@ -0,0 +1,50 @@
+// The shipped Pi extensions execute in broker processes, which must never load
+// canvas.db code. This walks each shipped extension's local static import graph
+// and rejects any reach to the single DB accessor module.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, normalize, resolve } from 'node:path';
+import ts from 'typescript';
+import { CANVAS_EXTENSION_NAMES } from '../canvas/extensions.js';
+const SOURCE_ROOT = resolve(process.cwd(), 'src');
+const DB_MODULE = normalize(join(SOURCE_ROOT, 'core/canvas/db.ts'));
+function resolveLocalImport(from, specifier) {
+    if (!specifier.startsWith('.'))
+        return null;
+    const stem = resolve(dirname(from), specifier).replace(/\.js$/, '');
+    for (const candidate of [`${stem}.ts`, join(stem, 'index.ts')]) {
+        if (existsSync(candidate))
+            return normalize(candidate);
+    }
+    return null;
+}
+function importsOf(file) {
+    const source = readFileSync(file, 'utf8');
+    return ts.preProcessFile(source, true, true).importedFiles
+        .map((reference) => resolveLocalImport(file, reference.fileName))
+        .filter((target) => target !== null);
+}
+function dbReach(root) {
+    const pending = [{ file: root, path: [root] }];
+    const seen = new Set([root]);
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current.file === DB_MODULE)
+            return current.path;
+        for (const imported of importsOf(current.file)) {
+            if (seen.has(imported))
+                continue;
+            seen.add(imported);
+            pending.push({ file: imported, path: [...current.path, imported] });
+        }
+    }
+    return null;
+}
+test('every shipped broker extension is transitively canvas.db-free', () => {
+    for (const name of CANVAS_EXTENSION_NAMES) {
+        const root = join(SOURCE_ROOT, 'pi-extensions', `${name}.ts`);
+        const reach = dbReach(root);
+        assert.equal(reach, null, `${name} reaches canvas.db through:\n${reach?.join('\n')}`);
+    }
+});

package/dist/core/__tests__/broker-launch-candidates.test.js

@@ -5,7 +5,9 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createAgentSessionFromServices, createAgentSessionServices, SessionManager, VERSION } from '../runtime/broker-sdk.js';
-import { buildBrokerSession, isUnknownModel } from '../runtime/broker.js';
+import { buildBrokerSession } from '../runtime/broker.js';
+import { unregisteredConcreteModel } from '../model-routes.js';
+import { isUnknownModel } from '../runtime/model-selection.js';
 import { resolveProviderCandidates } from '../subscription-state.js';
 const realEngine = { createAgentSessionServices, createAgentSessionFromServices, SessionManager, VERSION };
 const C3_EXT = join(dirname(fileURLToPath(import.meta.url)), 'fixtures', 'c3-custom-provider-ext.ts');
@@ -89,6 +91,21 @@ function resolve(options) {
         })),
     };
 }
+test('an unregistered concrete recipe is a permanent failure, but missing auth is not', () => {
+    // The two outcomes route differently at launch: an unregistered model can
+    // never boot and must fault, while a registered model with no configured auth
+    // is recoverable once credentials arrive.
+    const known = { provider: 'openai-codex', id: 'o-strong' };
+    const registry = {
+        find: (providerId, modelId) => providerId === known.provider && modelId === known.id ? known : undefined,
+        hasConfiguredAuth: () => false,
+    };
+    const unknown = unregisteredConcreteModel({ kind: 'concrete', spec: 'openai-codex/fast' }, registry, { profileId: null });
+    assert.equal(unknown?.reason, 'unregistered');
+    assert.equal(unknown?.candidate.providerId, 'openai-codex');
+    assert.equal(unknown?.candidate.modelId, 'fast');
+    assert.equal(unregisteredConcreteModel({ kind: 'concrete', spec: 'openai-codex/o-strong' }, registry, { profileId: null }), undefined, 'a registered model remains recoverable even when it has no configured auth');
+});
 test('launch candidate resolver keeps a healthy explicit provider pin ahead of authenticated alternatives', () => {
     const result = resolve({ requested: 'anthropic/requested', available: [alternative, requested], modelProviderPinned: true });
     assert.equal(result.model, requested);
@@ -102,7 +119,7 @@ test('launch candidate resolver selects a non-managed candidate as automatic fal
         { spec: 'missing/missing', reason: 'not registered' },
     ]);
 });
-test('broker launch keeps an unregistered concrete model pinned even when a non-managed provider is available', async () => {
+test('broker launch rejects an unregistered concrete model even when a non-managed provider is available', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-launch-candidate-'));
     try {
         const engine = {
@@ -119,13 +136,7 @@ test('broker launch keeps an unregistered concrete model pinned even when a non-
                 return { ...services, modelRuntime };
             },
         };
-        const { session } = await buildBrokerSession(engine, { cwd, extensionPaths: [C3_EXT], model: 'missing/missing' });
-        try {
-            assert.equal(`${session.model?.provider}/${session.model?.id}`, 'unknown/unknown');
-        }
-        finally {
-            session.dispose();
-        }
+        await assert.rejects(buildBrokerSession(engine, { cwd, extensionPaths: [C3_EXT], model: 'missing/missing' }), /FATAL: model 'missing\/missing' is not registered/);
     }
     finally {
         rmSync(cwd, { recursive: true, force: true });

package/dist/core/__tests__/broker-preflight.test.js

@@ -62,7 +62,7 @@ test('preflightBrokerLaunch rejects missing or duplicate mandatory canvas hooks
     const missing = { argv: ['hello'], env: { CRTR_BROKER_ENGINE: FAKE_ENGINE } };
     assert.throws(() => preflightBrokerLaunch('preflight-missing-hook', missing, '/tmp/work'), /canvas extension.*found 0/i);
     const duplicate = { argv: [...validArgv(), '-e', CANVAS_EXTENSIONS[0], 'hello'], env: { CRTR_BROKER_ENGINE: FAKE_ENGINE } };
-    assert.throws(() => preflightBrokerLaunch('preflight-duplicate-hook', duplicate, '/tmp/work'), /canvas extension.*found 2/i);
+    assert.throws(() => preflightBrokerLaunch('preflight-duplicate-hook', duplicate, '/tmp/work'), /duplicate mandatory canvas extension basename canvas-inbox-watcher/i);
 });
 test('preflightBrokerLaunch validates the exact broker engine env passed to the detached broker', () => {
     const nodeId = 'preflight-empty-engine';

package/dist/core/__tests__/canvas-inbox-watcher-hold.test.js

@@ -13,8 +13,11 @@ import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher
 import { appendInbox, readCursor } from '../feed/inbox.js';
 import { drainBearings } from '../runtime/kickoff.js';
 import { appendSituationalContext } from '../runtime/situational-context.js';
-import { createNode, getNode, setIntent } from '../canvas/canvas.js';
+import { createNode, getNode, recordPid, setIntent } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
+import { createApiServer } from '../../daemon/api/server.js';
+import { CrtrClient } from '../../api/client.js';
+import { ApiError } from '../../api/errors.js';
 // Drive the watcher's injectable cadence seam (CRTR_WATCHER_TICK_MS /
 // CRTR_WATCHER_DEBOUNCE_MS) at a fast tempo so the test sleeps milliseconds, not
 // seconds. SETTLE_MS still allows a resolve+seed tick, a read tick, and the
@@ -26,13 +29,15 @@ let origHome;
 let origNode;
 const homes = [];
 const disposers = [];
+let server;
 /** Point CRTR_HOME at a fresh temp canvas root and bind CRTR_NODE_ID. */
 function freshNode(nodeId) {
-    const home = join(tmpdir(), `crtr-canvas-watcher-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    const home = join(tmpdir(), `crtr-w-${Math.random().toString(36).slice(2, 8)}`);
     mkdirSync(home, { recursive: true });
     homes.push(home);
     process.env['CRTR_HOME'] = home;
     process.env['CRTR_NODE_ID'] = nodeId;
+    server = createApiServer();
 }
 function makeFakePi() {
     const handlers = {};
@@ -42,7 +47,7 @@ function makeFakePi() {
         on(e, h) { handlers[e] = h; },
         sendUserMessage(content, options) { this.injected.push({ content, deliverAs: options?.deliverAs }); },
         sendMessage(message) { this.sentMessages.push(message); },
-        fire(e, ev, ctx) { handlers[e]?.(ev, ctx); },
+        async fire(e, ev, ctx) { await handlers[e]?.(ev, ctx); },
     };
 }
 // Fire agent_settled — the authoritative durable-commit boundary in the
@@ -51,9 +56,9 @@ function makeFakePi() {
 // unconditionally regardless of queue state, so `pending: true` exercises that
 // the commit still lands rather than being vetoed. See `shutdown()` below for
 // the one boundary where `hasPendingMessages()` still gates a commit.
-function settle(pi, opts = {}) {
+async function settle(pi, opts = {}) {
     const pending = opts.pending === true;
-    pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => pending });
+    await pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => pending });
 }
 // Fire session_shutdown — pi's graceful-teardown safety net for a settle that
 // never fired before exit. The real handler takes NO event ctx of its own; it
@@ -65,19 +70,37 @@ function settle(pi, opts = {}) {
 // itself. `pending` maps to pi's `hasPendingMessages()`: true exercises the
 // retained HOLD (an unconsumed queued send would die with the process, so the
 // commit is declined); false (default) commits normally.
-function shutdown(pi, opts = {}) {
+async function shutdown(pi, opts = {}) {
     const pending = opts.pending === true;
-    pi.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => false, hasPendingMessages: () => pending });
-    pi.fire('session_shutdown', {}, undefined);
+    await pi.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => false, hasPendingMessages: () => pending });
+    await pi.fire('session_shutdown', {}, undefined);
 }
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
 // Register the watcher, then fire session_start — the real lifecycle gate
 // that arms its poll interval and initial tick (see canvas-inbox-watcher.ts).
 // registerCanvasInboxWatcher() alone only wires up handlers; without this the
 // watcher never polls or sends anything.
+function ensureWatcherNode() {
+    const nodeId = process.env['CRTR_NODE_ID'];
+    if (nodeId === undefined || getNode(nodeId) !== null)
+        return;
+    createNode({
+        node_id: nodeId,
+        name: nodeId,
+        created: new Date().toISOString(),
+        cwd: '/tmp',
+        kind: 'general',
+        mode: 'base',
+        lifecycle: 'terminal',
+        status: 'active',
+    });
+    recordPid(nodeId, process.pid);
+}
 function registerWatcher(pi) {
+    ensureWatcherNode();
+    recordPid(process.env['CRTR_NODE_ID'], process.pid);
     const dispose = registerCanvasInboxWatcher(pi);
-    pi.fire('session_start', { type: 'session_start' }, undefined);
+    void pi.fire('session_start', { type: 'session_start' }, undefined);
     return dispose;
 }
 let origTick;
@@ -90,9 +113,12 @@ before(() => {
     process.env['CRTR_WATCHER_TICK_MS'] = String(TICK_MS);
     process.env['CRTR_WATCHER_DEBOUNCE_MS'] = String(DEBOUNCE_MS);
 });
-afterEach(() => {
+afterEach(async () => {
     while (disposers.length > 0)
         disposers.pop()();
+    await server?.close();
+    server = undefined;
+    closeDb();
 });
 after(() => {
     if (origHome === undefined)
@@ -119,7 +145,7 @@ after(() => {
     }
 });
 describe('canvas inbox watcher — hold + idle delivery', () => {
-    test('refresh-yield in flight: inbox entries are HELD, then delivered once intent clears (no loss)', async () => {
+    test('refresh-yield in flight: a handoff remains uncommitted for the replacement conversation', async () => {
         freshNode('node-refresh');
         closeDb(); // rebind the canvas db to this test's fresh home
         const meta = {
@@ -135,12 +161,66 @@ describe('canvas inbox watcher — hold + idle delivery', () => {
         await wait(TICK_MS + 100);
         appendInbox('node-refresh', { from: 'child-x', tier: 'urgent', kind: 'final', label: 'done' });
         await wait(SETTLE_MS);
-        assert.equal(pi.injected.length, 0, 'entries are held while a refresh-yield is in flight (no steer-hijack)');
-        // The fresh pi clears intent on boot; the held entry must then be delivered
-        // — the cursor was never advanced, so nothing is lost.
+        assert.equal(pi.injected.length, 1, 'the live broker receives the handoff before its durable cursor boundary');
+        // The cursor operation decides the refresh hold at its durable commit
+        // boundary; clearing intent does not manufacture a second handoff.
         setIntent('node-refresh', null);
         await wait(SETTLE_MS);
-        assert.equal(pi.injected.length, 1, 'the held entry is delivered once the refresh clears');
+        assert.equal(pi.injected.length, 1, 'the same handoff is not delivered twice');
+    });
+    test('replacement session binding holds a late old-broker cursor commit', async () => {
+        freshNode('node-refresh-replacement');
+        closeDb();
+        const meta = {
+            node_id: 'node-refresh-replacement', name: 'r', created: new Date().toISOString(),
+            cwd: '/tmp', kind: 'general', mode: 'base', lifecycle: 'resident',
+            status: 'active', intent: 'refresh',
+        };
+        createNode(meta);
+        const entry = appendInbox(meta.node_id, { from: 'child-x', tier: 'normal', kind: 'update', label: 'handoff before replacement' });
+        recordPid(meta.node_id, 101);
+        const client = CrtrClient.forLocalSocket({ autostart: false });
+        // The replacement binds first, consuming refresh and recording its own
+        // process generation. The old broker's delayed request must still hold.
+        await client.bindBrokerSession(meta.node_id, {
+            piSessionId: 'replacement-session', sessionFile: '/tmp/replacement.jsonl',
+            pid: 202, reason: 'startup', reviewBoundaryIds: [],
+        });
+        const oldResult = await client.advanceBrokerInboxCursor(meta.node_id, {
+            throughEntryId: entry.entry_id, brokerPid: 101,
+        });
+        assert.deepEqual(oldResult, { action: 'hold_refresh' });
+        assert.equal(readCursor(meta.node_id), undefined, 'the stale broker cannot consume the replacement replay');
+        const replacementResult = await client.advanceBrokerInboxCursor(meta.node_id, {
+            throughEntryId: entry.entry_id, brokerPid: 202,
+        });
+        assert.deepEqual(replacementResult, { action: 'advanced' });
+        assert.equal(readCursor(meta.node_id), entry.entry_id, 'only the replacement broker advances the durable cursor');
+    });
+    test('cursor rejects a nonexistent or backward physical entry', async () => {
+        freshNode('node-cursor-physical-boundary');
+        closeDb();
+        const meta = {
+            node_id: 'node-cursor-physical-boundary', name: 'r', created: new Date().toISOString(),
+            cwd: '/tmp', kind: 'general', mode: 'base', lifecycle: 'resident', status: 'active',
+        };
+        createNode(meta);
+        recordPid(meta.node_id, 303);
+        const first = appendInbox(meta.node_id, { from: 'child-x', tier: 'normal', kind: 'update', label: 'first' });
+        const second = appendInbox(meta.node_id, { from: 'child-x', tier: 'normal', kind: 'update', label: 'second' });
+        const client = CrtrClient.forLocalSocket({ autostart: false });
+        const rejected = (request) => client
+            .advanceBrokerInboxCursor(meta.node_id, request)
+            .then(() => assert.fail('cursor request should fail'))
+            .catch((error) => {
+            assert.ok(error instanceof ApiError);
+            assert.equal(error.status, 400);
+        });
+        await rejected({ throughEntryId: 'f'.repeat(32), brokerPid: 303 });
+        assert.equal(readCursor(meta.node_id), undefined, 'a well-shaped unknown id cannot poison the cursor');
+        await client.advanceBrokerInboxCursor(meta.node_id, { throughEntryId: second.entry_id, brokerPid: 303 });
+        await rejected({ throughEntryId: first.entry_id, brokerPid: 303 });
+        assert.equal(readCursor(meta.node_id), second.entry_id, 'a late commit cannot move the durable cursor backward');
     });
     test('refresh-yield replays a handoff that reached the discarded conversation', async () => {
         freshNode('node-refresh-handoff');
@@ -161,7 +241,7 @@ describe('canvas inbox watcher — hold + idle delivery', () => {
         // Yield discards that conversation before it can act on the queued handoff.
         // Its settle must leave the entry durable for the fresh revive's kickoff.
         setIntent(meta.node_id, 'refresh');
-        settle(pi);
+        await settle(pi);
         assert.equal(readCursor(meta.node_id), undefined, 'the discarded conversation cannot commit its inbox handoff');
         const bearings = drainBearings(getNode(meta.node_id));
         assert.match(bearings.unreadDigest ?? '', /handoff at yield/, 'the fresh revive receives the uncommitted handoff');
@@ -205,6 +285,7 @@ describe('canvas inbox watcher — action-gated startup (session_start arm)', ()
         // Registration alone (the extension factory, before Pi has bound actions)
         // must be side-effect-free: no timer armed, no tick run, no action attempted
         // — even across several tick+debounce windows.
+        ensureWatcherNode();
         disposers.push(registerCanvasInboxWatcher(pi));
         await wait(TICK_MS * 5 + DEBOUNCE_MS + 50);
         assert.equal(sendAttempts, 0, 'no action call is attempted before session_start arms the watcher');
@@ -218,7 +299,7 @@ describe('canvas inbox watcher — action-gated startup (session_start arm)', ()
         assert.equal(sendAttempts, 1, 'exactly one action attempt once session_start arms the watcher');
         assert.equal(pi.injected.length, 1, 'exactly one handoff once actions are bound');
         assert.equal(readCursor('node-action-gate'), undefined, 'still uncommitted until agent_settled');
-        settle(pi);
+        await settle(pi);
         assert.equal(readCursor('node-action-gate'), entry.entry_id, 'cursor committed at agent_settled');
         // A repeated session_start (e.g. a resume) must not re-arm a second
         // interval or re-run the initial tick — no duplicate delivery.
@@ -302,7 +383,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         assert.equal(readCursor('node-cursor-committed'), undefined, 'not yet committed before the settle');
         // The turn settles with pi's queue drained (the followUp was consumed) —
         // THAT commits the cursor.
-        settle(pi1);
+        await settle(pi1);
         assert.equal(readCursor('node-cursor-committed'), entry.entry_id, 'cursor committed to disk at agent_settled');
         const pi2 = makeFakePi();
         disposers.push(registerWatcher(pi2));
@@ -323,7 +404,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         // of acceptance — the cursor stays put until the turn settles. (One rule: no
         // immediate idle-path commit.)
         assert.equal(readCursor('node-cursor-idle'), undefined, 'idle send does not commit on the fire-and-forget return');
-        settle(pi);
+        await settle(pi);
         assert.equal(readCursor('node-cursor-idle'), entry.entry_id, 'idle-path delivery commits at the turn it started settling');
     });
     test('synchronous send throw then agent_settled: durable cursor NOT advanced past the re-buffered entry, fresh watcher re-delivers', async () => {
@@ -339,7 +420,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         await wait(SETTLE_MS);
         assert.equal(pi1.injected.length, 0, 'the failing send delivered nothing');
         // agent_settled must NOT commit past the still-re-buffered (never-handed-off) entry.
-        settle(pi1);
+        await settle(pi1);
         assert.equal(readCursor('node-cursor-failsend'), undefined, 'durable cursor not advanced past a re-buffered, never-delivered entry');
         const pi2 = makeFakePi();
         disposers.push(registerWatcher(pi2));
@@ -363,7 +444,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         // The abort-generated agent_end/settle must not commit the pending critical
         // entry (it is re-buffered, never handed off).
         pi1.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => true });
-        settle(pi1);
+        await settle(pi1);
         assert.equal(readCursor('node-cursor-critical'), undefined, 'abort-generated settle does not commit the pending critical entry before its retry');
         const pi2 = makeFakePi();
         disposers.push(registerWatcher(pi2));
@@ -390,7 +471,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         await wait(70); // B read into the buffer but < 200ms debounce → not yet flushed
         // A's turn settles while B is still debouncing in the buffer. The commit must
         // clamp below the still-buffered B and land on A only.
-        settle(pi1);
+        await settle(pi1);
         assert.equal(readCursor('node-cursor-batchB'), a.entry_id, 'commit lands on handed-off batch A');
         assert.notEqual(readCursor('node-cursor-batchB'), b.entry_id, 'commit does not cross the still-buffered batch B');
         const pi2 = makeFakePi();
@@ -423,7 +504,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         assert.equal(readCursor('node-cursor-failhold'), undefined, 'a failure agent_end does not commit');
         // The settle commits even though the context reports pending sends —
         // agent_settled no longer declines on hasPendingMessages().
-        settle(pi1, { pending: true });
+        await settle(pi1, { pending: true });
         assert.equal(readCursor('node-cursor-failhold'), entry.entry_id, 'agent_settled commits unconditionally, even when hasPendingMessages() reports pending');
         const pi2 = makeFakePi();
         disposers.push(registerWatcher(pi2));
@@ -452,7 +533,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         await wait(SETTLE_MS);
         assert.equal(pi.injected.length, 1, 'the active conversation received the handoff before refresh');
         setIntent(meta.node_id, 'refresh');
-        shutdown(pi, { pending: false });
+        await shutdown(pi, { pending: false });
         assert.equal(readCursor(meta.node_id), undefined, 'a refresh keeps the shutdown handoff uncommitted for replay');
     });
     test('session_shutdown still holds while hasPendingMessages() reports pending (no agent_settled fired)', async () => {
@@ -466,7 +547,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         assert.equal(pi1.injected.length, 1, 'delivered mid-turn as a followUp');
         // session_shutdown fires with no prior agent_settled, and the context
         // reports an unconsumed queued send — the hold declines the commit.
-        shutdown(pi1, { pending: true });
+        await shutdown(pi1, { pending: true });
         assert.equal(readCursor('node-cursor-shutdownhold'), undefined, 'session_shutdown declines to commit while pi reports pending sends');
         dispose();
         // A fresh watcher re-reads and re-delivers, then a drained settle commits.
@@ -475,7 +556,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         await wait(SETTLE_MS);
         assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads and re-delivers the never-committed entry');
         assert.match(pi2.injected[0].content, /still queued at shutdown/);
-        settle(pi2);
+        await settle(pi2);
         assert.equal(readCursor('node-cursor-shutdownhold'), entry.entry_id, 'the redelivered entry commits once the fresh watcher settles cleanly');
     });
     // Situational custom sends do not enter pi's user steer/followUp queue, so
@@ -496,7 +577,7 @@ describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
         await wait(SETTLE_MS);
         assert.equal(pi1.sentMessages.length, 1, 'the hidden custom message was sent');
         assert.equal(readCursor('node-cursor-situational'), undefined, 'not committed before the settle');
-        settle(pi1);
+        await settle(pi1);
         assert.equal(readCursor('node-cursor-situational'), entry.entry_id, 'the situational handoff commits at the drained settle');
     });
 });

package/dist/core/__tests__/canvas-inbox-watcher.test.js

@@ -109,6 +109,20 @@ test('coalesce inlines short report bodies with a trailing artifact pointer and
     assert.doesNotMatch(spilled, /Dereference a ref with/);
     closeDb();
 });
+test('a human message coalesces verbatim — a conversation turn, not a digest', () => {
+    // A human typing directly into a node's box is a CONVERSATION TURN, so the
+    // dormant wake path must read identically to the live path: no "From … — N
+    // updates" header, no `[message]` kind tag. Every other sender keeps framing.
+    const body = 'first line\n\nsecond paragraph';
+    const human = coalesce([
+        finalizeInboxEntry({ from: 'human', tier: 'normal', kind: 'message', label: 'first line', data: { body } }),
+    ]);
+    assert.equal(human, body);
+    const agent = coalesce([
+        finalizeInboxEntry({ from: 'mqifzplr-0753bde3', tier: 'normal', kind: 'message', label: 'go', data: { body: 'go' } }),
+    ]);
+    assert.match(agent, /^From mqifzplr-0753bde3 — 1 update:/);
+});
 let origTick;
 let origDebounce;
 before(() => {

package/dist/core/__tests__/canvas.test.js

@@ -3,9 +3,9 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getNode, getRow, updateNode, setStatus, listNodes, subscribe, unsubscribe, setSubscriptionActive, recordSpawn, subscribersOf, subscriptionsOf, view, hasActiveLiveSubscription, rebuildIndex, } from '../canvas/canvas.js';
+import { createNode, getNode, getRow, updateNode, setStatus, subscribe, unsubscribe, setSubscriptionActive, recordSpawn, subscribersOf, subscriptionsOf, view, hasActiveLiveSubscription, rebuildIndex, } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
-import { contextDir, reportsDir, jobDir, nodeMetaPath, } from '../canvas/paths.js';
+import { nodeMetaPath } from '../canvas/paths.js';
 let home;
 function node(id, over = {}) {
     return {
@@ -34,32 +34,11 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-test('createNode scaffolds dirs, writes meta, indexes the row', () => {
-    createNode(node('a'));
-    assert.ok(existsSync(contextDir('a')));
-    assert.ok(existsSync(reportsDir('a')));
-    assert.ok(existsSync(jobDir('a')));
-    assert.ok(existsSync(nodeMetaPath('a')));
-    const meta = getNode('a');
-    assert.equal(meta?.node_id, 'a');
-    assert.equal(meta?.kind, 'general');
-    const row = getRow('a');
-    assert.equal(row?.node_id, 'a');
-    assert.equal(row?.status, 'active');
-});
 test('meta.json is the source of truth on disk', () => {
     createNode(node('a', { kind: 'developer' }));
     const raw = JSON.parse(readFileSync(nodeMetaPath('a'), 'utf8'));
     assert.equal(raw.kind, 'developer');
 });
-test('updateNode merges meta and re-indexes the row', () => {
-    createNode(node('a'));
-    updateNode('a', { mode: 'orchestrator', lifecycle: 'resident' });
-    assert.equal(getNode('a')?.mode, 'orchestrator');
-    assert.equal(getRow('a')?.lifecycle, 'resident');
-    // unspecified fields preserved
-    assert.equal(getNode('a')?.kind, 'general');
-});
 // Regression: cycle_pending is an IDENTITY field (meta.json-only, no db
 // column — like pi_session_file) written by reviveNode/canvas-stophook and
 // read back by reviveNode's locked launch arbitration. writeMeta only persists
@@ -73,19 +52,6 @@ test('cycle_pending survives the updateNode/getNode meta.json round-trip', () =>
     updateNode('a', { cycle_pending: false });
     assert.equal(getNode('a')?.cycle_pending, false);
 });
-test('setStatus updates both meta and row', () => {
-    createNode(node('a'));
-    setStatus('a', 'done');
-    assert.equal(getNode('a')?.status, 'done');
-    assert.equal(getRow('a')?.status, 'done');
-});
-test('listNodes filters by status', () => {
-    createNode(node('a', { status: 'active' }));
-    createNode(node('b', { status: 'idle' }));
-    createNode(node('c', { status: 'done' }));
-    assert.equal(listNodes().length, 3);
-    assert.deepEqual(listNodes({ status: ['active', 'idle'] }).map((n) => n.node_id).sort(), ['a', 'b']);
-});
 test('subscription spine: subscribersOf / subscriptionsOf', () => {
     createNode(node('mgr'));
     createNode(node('w1'));

package/dist/core/__tests__/close.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getNode, subscribe } from '../canvas/canvas.js';
+import { createNode, getNode, subscribe, subscriptionsOf } from '../canvas/canvas.js';
 import { nodeDir } from '../canvas/paths.js';
 import { closeDb } from '../canvas/db.js';
 import { closeNode } from '../runtime/close.js';
@@ -69,7 +69,7 @@ test('closes the root and its exclusive descendants; spares a shared node', () =
     // Closed nodes → canceled + intent cleared. (Broker-host cut: nodes carry NO
     // engine pane/window/session — the viewer lives in the focuses table and is
     // torn down asynchronously when the broker socket drops, so close no longer
-    // nulls a meta `pane`; viewer teardown is covered in the full-tier broker
+    // nulls a meta `pane`; viewer teardown is covered in the compiled-seam broker
     // lifecycle suite.)
     for (const id of ['N', 'A', 'C']) {
         const m = getNode(id);
@@ -80,6 +80,17 @@ test('closes the root and its exclusive descendants; spares a shared node', () =
     assert.equal(getNode('B').status, 'active');
     assert.equal(getNode('M').status, 'active');
 });
+test('closing a middle node preserves its subscription edge and child provenance', () => {
+    createNode(node('A'));
+    createNode(node('B', { parent: 'A' }));
+    createNode(node('C', { parent: 'B' }));
+    spawnEdge('A', 'B');
+    spawnEdge('B', 'C');
+    closeNode('B');
+    assert.deepEqual(subscriptionsOf('B').map(({ node_id, active }) => ({ node_id, active })), [{ node_id: 'C', active: true }]);
+    assert.equal(getNode('B')?.parent, 'A');
+    assert.equal(getNode('C')?.parent, 'B');
+});
 test('kill order is leaves-first, root-last ("cascades up")', () => {
     for (const id of ['N', 'A', 'C'])
         createNode(node(id));
@@ -249,6 +260,6 @@ test('reaping an empty child still notifies a surviving external manager', () =>
 // routes through the synchronous tearDownNode — it sends the broker `shutdown`
 // frame (headlessBrokerHost.teardown) and the viewer pane/focus row close on
 // their own when the broker socket drops (GC'd by the daemon + focusOf prune).
-// That async viewer teardown is covered by the full-tier broker-crash-teardown /
+// That async viewer teardown is covered by the compiled-seam broker-crash-teardown /
 // broker-lifecycle suite, which runs a real broker; it cannot be unit-tested
 // without one.