@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/config.js

@@ -1,14 +1,17 @@
 import { envProfileId } from '../shared/env.js';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { CONFIG_FILE, STATE_FILE, CONDENSED_HISTORY_MODES, MOUSE_MODE_DEFAULTS, WHIP_MESSAGE_MODES, DEFAULT_WHIP_MESSAGES, defaultScopeConfig, defaultScopeState, defaultModelLaddersConfig, defaultKindsConfig, defaultRemoteCanvasConfig } from '../types.js';
 import { BINDING_CATALOG, BINDING_IDS, isAttachPaneBinding } from './keybindings/catalog.js';
-import { usage } from './errors.js';
+import { notFound, usage } from './errors.js';
 import { emitEvent } from './events/emit.js';
-import { atomicWriteJson, readJsonIfExists, writeJson, ensureDir } from './fs-utils.js';
-import { scopeRoot, requireScopeRoot, findProjectScopeRoots } from './scope.js';
+import { atomicWriteJson, readJsonIfExists, ensureDir } from './fs-utils.js';
+import { scopeRoot, requireScopeRoot, findProjectScopeRoots, userScopeRoot } from './scope.js';
 import { listInstalledPluginsInRoot } from './installed-plugins.js';
-import { profileRoot } from './profiles/manifest.js';
+import { profileRoot, listProfiles } from './profiles/manifest.js';
+import { canonicalRoot, projectStore, userStore } from './scoped-state/paths.js';
+import { convertLegacyScopedStore, initializeFreshScopedStore } from './scoped-state/migrate.js';
+import { mutateRawSettings, readBookkeeping, readRawSettings, readRawSettingsWithRevision, replaceRawSettings, writeBookkeeping, writeRawSettings } from './scoped-state/settings.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
 import { SCOPE_CONFIG_KEYS } from './user-settings.js';
 import { normalizeWorkingGerunds } from '../shared/working-activity.js';
@@ -16,6 +19,10 @@ import { mergePageComponentLayers, normalizePageComponents } from './human/page-
 function configPathFor(root) {
     return join(root, CONFIG_FILE);
 }
+function withConfigPathLock(path, run) {
+    ensureDir(dirname(path));
+    return withExclusiveDirectoryLock(`${path}.lock`, () => run(path), { timeoutError: () => new Error(`timed out waiting for config lock: ${path}`) });
+}
 function statePathFor(root) {
     return join(root, STATE_FILE);
 }
@@ -27,100 +34,83 @@ export function statePath(scope) {
     const root = scopeRoot(scope);
     return root ? statePathFor(root) : null;
 }
-export function readConfig(scope) {
-    const root = scopeRoot(scope);
-    if (!root)
-        return defaultScopeConfig();
-    return readConfigAtRoot(root);
-}
-/** Read the config that lives at an EXACT scope-root dir, rather than the
- *  resolved nearest root for a scope. Lets a caller iterate each visible
- *  project root's own config when several are in scope (nested `.crouter` dirs
- *  or a profile-widened stack), instead of collapsing them onto the nearest. */
-export function readConfigAtRoot(root) {
-    const existing = readJsonIfExists(configPathFor(root));
-    if (!existing)
-        return defaultScopeConfig();
-    return mergeConfig(existing);
-}
-export function readState(scope) {
-    const root = scopeRoot(scope);
-    if (!root)
-        return defaultScopeState();
-    const existing = readJsonIfExists(statePathFor(root));
-    if (!existing)
-        return defaultScopeState();
-    return {
-        marketplaces: existing.marketplaces ?? {},
-        plugins: existing.plugins ?? {},
-        last_self_check: existing.last_self_check,
-        activeCanvas: existing.activeCanvas ?? null,
-    };
-}
-function withConfigPathLock(path, run) {
-    ensureDir(dirname(path));
-    return withExclusiveDirectoryLock(`${path}.lock`, () => run(path), {
-        timeoutError: () => new Error(`timed out waiting for config lock: ${path}`),
-    });
+function settingsOwnerForRoot(root) {
+    const canonical = canonicalRoot(root);
+    const userRoot = canonicalRoot(userScopeRoot());
+    if (canonical === userRoot)
+        return { store: userStore(userRoot), key: 'user', kind: 'user', root: userRoot };
+    // Project roots can be classified without opening the user store. This keeps a
+    // fresh project usable when an unrelated legacy user root still needs conversion.
+    if (basename(canonical) === '.crouter') {
+        convertLegacyScopedStore({ kind: 'project', root: canonical });
+        return { store: projectStore(canonical), key: 'project', kind: 'project', root: canonical };
+    }
+    for (const profile of listProfiles()) {
+        const profilePath = canonicalRoot(profileRoot(profile.profileId));
+        if (canonical === profilePath)
+            return { store: userStore(userRoot), key: `profile:${profile.profileId}`, kind: 'profile', root: profilePath, profileId: profile.profileId };
+    }
+    throw new Error(`settings root is not a recognized owner: ${root}`);
+}
+function readRawAtRoot(root) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project')
+        return readJsonIfExists(configPathFor(owner.root));
+    return readRawSettings(owner);
+}
+function writeRawAtRoot(root, raw) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project') {
+        withConfigPathLock(configPathFor(owner.root), (path) => atomicWriteJson(path, raw));
+        return;
+    }
+    writeRawSettings(owner, raw);
+}
+function mutateRawAtRoot(root, mutate) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project')
+        return withConfigPathLock(configPathFor(owner.root), (path) => { const result = mutate(readJsonIfExists(path) ?? {}); atomicWriteJson(path, result.next); return result.value; });
+    return mutateRawSettings(owner, (raw) => mutate(raw));
+}
+export function readConfig(scope) { const root = scopeRoot(scope); return root ? readConfigAtRoot(root) : defaultScopeConfig(); }
+export function readConfigAtRoot(root) { const existing = readRawAtRoot(root); return existing ? mergeConfig(existing) : defaultScopeConfig(); }
+export function readState(scope) { const root = scopeRoot(scope); if (!root)
+    return defaultScopeState(); return readBookkeeping(settingsOwnerForRoot(root)); }
+export class InvalidRawSettingsError extends Error {
+    constructor(cause) {
+        super(`settings cannot be merged: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'InvalidRawSettingsError';
+    }
 }
-function withConfigLock(scope, run) {
-    const root = requireScopeRoot(scope);
-    return withConfigPathLock(configPathFor(root), run);
+function rawSettingsOwnerForTarget(target) {
+    if (target.scope === 'user')
+        return settingsOwnerForRoot(userScopeRoot());
+    if (!listProfiles().some((profile) => profile.profileId === target.profileId)) {
+        throw notFound(`profile not found: ${target.profileId}`, { received: target.profileId, next: 'Run `crtr profile list` to see available profiles.' });
+    }
+    return settingsOwnerForRoot(profileRoot(target.profileId));
 }
-export function updateRawConfigAtomically(scope, mutate) {
-    return withConfigLock(scope, (path) => {
-        const latest = readJsonIfExists(path) ?? {};
-        const next = mutate(latest);
-        atomicWriteJson(path, next);
-        return next;
-    });
+export function readRawSettingsForTarget(target) {
+    return readRawSettingsWithRevision(rawSettingsOwnerForTarget(target));
 }
-export function writeConfig(scope, config) {
-    withConfigLock(scope, (path) => atomicWriteJson(path, config));
-}
-/** Persist a RAW PARTIAL config to a scope's config.json exactly as given.
- *  Unlike `writeConfig`, this makes no promise that every field is present --
- *  callers pass the sparse partial that should live on disk, so an untouched
- *  key stays absent (and `readConfig`/`mergeConfig` re-derive it live from
- *  whichever build is running). This is the single central primitive every
- *  mutation path funnels through so no writer ever freezes a fully
- *  materialized `modelLadders` (concrete model ids that go stale across
- *  builds -- the live-Hearth freeze bug) onto disk. */
-export function writeRawConfig(scope, config) {
-    withConfigLock(scope, (path) => atomicWriteJson(path, config));
-}
-export function writeState(scope, state) {
-    const root = requireScopeRoot(scope);
-    ensureDir(root);
-    writeJson(statePathFor(root), state);
-}
-export function ensureScopeInitialized(scope, root) {
-    ensureDir(root);
-    withConfigPathLock(configPathFor(root), (cfgPath) => {
-        if (readJsonIfExists(cfgPath))
-            return;
-        // Persist no materialized model ladder or keybinding defaults. `modelLadders` holds concrete model ids (e.g.
-        // "openai-codex/gpt-5.6-sol:high") that are only valid as long as they match whatever
-        // pi model registry this crouter build ships. Baking a materialized snapshot here would
-        // freeze this scope's ladder to whatever ids happened to be current the moment it was
-        // first initialized -- a later crouter/pi upgrade (or a rollback) that changes the
-        // registry can then never reach it: the stale persisted override still wins over the
-        // new build's compiled defaults in `mergeConfig`/`mergeModelLadders`, producing a
-        // fallback rung `resolveViableFallback` rejects as unregistered while the terminal
-        // error misleadingly claims the fallback provider needs authenticating (see live
-        // incident: a home's config.json was seeded with `gpt-5.6-*` ladder entries from a
-        // build newer than the one actually installed, so its own model registry never had
-        // them). Omitting the key here is safe: `readConfig`/`mergeConfig` already default-fill
-        // a missing `modelLadders` from whatever build is CURRENTLY running, and an explicit
-        // user override (`sys config set modelLadders...`) still persists and still wins.
-        // Keybindings are sparse user overrides, so an untouched scope omits that member too.
-        const { modelLadders: _omittedModelLadders, keybindings: _omittedKeybindings, tmux_passthrough: _omittedTmuxPassthrough, brokerThresholds, lifecycle, ...rest } = defaultScopeConfig();
-        // Broker thresholds and lifecycle timing are host-wide daemon policy, so
-        // only user scope persists them. Project config must never acquire a
-        // machine setting.
-        atomicWriteJson(cfgPath, scope === 'user' ? { ...rest, brokerThresholds, lifecycle } : rest);
+export function replaceRawSettingsForTarget(target, next, ifRevision) {
+    return replaceRawSettings(rawSettingsOwnerForTarget(target), next, ifRevision, (settings) => {
+        try {
+            mergeConfig(settings);
+        }
+        catch (error) {
+            throw new InvalidRawSettingsError(error);
+        }
     });
 }
+export function updateRawConfigAtomically(scope, mutate) { const root = requireScopeRoot(scope); return mutateRawAtRoot(root, (latest) => { const next = mutate(latest); return { value: next, next }; }); }
+export function writeConfig(scope, config) { writeRawAtRoot(requireScopeRoot(scope), config); }
+export function writeRawConfig(scope, config) { writeRawAtRoot(requireScopeRoot(scope), config); }
+export function writeState(scope, state) { const root = requireScopeRoot(scope); writeBookkeeping(settingsOwnerForRoot(root), state); }
+export function ensureScopeInitialized(scope, root) { ensureDir(root); const owner = scope === 'user' ? settingsOwnerForRoot(userScopeRoot()) : settingsOwnerForRoot(root); initializeFreshScopedStore({ kind: owner.kind === 'user' ? 'user' : 'project', root: owner.store.root }); if (owner.kind === 'project' && readJsonIfExists(configPathFor(owner.root)) === null) {
+    const { modelLadders: _a, keybindings: _b, tmux_passthrough: _c, brokerThresholds, lifecycle, ...rest } = defaultScopeConfig();
+    writeRawAtRoot(owner.root, rest);
+} }
 function normalizeKeybindings(raw) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
         return {};
@@ -798,7 +788,7 @@ function mergeConfig(partial) {
  *  for why `readConfig(scope)`, which already defaults-fills, is unusable
  *  for cross-scope layering). */
 export function readRawConfigAtRoot(root) {
-    return readJsonIfExists(configPathFor(root));
+    return readRawAtRoot(root);
 }
 export function readRawScopeConfig(scope) {
     const root = scopeRoot(scope);
@@ -814,7 +804,7 @@ function readRawProfileConfig(profileId) {
     if (profileId === null || profileId === '')
         return null;
     try {
-        return readJsonIfExists(configPathFor(profileRoot(profileId)));
+        return readRawAtRoot(profileRoot(profileId));
     }
     catch {
         return null;
@@ -832,7 +822,7 @@ function readRawProjectScopeConfigs(targetCwd, targetProfileId) {
     const farthestFirst = [...nearestFirst].reverse();
     // A root with no config.json still contributes: its installed plugins may
     // declare kinds, so the ROOT rides along and `raw` stays null.
-    return farthestFirst.map((root) => ({ root, raw: readJsonIfExists(configPathFor(root)) }));
+    return farthestFirst.map((root) => ({ root, raw: readRawAtRoot(root) }));
 }
 /** Merge launch knobs (`kinds`, `modelLadders`) across scopes in
  *  project stack > profile > user > builtin precedence — the same precedence
@@ -994,27 +984,21 @@ function sparseModelLaddersToPersist(rawLadders, baseline, mutated) {
  *  `sys config set` never freezes a full concrete `modelLadders` to disk,
  *  and a direct ladder-rung set still persists only the touched rung -- all
  *  through one lock-protected atomic update path. */
-function mutateConfigAtPath(path, mutate) {
-    return withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
+function mutateConfigAtRoot(root, mutate) {
+    return mutateRawAtRoot(root, (raw) => {
         const baseline = mergeConfig(raw);
         const cfg = mergeConfig(raw);
         mutate(cfg);
         const partial = { ...raw };
-        for (const key of SCOPE_CONFIG_KEYS) {
-            if (key === 'modelLadders')
-                continue;
-            if (!isDeepStrictEqual(cfg[key], baseline[key])) {
+        for (const key of SCOPE_CONFIG_KEYS)
+            if (key !== 'modelLadders' && !isDeepStrictEqual(cfg[key], baseline[key]))
                 partial[key] = cfg[key];
-            }
-        }
         const ladders = sparseModelLaddersToPersist(raw.modelLadders, baseline.modelLadders, cfg.modelLadders);
         if (ladders !== undefined)
             partial.modelLadders = ladders;
         else
             delete partial.modelLadders;
-        atomicWriteJson(lockedPath, partial);
-        return cfg;
+        return { value: cfg, next: partial };
     });
 }
 /** Persist an EXPLICIT sparse `modelLadders` intent at one config root: the
@@ -1029,21 +1013,10 @@ function mutateConfigAtPath(path, mutate) {
  *  evaporates as soon as the default moves. Explicit intent is recorded as
  *  written. Mirrors `persistDefaultKindModel`. */
 export function persistModelLadders(root, patch) {
-    const path = configPathFor(root);
-    ensureDir(root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const current = (raw.modelLadders ?? {});
-        const next = { ...current };
-        if (patch.defaultProvider !== undefined)
-            next.defaultProvider = patch.defaultProvider;
-        for (const provider of ['anthropic', 'openai']) {
-            const rungs = patch[provider];
-            if (rungs !== undefined)
-                next[provider] = { ...(current[provider] ?? {}), ...rungs };
-        }
-        atomicWriteJson(lockedPath, { ...raw, modelLadders: next });
-    });
+    mutateRawAtRoot(root, (raw) => { const current = (raw.modelLadders ?? {}); const next = { ...current }; if (patch.defaultProvider !== undefined)
+        next.defaultProvider = patch.defaultProvider; for (const provider of ['anthropic', 'openai'])
+        if (patch[provider] !== undefined)
+            next[provider] = { ...(current[provider] ?? {}), ...patch[provider] }; return { value: undefined, next: { ...raw, modelLadders: next } }; });
 }
 /** Persist one complete route at one exact config root. The route is the only
  * raw route entry touched; unrelated routes and local ladder defaults remain
@@ -1054,33 +1027,18 @@ export function persistModelRoute(root, routeId, route) {
         assertCompleteModelRoute(routeId, route);
     else if (routeId.trim() === '')
         throw new Error('model route id must be a non-empty string');
-    const path = configPathFor(root);
-    ensureDir(root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const routes = copyRouteRecord((raw.modelRoutes ?? {}));
-        if (route === undefined)
-            delete routes[routeId];
-        else {
-            const current = routes[routeId];
-            setRouteRecord(routes, routeId, {
-                ...(current !== null && typeof current === 'object' && !Array.isArray(current) ? current : {}),
-                ...route,
-                models: { ...route.models },
-            });
-        }
-        const next = { ...raw };
-        if (Object.keys(routes).length === 0)
-            delete next.modelRoutes;
-        else
-            next.modelRoutes = routes;
-        atomicWriteJson(lockedPath, next);
-    });
+    mutateRawAtRoot(root, (raw) => { const routes = copyRouteRecord((raw.modelRoutes ?? {})); if (route === undefined)
+        delete routes[routeId];
+    else
+        setRouteRecord(routes, routeId, { ...route, models: { ...route.models } }); const next = { ...raw }; if (Object.keys(routes).length === 0)
+        delete next.modelRoutes;
+    else
+        next.modelRoutes = routes; return { value: undefined, next }; });
 }
 /** Mutate one exact config root. Setup uses this for profile and explicit
  * project targets that cannot be represented by the user/project Scope enum. */
 export function updateConfigAtRoot(root, mutate) {
-    return mutateConfigAtPath(configPathFor(root), mutate);
+    return mutateConfigAtRoot(root, mutate);
 }
 export function updateConfig(scope, mutate) {
     return updateConfigAtRoot(requireScopeRoot(scope), mutate);
@@ -1090,15 +1048,8 @@ export function updateConfig(scope, mutate) {
  * scopes instead of freezing a materialized registry snapshot. */
 export function persistDefaultKindModel(opts) {
     const field = opts.orchestrator === true ? 'orchestratorModel' : 'model';
-    const path = configPathFor(opts.root);
-    ensureDir(opts.root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const kinds = { ...(raw.kinds ?? {}) };
-        kinds[opts.kind] = { ...(kinds[opts.kind] ?? {}), [field]: opts.model };
-        atomicWriteJson(lockedPath, { ...raw, kinds });
-    });
-    return { path, field };
+    mutateRawAtRoot(opts.root, (raw) => { const kinds = { ...(raw.kinds ?? {}), [opts.kind]: { ...(raw.kinds ?? {})[opts.kind], [field]: opts.model } }; return { value: undefined, next: { ...raw, kinds: kinds } }; });
+    return { path: configPathFor(opts.root), field };
 }
 export function updateState(scope, mutate) {
     const s = readState(scope);

package/dist/core/errors.d.ts

@@ -22,6 +22,7 @@ export declare function general(message: string, details?: Record<string, unknow
  *  `apiErrorToCliError` (tier 2) reconstructs the exact code, message, and
  *  actionable `next` instead of degrading to a generic `invalid_request`. */
 export declare function brokerLaunchFailed(message: string, next: string): CrtrError;
+export declare function nodeCreateRefused(message: string, next: string): CrtrError;
 /** Thrown by stub handlers for leaves not yet wired in P3+.
  *  code='not_implemented', exitCode=GENERAL, next names the node. */
 export declare function notImplemented(node: string): CrtrError;

package/dist/core/errors.js

@@ -41,6 +41,10 @@ export function brokerLaunchFailed(message, next) {
     const code = 'broker_launch_failed';
     return new CrtrError(code, message, ExitCode.GENERAL, { error: code, message, next });
 }
+export function nodeCreateRefused(message, next) {
+    const code = 'node_create_refused';
+    return new CrtrError(code, message, ExitCode.GENERAL, { error: code, message, next });
+}
 /** Thrown by stub handlers for leaves not yet wired in P3+.
  *  code='not_implemented', exitCode=GENERAL, next names the node. */
 export function notImplemented(node) {

package/dist/core/feed/__tests__/inbox-migrate.test.js

@@ -1,49 +1,45 @@
-// Regression (2026-07-22 revive-loop flap): removing legacy inbox compat
-// (e2904a09) with no on-host cutover left every pre-cutover node fatally
-// unreadable — the broker crashed at inbox seed and the daemon revived it
-// forever, flashing "node refreshing — reconnecting…" in every attached
-// viewer. The boot migration must rewrite identity-less rows and map the
-// ISO-timestamp cursor boundary onto an exact entry identity the strict
-// reader accepts.
+// Retained legacy mailbox import: the SQL cutover preserves historical inbox
+// bytes by importing them into messages and deliveries without leaving a
+// runtime filesystem reader.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { migrateLegacyInboxIdentities } from '../inbox-migrate.js';
-import { readCursor, readInboxSince } from '../inbox.js';
-import { nodeDir, inboxPath } from '../../canvas/paths.js';
-test('legacy inbox rows and ISO cursor migrate to strict identities once', () => {
+import { migrateMessagingState } from '../../canvas/deliveries.js';
+import { inboxPath, nodeDir } from '../../canvas/paths.js';
+test('legacy inbox rows and cursor import once into acknowledged and pending SQL deliveries', () => {
     const home = mkdtempSync(join(tmpdir(), 'crtr-inboxmigrate-'));
     const orig = process.env['CRTR_HOME'];
     process.env['CRTR_HOME'] = home;
     const nodeId = 'mrtest01-aabbccdd';
+    const db = new DatabaseSync(join(home, 'canvas.db'));
     try {
+        db.exec('CREATE TABLE nodes (node_id TEXT PRIMARY KEY, waiting_for TEXT, waiting_for_generation INTEGER)');
+        db.prepare('INSERT INTO nodes (node_id, waiting_for, waiting_for_generation) VALUES (?, NULL, 0)').run(nodeId);
+        db.exec('CREATE TABLE human_action_deliveries (request_id TEXT, state TEXT, attempt INTEGER, argv_json TEXT, cwd TEXT, completion_json TEXT, next_attempt_at INTEGER, claimed_at INTEGER, claim_owner TEXT, accepted_at INTEGER, permanent_failed_at INTEGER, last_failure_json TEXT, created_at INTEGER, updated_at INTEGER)');
+        db.exec('CREATE TABLE node_outcome_deliveries (node_id TEXT, state TEXT, attempt INTEGER, action_name TEXT, argv_json TEXT, cwd TEXT, config_origin TEXT, payload_json TEXT, document_json TEXT, next_attempt_at INTEGER, claimed_at INTEGER, claim_owner TEXT, accepted_at INTEGER, permanent_failed_at INTEGER, last_failure_json TEXT, created_at INTEGER, updated_at INTEGER)');
         mkdirSync(nodeDir(nodeId), { recursive: true });
         const lines = [
-            '{"ts":"2026-07-09T22:54:06.294Z","from":"mrpeer1-00000001","tier":"normal","kind":"final","label":"one"}',
-            '{"ts":"2026-07-10T01:00:00.000Z","from":"mrpeer1-00000001","tier":"normal","kind":"update","label":"two"}',
+            '{"entry_id":"11111111111111111111111111111111","operation_id":"22222222222222222222222222222222","ts":"2026-07-09T22:54:06.294Z","from":"mrpeer1-00000001","tier":"normal","kind":"final","label":"one"}',
+            '{"entry_id":"33333333333333333333333333333333","operation_id":"44444444444444444444444444444444","ts":"2026-07-10T01:00:00.000Z","from":"mrpeer1-00000001","tier":"normal","kind":"update","label":"two"}',
         ];
         writeFileSync(inboxPath(nodeId), `${lines.join('\n')}\n`, 'utf8');
-        writeFileSync(`${inboxPath(nodeId)}.cursor`, '2026-07-09T22:54:06.294Z', 'utf8');
-        const first = migrateLegacyInboxIdentities();
-        assert.equal(first.nodes, 1);
-        assert.equal(first.entries, 2);
-        assert.equal(first.cursors, 1);
-        assert.equal(first.failures, 0);
-        // The strict reader consumes the migrated state: cursor covers entry one,
-        // exactly entry two is unread.
-        const cursor = readCursor(nodeId);
-        assert.notEqual(cursor, undefined);
-        const unread = readInboxSince(nodeId, cursor);
-        assert.equal(unread.length, 1);
-        assert.equal(unread[0].ts, '2026-07-10T01:00:00.000Z');
-        const migratedRaw = readFileSync(inboxPath(nodeId), 'utf8');
-        const second = migrateLegacyInboxIdentities();
-        assert.deepEqual(second, { nodes: 0, entries: 0, cursors: 0, failures: 0 });
-        assert.equal(readFileSync(inboxPath(nodeId), 'utf8'), migratedRaw, 'second run is a no-op');
+        writeFileSync(`${inboxPath(nodeId)}.cursor`, '11111111111111111111111111111111', 'utf8');
+        migrateMessagingState(db);
+        const deliveries = db.prepare(`SELECT m.message_id, m.created_at, d.state, d.acknowledged_at
+         FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+        WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? ORDER BY m.seq`).all(nodeId);
+        assert.deepEqual(deliveries.map(({ message_id, state }) => ({ message_id, state })), [
+            { message_id: '11111111111111111111111111111111', state: 'acknowledged' },
+            { message_id: '33333333333333333333333333333333', state: 'pending' },
+        ], 'the retained file rows become ordered SQL message/delivery facts and the legacy cursor becomes acknowledgement');
+        assert.equal(deliveries[0].acknowledged_at, Date.parse('2026-07-09T22:54:06.294Z'));
+        assert.equal(deliveries[1].created_at, '2026-07-10T01:00:00.000Z');
     }
     finally {
+        db.close();
         if (orig === undefined)
             delete process.env['CRTR_HOME'];
         else

package/dist/core/feed/feed.d.ts

@@ -27,12 +27,6 @@ export declare class FinalizationError extends Error {
     readonly reportPath?: string | undefined;
     constructor(code: 'already_finalized' | 'finalization_forbidden' | 'unknown_node', reportPath?: string | undefined);
 }
-export declare class FinalDeliveryError extends Error {
-    readonly reportPath: string;
-    readonly deliveredTo: string[];
-    readonly failedTo: string[];
-    constructor(reportPath: string, deliveredTo: string[], failedTo: string[]);
-}
 export declare function push(nodeId: string, opts: PushOpts): Promise<PushResult>;
 export declare function pushUpdate(nodeId: string, body: string, opts?: {
     from?: string;