@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/__tests__/integration/deferred-no-wake.test.js

@@ -20,7 +20,7 @@
 //       wake-worthy work" (no revive, relaunch-attempt state cleared); a
 //       non-deferred unseen entry still wakes exactly as before, and delivers
 //       the previously-held deferred entry alongside it with no loss (neither
-//       entry is ever dropped or skipped by the cursor).
+//       delivery is ever dropped or acknowledged before settlement).
 //
 // (1) and (2) are exercised through the REAL `node message send` command
 // boundary (mirrors push-final-guard.test.ts's #339/#340 pattern) with
@@ -47,7 +47,11 @@ import { DatabaseSync } from 'node:sqlite';
 import { createNode, deleteNode, getNode, setFrozen, setStatus, subscribe, withFreshTerminalGuard } from '../../canvas/canvas.js';
 import { hasNoNaturalCycle } from '../../runtime/revive-all.js';
 import { canvasDbPath, nodeDir, apiSocketPath } from '../../canvas/paths.js';
-import { closeDb } from '../../canvas/db.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
+import { recordExecutionPid } from '../../canvas/executions.js';
+import { closeScopedStores } from '../../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
+import { userScopeRoot } from '../../scope.js';
 import { createApiServer } from '../../../daemon/api/server.js';
 import { CrtrClient } from '../../../api/index.js';
 import { BROKER_IDLE_TURN_START } from '../../runtime/broker/held-deferred-inbox.js';
@@ -55,7 +59,9 @@ import { registerNode } from '../../../commands/node.js';
 import { pushFinal } from '../../feed/feed.js';
 import { InputError } from '../../io.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
-import { appendInbox, readInboxSince, readCursor } from '../../feed/inbox.js';
+import { enqueueNodeMail } from '../../feed/messages.js';
+import { acknowledgedNodeMailCount } from '../../canvas/deliveries.js';
+import { beginExecution } from '../../canvas/executions.js';
 import { superviseTick } from '../../../daemon/crtrd.js';
 import registerCanvasInboxWatcher from '../../../pi-extensions/canvas-inbox-watcher.js';
 import { bindTestFleet } from '../helpers/fleet.js';
@@ -63,6 +69,7 @@ import { resetFleetForTests } from '../../runtime/fleet.js';
 let home;
 let server;
 const prevNodeId = process.env['CRTR_NODE_ID'];
+const prevHome = process.env['HOME'];
 // createApiServer binds its socket asynchronously (file created in the listen
 // callback), and the socket FILE existing does not yet prove the server answers
 // a full HTTP round-trip — under serial recycle the first request to a
@@ -86,6 +93,25 @@ async function waitForSocket(path) {
     }
     throw new Error(`api socket never answered /healthz at ${path}`);
 }
+function inboxRows(nodeId) {
+    return openDb().prepare(`SELECT m.message_id, d.urgency, d.state, d.acknowledged_at FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+      WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.canceled_at IS NULL ORDER BY m.seq`).all(nodeId).map((row) => ({
+        messageId: row.message_id,
+        tier: row.urgency,
+        state: row.state,
+        acknowledgedAt: row.acknowledged_at,
+    }));
+}
+function sendMail(nodeId, tier, body, senderNodeId = 'human') {
+    return enqueueNodeMail(nodeId, {
+        ...(senderNodeId === null ? {} : { senderNodeId }),
+        kind: 'message',
+        label: body,
+        bodyJson: { body },
+        urgency: tier,
+        wake: 1,
+    });
+}
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -99,6 +125,14 @@ function node(id, over = {}) {
         ...over,
     };
 }
+function createFixtureNode(meta) {
+    createNode(meta);
+    if (meta.pi_pid == null)
+        return null;
+    const executionId = beginExecution(meta.node_id, { daemonEpoch: 'test-epoch' });
+    recordExecutionPid(executionId, meta.node_id, meta.pi_pid);
+    return executionId;
+}
 /** A pid guaranteed dead by the time spawnSync returns. */
 function deadPid() {
     const r = spawnSync('true', [], { stdio: 'ignore' });
@@ -113,6 +147,7 @@ function messageSendLeaf() {
 }
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-deferred-nowake-'));
+    process.env['HOME'] = home;
     process.env['CRTR_HOME'] = home;
     // superviseTick and the in-process API server's launch verbs resolve
     // boundFleet() (D-2). Empty is the point: no fabricated row here has a live
@@ -121,8 +156,11 @@ before(() => {
 });
 beforeEach(async () => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     mkdirSync(home, { recursive: true });
+    migrate(openDb());
+    initializeFreshScopedStore({ kind: 'user', root: userScopeRoot() });
     // POST-P1 the `node message send` leaf forwards its wake/revive canvas ops
     // through cliClient() over crtrd's socket. This home neutralizes the daemon (no REAL
     // crtrd) but binds no server, so stand one up in-process on the isolated
@@ -135,11 +173,17 @@ afterEach(async () => {
     await server?.close();
     server = undefined;
     closeDb();
+    closeScopedStores();
 });
 after(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    if (prevHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = prevHome;
     if (prevNodeId === undefined)
         delete process.env['CRTR_NODE_ID'];
     else
@@ -153,7 +197,7 @@ test('node message send --tier deferred to an ordinary dormant (idle-released) t
     // terminal target takes no such cycle, so its mail is raised to the steering
     // tier instead (locked by the next test).
     createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release' }));
-    const inboxBefore = readInboxSince(id, undefined).length;
+    const inboxBefore = inboxRows(id).length;
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = ((...args) => {
@@ -169,14 +213,14 @@ test('node message send --tier deferred to an ordinary dormant (idle-released) t
         headlessBrokerHost.launch = originalLaunch;
     }
     assert.equal(launchCalls, 0, 'a deferred delivery to a dormant target must never attempt a revive');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore + 1, 'the message is durably appended despite the hold');
+    assert.equal(inboxRows(id).length, inboxBefore + 1, 'the SQL delivery is durable despite the hold');
     const after = getNode(id);
     assert.equal(after.status, 'idle', 'target left exactly where it was');
     assert.equal(after.intent, 'idle-release', 'target left exactly where it was');
 });
 test('node message send --tier deferred to a TERMINAL-lifecycle target is raised to the steering tier and wakes it', { timeout: 30_000 }, async () => {
     const id = 'terminalLifecycleTarget';
-    createNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    createFixtureNode(node(id, { status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
     // Fully stubbed (never delegates): the point is that the raised entry DOES
     // attempt the wake, so a real detached broker must not be spawned to prove it.
     const originalLaunch = headlessBrokerHost.launch;
@@ -192,9 +236,9 @@ test('node message send --tier deferred to a TERMINAL-lifecycle target is raised
     finally {
         headlessBrokerHost.launch = originalLaunch;
     }
-    const entries = readInboxSince(id, undefined);
-    assert.equal(entries.length, 1, 'the message is durably appended');
-    assert.equal(entries[0].tier, 'urgent', 'a terminal target takes no later cycle, so the entry is raised to the steering tier');
+    const entries = inboxRows(id);
+    assert.equal(entries.length, 1, 'the SQL delivery is durable');
+    assert.equal(entries[0].tier, 'urgent', 'a terminal target takes no later cycle, so the delivery is raised to the steering tier');
     assert.equal(launchCalls, 1, 'the raised entry wakes the dormant terminal target instead of waiting for a cycle it never takes');
     assert.equal(res['revived'], true, 'the send reports the wake it actually performed');
 });
@@ -202,7 +246,7 @@ test('node message send --tier deferred rejects ordinary terminal targets but ac
     for (const status of ['done', 'canceled']) {
         const id = `terminal-${status}`;
         createNode(node(id, { status, intent: null }));
-        const inboxBefore = readInboxSince(id, undefined).length;
+        const inboxBefore = inboxRows(id).length;
         const originalLaunch = headlessBrokerHost.launch;
         let launchCalls = 0;
         headlessBrokerHost.launch = ((...args) => {
@@ -216,7 +260,7 @@ test('node message send --tier deferred rejects ordinary terminal targets but ac
             headlessBrokerHost.launch = originalLaunch;
         }
         assert.equal(launchCalls, 0, `${status}: a rejected deferred must never attempt a revive`);
-        assert.equal(readInboxSince(id, undefined).length, inboxBefore, `${status}: a rejected deferred must not append an inbox entry`);
+        assert.equal(inboxRows(id).length, inboxBefore, `${status}: a rejected deferred must not create a SQL delivery`);
     }
     const frozenId = 'terminal-frozen';
     createNode(node(frozenId, {
@@ -225,25 +269,20 @@ test('node message send --tier deferred rejects ordinary terminal targets but ac
         intent: 'parked',
     }));
     setFrozen(frozenId, new Date().toISOString());
-    const inboxBefore = readInboxSince(frozenId, undefined).length;
+    const inboxBefore = inboxRows(frozenId).length;
     const result = await messageSendLeaf().run({ to: frozenId, tier: 'deferred', body: 'held for thaw' });
     assert.equal(result['guidance'], "Delivered — held for the target's next natural cycle; not revived.", 'a frozen terminal row still has a thaw cycle');
     assert.equal(result['revived'], false, 'deferred mail waits for the thaw without launching');
-    assert.equal(readInboxSince(frozenId, undefined).length, inboxBefore + 1, 'the deferred message is durably appended');
+    assert.equal(inboxRows(frozenId).length, inboxBefore + 1, 'the deferred SQL delivery is durable');
 });
 // #343 third-fix-cycle review: the IMMEDIATE `--tier deferred` path had its
 // own, separate TOCTOU — a stale-snapshot check (`rejectDeferredWithoutNaturalCycle`)
-// ran well before the real appendInbox call, with several fallible side
-// effects (assertFinalizedForReopen/writeOutputSchema/appendSituationalContext/
-// commitReopen) in between. Fixed shape: the whole remaining sequence is now
-// one `deliverImmediate` closure, guarded end-to-end by `withFreshTerminalGuard`
-// when tier === 'deferred' — so the fresh check and every side effect
-// (appendInbox included) share ONE canvas write-lock transaction. This drives
-// that exact composed shape (the guard wrapping a body that appends an inbox
-// entry identical to what `deliverImmediate` builds) against a REAL rival
-// writer, proving the immediate path linearizes the same way the shared
-// primitive is proven to below.
-test('#343 (immediate path): withFreshTerminalGuard closes the TOCTOU for `node message send --tier deferred` immediate delivery too — a rival terminalization cannot land between the fresh check and the appendInbox it guards', { timeout: 30_000 }, () => {
+// ran before the SQL delivery write, with several fallible side effects
+// (assertFinalizedForReopen/writeOutputSchema/appendSituationalContext/
+// commitReopen) in between. The guarded closure keeps the fresh check and
+// delivery write in one canvas transaction. This drives that shape against a
+// real rival writer.
+test('#343 (immediate path): withFreshTerminalGuard closes the TOCTOU for `node message send --tier deferred` — a rival terminalization cannot land between the fresh check and the SQL delivery it guards', { timeout: 30_000 }, () => {
     const targetId = 'raceTargetImmediate';
     createNode(node(targetId, { status: 'active', intent: null }));
     const rival = new DatabaseSync(canvasDbPath());
@@ -252,13 +291,7 @@ test('#343 (immediate path): withFreshTerminalGuard closes the TOCTOU for `node
     const outcome = withFreshTerminalGuard(targetId, hasNoNaturalCycle, () => {
         // Same entry shape `deliverImmediate` builds for a body message — the
         // guarded write this test's race must prove is atomic with the fresh read.
-        const entry = appendInbox(targetId, {
-            from: 'human',
-            tier: 'deferred',
-            kind: 'message',
-            label: 'raced note',
-            data: { body: 'raced note' },
-        });
+        const entry = sendMail(targetId, 'deferred', 'raced note');
         // Attempted WHILE the guard holds its BEGIN IMMEDIATE write lock — a real
         // concurrent finish/cancel/finalization racing the immediate delivery.
         try {
@@ -274,7 +307,7 @@ test('#343 (immediate path): withFreshTerminalGuard closes the TOCTOU for `node
     try {
         assert.equal(rivalBlocked, true, 'the rival terminalization could not acquire the lock mid-guard — the immediate delivery genuinely serializes against it');
         assert.equal(outcome.kind, 'ran', 'the guard read the pre-terminal state and completed the delivery, uncontested by the rival');
-        assert.equal(readInboxSince(targetId, undefined).length, 1, 'exactly the one guarded append landed');
+        assert.equal(inboxRows(targetId).length, 1, 'exactly the one guarded SQL delivery landed');
     }
     finally {
         try {
@@ -307,7 +340,7 @@ test('#343 (immediate path): `node message send --tier deferred --reopen` agains
         else
             process.env['CRTR_NODE_ID'] = priorNodeId;
     }
-    const inboxBefore = readInboxSince(id, undefined).length;
+    const inboxBefore = inboxRows(id).length;
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = ((...args) => {
@@ -321,7 +354,7 @@ test('#343 (immediate path): `node message send --tier deferred --reopen` agains
         headlessBrokerHost.launch = originalLaunch;
     }
     assert.equal(launchCalls, 0, 'a rejected reopen+deferred retask must never attempt a revive');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore, 'a rejected reopen+deferred retask must not append an inbox entry');
+    assert.equal(inboxRows(id).length, inboxBefore, 'a rejected reopen+deferred retask must not create a SQL delivery');
     assert.equal(getNode(id)?.final_report, firstFinal, 'the canonical final must survive untouched — assertFinalizedForReopen/commitReopen never ran on the rejected path');
 });
 // The shared `withFreshTerminalGuard` primitive itself (Major, gh #341/#343
@@ -396,11 +429,11 @@ test("withFreshTerminalGuard reports 'missing' — never runs the guarded body
     let bodyRan = false;
     const outcome = withFreshTerminalGuard(targetId, hasNoNaturalCycle, () => {
         bodyRan = true;
-        return appendInbox(targetId, { from: 'human', tier: 'deferred', kind: 'message', label: 'orphan', data: { body: 'orphan' } });
+        return sendMail(targetId, 'deferred', 'orphan');
     });
     assert.equal(bodyRan, false, "a missing target must NEVER run the guarded body — 'missing' must not be treated as safe/empty-and-runnable");
     assert.deepEqual(outcome, { kind: 'missing' }, "the guard reports a distinct 'missing' outcome, not 'terminal' (nothing to report) and not a fabricated 'ran'");
-    assert.equal(existsSync(nodeDir(targetId)), false, 'the guarded appendInbox never ran, so no orphan node dir was recreated for the deleted target');
+    assert.equal(existsSync(nodeDir(targetId)), false, 'the guarded SQL delivery never ran, so no orphan node dir was recreated for the deleted target');
 });
 // Daemon second pass — crtrd.ts's idle-release inbox loop
 // Deterministic: `headlessBrokerHost.launch` is fully STUBBED (never delegates
@@ -409,18 +442,18 @@ test("withFreshTerminalGuard reports 'missing' — never runs the guarded body
 // `exited` promise never settles and its pid is a fixed sentinel, so the only
 // thing under test is the daemon's revive-or-hold DECISION (cycles/status/
 // intent), never a real engine's boot. Genuine post-revive DELIVERY (both
-// entries actually reaching the target, no duplicate/loss, cursor settling) is
+// entries actually reaching the target, no duplicate/loss, SQL acknowledgement) is
 // proven separately below through the real inbox watcher.
 test('daemon second pass: a deferred-only unseen set never wakes an idle-released node; a later non-deferred entry wakes it (decision only — real delivery is proven separately below)', { timeout: 30_000 }, async () => {
     const id = 'idleReleaseDeferredDaemon';
-    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    createFixtureNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
     // A live child is a standing obligation, which is what keeps this row
     // idle-released across the tick. Without one it would settle into its park
     // instead (the resident carve-out, locked in the next test) and the wake half
     // below would be measuring a parked row.
     createNode(node(`${id}Child`, { status: 'active' }));
     subscribe(id, `${id}Child`);
-    const baseline = readCursor(id); // undefined — the real watcher never ran here
+    const baselineAcknowledged = acknowledgedNodeMailCount(id);
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = (() => {
@@ -430,13 +463,7 @@ test('daemon second pass: a deferred-only unseen set never wakes an idle-release
     let deferredEntry;
     let normalEntry;
     try {
-        deferredEntry = appendInbox(id, {
-            from: 'human',
-            tier: 'deferred',
-            kind: 'message',
-            label: 'deferred note',
-            data: { body: 'deferred note' },
-        });
+        deferredEntry = sendMail(id, 'deferred', 'deferred note');
         await superviseTick();
         {
             const after = getNode(id);
@@ -445,14 +472,8 @@ test('daemon second pass: a deferred-only unseen set never wakes an idle-release
             assert.equal(after.intent, 'idle-release', 'target left idle-release');
             assert.equal(launchCalls, 0, 'no launch attempt for a deferred-only unseen set');
         }
-        assert.equal(readCursor(id), baseline, 'the cursor is untouched while the entry is held (nothing consumed it)');
-        normalEntry = appendInbox(id, {
-            from: 'human',
-            tier: 'normal',
-            kind: 'message',
-            label: 'go now',
-            data: { body: 'go now' },
-        });
+        assert.equal(acknowledgedNodeMailCount(id), baselineAcknowledged, 'the held delivery remains unacknowledged');
+        normalEntry = sendMail(id, 'normal', 'go now');
         await superviseTick();
         {
             const after = getNode(id);
@@ -465,15 +486,12 @@ test('daemon second pass: a deferred-only unseen set never wakes an idle-release
     finally {
         headlessBrokerHost.launch = originalLaunch;
     }
-    // No loss: BOTH the previously-held deferred entry and the new one are still
-    // past the (daemon-never-advances) cursor, ready for the real inbox watcher's
-    // normal flush to deliver together on this same revived cycle.
-    const unseen = readInboxSince(id, baseline).map((e) => e.entry_id);
-    assert.deepEqual(unseen, [deferredEntry.entry_id, normalEntry.entry_id], 'neither entry was dropped or skipped by the daemon');
+    // No loss: both independent SQL obligations remain pending for the revived execution.
+    assert.deepEqual(inboxRows(id).filter((row) => row.state === 'pending').map((row) => row.messageId), [deferredEntry.messageId, normalEntry.messageId], 'neither delivery was dropped or acknowledged by the daemon');
 });
 test('the lifecycle tick parks a resident holding deferred-only mail — mail that never wakes it must not hold it idle forever either', { timeout: 30_000 }, async () => {
     const id = 'residentDeferredOnly';
-    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
+    createFixtureNode(node(id, { lifecycle: 'resident', status: 'idle', intent: 'idle-release', pi_pid: deadPid(), pi_session_id: null, cwd: home }));
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = (() => {
@@ -481,19 +499,19 @@ test('the lifecycle tick parks a resident holding deferred-only mail — mail th
         return { pid: 0x7ffffffe, exited: new Promise(() => { }) };
     });
     try {
-        const held = appendInbox(id, {
-            from: null,
-            tier: 'deferred',
+        const held = enqueueNodeMail(id, {
             kind: 'message',
             label: 'Child done — auto-done notice',
-            data: { reason: 'child-auto-done' },
+            bodyJson: { reason: 'child-auto-done' },
+            urgency: 'deferred',
+            wake: 1,
         });
         await superviseTick();
         const after = getNode(id);
         assert.equal(after.status, 'done', 'the resident settles into its park instead of sitting idle behind mail that cannot wake it');
         assert.equal(after.intent, 'parked', 'parked, not released');
         assert.equal(launchCalls, 0, 'settling quietly never launches an engine');
-        assert.deepEqual(readInboxSince(id, undefined).map((e) => e.entry_id), [held.entry_id], 'the held entry survives the park, ready for the cycle that reopens the conversation');
+        assert.deepEqual(inboxRows(id).filter((row) => row.state === 'pending').map((row) => row.messageId), [held.messageId], 'the held delivery survives the park, ready for the cycle that reopens the conversation');
     }
     finally {
         headlessBrokerHost.launch = originalLaunch;
@@ -512,21 +530,32 @@ function makeFakePi() {
     return pi;
 }
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
-test('the real inbox watcher holds a deferred entry alone, then delivers it TOGETHER with a later normal entry with no duplicate/loss, and the durable cursor settles past both (gh #341 review: genuine delivery, not just the daemon decision)', { timeout: 30_000 }, async () => {
+async function waitUntil(check, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (!check()) {
+        if (Date.now() >= deadline)
+            throw new Error('timed out waiting for watcher deliveries');
+        await wait(5);
+    }
+}
+test('the real inbox watcher holds a deferred delivery alone, then delivers it TOGETHER with a later normal delivery with no duplicate/loss, and acknowledges both at settlement (gh #341 review: genuine delivery, not just the daemon decision)', { timeout: 30_000 }, async () => {
     const id = 'watcherDeferredThenNormal';
-    // The watcher may advance its cursor only for the current broker generation.
-    // This fake Pi runs in this test process, so its fabricated node must carry
-    // that process as the active broker just like a real launched node does.
-    createNode(node(id, { lifecycle: 'resident', status: 'idle', intent: null, pi_pid: process.pid }));
+    // The watcher claims mail only for its current execution. This fake Pi runs
+    // in this test process, so its fabricated node must carry that execution just
+    // like a real launched node does.
+    createNode(node(id, { description: 'deferred inbox watcher fixture', lifecycle: 'resident', status: 'idle', intent: null }));
+    const executionId = beginExecution(id, { daemonEpoch: 'test' });
     const TICK_MS = 20;
     const DEBOUNCE_MS = 25;
     const SETTLE_MS = TICK_MS * 2 + DEBOUNCE_MS + 30;
     const origTick = process.env['CRTR_WATCHER_TICK_MS'];
     const origDebounce = process.env['CRTR_WATCHER_DEBOUNCE_MS'];
     const origNodeId = process.env['CRTR_NODE_ID'];
+    const origExecutionId = process.env['CRTR_EXECUTION_ID'];
     process.env['CRTR_WATCHER_TICK_MS'] = String(TICK_MS);
     process.env['CRTR_WATCHER_DEBOUNCE_MS'] = String(DEBOUNCE_MS);
     process.env['CRTR_NODE_ID'] = id;
+    process.env['CRTR_EXECUTION_ID'] = executionId;
     const pi = makeFakePi();
     let dispose;
     try {
@@ -538,24 +567,12 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
         // No agent_start fired — the watcher treats the node as idle, same as the
         // idle-released daemon scenario above.
         await wait(TICK_MS + 60);
-        const deferredEntry = appendInbox(id, {
-            from: 'human',
-            tier: 'deferred',
-            kind: 'message',
-            label: 'deferred note',
-            data: { body: 'deferred note' },
-        });
+        const deferredEntry = sendMail(id, 'deferred', 'deferred note');
         await wait(SETTLE_MS);
         assert.equal(pi.injected.length, 0, 'a deferred-only idle buffer is held by the real watcher, not delivered alone');
-        assert.equal(readCursor(id), undefined, 'nothing committed while held');
-        const normalEntry = appendInbox(id, {
-            from: 'human',
-            tier: 'normal',
-            kind: 'message',
-            label: 'go now',
-            data: { body: 'go now' },
-        });
-        await wait(SETTLE_MS + TICK_MS * 2);
+        assert.equal(acknowledgedNodeMailCount(id), 0, 'nothing is acknowledged while held');
+        const normalEntry = sendMail(id, 'normal', 'go now');
+        await waitUntil(() => pi.injected.length === 2, SETTLE_MS + TICK_MS * 12);
         // Two direct human entries are two verbatim deliveries — one message per
         // entry, physical order preserved, one visible send per watcher cycle.
         assert.equal(pi.injected.length, 2, 'both entries are delivered once a non-deferred entry joins the batch — each human entry as its own verbatim message');
@@ -563,13 +580,13 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
         assert.doesNotMatch(pi.injected[0].content, /go now/, 'the deliveries are separate messages, not one concatenation');
         assert.match(pi.injected[1].content, /go now/, 'the new normal entry follows in its own message — not duplicated');
         assert.equal(pi.injected[0].deliverAs, undefined, 'idle delivery triggers a fresh turn, no deliverAs');
-        // Idle-path delivery hands off on the void send but only COMMITS the
-        // durable cursor at agent_settled (never on the fire-and-forget send
-        // itself) — settle the turn and prove the cursor lands past BOTH delivered
-        // entries, not just the earlier (previously-held) one.
+        // Idle-path delivery hands off on the void send but only acknowledges the
+        // SQL deliveries at agent_settled (never on the fire-and-forget send
+        // itself) — settle the turn and prove both delivered obligations settle.
         await pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => false });
-        assert.equal(readCursor(id), normalEntry.entry_id, 'the durable cursor settles past BOTH delivered entries, at the final physical entry');
-        assert.notEqual(readCursor(id), deferredEntry.entry_id, 'not a partial commit stuck at the earlier entry');
+        assert.equal(acknowledgedNodeMailCount(id), 2, 'agent_settled acknowledges both delivered SQL obligations');
+        assert.ok(inboxRows(id).every((row) => row.acknowledgedAt !== null), 'neither delivery is left in a partial handoff');
+        assert.notEqual(normalEntry.messageId, deferredEntry.messageId, 'the batch retains distinct message identities');
     }
     finally {
         dispose?.();
@@ -585,5 +602,9 @@ test('the real inbox watcher holds a deferred entry alone, then delivers it TOGE
             delete process.env['CRTR_NODE_ID'];
         else
             process.env['CRTR_NODE_ID'] = origNodeId;
+        if (origExecutionId === undefined)
+            delete process.env['CRTR_EXECUTION_ID'];
+        else
+            process.env['CRTR_EXECUTION_ID'] = origExecutionId;
     }
 });

package/dist/core/__tests__/integration/host-teardown-process-group.test.js

@@ -67,8 +67,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createHarness } from '../helpers/harness.js';
 import { isPidAlive, capturePidIdentities, killProcessTreePids, captureTeardownSnapshot } from '../../canvas/pid.js';
-import { recordPid } from '../../canvas/canvas.js';
 import { openDb } from '../../canvas/db.js';
+import { beginExecution, recordExecutionPid } from '../../canvas/executions.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
 let h;
 let root;
@@ -85,6 +85,10 @@ function trackPid(pid) {
     if (pid != null)
         spawnedPids.add(pid);
 }
+function recordExecution(nodeId, pid) {
+    const executionId = beginExecution(nodeId, { daemonEpoch: h.fleet.epoch() });
+    recordExecutionPid(executionId, nodeId, pid);
+}
 before(async () => {
     h = await createHarness({ headless: true, sessionPrefix: 'crtr-hostpg' });
     root = h.spawnRoot('host-teardown-process-group suite root');
@@ -362,7 +366,7 @@ test('CONNECTED broker accepts the shutdown frame and exits cleanly, but leaves
     const id = h.fabricateBrokerNode({ parent: root, pi_pid: null, status: 'active' });
     const sockPath = h.brokerSock(id);
     const { leaderPid, descendantPid } = await spawnBrokerWithDetachedDescendantAndSocket(sockPath, ['sleep', '300']);
-    recordPid(id, leaderPid);
+    recordExecution(id, leaderPid);
     assert.equal(isPidAlive(leaderPid), true, 'fake connected broker leader alive before teardown');
     assert.equal(isPidAlive(descendantPid), true, 'detached descendant alive before teardown');
     // teardown() connects, writes the shutdown frame, and the fake broker
@@ -455,14 +459,14 @@ test('end-to-end: headlessBrokerHost.teardown() honors a launch-time identity mi
     'stand-in "reused pid" tree at all, even after both the SIGTERM and SIGKILL escalation grace windows elapse', async () => {
     const { leaderPid, descendantPid } = await spawnBrokerWithSharedGroupDescendant('teardown-mismatch');
     const id = h.fabricateBrokerNode({ parent: root, pi_pid: leaderPid, status: 'active' });
-    // recordPid captures the REAL current identity for leaderPid (genuinely
+    // recordExecution captures the REAL current identity for leaderPid (genuinely
     // alive right now, so this succeeds) — then this corrupts JUST the stored
     // identity column to simulate "the recorded launch-time baseline no
     // longer matches this pid's CURRENT owner", standing in for an actual OS
     // pid-recycle between this node's launch and this teardown() call.
-    recordPid(id, leaderPid);
+    recordExecution(id, leaderPid);
     openDb()
-        .prepare('UPDATE nodes SET pi_pid_identity = ? WHERE node_id = ?')
+        .prepare("UPDATE executions SET process_identity = ? WHERE node_id = ? AND state != 'exited'")
         .run('deliberately-mismatched-launch-identity', id);
     headlessBrokerHost.teardown(id);
     // No real broker listens on this fabricated node's view.sock, so