@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/__tests__/daemon-boot.test.js

@@ -7,18 +7,23 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, spawn } from 'node:child_process';
 import { createServer } from 'node:net';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
-import { readInboxSince } from '../feed/inbox.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
+import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
+import { openTurn } from '../canvas/recovery.js';
 import { superviseTick } from '../../daemon/crtrd.js';
 import { readPidfile } from '../../daemon/pidfile.js';
 import { verifyDaemonStartup, waitForDaemonExit } from '../../daemon/manage.js';
 import { waitForBrokerViewSocket } from '../runtime/placement-tmux.js';
 import { viewSocketPath } from '../canvas/paths.js';
-import { markBusy, clearBusy } from '../runtime/busy.js';
 import { headlessBrokerHost } from '../runtime/host.js';
 import { bindTestFleet } from './helpers/fleet.js';
 import { resetFleetForTests } from '../runtime/fleet.js';
 let home;
+let scopeHome;
+let originalCwd;
+let originalHome;
 let tf;
 function node(id, over = {}) {
     return {
@@ -43,20 +48,41 @@ function deadPid() {
     const r = spawnSync('true', [], { stdio: 'ignore' });
     return r.pid ?? 0x7ffffffe;
 }
+function wakeMail(nodeId) {
+    return openDb().prepare(`SELECT m.sender_node_id AS "from", d.urgency AS tier, m.label
+    FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+    WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 1
+    ORDER BY m.seq`).all(nodeId);
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-daemon-boot-'));
+    scopeHome = mkdtempSync(join(tmpdir(), 'crtr-daemon-boot-home-'));
+    originalCwd = process.cwd();
+    originalHome = process.env['HOME'];
+    process.chdir(scopeHome);
+    process.env['HOME'] = scopeHome;
     process.env['CRTR_HOME'] = home;
     // superviseTick + exit-policy delivery require a bound fleet (D-2).
     tf = bindTestFleet();
 });
 beforeEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    initializeFreshScopedStore({ kind: 'user', root: join(scopeHome, '.crouter') });
+    migrate(openDb());
 });
 after(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    process.chdir(originalCwd);
+    rmSync(scopeHome, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    if (originalHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = originalHome;
     tf.fleet.dispose();
     resetFleetForTests();
 });
@@ -66,13 +92,15 @@ after(() => {
 // exit is observation-only.
 test('never-booted broker is marked dead by the tick and surfaced to the parent as urgent', async () => {
     createNode(node('P', { kind: 'developer', lifecycle: 'resident' }));
+    const crashedPid = deadPid();
     createNode(node('C', {
         parent: 'P',
         kind: 'explore',
-        pi_pid: deadPid(), // launch recorded its process before it died
+        pi_pid: crashedPid, // launch recorded its process before it died
         pi_session_id: null, // never booted
         intent: null,
     }));
+    recordExecutionPid(beginExecution('C', { daemonEpoch: 'test' }), 'C', crashedPid);
     spawnEdge('P', 'C');
     // The launch's real child exit is delivered synthetically here, then the
     // authoritative tick classifies the dead recorded pid as table row 8:
@@ -84,7 +112,7 @@ test('never-booted broker is marked dead by the tick and surfaced to the parent
     // Row 8 fans TWO entries: the urgent surfaceBootFailure push and the normal
     // doctrine wake (design flow B row 8 — crash + surfaceBootFailure + doctrine
     // wake), both from C.
-    const inbox = readInboxSince('P');
+    const inbox = wakeMail('P');
     assert.equal(inbox.length, 2, 'parent received the boot-failure push and the doctrine wake');
     const urgent = inbox.find((e) => e.tier === 'urgent');
     assert.ok(urgent, 'boot failure is delivered as urgent');
@@ -105,16 +133,19 @@ test('a crashed booted child is relaunched on its saved session, not reaped, and
     };
     try {
         createNode(node('P2', { kind: 'developer', lifecycle: 'resident' }));
+        const crashedPid = deadPid();
         createNode(node('C2', {
             cwd: home, // a cwd that exists — reviveNode's preflight refuses a missing one
             parent: 'P2',
             kind: 'explore',
-            pi_pid: deadPid(), // engine crashed — its recorded pid is dead
+            pi_pid: crashedPid, // engine crashed — its recorded pid is dead
             pi_session_id: '019e8f00-booted-once', // it booted before dying
             intent: null,
         }));
         spawnEdge('P2', 'C2');
-        markBusy('C2'); // died mid-generation
+        const executionId = beginExecution('C2', { daemonEpoch: 'test' });
+        recordExecutionPid(executionId, 'C2', crashedPid);
+        openTurn(executionId, { reason: 'agent-start' }); // died mid-generation
         await superviseTick();
         const afterFirstTick = getNode('C2');
         assert.deepEqual(launches, [], 'the first tick records the failed launch without relaunching');
@@ -123,8 +154,7 @@ test('a crashed booted child is relaunched on its saved session, not reaped, and
         await superviseTick(Date.parse(afterFirstTick.respawn_not_before));
         assert.deepEqual(launches, ['C2'], 'the matured tick recovers the crash through the policy table');
         assert.equal(getNode('C2').status, 'active', 'crashed booted child is relaunched, NOT marked dead');
-        assert.equal(readInboxSince('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
-        clearBusy('C2');
+        assert.equal(wakeMail('P2').length, 0, 'no false boot-failure / child-death push on a crash (wake relocated to push/close)');
     }
     finally {
         headlessBrokerHost.launch = originalLaunch;
@@ -193,17 +223,24 @@ test('verifyDaemonStartup waits for pidfile, live pid, and serving socket before
     assert.equal(socketServing, true, 'the Unix API socket must serve before success');
     assert.equal(slept >= 40, true, 'the guard must actually poll through socket readiness');
 });
-test('runDaemon claims ownership before activation and readiness', () => {
+test('runDaemon initializes SQL before binding restricted repair', () => {
     const source = readFileSync(fileURLToPath(new URL('../../daemon/crtrd.ts', import.meta.url)), 'utf8');
     const runDaemonAt = source.indexOf('export async function runDaemon');
-    const activationAt = source.indexOf('await ensureOnDiskMigrations();', runDaemonAt);
     const ownershipAt = source.indexOf('claimDaemonOwnership(', runDaemonAt);
-    const readinessAt = source.indexOf('writePidfile();', runDaemonAt);
+    const profileAt = source.indexOf('runProfileManifestMigrations(', ownershipAt);
+    const migrateAt = source.indexOf('migrate(openDb());', profileAt);
+    const restrictionAt = source.indexOf("phase: 'initializing'", migrateAt);
+    const pidfileAt = source.indexOf('writePidfile();', restrictionAt);
+    const serverAt = source.indexOf('createApiServer(', pidfileAt);
+    const activationAt = source.indexOf('await activateOnDiskMigrations(', serverAt);
     assert.ok(runDaemonAt >= 0, 'runDaemon exists');
     assert.ok(ownershipAt > runDaemonAt, 'runDaemon claims ownership');
     assert.equal(source.slice(runDaemonAt, ownershipAt).includes('await '), false, 'ownership is claimed before startup can await');
-    assert.ok(ownershipAt < activationAt, 'ownership precedes on-disk activation');
-    assert.ok(activationAt < readinessAt, 'activation completes before readiness is published');
+    assert.ok(ownershipAt < profileAt, 'ownership precedes raw profile migration');
+    assert.ok(profileAt < migrateAt, 'profile migration precedes SQL migration');
+    assert.ok(migrateAt < restrictionAt, 'SQL migration precedes restriction state');
+    assert.ok(restrictionAt < pidfileAt && pidfileAt < serverAt, 'restriction precedes repair listener binding');
+    assert.ok(serverAt < activationAt, 'repair listener precedes on-disk activation');
 });
 // Regression for the cold-guest recreate blocker: the production startup window
 // must tolerate a slower cold start than the old 500ms bound.

package/dist/core/__tests__/fixtures/fake-engine.d.ts

@@ -20,7 +20,7 @@ export declare class SessionManager {
      *  broker tests do not replay source history, but they must reach the same
      *  post-fork model/session construction path as the real engine. */
     static forkFrom(_source: string, cwd: string): SessionManager;
-    /** Resume: round-trip the .jsonl PATH the revive passed via `--session`. */
+    /** Resume: round-trip the saved session identity with its .jsonl path. */
     static open(path: string): SessionManager;
     getSessionId(): string;
     getSessionFile(): string;

package/dist/core/__tests__/fixtures/fake-engine.js

@@ -91,7 +91,9 @@ export class SessionManager {
         const sessionFile = join(dir, 'fake-session.jsonl');
         if (!existsSync(sessionFile))
             writeFileSync(sessionFile, '');
-        return new SessionManager(`fake-sess-${randomUUID()}`, sessionFile, false);
+        const sessionId = `fake-sess-${randomUUID()}`;
+        writeFileSync(`${sessionFile}.id`, sessionId);
+        return new SessionManager(sessionId, sessionFile, false);
     }
     /** Spawn-time fork: create the fork's distinct fake session. The focused
      *  broker tests do not replay source history, but they must reach the same
@@ -99,9 +101,12 @@ export class SessionManager {
     static forkFrom(_source, cwd) {
         return SessionManager.create(cwd);
     }
-    /** Resume: round-trip the .jsonl PATH the revive passed via `--session`. */
+    /** Resume: round-trip the saved session identity with its .jsonl path. */
     static open(path) {
-        return new SessionManager(`fake-sess-resume-${randomUUID()}`, path, true);
+        const sessionId = readFileSync(`${path}.id`, 'utf8').trim();
+        if (sessionId === '')
+            throw new Error(`fake session identity is empty: ${path}.id`);
+        return new SessionManager(sessionId, path, true);
     }
     getSessionId() {
         return this.sessionId;

package/dist/core/__tests__/focuses.test.js

@@ -16,7 +16,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { openFocusRow, setFocusOccupant, setFocusPane, closeFocusRow, getFocusByNode, getFocusByPane, getFocusById, listFocuses, } from '../canvas/focuses.js';
-import { openDb, closeDb, MIGRATIONS } from '../canvas/db.js';
+import { openDb, closeDb, migrate, MIGRATIONS } from '../canvas/db.js';
 import { focusOf, isFocused, focusByPane, focusedNodes, listFocuses as placementListFocuses, } from '../runtime/placement.js';
 let home;
 function userVersion(db) {
@@ -25,6 +25,11 @@ function userVersion(db) {
 function tableNames(db) {
     return db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name);
 }
+function freshDb() {
+    const db = openDb();
+    migrate(db);
+    return db;
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-focuses-'));
     process.env['CRTR_HOME'] = home;
@@ -40,13 +45,13 @@ after(() => {
 });
 // Migration v6 — the additive `focuses` table.
 test('a fresh db migrates to the latest version and has the focuses table', () => {
-    const db = openDb();
+    const db = freshDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     assert.ok(tableNames(db).includes('focuses'), 'focuses table exists on a fresh db');
 });
 // Canvas setters / reads — open / setOccupant / setPane / close round-trip.
 test('open / setOccupant / close round-trip with the reads', () => {
-    openDb();
+    freshDb();
     openFocusRow('f1', '%a', 'Sa', 'A');
     // getFocusByNode / getFocusByPane / getFocusById all resolve the same row.
     const byNode = getFocusByNode('A');
@@ -70,7 +75,7 @@ test('open / setOccupant / close round-trip with the reads', () => {
     assert.deepEqual(listFocuses(), []);
 });
 test('independent focus rows do not contend', () => {
-    openDb();
+    freshDb();
     openFocusRow('f1', '%a', 'Sa', 'A');
     openFocusRow('f2', '%b', 'Sb', 'B');
     // Mutating one viewport leaves the other entirely intact.
@@ -89,7 +94,7 @@ test('independent focus rows do not contend', () => {
 // can't be fabricated in the ordinary suite, so we cover the prune + null-pane paths
 // here; the live-pane read is covered in the compiled-seam broker lifecycle suite.
 test('placement reads GC dead-pane viewer rows and keep null-pane rows', () => {
-    openDb();
+    freshDb();
     openFocusRow('f1', '%a', 'Sa', 'A'); // %a is not a live tmux pane → pruned on read
     openFocusRow('f2', null, 'Sb', 'B'); // null pane (not realized yet) → kept
     // The dead-pane row is GC'd on read: placement returns null AND the row is

package/dist/core/__tests__/helpers/harness.js

@@ -26,15 +26,19 @@ import { homedir, tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
-import { createNode, getNode, recordPid, subscribersOf, subscriptionsOf, } from '../../canvas/canvas.js';
-import { closeDb } from '../../canvas/db.js';
+import { createNode, getNode, subscribersOf, subscriptionsOf, } from '../../canvas/canvas.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
+import { beginExecution, liveExecutionForNode, recordExecutionPid } from '../../canvas/executions.js';
+import { resetSession } from '../../canvas/sessions.js';
+import { closeScopedStores } from '../../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
+import { piAgentDir } from '../../runtime/package-health.js';
 import { spawnChild } from '../../runtime/spawn.js';
 import { superviseTick } from '../../../daemon/crtrd.js';
 import { DaemonFleet } from '../../../daemon/fleet.js';
 import { apiSocketPath } from '../../canvas/paths.js';
 import { bindDaemonEventSource, resetEventSourceForTests } from '../../events/source.js';
 import { bindFleet, resetFleetForTests } from '../../runtime/fleet.js';
-import { readInboxSince } from '../../feed/inbox.js';
 import { capturePidCommand, recordedPidLiveness } from '../../canvas/pid.js';
 // locations
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -157,7 +161,7 @@ export async function createHarness(opts = {}) {
     // short); a test-only artifact of the long temp base. Use a SHORT base + short
     // prefix for the canvas home so broker sockets fit. tmpHome (HOME) hosts no
     // socket, so it can stay on the standard temp base.
-    const shortTmpBase = existsSync('/tmp') ? '/tmp' : tmpdir();
+    const shortTmpBase = tmpdir();
     const home = mkdtempSync(join(shortTmpBase, 'crh-'));
     const tmpHome = mkdtempSync(join(tmpdir(), 'crtr-harness-HOME-'));
     const session = `${opts.sessionPrefix ?? 'crtr-harness'}-${process.pid}-${Date.now().toString(36)}`;
@@ -202,7 +206,10 @@ export async function createHarness(opts = {}) {
             .join(' ');
     }
     process.env['CRTR_BROKER_ENGINE'] = FAKE_ENGINE;
+    initializeFreshScopedStore({ kind: 'user', root: join(tmpHome, '.crouter') });
+    initializeFreshScopedStore({ kind: 'provider', root: piAgentDir() });
     closeDb();
+    migrate(openDb());
     // The harness drives superviseTick() in-process, so it stands in for the
     // daemon process (crtrd.ts:2490 binds the same way at real-daemon startup).
     // Reset first: `bound` is a single-assignment process global with no other
@@ -432,6 +439,29 @@ export async function createHarness(opts = {}) {
     function bootCount(nodeId) {
         return readLines(join(nodeDir(nodeId), 'fake-pi.boots.jsonl')).length;
     }
+    function inbox(nodeId) {
+        return openDb().prepare(`SELECT m.message_id AS entry_id, m.operation_id, m.created_at AS ts,
+      m.sender_node_id AS "from", m.sender_name AS from_name, d.urgency AS tier,
+      m.kind, m.body_ref AS ref, m.label, m.body_json AS data, m.disposition
+      FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+      WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 1
+      ORDER BY m.seq`).all(nodeId).map((row) => {
+            const value = row;
+            return {
+                entry_id: value['entry_id'],
+                operation_id: value['operation_id'],
+                ts: value['ts'],
+                from: value['from'],
+                ...(value['from_name'] === null ? {} : { from_name: value['from_name'] }),
+                tier: value['tier'],
+                kind: value['kind'],
+                ...(value['ref'] === null ? {} : { ref: value['ref'] }),
+                label: value['label'],
+                ...(value['data'] === null ? {} : { data: JSON.parse(value['data']) }),
+                ...(value['disposition'] === null ? {} : { disposition: value['disposition'] }),
+            };
+        });
+    }
     function injected(nodeId) {
         return readLines(join(nodeDir(nodeId), 'fake-pi.injected.jsonl'))
             .map((l) => {
@@ -470,16 +500,8 @@ export async function createHarness(opts = {}) {
                 parent: null,
             };
             createNode(meta);
-            // Every real bootRoot records its broker's pid synchronously at launch
-            // (spawn.ts's bootRoot calls recordPid right after launchBrokerOrCrash,
-            // well before any daemon tick) — a production root's pi_pid is never
-            // null for longer than an instant. This in-process fixture has no real
-            // broker to launch, so mint it a pid that is genuinely alive for the
-            // rest of the test: this harness process's own pid (already threaded
-            // into the id scheme above). The pid is metadata post-cutover (fleet
-            // entries are the liveness authority), but status surfaces and identity
-            // rechecks still read it, so keep the fixture row shaped like a real one.
-            recordPid(id, process.pid);
+            const executionId = beginExecution(id, { daemonEpoch: fleet.epoch() });
+            recordExecutionPid(executionId, id, process.pid);
             closeDb();
             return id;
         },
@@ -502,6 +524,13 @@ export async function createHarness(opts = {}) {
                 pi_pid: o.pi_pid ?? null,
             };
             createNode(meta);
+            if (o.pi_pid !== null && o.pi_pid !== undefined) {
+                const executionId = beginExecution(id, { daemonEpoch: fleet.epoch() });
+                recordExecutionPid(executionId, id, o.pi_pid);
+            }
+            if (o.pi_session_id !== null && o.pi_session_id !== undefined || o.pi_session_file !== null && o.pi_session_file !== undefined) {
+                resetSession(id, { sessionId: o.pi_session_id ?? '', transcriptPath: o.pi_session_file ?? null });
+            }
             closeDb();
             return id;
         },
@@ -631,7 +660,7 @@ export async function createHarness(opts = {}) {
         },
         inbox(nodeId) {
             closeDb();
-            return readInboxSince(nodeId);
+            return inbox(nodeId);
         },
         injected,
         fakeCmd(nodeId, cmd) {
@@ -644,7 +673,7 @@ export async function createHarness(opts = {}) {
             catch {
                 /* already gone */
             }
-            await waitFor(() => apiServerProc.exitCode === null ? null : true, { label: 'harness API server exit' });
+            await waitFor(() => apiServerProc.exitCode === null && apiServerProc.signalCode === null ? null : true, { label: 'harness API server exit' });
         },
         dialogResults(nodeId) {
             return readLines(join(nodeDir(nodeId), 'fake-pi.dialog.jsonl'))
@@ -685,8 +714,9 @@ export async function createHarness(opts = {}) {
             for (const d of nodeDirs()) {
                 try {
                     const n = getNode(d);
-                    if (n?.pi_pid != null)
-                        pidsToKill.add(n.pi_pid);
+                    const execution = liveExecutionForNode(d);
+                    if (execution?.pid != null)
+                        pidsToKill.add(execution.pid);
                 }
                 catch {
                     /* row gone — fine */
@@ -726,6 +756,7 @@ export async function createHarness(opts = {}) {
                 }
             }
             closeDb();
+            closeScopedStores();
             // Stop the standalone API-server process (its socket lives under home/,
             // removed below). SIGTERM lets it close() its listener and unlink the
             // socket; the pid is also in pidsToKill as a backstop.
@@ -735,6 +766,7 @@ export async function createHarness(opts = {}) {
             catch {
                 /* already gone */
             }
+            await waitFor(() => apiServerProc.exitCode === null && apiServerProc.signalCode === null ? null : true, { label: 'harness API server exit' });
             // Leave the process-global event source + fleet unbound so the next
             // harness instance in this same test process can bind cleanly (see setup
             // above). dispose() the fleet first: a pending backoff-respawn timer

package/dist/core/__tests__/history-inbox.test.js

@@ -6,13 +6,13 @@
 // sender (`from`) is visible in both the read body and the artifact title.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { contextDir } from '../canvas/paths.js';
-import { appendInbox } from '../feed/inbox.js';
+import { enqueueNodeMail } from '../feed/messages.js';
 import { buildCorpus, nodeArtifacts, resolveRef } from '../canvas/history.js';
 let home;
 function node(id, cwd) {
@@ -34,6 +34,8 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    mkdirSync(home, { recursive: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -64,12 +66,9 @@ test('default history excludes inbox; --type inbox includes it, with full sender
     createNode(node('sender-1', cwd));
     const receiver = createNode(node('receiver-1', cwd));
     const longBody = 'a'.repeat(4000); // well past any old label-clip length
-    appendInbox(receiver.node_id, {
-        from: 'sender-1',
-        tier: 'urgent',
-        kind: 'message',
-        label: 'first line of a long message',
-        data: { body: longBody },
+    enqueueNodeMail(receiver.node_id, {
+        senderNodeId: 'sender-1', kind: 'message', label: 'first line of a long message',
+        bodyJson: { body: longBody }, urgency: 'urgent', wake: 1,
     });
     // (a) default corpus (no explicit types) excludes inbox entirely.
     const defaultCorpus = buildCorpus({ nodes: [receiver.node_id] }, {});
@@ -104,12 +103,9 @@ test('a spilled message body is read RAW — a leading frontmatter-shaped block
     // survive intact, unlike a report ref (which always has real frontmatter
     // stripped by fileBodyLoader).
     const body = '---\nfoo: bar\n---\n' + 'a'.repeat(4000);
-    appendInbox(receiver.node_id, {
-        from: 'sender-3',
-        tier: 'normal',
-        kind: 'message',
-        label: 'first line',
-        data: { body },
+    enqueueNodeMail(receiver.node_id, {
+        senderNodeId: 'sender-3', kind: 'message', label: 'first line',
+        bodyJson: { body }, urgency: 'normal', wake: 1,
     });
     const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
     assert.ok(resolved !== null);
@@ -118,7 +114,7 @@ test('a spilled message body is read RAW — a leading frontmatter-shaped block
 test('a null-from (system) inbox entry reads as "system", not blank or thrown', () => {
     const cwd = '/tmp/hist-work-2';
     const receiver = createNode(node('receiver-2', cwd));
-    appendInbox(receiver.node_id, { from: null, tier: 'normal', kind: 'update', label: 'system note' });
+    enqueueNodeMail(receiver.node_id, { kind: 'update', label: 'system note', urgency: 'normal', wake: 1 });
     const resolved = resolveRef(`${receiver.node_id}:inbox/000000`);
     assert.ok(resolved !== null);
     assert.ok(resolved.body.includes('from: system'), 'null sender renders as "system"');

package/dist/core/__tests__/human-action-delivery.test.js

@@ -3,29 +3,55 @@ import assert from 'node:assert/strict';
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
-import { claimActionDelivery, enqueueActionDelivery, readActionDelivery, } from '../canvas/human-deliveries.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { ensureScopeInitialized } from '../config.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { enqueueExternalAction } from '../feed/messages.js';
+import { claimExternalActionDelivery, readExternalActionDelivery, settleDelivery } from '../canvas/deliveries.js';
 import { deliveryBackoffMs } from '../canvas/delivery-contract.js';
-import { deliverySettlementForOutcome } from '../../daemon/delivery/run-delivery.js';
-import { deliverAction } from '../../daemon/human/deliver-action.js';
+import { deliverySettlementForOutcome, runDelivery } from '../../daemon/delivery/run-delivery.js';
 let home;
 const priorHome = process.env['CRTR_HOME'];
+const priorUserHome = process.env['HOME'];
+function actionDelivery(requestId) {
+    return readExternalActionDelivery(`human-action:${requestId}`);
+}
+function enqueueAction(requestId, argv, cwd, completion) {
+    return enqueueExternalAction({
+        destinationId: 'human_action',
+        adapter: { adapter: 'subprocess', argv, cwd },
+        bodyJson: completion,
+        idempotencyKey: `human-action:${requestId}`,
+    });
+}
+async function deliverAction(deliveryId, argv, cwd, document, attempt, claimOwner) {
+    await runDelivery({ argv, cwd, document, attempt }, (settlement) => settleDelivery(deliveryId, attempt, claimOwner, settlement, Date.now()));
+}
 beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-human-action-delivery-'));
     process.env['CRTR_HOME'] = home;
+    process.env['HOME'] = home;
+    ensureScopeInitialized('user', join(home, '.crouter'));
+    migrate(openDb());
 });
 afterEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
 });
 after(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     if (priorHome === undefined)
         delete process.env['CRTR_HOME'];
     else
         process.env['CRTR_HOME'] = priorHome;
+    if (priorUserHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = priorUserHome;
 });
 test('delivery retries follow the durable backoff and exit boundary', () => {
     assert.equal(deliveryBackoffMs(1), 5_000);
@@ -92,15 +118,12 @@ test('the delivery child gets the consent boundary env, never crtrd\'s own', asy
     process.env['CRTRD_ONLY_SECRET'] = 'must-not-cross';
     const requestId = 'b'.repeat(64);
     try {
-        enqueueActionDelivery({
-            requestId,
-            argv: [script],
-            cwd: project,
-            completion: { schema: 'crtr.human-completion/v1', requestId, delivery: { attempt: 0 } },
-        });
-        const claimed = claimActionDelivery(requestId, Date.now(), 'claimant');
+        enqueueAction(requestId, [script], project, { schema: 'crtr.human-completion/v1', requestId, delivery: { attempt: 0 } });
+        const delivery = actionDelivery(requestId);
+        assert.ok(delivery !== null);
+        const claimed = claimExternalActionDelivery(delivery.deliveryId, Date.now(), 'claimant');
         assert.ok(claimed !== null);
-        await deliverAction(claimed, 'claimant');
+        await deliverAction(claimed.deliveryId, [script], project, { schema: 'crtr.human-completion/v1', requestId, delivery: { attempt: 0 } }, claimed.attempts, 'claimant');
     }
     finally {
         delete process.env['NL_CORE_URL'];
@@ -110,7 +133,7 @@ test('the delivery child gets the consent boundary env, never crtrd\'s own', asy
         else
             process.env['HOME'] = priorUserHome;
     }
-    assert.equal(readActionDelivery(requestId)?.state, 'accepted');
+    assert.equal(actionDelivery(requestId)?.state, 'acknowledged');
     const childEnv = new Map(readFileSync(envDump, 'utf8').split('\n').flatMap((line) => {
         const split = line.indexOf('=');
         return split === -1 ? [] : [[line.slice(0, split), line.slice(split + 1)]];
@@ -122,21 +145,18 @@ test('the delivery child gets the consent boundary env, never crtrd\'s own', asy
 });
 test('the guarded claim admits only one contender', () => {
     const requestId = 'a'.repeat(64);
-    enqueueActionDelivery({
-        requestId,
-        argv: ['/bin/true'],
-        cwd: home,
-        completion: { schema: 'crtr.human-completion/v1', delivery: { attempt: 0 } },
-    });
+    enqueueAction(requestId, ['/bin/true'], home, { schema: 'crtr.human-completion/v1', delivery: { attempt: 0 } });
     const now = Date.now();
-    const first = claimActionDelivery(requestId, now, 'claimant-a');
-    const second = claimActionDelivery(requestId, now, 'claimant-b');
-    assert.equal(first?.state, 'running');
-    assert.equal(first?.attempt, 1);
+    const delivery = actionDelivery(requestId);
+    assert.ok(delivery !== null);
+    const first = claimExternalActionDelivery(delivery.deliveryId, now, 'claimant-a');
+    const second = claimExternalActionDelivery(delivery.deliveryId, now, 'claimant-b');
+    assert.equal(first?.state, 'handed_off');
+    assert.equal(first?.attempts, 1);
     assert.equal(second, null);
-    assert.deepEqual(readActionDelivery(requestId) && {
-        state: readActionDelivery(requestId).state,
-        attempt: readActionDelivery(requestId).attempt,
-        claimOwner: readActionDelivery(requestId).claimOwner,
-    }, { state: 'running', attempt: 1, claimOwner: 'claimant-a' });
+    assert.deepEqual(actionDelivery(requestId) && {
+        state: actionDelivery(requestId).state,
+        attempt: actionDelivery(requestId).attempts,
+        claimOwner: actionDelivery(requestId).claimOwner,
+    }, { state: 'handed_off', attempt: 1, claimOwner: 'claimant-a' });
 });

package/dist/core/__tests__/human-actions.test.js

@@ -8,6 +8,8 @@ import assert from 'node:assert/strict';
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { ensureScopeInitialized, writeRawConfig } from '../config.js';
+import { closeScopedStores } from '../scoped-state/db.js';
 import { resolveHumanAction } from '../human-actions.js';
 import { createProfile } from '../profiles/manifest.js';
 import { resetScopeCache } from '../scope.js';
@@ -29,13 +31,16 @@ beforeEach(() => {
     delete process.env['CRTR_PROFILE_ID'];
     process.chdir(cwd);
     resetScopeCache();
+    ensureScopeInitialized('user', join(home, '.crouter'));
 });
 afterEach(() => {
     process.chdir(previousCwd);
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     resetScopeCache();
 });
 after(() => {
+    closeScopedStores();
     process.chdir(previousCwd);
     if (previousHome === undefined)
         delete process.env['HOME'];
@@ -57,10 +62,9 @@ function writeAction(root, relativeExecutable, relativeCwd) {
 test('nearest project declaration wins and resolves paths from its authoring root', () => {
     const userRoot = join(home, '.crouter');
     writeAction(userRoot, 'user-bin', 'user-cwd');
-    mkdirSync(userRoot, { recursive: true });
-    writeFileSync(join(userRoot, 'config.json'), JSON.stringify({
+    writeRawConfig('user', {
         humanActions: { release: { argv: ['user-bin'], cwd: 'user-cwd' }, 'user-only': { argv: ['user-bin'], cwd: 'user-cwd' } },
-    }));
+    });
     const outer = join(home, 'work', 'outer');
     writeAction(outer, 'outer-bin', 'outer-cwd');
     mkdirSync(join(outer, '.crouter'), { recursive: true });