@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/canvas/canvas.js

@@ -1,127 +1,39 @@
-// The canvas data-access layer. The one place that reads/writes the node+edge
-// model. Later phases (spawn, push, lifecycle, daemon) call only this.
-//
-// Source-of-truth split: a node's meta.json is canonical for its own fields;
-// the db row is a queryable index re-derivable from it. The subscribes_to edges
-// are db-authoritative (mutable, many-writers — what WAL is for).
+// The canvas data-access layer. Nodes, their sessions, executions, and managed
+// worktrees are SQL-authoritative. Node directories hold only artifacts.
 import { envNodeId } from '../../shared/env.js';
-import { existsSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { existsSync, realpathSync, rmSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { openDb, withCanvasWrite } from './db.js';
-import { withMetaLock, readMetaObject, writeMetaObjectLocked, writeJsonFileDurably } from './meta-file.js';
-import { isPidAlive, recordedPidLiveness, capturePidIdentities, identitiesMatch, isLegacyTicksIdentity, isBootScopedIdentity, } from './pid.js';
-import { ensureHome, ensureNodeDirs, nodeMetaPath, nodeDir, nodesRoot, jobDir, } from './paths.js';
-// meta.json (durable identity — the source of truth for what PERSISTS)
-//
-// One authoritative store per fact: meta.json holds NodeIdentity only; live
-// runtime fields are authoritative in the WAL'd `nodes` row. getNode() hydrates
-// the two back into the historical NodeMeta view.
-/** The identity keys meta.json persists. Listed explicitly so no runtime field
- *  can ever leak onto disk even when a fully-hydrated NodeMeta is handed in. */
-const IDENTITY_KEYS = [
-    'node_id', 'name', 'description', 'title', 'icon', 'cycles', 'created', 'cwd', 'host_kind', 'profile_id', 'kind', 'mode',
-    'lifecycle', 'persona_ack', 'parent', 'spawned_by', 'creator', 'fork_from', 'fork_source_file', 'review_binding', 'passive_default', 'pi_session_id',
-    'pi_session_file', 'cycle_pending', 'model_override',
-    'launch', 'managed_worktree',
-];
-/** Project any node object down to its durable-identity subset. */
-function toIdentity(m) {
-    const out = {};
-    for (const k of IDENTITY_KEYS) {
-        if (m[k] !== undefined)
-            out[k] = m[k];
-    }
-    for (const key of ['pi_session_file', 'fork_source_file']) {
-        if (typeof out[key] === 'string')
-            out[key] = canonicalSessionFile(out[key]);
-    }
-    return out;
-}
-function readMeta(nodeId) {
-    const p = nodeMetaPath(nodeId);
-    if (!existsSync(p))
-        return null;
-    // Legacy metas may still carry runtime fields on disk; toIdentity-on-read is
-    // unnecessary (callers go through getNode, which overlays the row), but the
-    // raw parse is typed as identity — extra props are ignored.
-    //
-    // Tolerate an EMPTY or unparseable meta.json by treating it as MISSING (null)
-    // rather than throwing. A bare write-temp-then-rename without fsync can leave a
-    // 0-byte meta.json on an NFS-backed home after the holding process/sandbox dies
-    // (see writeMeta + the guest cold-boot bug it guards against); a single corrupt
-    // node must not crash rebuildIndex/revive for the whole canvas. Recovery
-    // (re-seed from a durable snapshot) is the caller's job.
-    const raw = readFileSync(p, 'utf8');
-    if (raw.trim() === '')
-        return null;
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
+import { activateArmedExternalActionDelivery, armExternalActionDelivery } from './deliveries.js';
+import { findNodeBySessionFileSql } from './sessions.js';
+import { readFault, readLiveTurn } from './recovery.js';
+import { hasUnreconciledWorktree, openWorktree, readWorktree } from './worktrees.js';
+import { isPidAlive, recordedPidLiveness } from './pid.js';
+import { ensureHome, ensureNodeDirs, jobDir, nodeDir } from './paths.js';
+function jsonValue(value, field) {
+    if (value === undefined || value === null)
         return null;
-    }
-}
-/** Serialize ONLY the identity subset → meta.json never holds runtime fields.
- *
- *  Durable write: fsync the temp file before the rename, then fsync the parent
- *  directory so the rename itself is on disk. A bare writeFileSync+rename is not
- *  crash-durable — a host crash or abrupt sandbox teardown shortly after the
- *  rename can surface a 0-byte or missing meta.json (observed on a guest home as
- *  a cold-boot 0-byte meta.json → rebuild-index/revive JSON.parse('')). meta.json
- *  is written rarely (birth, polymorph, session-id capture, naming) so the
- *  per-write fsync cost is negligible. */
-function writeMeta(meta) {
-    writeJsonFileDurably(nodeMetaPath(meta.node_id), toIdentity(meta));
-}
-// row index — identity columns are a derived projection of meta; runtime
-// columns are authoritative. The two have DIFFERENT writers: upsertRow only
-// ever touches identity (so a re-index never clobbers live runtime), while
-// createNode seeds runtime once and the atomic setters own it thereafter.
-/** Upsert the IDENTITY columns of a node's row. ON CONFLICT updates identity
- *  ONLY — runtime columns (status/intent/pi_pid/window/tmux_session/pane) are left
- *  exactly as they are, so re-indexing or an identity edit never disturbs live
- *  state. A fresh insert takes the schema defaults for runtime. */
-function upsertRow(meta) {
-    openDb()
-        .prepare(`INSERT INTO nodes (node_id, name, description, cycles, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, created, pi_session_file)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(node_id) DO UPDATE SET
-         name=excluded.name, description=excluded.description, cycles=excluded.cycles,
-         kind=excluded.kind, mode=excluded.mode,
-         lifecycle=excluded.lifecycle, cwd=excluded.cwd, host_kind=excluded.host_kind,
-         profile_id=excluded.profile_id, parent=excluded.parent,
-         pi_session_file=excluded.pi_session_file`)
-        .run(meta.node_id, meta.name, meta.description ?? null, meta.cycles ?? null, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.profile_id ?? null, meta.parent ?? null, meta.created, typeof meta.pi_session_file === 'string' ? canonicalSessionFile(meta.pi_session_file) : null);
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined)
+        throw new TypeError(`${field} must be JSON-serializable`);
+    return encoded;
 }
 function insertArmedOutcomeDelivery(db, nodeId, delivery) {
-    const payloadJson = delivery.payload === undefined ? null : JSON.stringify(delivery.payload);
-    if (payloadJson === undefined)
-        throw new TypeError('outcome delivery payload must be JSON-serializable');
-    const now = Date.now();
-    db.prepare(`INSERT INTO node_outcome_deliveries
-      (node_id, state, action_name, argv_json, cwd, config_origin, payload_json, next_attempt_at, created_at, updated_at)
-     VALUES (?, 'armed', ?, ?, ?, ?, ?, 0, ?, ?)`).run(nodeId, delivery.actionName, JSON.stringify(delivery.argv), delivery.cwd, delivery.configOrigin, payloadJson, now, now);
-}
-function seedRow(meta, db = openDb()) {
-    db
-        .prepare(`INSERT INTO nodes
-         (node_id, name, description, cycles, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, created, pi_session_file,
-          status, intent, waiting_for, final_report, finalized_at, deadline_at, pi_pid, "window", tmux_session, pane)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(node_id) DO UPDATE SET
-         name=excluded.name, description=excluded.description, cycles=excluded.cycles,
-         kind=excluded.kind, mode=excluded.mode,
-         lifecycle=excluded.lifecycle, cwd=excluded.cwd, host_kind=excluded.host_kind,
-         profile_id=excluded.profile_id, parent=excluded.parent,
-         pi_session_file=excluded.pi_session_file,
-         status=excluded.status, intent=excluded.intent, waiting_for=excluded.waiting_for,
-         final_report=excluded.final_report, finalized_at=excluded.finalized_at,
-         pi_pid=excluded.pi_pid, "window"=excluded."window", tmux_session=excluded.tmux_session,
-         pane=excluded.pane`)
-        .run(meta.node_id, meta.name, meta.description ?? null, meta.cycles ?? null, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.profile_id ?? null, meta.parent ?? null, meta.created, typeof meta.pi_session_file === 'string' ? canonicalSessionFile(meta.pi_session_file) : null, meta.status ?? 'active', meta.intent ?? null, meta.waiting_for ?? null, meta.final_report ?? null, meta.finalized_at ?? null, meta.deadline_at ?? null, meta.pi_pid ?? null, meta.window ?? null, meta.tmux_session ?? null, meta.pane ?? null);
+    armExternalActionDelivery(db, {
+        destinationId: delivery.actionName,
+        adapter: {
+            adapter: 'subprocess', argv: delivery.argv, cwd: delivery.cwd,
+            config_origin: delivery.configOrigin, payload: delivery.payload ?? null,
+        },
+        idempotencyKey: `node-outcome:${nodeId}`,
+    });
+}
+function seedRow(meta, db) {
+    db.prepare(`INSERT INTO nodes (node_id, name, description, title, icon, cycles, kind, mode, lifecycle, cwd, host_kind, profile_id, parent, spawned_by, creator, fork_from, fork_source_file, created, passive_default, cycle_pending, model_override, persona_ack_json, review_binding_json, launch_config_json, status, intent, waiting_for, final_report, finalized_at, deadline_at, "window", tmux_session, pane) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(meta.node_id, meta.name, meta.description ?? null, meta.title ?? null, meta.icon ?? null, meta.cycles ?? null, meta.kind, meta.mode, meta.lifecycle, meta.cwd, meta.host_kind ?? null, meta.profile_id ?? null, meta.parent ?? null, meta.spawned_by ?? null, meta.creator ?? null, meta.fork_from ?? null, meta.fork_source_file ?? null, meta.created, meta.passive_default === true ? 1 : 0, meta.cycle_pending === true ? 1 : 0, meta.model_override ?? null, jsonValue(meta.persona_ack, 'persona_ack'), jsonValue(meta.review_binding, 'review_binding'), jsonValue(meta.launch, 'launch'), meta.status ?? 'active', meta.intent ?? null, meta.waiting_for ?? null, meta.final_report ?? null, meta.finalized_at ?? null, meta.deadline_at ?? null, meta.window ?? null, meta.tmux_session ?? null, meta.pane ?? null);
 }
 function rowFrom(r) {
-    return {
+    const node = {
         node_id: r['node_id'],
         name: r['name'],
         description: r['description'] ?? undefined,
@@ -156,75 +68,54 @@ function rowFrom(r) {
         window: r['window'] ?? null,
         tmux_session: r['tmux_session'] ?? null,
         pane: r['pane'] ?? null,
+        fault: null,
+        streaming: false,
     };
-}
-/** The authoritative runtime fields for `nodeId`, read from its row. Null when
- *  no row exists yet (the hydration then falls back to whatever the meta held). */
-function runtimeFromRow(nodeId) {
-    const r = openDb()
-        .prepare('SELECT status, intent, waiting_for, frozen_at, respawn_failures, respawn_not_before, launched_at, last_settled_at, terminal_reason, final_report, finalized_at, outcome_kind, outcome_reason, outcome_at, outcome_revision, outcome_detail_json, deadline_at, pi_pid, pi_pid_identity, "window", tmux_session, pane FROM nodes WHERE node_id = ?')
-        .get(nodeId);
-    if (r === undefined)
-        return null;
-    return {
-        status: r['status'] ?? 'active',
-        intent: r['intent'] ?? null,
-        waiting_for: r['waiting_for'] ?? null,
-        frozen_at: r['frozen_at'] ?? null,
-        respawn_failures: r['respawn_failures'] ?? 0,
-        respawn_not_before: r['respawn_not_before'] ?? null,
-        launched_at: r['launched_at'] ?? null,
-        last_settled_at: r['last_settled_at'] ?? null,
-        terminal_reason: r['terminal_reason'] ?? null,
-        final_report: r['final_report'] ?? null,
-        finalized_at: r['finalized_at'] ?? null,
-        outcome_kind: r['outcome_kind'] ?? null,
-        outcome_reason: r['outcome_reason'] ?? null,
-        outcome_at: r['outcome_at'] ?? null,
-        outcome_revision: r['outcome_revision'] ?? 0,
-        outcome_detail_json: r['outcome_detail_json'] ?? null,
-        deadline_at: r['deadline_at'] ?? null,
-        pi_pid: r['pi_pid'] ?? null,
-        pi_pid_identity: r['pi_pid_identity'] ?? null,
-        window: r['window'] ?? null,
-        tmux_session: r['tmux_session'] ?? null,
-        pane: r['pane'] ?? null,
-    };
+    const fault = readFault(node.node_id);
+    node.fault = fault?.link === 'pi→provider' && fault.retry.by === 'daemon' && fault.retry.disposition === 'auto' && !isPidAlive(node.pi_pid)
+        ? null
+        : fault;
+    node.streaming = readLiveTurn(node.node_id)?.busy === true && isPidAlive(node.pi_pid);
+    return node;
 }
 // Nodes
-/** Create a node: scaffold its dirs, persist identity to meta.json, and seed the
- *  row (identity + runtime from the incoming meta). Returns the hydrated view. */
+/** Create a SQL-authoritative node, then ensure its artifact directories exist. */
 export function createNode(meta, opts = {}) {
     ensureHome();
-    const scaffolded = !existsSync(nodeDir(meta.node_id));
-    ensureNodeDirs(meta.node_id);
-    try {
-        writeMeta(meta);
-    }
-    catch (error) {
-        // No row exists yet, so a dir left here is invisible to every surface and to
-        // ghost-row reaping. Only unwind a dir this call created.
-        if (scaffolded)
-            rmSync(nodeDir(meta.node_id), { recursive: true, force: true });
-        throw error;
-    }
     withCanvasWrite((db) => {
         seedRow(meta, db);
+        if (meta.managed_worktree !== undefined && meta.managed_worktree !== null)
+            openWorktree(meta.node_id, meta.managed_worktree, db);
         if (opts.outcomeDelivery !== undefined)
             insertArmedOutcomeDelivery(db, meta.node_id, opts.outcomeDelivery);
     });
+    ensureNodeDirs(meta.node_id);
     return getNode(meta.node_id);
 }
-/** The canonical node record: durable identity (meta.json) ∪ authoritative
- *  runtime (the row). Null if unknown. */
+/** The canonical node record, hydrated from SQL. Null if unknown. */
 export function getNode(nodeId) {
-    const ident = readMeta(nodeId);
-    if (ident === null)
+    const row = openDb().prepare('SELECT * FROM node_rows WHERE node_id = ?').get(nodeId);
+    if (row === undefined)
         return null;
-    const rt = runtimeFromRow(nodeId);
-    // The row is authoritative for runtime; overlay it over identity. When no row
-    // exists yet (rare — pre-rebuild), keep whatever the meta carried.
-    return { ...ident, ...(rt ?? {}) };
+    const worktree = readWorktree(nodeId);
+    return {
+        ...rowFrom(row),
+        title: row['title'] ?? undefined,
+        icon: row['icon'] ?? undefined,
+        spawned_by: row['spawned_by'] ?? null,
+        creator: row['creator'] ?? null,
+        fork_from: row['fork_from'] ?? null,
+        fork_source_file: row['fork_source_file'] ?? null,
+        passive_default: row['passive_default'] === 1,
+        cycle_pending: row['cycle_pending'] === 1,
+        model_override: row['model_override'] ?? null,
+        persona_ack: row['persona_ack_json'] == null ? undefined : JSON.parse(row['persona_ack_json']),
+        review_binding: row['review_binding_json'] == null ? undefined : JSON.parse(row['review_binding_json']),
+        launch: row['launch_config_json'] == null ? undefined : JSON.parse(row['launch_config_json']),
+        pi_session_id: row['pi_session_id'] ?? null,
+        pi_session_file: row['pi_session_file'] ?? null,
+        ...(worktree === null ? {} : { managed_worktree: worktree }),
+    };
 }
 export function canonicalSessionFile(sessionFile) {
     const absolute = resolve(sessionFile);
@@ -232,20 +123,12 @@ export function canonicalSessionFile(sessionFile) {
 }
 /** Resolve the crouter node that owns one exact Pi session file. */
 export function findNodeBySessionFile(sessionFile) {
-    const canonical = canonicalSessionFile(sessionFile);
-    // v36 makes this unique. LIMIT 1 also keeps the lookup total for a canvas
-    // opened during repair of an older duplicate projection: the deterministic
-    // oldest row remains the owner instead of turning a lookup into a crash.
-    const match = openDb()
-        .prepare('SELECT node_id FROM nodes WHERE pi_session_file = ? ORDER BY created, node_id LIMIT 1')
-        .get(canonical);
-    return match === undefined ? null : getNode(match.node_id);
+    const nodeId = findNodeBySessionFileSql(sessionFile);
+    return nodeId === null ? null : getNode(nodeId);
 }
 /** The indexed row (from the db) — cheap for queries that don't need full meta. */
 export function getRow(nodeId) {
-    const r = openDb()
-        .prepare('SELECT * FROM nodes WHERE node_id = ?')
-        .get(nodeId);
+    const r = openDb().prepare('SELECT * FROM node_rows WHERE node_id = ?').get(nodeId);
     return r ? rowFrom(r) : null;
 }
 /** The node row whose durable LOCATION pane is `pane`, or null. Lets placement
@@ -253,14 +136,12 @@ export function getRow(nodeId) {
  *  to adopt a caller's pane as a focus). pane is not UNIQUE in the schema, but a
  *  live pane backs at most one node, so this returns the single match. */
 export function getRowByPane(pane) {
-    const r = openDb()
-        .prepare('SELECT * FROM nodes WHERE pane = ?')
-        .get(pane);
+    const r = openDb().prepare('SELECT * FROM node_rows WHERE pane = ?').get(pane);
     return r ? rowFrom(r) : null;
 }
 /** Nodes whose persisted spawn deadline has elapsed and that remain live work. */
 export function dueNodeDeadlines(nowIso) {
-    return openDb().prepare(`SELECT * FROM nodes
+    return openDb().prepare(`SELECT * FROM node_rows
      WHERE deadline_at IS NOT NULL AND outcome_at IS NULL
        AND deadline_at <= ? AND status IN ('active','idle') AND kind != 'human'
      ORDER BY deadline_at, created, node_id`).all(nowIso).map(rowFrom);
@@ -287,24 +168,56 @@ export function shiftProfileNodeDeadlines(profileId, pauseDurationMs) {
         return shifted;
     });
 }
-/** Merge an IDENTITY patch into a node's meta.json and re-index its identity
- *  columns. Identity has a single writer per node, so this read-modify-write is
- *  safe (the contended runtime fields were moved out — see the atomic setters
- *  below). Returns the hydrated view (runtime included). */
+function sqlInput(value, field) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'bigint' || value instanceof Uint8Array)
+        return value;
+    throw new TypeError(`${field} must be a SQLite scalar`);
+}
+/** Update node identity/configuration columns. Sessions and worktrees have named stores. */
 export function updateNode(nodeId, patch) {
-    const path = nodeMetaPath(nodeId);
-    // The whole read/merge/write runs under the SAME per-node lock a migration
-    // takes (meta-file.ts), so a concurrent v15 normalization and an identity edit
-    // cannot interleave into a lost write or a restored legacy hook prefix.
-    const next = withMetaLock(path, () => {
-        const cur = readMetaObject(path);
-        if (cur === null)
+    const fields = [];
+    const add = (key, column = key) => {
+        if (Object.prototype.hasOwnProperty.call(patch, key))
+            fields.push([column, sqlInput(patch[key], key)]);
+    };
+    add('name');
+    add('description');
+    add('title');
+    add('icon');
+    add('cycles');
+    add('kind');
+    add('mode');
+    add('lifecycle');
+    add('cwd');
+    add('host_kind');
+    add('profile_id');
+    add('parent');
+    add('spawned_by');
+    add('creator');
+    add('fork_from');
+    add('fork_source_file');
+    add('model_override');
+    if (Object.prototype.hasOwnProperty.call(patch, 'passive_default'))
+        fields.push(['passive_default', patch.passive_default === true ? 1 : 0]);
+    if (Object.prototype.hasOwnProperty.call(patch, 'cycle_pending'))
+        fields.push(['cycle_pending', patch.cycle_pending === true ? 1 : 0]);
+    if (Object.prototype.hasOwnProperty.call(patch, 'persona_ack'))
+        fields.push(['persona_ack_json', jsonValue(patch.persona_ack, 'persona_ack')]);
+    if (Object.prototype.hasOwnProperty.call(patch, 'review_binding'))
+        fields.push(['review_binding_json', jsonValue(patch.review_binding, 'review_binding')]);
+    if (Object.prototype.hasOwnProperty.call(patch, 'launch'))
+        fields.push(['launch_config_json', jsonValue(patch.launch, 'launch')]);
+    if (fields.length === 0) {
+        const existing = getNode(nodeId);
+        if (existing === null)
             throw new Error(`unknown node: ${nodeId}`);
-        const identity = toIdentity({ ...cur, ...patch, node_id: nodeId });
-        writeMetaObjectLocked(path, identity);
-        return identity;
-    });
-    upsertRow(next);
+        return existing;
+    }
+    const result = openDb().prepare(`UPDATE nodes SET ${fields.map(([column]) => `${column} = ?`).join(', ')} WHERE node_id = ?`).run(...fields.map(([, value]) => value), nodeId);
+    if (result.changes !== 1)
+        throw new Error(`unknown node: ${nodeId}`);
     return getNode(nodeId);
 }
 // Atomic runtime setters — each one a single-statement UPDATE on the WAL'd row,
@@ -390,20 +303,13 @@ export function transitionStatusIntent(nodeId, fields, opts = {}) {
         if (Number(result.changes) === 0)
             return 0;
         const latched = db.prepare('SELECT outcome_at FROM nodes WHERE node_id = ?').get(nodeId);
-        if (outcome.supersede === true || latched.outcome_at === outcome.at) {
-            const now = Date.now();
-            if (outcome.supersede === true) {
-                db.prepare(`UPDATE node_outcome_deliveries
-           SET state = 'pending', attempt = 0, document_json = ?, next_attempt_at = ?,
-               claimed_at = NULL, claim_owner = NULL, accepted_at = NULL, permanent_failed_at = NULL,
-               last_failure_json = NULL, updated_at = ?
-           WHERE node_id = ?`).run(outcome.documentJson ?? null, now, now, nodeId);
-            }
-            else {
-                db.prepare(`UPDATE node_outcome_deliveries
-           SET state = 'pending', next_attempt_at = ?, document_json = ?, updated_at = ?
-           WHERE node_id = ? AND state = 'armed' AND ? IS NOT NULL`).run(now, outcome.documentJson ?? null, now, nodeId, outcome.documentJson ?? null);
-            }
+        if ((outcome.supersede === true || latched.outcome_at === outcome.at) && outcome.documentJson !== null && outcome.documentJson !== undefined) {
+            activateArmedExternalActionDelivery(db, {
+                idempotencyKey: `node-outcome:${nodeId}`,
+                label: nodeId,
+                bodyJson: outcome.documentJson,
+                supersede: outcome.supersede === true,
+            });
         }
         return Number(result.changes);
     });
@@ -434,32 +340,6 @@ export function setPresence(nodeId, presence) {
         .prepare('UPDATE nodes SET tmux_session = ?, "window" = ?, pane = ? WHERE node_id = ?')
         .run(presence.tmux_session ?? null, presence.window ?? null, presence.pane ?? null, nodeId);
 }
-/** Record the live pi pid (daemon liveness signal) PLUS its launch-time
- *  identity fingerprint, in one atomic write:
- *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
- *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
- *  therefore definitely still exists — this is the LAUNCH-time baseline
- *  `headlessBrokerHost.teardown()` later compares against before signaling
- *  anything. A failed probe (rare — `ps` itself misbehaving) or a probe that
- *  finds no row for `pid` (raced away in the instant between spawn and this
- *  call) both write `NULL`: no baseline recorded, so the teardown guard fails
- *  open exactly like a node booted before this column existed — never a false
- *  identity that could itself cause a false mismatch later. */
-export function recordPid(nodeId, pid) {
-    const identity = capturePidIdentities([pid])?.get(pid) ?? null;
-    openDb()
-        .prepare('UPDATE nodes SET pi_pid = ?, pi_pid_identity = ? WHERE node_id = ?')
-        .run(pid, identity, nodeId);
-}
-/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it)
- *  AND its recorded launch-time identity — the two are written together by
- *  `recordPid` and must be cleared together, or a subsequent relaunch that
- *  reuses the pid namespace could compare its own fresh pid against a STALE
- *  identity left over from the pid this row held before. */
-export function clearRecordedPid(nodeId) {
-    openDb().prepare('UPDATE nodes SET pi_pid = NULL, pi_pid_identity = NULL WHERE node_id = ?').run(nodeId);
-}
-export const clearPid = clearRecordedPid;
 export function recordLaunch(nodeId, at) {
     openDb()
         .prepare('UPDATE nodes SET launched_at = ?, frozen_at = NULL, respawn_not_before = NULL WHERE node_id = ?')
@@ -479,70 +359,6 @@ export function recordRespawnAttempt(nodeId, attempt) {
         .prepare('UPDATE nodes SET respawn_failures = ?, respawn_not_before = ? WHERE node_id = ?')
         .run(attempt.failures, attempt.notBefore, nodeId);
 }
-/** ONE-TIME completion of the boot-scoped-identity format migration, run once
- *  at daemon startup (the natural boot-reconciliation chokepoint, right after
- *  `reconcileBootLiveness`). It closes the gap the `identitiesMatch` legacy
- *  lane only TOLERATES: a broker that survives an in-place crouter upgrade
- *  keeps its old `lstart#ticks` row indefinitely (`recordPid` only fires on
- *  launch/revive/session_start), so the cross-boot ticks-collision exposure the
- *  boot-scoped base was added to close never provably shuts for those rows.
- *
- *  For every row whose RECORDED identity is legacy-format while this platform
- *  now composes new-format (a readable kernel boot_id):
- *   - if the recorded pid's CURRENT live identity matches the recorded one via
- *     the migration lane (same live process, `identitiesMatch` true) AND that
- *     current identity is itself boot-scoped — re-record it with the new
- *     composer, completing the migration in place;
- *   - otherwise (pid gone, probe failed, reused — no match, or no readable
- *     boot_id for it) — leave the row untouched for the normal liveness
- *     handling that already runs each tick.
- *
- *  After this runs once, the legacy compare lane only ever engages for
- *  genuinely no-boot_id platforms. NOT a per-caller reconciliation layer — a
- *  single startup sweep. `captureIdentity` is injectable for unit tests.
- *
- *  GATED on proven same-boot provenance by its caller (daemon startup runs it
- *  only when `reconcileBootLiveness` returned `sameBootProven` — see
- *  `bootProvenSame`). This is what makes a bare ticks match safe to bless as a
- *  current-boot identity: without that proof an equal-ticks collision with an
- *  unrelated process from a DIFFERENT boot could be rewritten as
- *  `<currentBootId>#<ticks>`, permanently baptizing a stranger.
- *
- *  Not transactional by design: it never HOLDS the write lock across the (slow,
- *  per-row) `ps` probe. Each re-record is a compare-and-swap single-row UPDATE
- *  constrained by ALL three snapshotted values (`node_id`, `pi_pid`,
- *  `pi_pid_identity`), counted only when a row actually changed. So if the old
- *  broker exits and a concurrent revive atomically records a fresh
- *  `(pi_pid, pi_pid_identity)` between this sweep's probe and its update, the
- *  CAS matches zero rows and the migration is skipped rather than clobbering
- *  the newer identity with the stale one. */
-export function migrateLegacyPidIdentities(captureIdentity = (pid) => capturePidIdentities([pid])?.get(pid)) {
-    const db = openDb();
-    const rows = db
-        .prepare('SELECT node_id, pi_pid, pi_pid_identity FROM nodes WHERE pi_pid IS NOT NULL AND pi_pid_identity IS NOT NULL')
-        .all();
-    // Compare-and-swap: rewrite only if the row STILL carries the exact pid +
-    // legacy identity we probed. A concurrent revive between probe and update
-    // records a new (pi_pid, pi_pid_identity) pair, so this WHERE fails to match
-    // and we skip rather than clobber the fresh baseline.
-    const upd = db.prepare('UPDATE nodes SET pi_pid_identity = ? WHERE node_id = ? AND pi_pid = ? AND pi_pid_identity = ?');
-    const migrated = [];
-    for (const row of rows) {
-        if (!isLegacyTicksIdentity(row.pi_pid_identity))
-            continue;
-        const current = captureIdentity(row.pi_pid);
-        if (current === undefined)
-            continue; // pid gone / probe failed → normal liveness handling
-        if (!isBootScopedIdentity(current))
-            continue; // no readable boot_id for it → nothing to upgrade
-        if (!identitiesMatch(current, row.pi_pid_identity))
-            continue; // reused → leave to liveness
-        const res = upd.run(current, row.node_id, row.pi_pid, row.pi_pid_identity);
-        if (res.changes > 0)
-            migrated.push(row.node_id); // skipped if a concurrent revive re-recorded
-    }
-    return { migrated };
-}
 /** The one clause that hides unclaimed warm-pool spares from every listing.
  *  A spare is a real node with a booted broker, but nobody has been handed it
  *  yet — surfacing it would put a phantom empty conversation in the user's
@@ -564,6 +380,16 @@ export function listNodesByProfile(profileId) {
     });
 }
 /** All rows, optionally filtered by status and terminal execution traces. Unclaimed warm spares are excluded. */
+/** Every node's durable memory-resolution coordinates, including unclaimed warm-pool spares. */
+export function listNodeMemoryTargets() {
+    return openDb()
+        .prepare('SELECT node_id, cwd, profile_id FROM nodes ORDER BY created')
+        .all()
+        .map((row) => {
+        const node = row;
+        return { nodeId: node.node_id, cwd: node.cwd, profileId: node.profile_id };
+    });
+}
 export function listNodes(filter) {
     const clauses = [NOT_A_SPARE];
     const params = [];
@@ -577,7 +403,7 @@ export function listNodes(filter) {
     if (filter?.withRecordedPidOrFrozen === true)
         clauses.push('(pi_pid IS NOT NULL OR frozen_at IS NOT NULL)');
     const rows = openDb()
-        .prepare(`SELECT * FROM nodes WHERE ${clauses.join(' AND ')} ORDER BY created`)
+        .prepare(`SELECT * FROM node_rows WHERE ${clauses.join(' AND ')} ORDER BY created`)
         .all(...params);
     return rows.map(rowFrom);
 }
@@ -612,7 +438,7 @@ export function unregisterWarmSpare(nodeId) {
 function warmSpareRowsFor(db, recipeKey) {
     const sql = `SELECT w.node_id AS node_id, w.recipe_key AS recipe_key, w.created AS created,
             n.status AS status, n.pi_pid AS pi_pid, n.pi_pid_identity AS pi_pid_identity
-       FROM warm_pool w JOIN nodes n ON n.node_id = w.node_id` +
+       FROM warm_pool w JOIN node_rows n ON n.node_id = w.node_id` +
         (recipeKey === undefined ? '' : ' WHERE w.recipe_key = ?') +
         ' ORDER BY w.created';
     const rows = (recipeKey === undefined ? db.prepare(sql).all() : db.prepare(sql).all(recipeKey));
@@ -662,8 +488,7 @@ function spareIsClaimable(row) {
  *  The claim also restamps the row's `created` to `created` — birth time is a
  *  spare's MINT time, and consumers sort conversations on it, so an hour-old
  *  spare must not sort as an hour-old conversation. This is the one sanctioned
- *  write of `created` after birth (`upsertRow` deliberately never touches it);
- *  the caller mirrors the same stamp into meta.json. */
+ *  write of `created` after birth. */
 export function claimWarmSpare(recipeKey, created, opts = {}) {
     return withCanvasWrite((db) => {
         const row = warmSpareRowsFor(db, recipeKey).find(spareIsClaimable);
@@ -694,7 +519,7 @@ export function childrenOf(id) {
         .all(id).map((r) => r.node_id);
 }
 /** Every node's lean roster row, oldest first — a single scan indexed by
- *  `idx_nodes_created`. No per-row `getNode`/meta.json read, no N+1. */
+ *  `idx_nodes_created`, with no per-row hydration or N+1 query. */
 export function rosterNodes() {
     return openDb()
         .prepare(`SELECT node_id, name, kind, mode, lifecycle, status, cwd, host_kind, parent, created
@@ -735,7 +560,7 @@ export function rosterEdges() {
  *  last session HERE"), so it never teleports across projects. */
 export function listResumableRoots(cwd) {
     const rows = openDb()
-        .prepare(`SELECT * FROM nodes
+        .prepare(`SELECT * FROM node_rows
         WHERE parent IS NULL AND kind != 'human'
           AND status IN ('active','idle') AND cwd = ?
           AND ${NOT_A_SPARE}
@@ -914,46 +739,6 @@ export function withFreshTerminalGuard(nodeId, isTerminal, body) {
         return { kind: 'ran', result: body() };
     });
 }
-// Index rebuild
-/** Rebuild node rows from on-disk metas (the db node table is a derived index).
- *  Only the IDENTITY columns are rebuilt — they are a projection of meta. The
- *  runtime columns (status/intent/pi_pid/window/tmux_session/pane) are NOT in meta
- *  and NOT re-derivable from it: they describe live process/presence state, so
- *  an existing row keeps them and a freshly re-created row takes the schema's
- *  quiescent defaults (status='active', the rest null). The daemon reconciles
- *  liveness from tmux reality, not from a stale file.
- *  Edges are left intact — subscribes_to is db-authoritative; spawned_by is
- *  re-derived from each meta's `spawned_by` (fallback: `parent` for legacy metas). */
-export function rebuildIndex() {
-    if (!existsSync(nodesRoot()))
-        return;
-    // Collect every on-disk meta first, then index in TWO passes. Under the
-    // edges→nodes FK (migration v4), a `spawned_by` edge insert whose endpoint
-    // row isn't present yet violates the constraint — so ALL node rows must exist
-    // before ANY edge is added.
-    const metas = [];
-    for (const id of readdirSync(nodesRoot())) {
-        if (!existsSync(join(nodeDir(id), 'meta.json')))
-            continue;
-        const meta = readMeta(id);
-        if (!meta)
-            continue;
-        metas.push(meta);
-    }
-    // Pass 1 — upsert every node row (the edge endpoints).
-    for (const meta of metas)
-        upsertRow(meta);
-    // Pass 2 — add the audit-only `spawned_by` provenance edges. Skip any whose
-    // provenance node has no on-disk meta (a deleted/pruned ancestor): the FK
-    // would reject it, and an orphan provenance edge is exactly what v4 makes
-    // unrepresentable.
-    const known = new Set(metas.map((m) => m.node_id));
-    for (const meta of metas) {
-        const prov = meta.spawned_by ?? meta.parent;
-        if (prov && known.has(prov))
-            recordSpawn(meta.node_id, prov);
-    }
-}
 /** True when this node's identity is still required to own a managed checkout.
  *
  *  Ownership outlives the OPEN state. A closed record whose cleanup is still
@@ -969,10 +754,7 @@ export function rebuildIndex() {
  *  the checkout and retains its branch for a person on purpose, so there is no
  *  residual for the sweep to own. */
 function hasUnreconciledManagedWorktree(nodeId) {
-    const wt = getNode(nodeId)?.managed_worktree;
-    if (wt == null || wt.state === 'abandoned')
-        return false;
-    return wt.state === 'open' || wt.cleanup !== 'complete';
+    return hasUnreconciledWorktree(nodeId);
 }
 /** Whether a row may be removed by an automatic collection sweep. */
 export function isCollectible(row, opts = {}) {
@@ -1050,7 +832,7 @@ export function pruneNodes(opts) {
     const selfId = envNodeId() ?? '';
     const db = openDb();
     const terminal = db
-        .prepare(`SELECT * FROM nodes
+        .prepare(`SELECT * FROM node_rows
        WHERE status IN ('dead', 'done', 'canceled') AND created < ?
        ORDER BY created`)
         .all(cutoff)
@@ -1060,7 +842,7 @@ export function pruneNodes(opts) {
     // Stale non-terminal sweep (opt-in): active | idle past the TTL whose process
     // is provably gone (pi_pid NULL or not alive). Never the caller itself.
     const stale = !includeStale ? [] : db
-        .prepare(`SELECT node_id, status, created, pi_pid FROM nodes
+        .prepare(`SELECT node_id, status, created, pi_pid FROM node_rows
          WHERE status IN ('active', 'idle') AND created < ?
          ORDER BY created`)
         .all(cutoff)
@@ -1082,49 +864,6 @@ export function pruneNodes(opts) {
     deletePrunedNodes(candidates);
     return { pruned: candidates, dryRun };
 }
-/** Drop rows whose on-disk `nodes/<id>/` dir is gone — a node that no longer
- *  exists in the only place it is durably stored.
- *
- *  `createNode` scaffolds the dir and writes meta.json BEFORE seeding the row, and
- *  both delete paths ({@link deleteNode}, `deletePrunedNodes`) commit the row
- *  removal BEFORE removing the dir, so a row with no dir is never a transient of
- *  either — it is a node whose durable state was lost. Nothing about it is
- *  recoverable: `getNode` reads meta.json and returns null, so every surface that
- *  resolves a node (revive, focus, close, rename, message) rejects it as unknown
- *  while the roster keeps listing it. The row IS the residue, so deleting it is
- *  the whole repair; there is no dir left to remove.
- *
- *  Because `active`/`idle` ghosts are the ones that jam surfaces, status is not a
- *  filter here — count-based pruning protects those rows precisely so daemon
- *  crash-recovery can resume them, and that reason does not survive the dir being
- *  gone.
- *
- *  Refuses to act on "can't tell": an unreadable nodes root, or a readable one
- *  holding no node dirs at all while rows exist, reads as a detached or wiped
- *  store rather than per-node loss, and reaps nothing. Returns the reaped ids. */
-export function reapGhostRows() {
-    const rows = listNodes();
-    if (rows.length === 0)
-        return [];
-    let onDisk;
-    try {
-        onDisk = new Set(readdirSync(nodesRoot()));
-    }
-    catch {
-        return []; // nodes root absent or unreadable — can't tell, so touch nothing
-    }
-    if (onDisk.size === 0)
-        return [];
-    const ghosts = rows.map((r) => r.node_id).filter((id) => !onDisk.has(id));
-    if (ghosts.length === 0)
-        return [];
-    withCanvasWrite((db) => {
-        const del = db.prepare('DELETE FROM nodes WHERE node_id = ?');
-        for (const id of ghosts)
-            del.run(id);
-    });
-    return ghosts;
-}
 /** Hard-delete a set of pruned nodes in one transaction (the edges→nodes and
  *  anchored-crons FKs cascade their coupled state), followed by best-effort
  *  on-disk `nodes/<id>/` removal. Shared by TTL and count pruning so their