@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/__tests__/model-routes-config.test.js

@@ -1,10 +1,12 @@
 import { after, afterEach, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { persistModelRoute, readConfig, readMergedLaunchConfig } from '../config.js';
+import { persistModelRoute, readConfig, readMergedLaunchConfig, readRawConfigAtRoot, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { expandModelCandidates } from '../model-routes.js';
+import { piAgentDir } from '../runtime/package-health.js';
 import { resetScopeCache } from '../scope.js';
 let home;
 let work;
@@ -23,6 +25,10 @@ function route(providerId = 'provider-x', family = 'family-x', credentialSource
     };
 }
 function writeConfig(root, config) {
+    if (root === join(home, '.crouter')) {
+        writeRawConfig('user', config);
+        return;
+    }
     mkdirSync(root, { recursive: true });
     writeFileSync(join(root, 'config.json'), JSON.stringify(config));
 }
@@ -34,6 +40,8 @@ beforeEach(() => {
     work = mkdtempSync(join(tmpdir(), 'crtr-model-routes-work-'));
     process.env.HOME = home;
     resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    initializeFreshScopedStore({ kind: 'provider', root: piAgentDir() });
 });
 afterEach(() => {
     resetScopeCache();
@@ -87,7 +95,7 @@ test('route records retain __proto__ ids when read and persisted', () => {
     writeConfig(root, JSON.parse(JSON.stringify({ modelRoutes: { ['__proto__']: route() } })));
     assert.deepEqual(readMergedLaunchConfig(work, null).modelRoutes?.['__proto__'], route());
     persistModelRoute(root, '__proto__', route('persisted-provider'));
-    const raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    const raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes['__proto__'], route('persisted-provider'));
 });
 test('route candidate identity distinguishes delimiter-containing route and provider ids', () => {
@@ -131,12 +139,12 @@ test('persistModelRoute touches only its raw route and deletes by restoring inhe
     const other = route('other-provider');
     writeConfig(root, { modelRoutes: { other }, max_panes_per_window: 7 });
     persistModelRoute(root, 'edited', route('edited-provider'));
-    let raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    let raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes.other, other);
     assert.deepEqual(raw.modelRoutes.edited, route('edited-provider'));
     assert.equal(raw.modelLadders, undefined);
     assert.equal(raw.max_panes_per_window, 7);
     persistModelRoute(root, 'edited', undefined);
-    raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes, { other });
 });

package/dist/core/__tests__/node-outcome.test.js

@@ -4,15 +4,80 @@ import { DatabaseSync } from 'node:sqlite';
 import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb, MIGRATIONS } from '../canvas/db.js';
-import { createNode, getRow } from '../canvas/canvas.js';
-import { armOutcomeDelivery, claimOutcomeDelivery, readOutcomeDelivery, recoverRunningOutcomeDeliveries, settleOutcomeDelivery, } from '../canvas/node-outcome-deliveries.js';
+import { closeDb, MIGRATIONS, migrate, openDb, withCanvasWrite } from '../canvas/db.js';
+import { createNode, getNode, getRow } from '../canvas/canvas.js';
+import { activateArmedExternalActionDelivery, armExternalActionDelivery, claimExternalActionDelivery, messageBodyForDelivery, readExternalActionDelivery, resetHandedOffDeliveries, settleDelivery, } from '../canvas/deliveries.js';
 import { transition } from '../runtime/lifecycle.js';
 import { composeNodeOutcomeDocument } from '../runtime/outcome-document.js';
 import { pushFinal } from '../feed/feed.js';
 import { OUTCOME_PAYLOAD_MAX_BYTES } from '../canvas/types.js';
 let home;
 const priorHome = process.env['CRTR_HOME'];
+function outcomeKey(nodeId) {
+    return `node-outcome:${nodeId}`;
+}
+function outcomeDelivery(nodeId) {
+    return readExternalActionDelivery(outcomeKey(nodeId));
+}
+function nodeAtOutcome(node) {
+    const reason = node.outcome_reason;
+    let status;
+    let intent;
+    if (node.outcome_kind === 'result' || reason === 'finished' || reason === 'declined') {
+        status = 'done';
+        intent = 'done';
+    }
+    else if (reason === 'parked') {
+        status = 'done';
+        intent = 'parked';
+    }
+    else if (reason === 'closed' || reason === 'retired' || reason === 'stranded' || reason === 'deadline_exceeded') {
+        status = 'canceled';
+        intent = null;
+    }
+    else {
+        status = 'dead';
+        intent = null;
+    }
+    return { ...node, status, intent, terminal_reason: reason };
+}
+function armOutcomeAction(input) {
+    const payload = input.payload ?? null;
+    const json = JSON.stringify(payload);
+    if (json === undefined)
+        throw new TypeError('outcome delivery payload must be JSON-serializable');
+    if (Buffer.byteLength(json, 'utf8') > OUTCOME_PAYLOAD_MAX_BYTES)
+        throw new RangeError(`outcome delivery payload exceeds ${OUTCOME_PAYLOAD_MAX_BYTES} bytes`);
+    return withCanvasWrite((db) => {
+        const existing = outcomeDelivery(input.nodeId);
+        if (existing !== null && existing.state !== 'armed')
+            return null;
+        armExternalActionDelivery(db, {
+            destinationId: input.actionName,
+            adapter: { adapter: 'subprocess', argv: input.argv, cwd: input.cwd, config_origin: input.configOrigin, payload },
+            idempotencyKey: outcomeKey(input.nodeId),
+        }, input.now);
+        const node = getNode(input.nodeId);
+        if (node === null)
+            throw new Error(`unknown node ${input.nodeId}`);
+        if (node.outcome_at !== null) {
+            if (node.outcome_kind === null || node.outcome_reason === null)
+                throw new Error(`outcome latch is incomplete for node ${input.nodeId}`);
+            activateArmedExternalActionDelivery(db, {
+                idempotencyKey: outcomeKey(input.nodeId),
+                label: input.nodeId,
+                bodyJson: JSON.stringify(composeNodeOutcomeDocument({
+                    node: nodeAtOutcome(node),
+                    outcome: { kind: node.outcome_kind, reason: node.outcome_reason, at: node.outcome_at, revision: node.outcome_revision, detailJson: node.outcome_detail_json ?? null },
+                    action: { name: input.actionName, payload },
+                    finalReport: node.final_report,
+                })),
+                supersede: false,
+            }, input.now);
+        }
+        return outcomeDelivery(input.nodeId);
+    });
+}
 function node(nodeId) {
     return {
         node_id: nodeId,
@@ -29,6 +94,7 @@ beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-node-outcome-'));
     process.env['CRTR_HOME'] = home;
+    migrate(openDb());
 });
 afterEach(() => {
     closeDb();
@@ -105,23 +171,24 @@ test('a canonical final supersedes a prior failure outcome and increments revisi
 });
 test('outcome delivery rejects an oversized payload before a node is armed', () => {
     createNode(node('oversized-payload'));
-    assert.throws(() => armOutcomeDelivery({
+    assert.throws(() => armOutcomeAction({
         nodeId: 'oversized-payload', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { value: 'x'.repeat(OUTCOME_PAYLOAD_MAX_BYTES) },
     }), /exceeds/);
-    assert.equal(readOutcomeDelivery('oversized-payload'), null);
+    assert.equal(outcomeDelivery('oversized-payload'), null);
 });
 test('outcome delivery armed after settlement is born pending with its document', () => {
     createNode(node('settled-delivery'));
     transition('settled-delivery', 'crash');
-    const delivery = armOutcomeDelivery({
+    const delivery = armOutcomeAction({
         nodeId: 'settled-delivery', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { callback: 'one' }, now: 123,
     });
     assert.equal(delivery?.state, 'pending');
     assert.equal(delivery?.nextAttemptAt, 123);
-    assert.deepEqual(delivery?.document && {
-        schema: delivery.document.schema,
-        outcomeId: delivery.document.outcomeId,
-        action: delivery.document.action,
+    const document = delivery === null ? null : messageBodyForDelivery(delivery.deliveryId);
+    assert.deepEqual(document && {
+        schema: document.schema,
+        outcomeId: document.outcomeId,
+        action: document.action,
     }, {
         schema: 'crtr.node-outcome/v1',
         outcomeId: 'settled-delivery:1',
@@ -130,28 +197,28 @@ test('outcome delivery armed after settlement is born pending with its document'
 });
 test('outcome delivery state is fenced, recoverable, and follows the durable backoff', () => {
     createNode(node('delivery'));
-    assert.ok(armOutcomeDelivery({
+    assert.ok(armOutcomeAction({
         nodeId: 'delivery', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { callback: 'one' }, now: 100,
     }));
     transition('delivery', 'crash');
-    assert.equal(readOutcomeDelivery('delivery')?.state, 'pending');
-    assert.ok(readOutcomeDelivery('delivery')?.document, 'the armed row is stamped with its outcome document');
-    const first = claimOutcomeDelivery('delivery', Date.now(), 'daemon-a');
-    assert.equal(first.state, 'running');
-    assert.equal(settleOutcomeDelivery('delivery', first.attempt, 'daemon-b', { state: 'accepted' }, Date.now()), false, 'a stale claimant cannot settle');
-    assert.equal(settleOutcomeDelivery('delivery', first.attempt, 'daemon-a', { state: 'accepted' }, Date.now()), true);
-    assert.equal(readOutcomeDelivery('delivery')?.state, 'accepted');
+    assert.equal(outcomeDelivery('delivery')?.state, 'pending');
+    assert.ok(messageBodyForDelivery(outcomeDelivery('delivery').deliveryId), 'the armed row is stamped with its outcome document');
+    const first = claimExternalActionDelivery(outcomeDelivery('delivery').deliveryId, Date.now(), 'daemon-a');
+    assert.equal(first.state, 'handed_off');
+    assert.equal(settleDelivery(first.deliveryId, first.attempts, 'daemon-b', { state: 'accepted' }, Date.now()), false, 'a stale claimant cannot settle');
+    assert.equal(settleDelivery(first.deliveryId, first.attempts, 'daemon-a', { state: 'accepted' }, Date.now()), true);
+    assert.equal(outcomeDelivery('delivery')?.state, 'acknowledged');
     createNode(node('recover'));
-    armOutcomeDelivery({ nodeId: 'recover', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', now: 100 });
+    armOutcomeAction({ nodeId: 'recover', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', now: 100 });
     transition('recover', 'crash');
-    const running = claimOutcomeDelivery('recover', Date.now(), 'daemon-a');
-    assert.equal(running.state, 'running');
+    const running = claimExternalActionDelivery(outcomeDelivery('recover').deliveryId, Date.now(), 'daemon-a');
+    assert.equal(running.state, 'handed_off');
     const recoveredAt = Date.now();
-    assert.equal(recoverRunningOutcomeDeliveries(recoveredAt), 1);
-    assert.deepEqual(readOutcomeDelivery('recover') && {
-        state: readOutcomeDelivery('recover').state,
-        nextAttemptAt: readOutcomeDelivery('recover').nextAttemptAt,
-        claimOwner: readOutcomeDelivery('recover').claimOwner,
+    assert.equal(resetHandedOffDeliveries(recoveredAt), 1);
+    assert.deepEqual(outcomeDelivery('recover') && {
+        state: outcomeDelivery('recover').state,
+        nextAttemptAt: outcomeDelivery('recover').nextAttemptAt,
+        claimOwner: outcomeDelivery('recover').claimOwner,
     }, { state: 'pending', nextAttemptAt: recoveredAt, claimOwner: null });
 });
 test('v39 migrates a v38 database and backfills finalized and terminal rows', () => {

package/dist/core/__tests__/on-read-crouter-home-fence.test.js

@@ -10,7 +10,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs } from '../substrate/on-read-node.js';
@@ -32,6 +32,7 @@ beforeEach(() => {
     // touch the fake user home; the read path we test is constructed by hand.
     canvasHome = mkdtempSync(join(tmpdir(), 'crtr-fence-canvas-'));
     process.env['CRTR_HOME'] = canvasHome;
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -44,8 +45,8 @@ after(() => {
     else
         process.env['HOME'] = prevHomeEnv;
 });
-test('a store nested in the crouter home does not leak into a canvas-artifact read', () => {
-    const node = spawnNode({ kind: 'general', cwd: fakeHome, parent: null }).node_id;
+test('a store nested in the crouter home does not leak into a canvas-artifact read', async () => {
+    const node = (await spawnNode({ kind: 'general', cwd: fakeHome, parent: null })).node_id;
     // A private store misresolved into the crouter home: `~/.crouter/.crouter/memory/`.
     const leakedStore = join(fakeHome, '.crouter', '.crouter', 'memory');
     mkdirSync(leakedStore, { recursive: true });

package/dist/core/__tests__/on-read-dedup-resume.test.js

@@ -10,7 +10,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs } from '../substrate/on-read-node.js';
@@ -44,6 +44,7 @@ beforeEach(() => {
     else
         process.env['HOME'] = prevHomeEnv;
     work = mkdtempSync(join(tmpdir(), 'crtr-onread-work-'));
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -56,11 +57,11 @@ after(() => {
     else
         process.env['HOME'] = prevHomeEnv;
 });
-test('project and user memory docs without read surfaces do not fire on file reads', () => {
+test('project and user memory docs without read surfaces do not fire on file reads', async () => {
     const fakeHome = mkdtempSync(join(tmpdir(), 'crtr-onread-user-home-'));
     process.env['HOME'] = fakeHome;
     resetScopeCache();
-    const node = spawnNode({ kind: 'general', cwd: join(fakeHome, 'work'), parent: null }).node_id;
+    const node = (await spawnNode({ kind: 'general', cwd: join(fakeHome, 'work'), parent: null })).node_id;
     const userMemDir = join(fakeHome, '.crouter', 'memory');
     mkdirSync(userMemDir, { recursive: true });
     writeFileSync(join(userMemDir, 'noisy-global.md'), '---\nkind: preference\n' +
@@ -79,8 +80,8 @@ test('project and user memory docs without read surfaces do not fire on file rea
     assert.equal(rendered, '', 'no file context renders without an explicit trigger');
     rmSync(fakeHome, { recursive: true, force: true });
 });
-test('on-read exposure survives a strict resume and resets for a fresh context', () => {
-    const node = spawnNode({ kind: 'general', cwd: work, parent: null }).node_id;
+test('on-read exposure survives a strict resume and resets for a fresh context', async () => {
+    const node = (await spawnNode({ kind: 'general', cwd: work, parent: null })).node_id;
     // A file-routed substrate doc in a `.crouter/memory/` ancestor. The
     // `./`-anchored glob pins the repo-relative anchor: `src/file.ts` matches
     // only relative to the doc's owning repo dir, never absolutely.
@@ -111,8 +112,8 @@ test('on-read exposure survives a strict resume and resets for a fresh context',
     const stateFresh = loadContextExposureState(node);
     assert.ok(renderOnReadDocs(node, readFile, exposureTarget(stateFresh, 'transcript')).includes(FIXTURE_BODY), 'a fresh transcript surfaces the doc again');
 });
-test('an explicitly routed doc injects on-read under its frontmatter name, not the path-derived one', () => {
-    const node = spawnNode({ kind: 'general', cwd: work, parent: null }).node_id;
+test('an explicitly routed doc injects on-read under its frontmatter name, not the path-derived one', async () => {
+    const node = (await spawnNode({ kind: 'general', cwd: work, parent: null })).node_id;
     const memDir = join(work, '.crouter', 'memory');
     declareRepositoryRoot(memDir);
     writeFileSync(join(memDir, 'physical-guide.md'), '---\nkind: knowledge\n' +

package/dist/core/__tests__/on-read-nested-store.test.js

@@ -11,7 +11,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs, renderWorkspaceOpenDocs } from '../substrate/on-read-node.js';
@@ -36,6 +36,7 @@ beforeEach(() => {
     process.env['HOME'] = fakeHome;
     canvasHome = mkdtempSync(join(tmpdir(), 'crtr-nested-canvas-'));
     process.env['CRTR_HOME'] = canvasHome;
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -76,9 +77,9 @@ function makeWorkTree() {
         'NESTED NEIGHBOUR BODY\n');
     return work;
 }
-test('a nested store front door surfaces on a read beneath its owning dir, not outside it', () => {
+test('a nested store front door surfaces on a read beneath its owning dir, not outside it', async () => {
     const work = makeWorkTree();
-    const node = spawnNode({ kind: 'general', cwd: work, parent: null }).node_id;
+    const node = (await spawnNode({ kind: 'general', cwd: work, parent: null })).node_id;
     const inside = join(work, 'pkg', 'lib', 'file.ts');
     mkdirSync(join(work, 'pkg', 'lib'), { recursive: true });
     writeFileSync(inside, 'export const x = 1;\n');
@@ -93,9 +94,9 @@ test('a nested store front door surfaces on a read beneath its owning dir, not o
     const renderedOutside = renderOnReadDocs(node, outside, freshTranscriptTarget());
     assert.ok(!renderedOutside.includes(NESTED_BODY), `read outside pkg must not surface the nested front door; got: ${renderedOutside}`);
 });
-test('workspace-open and on-read share one exposure ledger', () => {
+test('workspace-open and on-read share one exposure ledger', async () => {
     const work = makeWorkTree();
-    const node = spawnNode({ kind: 'general', cwd: work, parent: null }).node_id;
+    const node = (await spawnNode({ kind: 'general', cwd: work, parent: null })).node_id;
     const transcript = freshTranscriptTarget();
     const opened = renderWorkspaceOpenDocs(node, transcript);
     assert.ok(opened.includes(ROOT_BODY), 'workspace open delivers the mounted root front door');
@@ -109,7 +110,7 @@ test('workspace-open and on-read share one exposure ledger', () => {
     assert.ok(onRead.includes('name="work/pkg"'), 'the nested front door answers under the root namespace plus owner path');
     assert.ok(!onRead.includes(ROOT_BODY), 'the root front door already delivered at workspace open — never twice');
 });
-test('a hand-authored `./`-anchored read glob in a user-scope doc never matches a read', () => {
+test('a hand-authored `./`-anchored read glob in a user-scope doc never matches a read', async () => {
     const userStore = join(fakeHome, '.crouter', 'memory');
     mkdirSync(userStore, { recursive: true });
     writeFileSync(join(userStore, 'control.md'), '---\nkind: knowledge\n' +
@@ -124,7 +125,7 @@ test('a hand-authored `./`-anchored read glob in a user-scope doc never matches
         'USER DOT BODY MUST NOT FIRE\n');
     const work = join(fakeHome, 'work');
     mkdirSync(work, { recursive: true });
-    const node = spawnNode({ kind: 'general', cwd: work, parent: null }).node_id;
+    const node = (await spawnNode({ kind: 'general', cwd: work, parent: null })).node_id;
     const readFile = join(fakeHome, 'notes', 'thing.md');
     mkdirSync(join(fakeHome, 'notes'), { recursive: true });
     writeFileSync(readFile, '# a note\n');

package/dist/core/__tests__/passive-subscription.test.js

@@ -1,49 +1,17 @@
-// End-to-end tests for passive subscriptions:
-//   1. A passive subscriber's pushes land in passive.jsonl, NOT inbox.jsonl
-//      (so the inbox-watcher never wakes it); an active subscriber's land in
-//      inbox.jsonl as before.
-//   2. the broker drain reads + clears the accumulator (surfaces exactly once).
-//   3. canvas-passive-context formats drained entries as timestamped XML and
-//      transforms an `input` event into pre-text + the original message.
-//
-// Run: node --import tsx/esm --test src/core/__tests__/passive-subscription.test.ts
-import { test, before, beforeEach, afterEach, after } from 'node:test';
+import { after, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
 import { createNode, subscribe } from '../canvas/canvas.js';
 import { armCron, getCron } from '../canvas/crons.js';
-import { closeDb } from '../canvas/db.js';
-import { inboxPath, passivePath, apiSocketPath } from '../canvas/paths.js';
-import { createApiServer } from '../../daemon/api/server.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { acknowledgeNodeMail, claimNodeMail, hasUnseenWakeMail } from '../canvas/deliveries.js';
+import { beginExecution } from '../canvas/executions.js';
 import { push } from '../feed/feed.js';
-import { appendPassive } from '../feed/passive.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { drainBrokerPassive } from '../runtime/broker/passive.js';
-import { readLeaf } from '../../commands/canvas-history/read.js';
-import registerCanvasPassiveContext from '../../pi-extensions/canvas-passive-context.js';
+import { nodeMailEntry } from '../feed/inbox.js';
+import { formatPassive } from '../../pi-extensions/canvas-passive-context.js';
 let home;
-function readPassiveEntries(nodeId) {
-    const path = passivePath(nodeId);
-    if (!existsSync(path))
-        return [];
-    return readFileSync(path, 'utf8').split('\n').filter(Boolean).map((line) => JSON.parse(line));
-}
-// The one test that resolves an emitted feed ref drives `canvas history read`'s
-// leaf (`readLeaf`), a thin CLI forwarder to crtrd since the API re-plumb. Stand
-// up a real in-process `createApiServer()` on the isolated CRTR_HOME's socket so
-// that read resolves through the genuine daemon seam — no autostarted
-// subprocess, no mock client.
-let server;
-async function waitForSocket(path) {
-    for (let i = 0; i < 200; i++) {
-        if (existsSync(path))
-            return;
-        await new Promise((r) => setTimeout(r, 25));
-    }
-    throw new Error(`api socket never bound at ${path}`);
-}
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -57,53 +25,44 @@ function node(id, over = {}) {
         ...over,
     };
 }
+function execution(nodeId) {
+    return beginExecution(nodeId, { daemonEpoch: 'test' });
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-passive-'));
     process.env['CRTR_HOME'] = home;
 });
-beforeEach(async () => {
+beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     mkdirSync(home, { recursive: true });
-    server = createApiServer();
-    await waitForSocket(apiSocketPath());
-});
-afterEach(async () => {
-    await server?.close();
+    migrate(openDb());
 });
 after(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
-    delete process.env['CRTR_NODE_ID'];
 });
-test('passive push accumulates in passive.jsonl, not inbox.jsonl', async () => {
+test('a passive subscriber receives a non-waking SQL delivery with the canonical report ref', async () => {
     createNode(node('pub'));
     createNode(node('observer'));
-    subscribe('observer', 'pub', false); // PASSIVE
+    subscribe('observer', 'pub', false);
     const result = await push('pub', { kind: 'update', body: 'first observation\nmore detail' });
-    // The emitted feed ref is the same canonical handle accepted by `canvas
-    // history read`, while PushResult.reportPath remains an absolute path.
-    const acc = readPassiveEntries('observer');
-    const ref = acc[0].ref;
-    assert.equal(ref, `pub:reports/${basename(result.reportPath)}`);
-    const resolved = await readLeaf.run({ ref });
-    assert.equal(resolved?.['ref'], ref, 'canvas history read accepts the emitted ref verbatim');
-    assert.equal(resolved?.['content'], 'first observation\nmore detail');
-    assert.equal(result.reportPath.startsWith('/'), true);
-    // No inbox entry → the inbox-watcher would never see it → no wake.
-    assert.equal(existsSync(inboxPath('observer')), false);
-    assert.equal(readInboxSince('observer').length, 0);
-    // It landed in the passive accumulator instead.
-    assert.equal(acc.length, 1);
-    assert.equal(acc[0].from, 'pub');
-    assert.equal(acc[0].label, 'first observation');
-    assert.match(acc[0].ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/, 'report refs use a compact random suffix');
+    const executionId = execution('observer');
+    const claim = claimNodeMail('observer', executionId, 'passive');
+    assert.equal(hasUnseenWakeMail('observer'), false, 'passive mail does not wake a node');
+    assert.equal(claim.action, 'claimed');
+    assert.equal(claim.deliveries.length, 1);
+    const entry = nodeMailEntry(claim.deliveries[0]);
+    assert.equal(entry.from, 'pub');
+    assert.equal(entry.label, 'first observation');
+    assert.equal(entry.ref, `pub:reports/${basename(result.reportPath)}`);
+    assert.match(entry.ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/);
 });
-test('active push still lands in inbox.jsonl (wakes) and clears the manager deadline', async () => {
+test('an active subscriber receives waking SQL mail and clears its deadline', async () => {
     createNode(node('pub'));
     createNode(node('worker-mgr'));
-    subscribe('worker-mgr', 'pub', true); // ACTIVE
+    subscribe('worker-mgr', 'pub', true);
     armCron({
         cron_id: 'manager-deadline',
         name: 'manager deadline',
@@ -126,102 +85,36 @@ test('active push still lands in inbox.jsonl (wakes) and clears the manager dead
         tier: 'normal',
     });
     await push('pub', { kind: 'update', body: 'active report' });
-    assert.equal(existsSync(passivePath('worker-mgr')), false);
-    const inbox = readInboxSince('worker-mgr');
-    assert.equal(inbox.length, 1);
-    assert.equal(inbox[0].from, 'pub');
-    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
-    assert.equal(getCron('manager-deadline'), null, 'the child report won the deadline race');
-});
-test('a deferred update still lands in an active subscriber inbox at deferred tier', async () => {
-    createNode(node('pub'));
-    // Resident: deferred mail to a TERMINAL target is bumped to urgent by the
-    // shipped tier bump, so only a resident subscriber shows the requested tier.
-    createNode(node('worker-mgr', { lifecycle: 'resident' }));
-    subscribe('worker-mgr', 'pub', true); // ACTIVE
-    await push('pub', { kind: 'update', deliveryTier: 'deferred', body: 'active report' });
-    assert.equal(existsSync(passivePath('worker-mgr')), false);
-    const inbox = readInboxSince('worker-mgr');
-    assert.equal(inbox.length, 1);
-    assert.equal(inbox[0].from, 'pub');
-    assert.equal(inbox[0].tier, 'deferred', 'requested delivery urgency reaches the subscriber unchanged');
-    assert.equal(inbox[0].kind, 'update', 'the stored report kind is untouched by delivery urgency');
-    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
+    const claim = claimNodeMail('worker-mgr', execution('worker-mgr'), 'wake');
+    assert.equal(hasUnseenWakeMail('worker-mgr'), true);
+    assert.equal(getCron('manager-deadline'), null, 'the report won the deadline race');
+    assert.equal(claim.deliveries.length, 1);
+    assert.equal(nodeMailEntry(claim.deliveries[0]).from, 'pub');
 });
-test('mixed active + passive subscribers route to their own stores', async () => {
+test('a passive delivery is acknowledged only after it has been claimed', async () => {
     createNode(node('pub'));
-    createNode(node('active-sub'));
-    createNode(node('passive-sub'));
-    subscribe('active-sub', 'pub', true);
-    subscribe('passive-sub', 'pub', false);
-    const res = await push('pub', { kind: 'urgent', body: 'something happened' });
-    assert.deepEqual(new Set(res.deliveredTo), new Set(['active-sub', 'passive-sub']));
-    assert.equal(readInboxSince('active-sub').length, 1);
-    assert.equal(existsSync(passivePath('active-sub')), false);
-    assert.equal(readPassiveEntries('passive-sub').length, 1);
-    assert.equal(existsSync(inboxPath('passive-sub')), false);
-});
-test('broker passive drain reads then clears (surfaces exactly once)', () => {
-    createNode(node('observer'));
-    appendPassive('observer', { from: 'a', tier: 'normal', kind: 'update', label: 'one' });
-    appendPassive('observer', { from: 'b', tier: 'normal', kind: 'update', label: 'two' });
-    const drained = drainBrokerPassive('observer');
-    assert.equal(drained.length, 2);
-    assert.deepEqual(drained.map((e) => e.label), ['one', 'two']); // oldest first
-    // Cleared — a second drain is empty.
-    assert.equal(drainBrokerPassive('observer').length, 0);
-    assert.equal(readPassiveEntries('observer').length, 0);
-});
-test('broker passive drain tolerates a corrupt line — keeps every good entry, loses only the bad one', () => {
     createNode(node('observer'));
-    appendPassive('observer', { from: 'a', tier: 'normal', kind: 'update', label: 'one' });
-    appendPassive('observer', { from: 'b', tier: 'normal', kind: 'update', label: 'two' });
-    // A torn/garbage line lands between good entries (a partial write, a crash
-    // mid-append). The whole feed must NOT be discarded over it.
-    appendFileSync(passivePath('observer'), '{not valid json\n', 'utf8');
-    appendPassive('observer', { from: 'c', tier: 'normal', kind: 'update', label: 'three' });
-    const drained = drainBrokerPassive('observer');
-    assert.equal(drained.length, 3, 'all three good entries survive the corrupt line');
-    assert.deepEqual(drained.map((e) => e.label), ['one', 'two', 'three']);
-    // And it still cleared: a second drain is empty (snapshot removed).
-    assert.equal(drainBrokerPassive('observer').length, 0);
-    assert.equal(existsSync(passivePath('observer')), false);
+    subscribe('observer', 'pub', false);
+    await push('pub', { kind: 'update', body: 'one' });
+    await push('pub', { kind: 'update', body: 'two' });
+    const executionId = execution('observer');
+    const claim = claimNodeMail('observer', executionId, 'passive');
+    assert.deepEqual(claim.deliveries.map((delivery) => nodeMailEntry(delivery).label), ['one', 'two']);
+    const receipt = acknowledgeNodeMail('observer', executionId, claim.deliveries.map((delivery) => ({
+        deliveryId: delivery.deliveryId,
+        attempts: delivery.attempts,
+        disposition: 'acknowledged',
+    })));
+    assert.deepEqual(receipt.results.map((result) => result.outcome), ['acknowledged', 'acknowledged']);
+    assert.deepEqual(claimNodeMail('observer', executionId, 'passive').deliveries, []);
 });
-function makeFakePi() {
-    return { on(e, h) { if (e === 'input')
-            this.handler = h; } };
-}
-test('input handler injects drained backlog as pre-text, then clears it', async () => {
+test('passive SQL mail retains the existing timestamped backlog rendering', async () => {
     createNode(node('pub'));
     createNode(node('observer'));
     subscribe('observer', 'pub', false);
     await push('pub', { kind: 'update', body: 'the body of the report\nsecond line' });
-    process.env['CRTR_NODE_ID'] = 'observer';
-    const pi = makeFakePi();
-    registerCanvasPassiveContext(pi);
-    assert.ok(pi.handler, 'input handler registered');
-    // First message → backlog drains in as pre-text before the user's text.
-    const out = await pi.handler({ type: 'input', text: 'hey what happened', source: 'interactive' });
-    assert.equal(out.action, 'transform');
-    assert.match(out.text, /<passive-subscription-backlog/);
-    assert.match(out.text, /the body of the report/); // dereferenced report body
-    assert.match(out.text, /hey what happened$/); // original message preserved at the end
-    // Second message → nothing accumulated → left untouched.
-    const out2 = await pi.handler({ type: 'input', text: 'still there?', source: 'interactive' });
-    assert.ok(out2 === undefined || out2.action === 'continue');
-    // Oversized canonical reports must leave an actionable reader command in the
-    // truncation tail, using the exact ref emitted into the passive feed.
-    await push('pub', { kind: 'update', body: 'oversized report line '.repeat(250) });
-    const oversizedRef = readPassiveEntries('observer')[0].ref;
-    const out3 = await pi.handler({ type: 'input', text: 'show me the rest', source: 'interactive' });
-    assert.equal(out3.action, 'transform');
-    assert.ok(out3.text.includes(`crtr canvas history read ${oversizedRef}`), 'truncation tail names the canonical reader and emitted ref');
-});
-test('input handler is inert when nothing is accumulated', async () => {
-    createNode(node('observer'));
-    process.env['CRTR_NODE_ID'] = 'observer';
-    const pi = makeFakePi();
-    registerCanvasPassiveContext(pi);
-    const out = await pi.handler({ type: 'input', text: 'plain message', source: 'interactive' });
-    assert.ok(out === undefined || out.action === 'continue');
+    const claim = claimNodeMail('observer', execution('observer'), 'passive');
+    const text = formatPassive(claim.deliveries.map(nodeMailEntry));
+    assert.match(text, /<passive-subscription-backlog/);
+    assert.match(text, /the body of the report/);
 });