@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/__tests__/plugin-kinds.test.js

@@ -17,7 +17,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import * as tar from 'tar';
 import { resetScopeCache } from '../scope.js';
-import { readMergedLaunchConfig } from '../config.js';
+import { readMergedLaunchConfig, updateRawConfigAtomically, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { validatePluginBundle } from '../command-plugins/bundle.js';
 let isolatedHome;
 let isolatedCwd;
@@ -32,6 +33,7 @@ beforeEach(() => {
     isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-plugin-kinds-cwd-')));
     process.env.HOME = isolatedHome;
     process.chdir(isolatedCwd);
+    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
     resetScopeCache();
 });
 afterEach(() => {
@@ -76,7 +78,7 @@ test('the scope\u2019s own config.json overrides its plugins; a disabled plugin
     const root = userRoot();
     plantPlugin(root, 'northlight', { 'applet-builder': { whenToUse: 'plugin gloss', model: 'anthropic/strong' } });
     plantPlugin(root, 'zzz-disabled', { ghost: { whenToUse: 'never registers' } });
-    writeFileSync(join(root, 'config.json'), JSON.stringify({
+    updateRawConfigAtomically('user', () => ({
         plugins: { 'zzz-disabled': { enabled: false } },
         kinds: { 'applet-builder': { model: 'openai/medium' } },
     }));
@@ -91,7 +93,7 @@ test('a whenToUse-only entry re-glosses an existing kind without stripping its m
     // Now every entry field-merges over an existing kind; only a NEW kind
     // requires whenToUse (a whenToUse-less new kind is dropped).
     const root = userRoot();
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ kinds: { explore: { whenToUse: 'custom explore gloss' }, 'new-glossless': { model: 'openai/light' } } }));
+    updateRawConfigAtomically('user', () => ({ kinds: { explore: { whenToUse: 'custom explore gloss' }, 'new-glossless': { model: 'openai/light' } } }));
     const kinds = readMergedLaunchConfig().kinds;
     assert.equal(kinds['explore']?.whenToUse, 'custom explore gloss');
     assert.equal(kinds['explore']?.model, 'openai/light'); // builtin tier survives
@@ -100,7 +102,7 @@ test('a whenToUse-only entry re-glosses an existing kind without stripping its m
 });
 test('a project-root plugin layers above user config, and the project config above the plugin', () => {
     const uRoot = userRoot();
-    writeFileSync(join(uRoot, 'config.json'), JSON.stringify({ kinds: { shared: { whenToUse: 'user gloss', model: 'openai/light' } } }));
+    writeRawConfig('user', { kinds: { shared: { whenToUse: 'user gloss', model: 'openai/light' } } });
     const pRoot = projectRoot();
     plantPlugin(pRoot, 'proj-plugin', { shared: { model: 'anthropic/strong' }, 'proj-kind': { whenToUse: 'project plugin kind' } });
     writeFileSync(join(pRoot, 'config.json'), JSON.stringify({ kinds: { 'proj-kind': { model: 'openai/medium' } } }));

package/dist/core/__tests__/plugin-link-symlinked-scope-root.test.js

@@ -11,8 +11,11 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { realpathSync } from 'node:fs';
 import { linkOrCopy } from '../fs-utils.js';
 import { listInstalledPluginsInRoot } from '../resolver.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 describe('plugin link through a symlinked scope-root ancestor', () => {
     test('the installed plugin resolves on the next invocation', () => {
         const base = mkdtempSync(join(tmpdir(), 'crtr-plugin-link-'));
@@ -28,10 +31,12 @@ describe('plugin link through a symlinked scope-root ancestor', () => {
             symlinkSync(join('physical', 'home'), join(base, 'home'), 'dir');
             const scopeRootPath = join(base, 'home', '.crouter');
             mkdirSync(join(scopeRootPath, 'plugins'), { recursive: true });
+            initializeFreshScopedStore({ kind: 'user', root: scopeRootPath });
             linkOrCopy(source, join(scopeRootPath, 'plugins', 'search'));
-            assert.deepEqual(listInstalledPluginsInRoot('user', scopeRootPath).map((p) => p.name), ['search']);
+            assert.deepEqual(listInstalledPluginsInRoot('user', realpathSync(scopeRootPath)).map((p) => p.name), ['search']);
         }
         finally {
+            closeScopedStores();
             rmSync(base, { recursive: true, force: true });
         }
     });

package/dist/core/__tests__/plugin-page-components.test.js

@@ -15,7 +15,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import * as tar from 'tar';
 import { resetScopeCache } from '../scope.js';
-import { resolvePageComponents } from '../config.js';
+import { resolvePageComponents, updateRawConfigAtomically, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { validatePluginBundle } from '../command-plugins/bundle.js';
 let isolatedHome;
 let isolatedCwd;
@@ -30,6 +31,7 @@ beforeEach(() => {
     isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-page-components-cwd-')));
     process.env.HOME = isolatedHome;
     process.chdir(isolatedCwd);
+    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
     resetScopeCache();
 });
 afterEach(() => {
@@ -60,7 +62,7 @@ test('an enabled user-scope plugin contributes its page components; a disabled o
         { kind: 'applet-card', display: true },
     ]);
     plantPlugin(root, 'zzz-disabled', ['ghost']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ plugins: { 'zzz-disabled': { enabled: false } } }));
+    writeRawConfig('user', { plugins: { 'zzz-disabled': { enabled: false } } });
     const components = resolvePageComponents();
     assert.deepEqual(components, [
         { kind: 'connector', description: 'Connector decision', useWhen: 'Use for a connector decision.', doc: 'Product contract.' },
@@ -70,9 +72,9 @@ test('an enabled user-scope plugin contributes its page components; a disabled o
 test('user config entries and plugin contributions resolve together, and a colliding kind is rejected', () => {
     const root = userRoot();
     plantPlugin(root, 'northlight', ['connector']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['approval'] }));
+    updateRawConfigAtomically('user', () => ({ page_components: ['approval'] }));
     assert.deepEqual(resolvePageComponents().map((component) => component.kind), ['approval', 'connector']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['connector'] }));
+    updateRawConfigAtomically('user', () => ({ page_components: ['connector'] }));
     assert.throws(() => resolvePageComponents(), /page component kind "connector" is registered by both config.json and plugin "northlight"/);
 });
 test('two plugins whose kinds derive one JSX tag are rejected, naming both sources', () => {

package/dist/core/__tests__/preview-registry-sync.test.js

@@ -16,6 +16,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { buildRoot } from '../../build-root.js';
 import { SUPPRESS_OUTPUT_LEAVES, LEAF_ICON_CP, SUMMARIZERS } from '../preview-registry.js';
+import { ensureScopeInitialized } from '../config.js';
 import { resetScopeCache } from '../scope.js';
 // buildRoot() composes external command-plugin branches from the effective
 // enabled plugins (user scope + project ancestors). Pin HOME + profile to an
@@ -31,6 +32,7 @@ before(() => {
     process.env['HOME'] = home;
     delete process.env['CRTR_PROFILE_ID'];
     resetScopeCache();
+    ensureScopeInitialized('user', join(home, '.crouter'));
 });
 after(() => {
     if (realHome !== undefined)

package/dist/core/__tests__/profile-project-memory-delivery.test.js

@@ -18,9 +18,10 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { createProfile } from '../profiles/manifest.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { memoryDir } from '../runtime/memory.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
@@ -115,6 +116,8 @@ before(() => {
     canvasHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-ppm-canvas-')));
     process.env['HOME'] = home;
     process.env['CRTR_HOME'] = canvasHome;
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
     // A project store answers only under the namespace its root INDEX.md
     // declares; without that declaration the store does not mount at all.
     const store = (slug, namespace) => {
@@ -350,11 +353,11 @@ after(() => {
     restore('CRTR_PROFILE_ID', prevProfile);
     restore('CRTR_NODE_ID', prevNode);
 });
-function newNode(kind = 'general') {
-    return spawnNode({ kind, cwd: cwdProject, parent: null, profile_id: profileId }).node_id;
+async function newNode(kind = 'general') {
+    return (await spawnNode({ kind, cwd: cwdProject, parent: null, profile_id: profileId })).node_id;
 }
-test('boot delivery caps every profile project at its relationship, including the one used as cwd', () => {
-    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+test('boot delivery caps every profile project at its relationship, including the one used as cwd', async () => {
+    const boot = renderKnowledgeBlock(await newNode(), freshTranscriptTarget());
     // The control: an uncapped relationship still renders its authored content.
     assert.ok(boot.includes(B.pcontent), `the content-capped project renders its body; got:\n${boot}`);
     // The reported failure. cwd reaches this root before the manifest pointer
@@ -369,22 +372,22 @@ test('boot delivery caps every profile project at its relationship, including th
     assert.match(boot, /[├└]─ t9-pname-doc$/m, `the name-capped doc discloses as a bare name; got:\n${boot}`);
     assert.ok(!boot.includes('When the name project delivers'), 'a name-capped doc discloses no preview line');
 });
-test('surface-entry gates select the rung by node kind while the document gate remains absolute', () => {
+test('surface-entry gates select the rung by node kind while the document gate remains absolute', async () => {
     for (const kind of ['design', 'spec', 'plan', 'developer']) {
-        const boot = renderKnowledgeBlock(newNode(kind), freshTranscriptTarget());
+        const boot = renderKnowledgeBlock(await newNode(kind), freshTranscriptTarget());
         assert.ok(boot.includes(B.kindSplit), `${kind} receives the content rung; got:\n${boot}`);
     }
     for (const kind of ['general', 'review', 'advisor']) {
-        const boot = renderKnowledgeBlock(newNode(kind), freshTranscriptTarget());
+        const boot = renderKnowledgeBlock(await newNode(kind), freshTranscriptTarget());
         assert.match(boot, /t9-kind-split {2}# read when: When the node needs this kind-specific guide\./, `${kind} receives the preview rung; got:\n${boot}`);
         assert.ok(!boot.includes(B.kindSplit), `${kind} does not receive the body`);
     }
     for (const kind of ['explore', 'personal-assistant']) {
-        const boot = renderKnowledgeBlock(newNode(kind), freshTranscriptTarget());
+        const boot = renderKnowledgeBlock(await newNode(kind), freshTranscriptTarget());
         assert.ok(!boot.includes('t9-kind-split'), `${kind} receives no kind-split entry; got:\n${boot}`);
         assert.ok(!boot.includes(B.kindSplit), `${kind} receives no kind-split body`);
     }
-    const developer = renderKnowledgeBlock(newNode('developer'), freshTranscriptTarget());
+    const developer = renderKnowledgeBlock(await newNode('developer'), freshTranscriptTarget());
     assert.ok(!developer.includes('t9-document-gate-wins'), `a failing document gate excludes every entry; got:\n${developer}`);
     assert.ok(!developer.includes(B.documentGateWins), 'a failing document gate excludes its content');
     assert.ok(developer.includes(B.codeCraftIndex), 'the directory document delivers its boot content');
@@ -394,8 +397,8 @@ test('surface-entry gates select the rung by node kind while the document gate r
     // The ancestor listing, not just the doc's own directory.
     assert.match(developer, /sibling {2}# read when: When the dev sibling applies\./, `content delivery exposes the enclosing directory's members too; got:\n${developer}`);
 });
-test('context docs accounting reports content attachment raises from the renderer', () => {
-    const node = newNode('developer');
+test('context docs accounting reports content attachment raises from the renderer', async () => {
+    const node = await newNode('developer');
     const subject = assembleNodeSubject(node);
     assert.ok(subject !== null, 'the fixture node assembles a subject');
     const target = { cwd: cwdProject, profileId, nodeId: node };
@@ -431,8 +434,8 @@ test('context docs accounting reports content attachment raises from the rendere
     assert.equal(viewerRecord?.deliveryCause, 'directory listing attached to content delivery');
     plans.dispose();
 });
-test('context docs accounting adds full-view workspace content attachments', () => {
-    const node = newNode();
+test('context docs accounting adds full-view workspace content attachments', async () => {
+    const node = await newNode();
     const subject = assembleNodeSubject(node);
     assert.ok(subject !== null, 'the fixture node assembles a subject');
     const target = { cwd: outsideProject, profileId, nodeId: node };
@@ -446,8 +449,8 @@ test('context docs accounting adds full-view workspace content attachments', ()
     assert.equal(companion?.final_rung, 'content');
     assert.equal(companion?.delivery_cause, 'memory-read companion of content delivery');
 });
-test('boot content triggers memory-read companions to a deduplicated fixpoint', () => {
-    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+test('boot content triggers memory-read companions to a deduplicated fixpoint', async () => {
+    const boot = renderKnowledgeBlock(await newNode(), freshTranscriptTarget());
     for (const body of [B.companionSource, B.companionA, B.companionB]) {
         assert.equal(boot.split(body).length - 1, 1, `content companion ${body} delivers once; got:\n${boot}`);
     }
@@ -455,8 +458,8 @@ test('boot content triggers memory-read companions to a deduplicated fixpoint',
     // discloses its members exactly as the doc that routed to it did.
     assert.match(boot, /member-1 {2}# read when: When the companion member applies\./, `a content companion exposes its own directory's members; got:\n${boot}`);
 });
-test('one body delivered across both boot partitions renders exactly once', () => {
-    const node = newNode();
+test('one body delivered across both boot partitions renders exactly once', async () => {
+    const node = await newNode();
     const subject = assembleNodeSubject(node);
     assert.ok(subject !== null, 'the fixture node assembles a subject');
     const state = emptyContextExposureState();
@@ -470,8 +473,8 @@ test('one body delivered across both boot partitions renders exactly once', () =
     const occurrences = (preferences.split(B.crossPartition).length - 1) + (knowledge.split(B.crossPartition).length - 1);
     assert.equal(occurrences, 1, `the companion body renders once across both partitions; got:\n${preferences}\n---\n${knowledge}`);
 });
-test('a node-local doc floors to name only without boot entries', () => {
-    const node = newNode('explore');
+test('a node-local doc floors to name only without boot entries', async () => {
+    const node = await newNode('explore');
     writeDoc(memoryDir(node), 't9-node-local-bootless', bootlessDoc('When the node-local fallback applies', 'BODY-T9-NODE-LOCAL-BOOTLESS'));
     writeDoc(memoryDir(node), 't9-node-local-entry-gated', [
         '---',
@@ -491,8 +494,8 @@ test('a node-local doc floors to name only without boot entries', () => {
     assert.ok(!boot.includes('t9-node-local-entry-gated'), `ineligible boot entries keep a node-local doc absent; got:\n${boot}`);
     assert.ok(!boot.includes('BODY-T9-NODE-LOCAL-ENTRY-GATED'), 'ineligible boot entries disclose no body');
 });
-test('a `none` project contributes nothing to boot — no body, no name, no hidden count, no shadow', () => {
-    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+test('a `none` project contributes nothing to boot — no body, no name, no hidden count, no shadow', async () => {
+    const boot = renderKnowledgeBlock(await newNode(), freshTranscriptTarget());
     assert.ok(!boot.includes(B.pnone), 'a none-capped body must not render');
     assert.ok(!boot.includes('pnone'), 'a none-capped store must not appear as a name either — not even its namespace row');
     // Hidden counts are disclosure too: the control project's namespace row proves
@@ -512,7 +515,7 @@ test('a capped nearer candidate yields the shared identity instead of suppressin
     // physical candidates. Automatic delivery filters candidates by the profile
     // cap BEFORE dedupe, so the `none`-capped nearer one drops out and the farther
     // one delivers; a deliberate read stays winner-only on source order.
-    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+    const boot = renderKnowledgeBlock(await newNode(), freshTranscriptTarget());
     assert.ok(boot.includes(B.dupFar), `the farther uncapped candidate delivers the shared identity; got:\n${boot}`);
     assert.ok(!boot.includes(B.dupNear), 'the none-capped nearer candidate delivers nothing');
     const read = (await readLeaf.run({
@@ -524,14 +527,14 @@ test('a capped nearer candidate yields the shared identity instead of suppressin
     }));
     assert.ok(read.content.includes(B.dupNear) && !read.content.includes(B.dupFar), `a deliberate read resolves the source-order winner; got:\n${read.content}`);
 });
-test('a non-none cap keeps its project precedence and discloses the duplicate at the capped rung', () => {
-    const boot = renderKnowledgeBlock(newNode(), freshTranscriptTarget());
+test('a non-none cap keeps its project precedence and discloses the duplicate at the capped rung', async () => {
+    const boot = renderKnowledgeBlock(await newNode(), freshTranscriptTarget());
     assert.match(boot, /[├└]─ t9-namedup-doc$/m, `the name-capped project discloses its doc as a bare name; got:\n${boot}`);
     assert.ok(!boot.includes(B.nameFromPname), 'a name-capped doc discloses at `name`, never its body');
     assert.ok(boot.includes(B.nameFromPcontent), 'the content project delivers its own distinct identity in full');
 });
-test('workspace-open clamps each project store the same way boot does', () => {
-    const opened = renderWorkspaceOpenDocs(newNode(), freshTranscriptTarget());
+test('workspace-open clamps each project store the same way boot does', async () => {
+    const opened = renderWorkspaceOpenDocs(await newNode(), freshTranscriptTarget());
     assert.ok(opened.includes(B.pcontent), `the content-capped project delivers its body; got:\n${opened}`);
     assert.ok(!opened.includes(B.ppreview), `the cwd project must not deliver its body; got:\n${opened}`);
     assert.match(opened, /name="ppreview\/t9-ppreview-doc" readWhen="When the cwd project delivers\./, `the cwd project delivers its preview line under its canonical name; got:\n${opened}`);
@@ -539,8 +542,8 @@ test('workspace-open clamps each project store the same way boot does', () => {
     assert.ok(!opened.includes('t9-pnone-doc'), 'the none-capped project delivers nothing at workspace-open');
     assert.ok(!opened.includes(B.sharedFromPnone), 'nor its side of a name collision');
 });
-test('workspace-open answers its listings from the workspace it opened, not the ambient one', () => {
-    const node = newNode();
+test('workspace-open answers its listings from the workspace it opened, not the ambient one', async () => {
+    const node = await newNode();
     const subject = assembleNodeSubject(node);
     assert.ok(subject !== null, 'the fixture node assembles a subject');
     // The process cwd is `ppreview`; this workspace is outside the profile
@@ -551,7 +554,7 @@ test('workspace-open answers its listings from the workspace it opened, not the
     assert.match(opened, /\[\[poutside\/t9-ws-guide\/member-1\]\]: When the outside guide member applies\./, `the listing carries that directory's own members; got:\n${opened}`);
 });
 test('memory list and find record synthetic pages without crediting matched documents', async () => {
-    const node = newNode();
+    const node = await newNode();
     process.env['CRTR_NODE_ID'] = node;
     try {
         const listed = await listLeaf.run({
@@ -589,7 +592,7 @@ test('memory list and find record synthetic pages without crediting matched docu
     }
 });
 test('an explicit read after boot content adds no duplicate directory attachments', async () => {
-    const node = newNode('developer');
+    const node = await newNode('developer');
     process.env['CRTR_NODE_ID'] = node;
     try {
         const state = loadContextExposureState(node);
@@ -614,7 +617,7 @@ test('an explicit read after boot content adds no duplicate directory attachment
     }
 });
 test('an explicit `crtr memory read` returns and records the full body a cap withheld', async () => {
-    const node = newNode();
+    const node = await newNode();
     process.env['CRTR_NODE_ID'] = node;
     const state = loadContextExposureState(node);
     const transcript = exposureTarget(state, 'transcript');

package/dist/core/__tests__/prune.test.js

@@ -3,8 +3,9 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
-import { closeDb, openDb } from '../canvas/db.js';
+import { createNode, getRow, subscribe, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
 import { nodeDir } from '../canvas/paths.js';
 let home;
 const DAY = 86_400_000;
@@ -33,6 +34,10 @@ function totalEdges() {
 function markCollectibleTerminal(nodeId) {
     transitionStatusIntent(nodeId, { terminal_reason: 'closed' });
 }
+function recordExecution(nodeId, pid) {
+    const executionId = beginExecution(nodeId, { daemonEpoch: 'test' });
+    recordExecutionPid(executionId, nodeId, pid);
+}
 /** The standard fixture: three prunable terminal nodes (old), three survivors
  *  (two old-but-live, one recent-but-dead), and edges that touch a pruned node
  *  so cascade is observable. */
@@ -55,6 +60,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -146,7 +152,7 @@ test('count pruning keeps all live nodes even when liveCount exceeds the cap', (
     // fall beyond rank 5 and are pruned.
     for (let i = 0; i < 5; i++) {
         createNode(node(`live-${i}`, { status: 'active', created: at(i) }));
-        recordPid(`live-${i}`, process.pid); // process.pid is alive → isPidAlive true
+        recordExecution(`live-${i}`, process.pid); // process.pid is alive → isPidAlive true
     }
     createNode(node('old-a', { status: 'dead', created: at(100) }));
     createNode(node('old-b', { status: 'done', created: at(101) }));
@@ -164,7 +170,7 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
     // Ranked by recency DESC: live-0, term-0, term-1 (top 3, kept), then
     // term-2, term-3, term-4 (rank >= 3, pruned).
     createNode(node('live-0', { status: 'idle', created: at(0) }));
-    recordPid('live-0', process.pid);
+    recordExecution('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
         const id = `term-${i}`;
         createNode(node(id, { status: 'dead', created: at(10 + i) }));
@@ -185,7 +191,7 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
 });
 test('count pruning dry-run reports candidates without deleting rows or dirs', () => {
     createNode(node('live-0', { status: 'idle', created: at(0) }));
-    recordPid('live-0', process.pid);
+    recordExecution('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
         const id = `term-${i}`;
         createNode(node(id, { status: 'dead', created: at(10 + i) }));

package/dist/core/__tests__/push-final-guard.test.js

@@ -4,21 +4,28 @@ import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, setStatus } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, openDb, migrate } from '../canvas/db.js';
 import { InputError } from '../io.js';
 import { messageRoutes } from '../../daemon/api/handlers/messages.js';
 import { pushFinal, FinalizationError } from '../feed/feed.js';
 import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../runtime/reopen.js';
 import { reviveNode } from '../runtime/revive.js';
 import { headlessBrokerHost } from '../runtime/host.js';
-import { readInboxSince } from '../feed/inbox.js';
+function nodeMailCount(nodeId) {
+    return Number(openDb().prepare(`SELECT COUNT(*) AS count FROM deliveries
+    WHERE destination_kind = 'node_inbox' AND destination_id = ?`).get(nodeId).count);
+}
 import { writeGoal } from '../runtime/kickoff.js';
 import { situationalContextPath } from '../canvas/paths.js';
 let home;
 const prevNodeId = process.env['CRTR_NODE_ID'];
 function node(id) { return { node_id: id, name: id, created: new Date().toISOString(), cwd: '/tmp/work', kind: 'general', mode: 'base', lifecycle: 'terminal', status: 'active' }; }
 before(() => { home = mkdtempSync(join(tmpdir(), 'crtr-pushfinal-')); process.env['CRTR_HOME'] = home; });
-beforeEach(() => { closeDb(); rmSync(home, { recursive: true, force: true }); });
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
+});
 after(() => { closeDb(); rmSync(home, { recursive: true, force: true }); delete process.env['CRTR_HOME']; if (prevNodeId === undefined)
     delete process.env['CRTR_NODE_ID'];
 else
@@ -66,13 +73,13 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
     const firstFinal = getNode(id)?.final_report;
     assert.ok(firstFinal);
     // A message to the now-finalized node, no --reopen: rejected before the
-    // handler ever reaches appendInbox/reviveNode. Prove BOTH: the latch is
+    // handler ever creates a delivery or reaches reviveNode. Prove BOTH: the latch is
     // untouched, AND (per #340's Minor finding) no side effect landed first —
     // spy on the exact revive seam reviveNode calls (headlessBrokerHost.launch,
     // the same seam revive.test.ts already uses to instrument reviveNode without
     // a real engine) and assert it was never invoked, plus the inbox is
     // unchanged.
-    const inboxBefore = readInboxSince(id, undefined).length;
+    const inboxBefore = nodeMailCount(id);
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = ((...args) => { launchCalls++; return originalLaunch(...args); });
@@ -84,7 +91,7 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
     }
     assert.equal(launchCalls, 0, 'a rejected retask must never attempt a revive');
     assert.equal(getNode(id)?.final_report, firstFinal, 'a rejected retask must not touch the latch');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore, 'a rejected retask must not append an inbox entry');
+    assert.equal(nodeMailCount(id), inboxBefore, 'a rejected retask must not create a delivery');
     // The successful path, driven through the ACTUAL daemon message handler (the
     // real seam --reopen now lives behind, not a direct call into the gate
     // internals) — stub the revive seam so no real engine process is spawned,
@@ -105,7 +112,7 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
         headlessBrokerHost.launch = originalLaunch;
     }
     assert.equal(getNode(id)?.final_report, null, '--reopen cleared the latch through the real handler seam');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore + 1, 'the re-task message was actually appended to the inbox');
+    assert.equal(nodeMailCount(id), inboxBefore + 1, 'the re-task message created one durable delivery');
     // The re-tasked node can now finish its new mandate and re-latch cleanly.
     process.env['CRTR_NODE_ID'] = id;
     await pushFinal(id, 'round 2 verdict');

package/dist/core/__tests__/relaunch-root.test.js

@@ -15,13 +15,19 @@ import { CrtrClient } from '../../api/client.js';
 import { createApiServer } from '../../daemon/api/server.js';
 import registerCanvasStophook from '../../pi-extensions/canvas-stophook.js';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { resetScopeCache } from '../scope.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { apiSocketPath } from '../canvas/paths.js';
 import { brokerCapReached, resetFleetForTests } from '../runtime/fleet.js';
 import { buildPiArgv } from '../runtime/launch.js';
 import { relaunchRoot } from '../runtime/reset.js';
 import { bindTestFleet } from './helpers/fleet.js';
 let home;
+let tf;
+const previousHome = process.env['HOME'];
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -67,16 +73,30 @@ function makeDeps(pid) {
 }
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-relaunch-'));
-    process.env['CRTR_HOME'] = home;
+    process.env['HOME'] = home;
+    process.env['CRTR_HOME'] = join(home, 'canvas');
 });
 beforeEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
+    tf = bindTestFleet();
 });
 after(() => {
     closeDb();
+    closeScopedStores();
+    tf.fleet.dispose();
+    resetFleetForTests();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    if (previousHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = previousHome;
+    resetScopeCache();
 });
 test('relaunchRoot parks the old root done and mints a fresh active root, reaping descendants', async () => {
     // root → child → grandchild (a parent that subscribes to its workers).
@@ -169,6 +189,10 @@ test('root /new capacity refusal reaches the attached human through broker UI no
     process.env['CRTR_NODE_ID'] = 'root';
     createNode(node('root', { parent: null, lifecycle: 'resident' }));
     const tf = bindTestFleet();
+    const executionId = beginExecution('root', { daemonEpoch: tf.fleet.epoch() });
+    assert.equal(recordExecutionPid(executionId, 'root', process.pid), 'recorded');
+    const previousExecutionId = process.env['CRTR_EXECUTION_ID'];
+    process.env['CRTR_EXECUTION_ID'] = executionId;
     const never = new Promise(() => { });
     tf.fleet.register('filler-a', { pid: 700_001, exited: never });
     tf.fleet.register('filler-b', { pid: 700_002, exited: never });
@@ -207,6 +231,10 @@ test('root /new capacity refusal reaches the attached human through broker UI no
         resetFleetForTests();
         delete process.env['CRTR_MAX_LIVE_BROKERS'];
         delete process.env['CRTR_NODE_ID'];
+        if (previousExecutionId === undefined)
+            delete process.env['CRTR_EXECUTION_ID'];
+        else
+            process.env['CRTR_EXECUTION_ID'] = previousExecutionId;
     }
 });
 test('relaunchRoot is a no-op for a non-root child and an already-parked root', async () => {

package/dist/core/__tests__/remote-canvas-target.test.js

@@ -11,7 +11,9 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { readConfig, updateConfig } from '../config.js';
+import { ensureScopeInitialized, readConfig, updateConfig } from '../config.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { resetScopeCache } from '../scope.js';
 import { setRelayToken } from '../secrets.js';
 import { getRemoteCanvasTarget, resolveRemoteCanvasTarget } from '../remote-canvas-target.js';
 let home;
@@ -22,9 +24,13 @@ before(() => {
     process.env['HOME'] = home;
 });
 beforeEach(() => {
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+    ensureScopeInitialized('user', join(home, '.crouter'));
 });
 after(() => {
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     if (realHome !== undefined)
         process.env['HOME'] = realHome;

package/dist/core/__tests__/repository-root-identity.test.js

@@ -8,9 +8,11 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { ensureScopeInitialized } from '../config.js';
 import { gitSync } from '../git.js';
 import { createProfile } from '../profiles/manifest.js';
 import { loadMemoryStoreView, memoryStoresInPrecedence, openProjectMemoryStore, resolveMemoryDocForTarget, } from '../memory-resolver.js';
+import { closeScopedStores } from '../scoped-state/db.js';
 import { resetScopeCache } from '../scope.js';
 const cleanups = [];
 let previousHome;
@@ -20,8 +22,10 @@ before(() => {
 beforeEach(() => {
     process.env.HOME = fixtureDir('crtr-repository-root-identity-home-');
     resetScopeCache();
+    ensureScopeInitialized('user', join(process.env.HOME, '.crouter'));
 });
 after(() => {
+    closeScopedStores();
     resetScopeCache();
     for (const path of cleanups)
         rmSync(path, { recursive: true, force: true });

package/dist/core/__tests__/review-model-floor.test.js

@@ -5,11 +5,13 @@
 // persona keeps the stronger default needed to synthesise a broad review.
 import { after, before, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { defaultKindsConfig, defaultModelLaddersConfig } from '../../types.js';
 import { buildLaunchSpec, normalizeModel } from '../runtime/launch.js';
+import { writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 const priorHome = process.env['HOME'];
 const ladders = defaultModelLaddersConfig();
 // Review's own kind default IS its floor — an explicit override weaker than
@@ -20,14 +22,15 @@ before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-review-model-floor-'));
     process.env['HOME'] = home;
     mkdirSync(join(home, '.crouter'), { recursive: true });
-    writeFileSync(join(home, '.crouter', 'config.json'), JSON.stringify({
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    writeRawConfig('user', {
         kinds: {
             'audit/reviewers/security': {
                 whenToUse: 'Review one security surface.',
                 model: 'medium',
             },
         },
-    }));
+    });
 });
 after(() => {
     if (priorHome === undefined)