@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/__tests__/kickoff.test.js

@@ -10,9 +10,11 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
 import { reportsDir } from '../canvas/paths.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { acknowledgeNodeMail, claimNodeMail } from '../canvas/deliveries.js';
+import { beginExecution } from '../canvas/executions.js';
 import { buildReviveKickoff, clearYieldMessage, drainBearings, readYieldMessage, writeYieldMessage, yieldMessagePath, } from '../runtime/kickoff.js';
-import { appendInbox, readCursor } from '../feed/inbox.js';
+import { enqueueNodeMail } from '../feed/messages.js';
 import { appendSituationalContext } from '../runtime/situational-context.js';
 import { buildContextBearings as buildContextIntro } from '../runtime/bearings.js';
 let home;
@@ -36,6 +38,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -45,18 +48,23 @@ after(() => {
 test('drainBearings preserves the yield note until explicit boot confirmation', () => {
     const id = 'n1';
     const meta = createNode(node(id));
+    const executionId = beginExecution(id, { daemonEpoch: 'test' });
     writeYieldMessage(id, 'on wake, finish step 3');
-    appendInbox(id, { from: 'w1', tier: 'normal', kind: 'update', label: 'first', ref: '/tmp/a.md' });
-    const last = appendInbox(id, { from: 'w1', tier: 'normal', kind: 'update', label: 'second', ref: '/tmp/b.md' });
-    const b1 = drainBearings(meta);
+    enqueueNodeMail(id, { senderNodeId: 'w1', kind: 'update', label: 'first', bodyRef: '/tmp/a.md', urgency: 'normal', wake: 1 });
+    enqueueNodeMail(id, { senderNodeId: 'w1', kind: 'update', label: 'second', bodyRef: '/tmp/b.md', urgency: 'normal', wake: 1 });
+    const b1 = drainBearings(meta, executionId);
     assert.equal(b1.yieldMsg?.trim(), 'on wake, finish step 3');
     assert.ok(b1.unreadDigest !== null && b1.unreadDigest.length > 0);
     assert.equal(existsSync(yieldMessagePath(id)), true, 'yield note remains pending before confirmation');
     assert.equal(readYieldMessage(id), 'on wake, finish step 3', 'reader sees the same persisted note');
-    assert.equal(readCursor(id), last.entry_id, 'cursor advanced to the last unread entry');
-    const b2 = drainBearings(meta);
+    const claim = claimNodeMail(id, executionId, 'wake');
+    const receipt = acknowledgeNodeMail(id, executionId, claim.deliveries.map((delivery) => ({
+        deliveryId: delivery.deliveryId, attempts: delivery.attempts, disposition: 'acknowledged',
+    })));
+    assert.deepEqual(receipt.results.map((result) => result.outcome), ['acknowledged', 'acknowledged']);
+    const b2 = drainBearings(meta, executionId);
     assert.equal(b2.yieldMsg, 'on wake, finish step 3', 'a failed launch can read the same note again');
-    assert.equal(b2.unreadDigest, null, 'the independently committed feed cursor remains drained');
+    assert.equal(b2.unreadDigest, null, 'settled deliveries do not return to the next launch');
     clearYieldMessage(id);
     clearYieldMessage(id);
     assert.equal(readYieldMessage(id), null, 'confirmation clear is idempotent');
@@ -65,30 +73,19 @@ test('drainBearings preserves the yield note until explicit boot confirmation',
 test('fresh kickoff keeps each inbox card directly before its own message', () => {
     const id = 'ordered-cards';
     const meta = createNode(node(id));
-    appendInbox(id, {
-        from: 'sender',
-        tier: 'normal',
-        kind: 'message',
-        label: 'FIRST-BODY',
-        data: { body: 'FIRST-BODY', cards: ['<runtime kind="test-card">FIRST-CARD</runtime>'] },
+    const executionId = beginExecution(id, { daemonEpoch: 'test' });
+    enqueueNodeMail(id, {
+        senderNodeId: 'sender', kind: 'message', label: 'FIRST-BODY',
+        bodyJson: { body: 'FIRST-BODY', cards: ['<runtime kind="test-card">FIRST-CARD</runtime>'] }, urgency: 'normal', wake: 1,
     });
-    appendInbox(id, {
-        from: 'sender',
-        tier: 'normal',
-        kind: 'message',
-        label: 'SECOND-BODY',
-        data: { body: 'SECOND-BODY', cards: ['<runtime kind="test-card">SECOND-CARD</runtime>'] },
+    enqueueNodeMail(id, {
+        senderNodeId: 'sender', kind: 'message', label: 'SECOND-BODY',
+        bodyJson: { body: 'SECOND-BODY', cards: ['<runtime kind="test-card">SECOND-CARD</runtime>'] }, urgency: 'normal', wake: 1,
     });
     for (const body of ['GROUPED-BODY-1', 'GROUPED-BODY-2', 'GROUPED-BODY-3']) {
-        appendInbox(id, {
-            from: 'card-free-sender',
-            tier: 'normal',
-            kind: 'message',
-            label: body,
-            data: { body },
-        });
+        enqueueNodeMail(id, { senderNodeId: 'card-free-sender', kind: 'message', label: body, bodyJson: { body }, urgency: 'normal', wake: 1 });
     }
-    const kickoff = buildReviveKickoff(meta, drainBearings(meta));
+    const kickoff = buildReviveKickoff(meta, drainBearings(meta, executionId));
     const firstCard = kickoff.indexOf('FIRST-CARD');
     const firstBody = kickoff.indexOf('FIRST-BODY');
     const secondCard = kickoff.indexOf('SECOND-CARD');
@@ -109,7 +106,7 @@ test('drainBearings leaves persona drift pending until the replacement context e
         mode: 'orchestrator',
         persona_ack: oldPersona,
     }));
-    const bearings = drainBearings(meta);
+    const bearings = drainBearings(meta, beginExecution(meta.node_id, { daemonEpoch: 'test' }));
     assert.match(bearings.driftGuidance ?? '', /ORCHESTRATOR/);
     assert.deepEqual(getNode(meta.node_id)?.persona_ack, oldPersona, 'pre-session_start launch work cannot acknowledge the drift');
 });
@@ -117,7 +114,7 @@ test('the feed block frames awaiting workers as alive + auto-waking, so a fresh
     const parent = createNode(node('p1'));
     const child = createNode(node('c1')); // status 'active' by default
     subscribe(parent.node_id, child.node_id); // parent awaits child
-    const msg = buildReviveKickoff(parent, drainBearings(parent));
+    const msg = buildReviveKickoff(parent, drainBearings(parent, beginExecution(parent.node_id, { daemonEpoch: 'test' })));
     // The roster names the live child...
     assert.ok(msg.includes(child.node_id), 'awaiting roster lists the live child');
     // ...and asserts aliveness + the automatic wake at the source, so the node
@@ -143,7 +140,7 @@ test('a fresh revive is pointed at its subscriptions\' on-disk report history (c
     const newer = join(dir, '20260608T130000-final.md');
     writeFileSync(older, '---\n---\nearly progress', 'utf8');
     writeFileSync(newer, '---\n---\nthe result', 'utf8');
-    const msg = buildReviveKickoff(parent, drainBearings(parent));
+    const msg = buildReviveKickoff(parent, drainBearings(parent, beginExecution(parent.node_id, { daemonEpoch: 'test' })));
     // The feed block stays condensed: it reports that history exists and surfaces
     // the newest report ref for immediate dereference, while older refs stay one
     // command away instead of being preloaded into the revive prompt.
@@ -170,7 +167,7 @@ test('a fresh revive kickoff never carries situational context — it rides the
     const id = 'n3';
     const meta = createNode(node(id));
     appendSituationalContext(id, 'user is mid-checkout on the store applet');
-    const kickoff = buildReviveKickoff(meta, drainBearings(meta));
+    const kickoff = buildReviveKickoff(meta, drainBearings(meta, beginExecution(meta.node_id, { daemonEpoch: 'test' })));
     assert.doesNotMatch(kickoff, /kind="situational"/, 'visible kickoff never carries the ambient card');
     assert.doesNotMatch(kickoff, /mid-checkout on the store applet/, 'visible kickoff never carries the ambient text');
     const hidden = buildContextIntro(id);
@@ -180,20 +177,20 @@ test('a fresh revive kickoff never carries situational context — it rides the
 test('buildReviveKickoff is pure — building twice eats nothing', () => {
     const id = 'n2';
     const meta = createNode(node(id));
+    const executionId = beginExecution(id, { daemonEpoch: 'test' });
     writeYieldMessage(id, 'remember the invariant');
-    const last = appendInbox(id, { from: 'w', tier: 'normal', kind: 'update', label: 'r', ref: '/tmp/r.md' });
-    // Drain once (the consuming step), then build twice off the same bearings.
-    const bearings = drainBearings(meta);
-    const cursorAfterDrain = readCursor(id);
-    assert.equal(cursorAfterDrain, last.entry_id);
+    enqueueNodeMail(id, { senderNodeId: 'w', kind: 'update', label: 'r', bodyRef: '/tmp/r.md', urgency: 'normal', wake: 1 });
+    // Claim once, then build twice from the same immutable bearings.
+    const bearings = drainBearings(meta, executionId);
     const s1 = buildReviveKickoff(meta, bearings);
     const s2 = buildReviveKickoff(meta, bearings);
-    // Identical output, and the build mutated nothing: cursor and note unchanged.
+    // Identical output, and the build mutates neither delivery receipts nor note.
     assert.equal(s1, s2);
     assert.match(s1, /<yield-message>\nremember the invariant\n<\/yield-message>/, 'yield note is delivered inline');
     const contextInventory = s1.match(/<context-dir path="[^"]+">[\s\S]*?<\/context-dir>/)?.[0];
     assert.ok(contextInventory, 'context inventory is present');
     assert.doesNotMatch(contextInventory, /yield-message\.md/, 'ephemeral yield note is not addressable from inventory');
-    assert.equal(readCursor(id), cursorAfterDrain, 'build does not touch the cursor');
+    const claim = claimNodeMail(id, executionId, 'wake');
+    assert.equal(claim.deliveries.length, 1, 'build does not settle its claimed delivery');
     assert.equal(readYieldMessage(id), 'remember the invariant', 'build does not mutate the persisted note');
 });

package/dist/core/__tests__/lifecycle-terminal-reasons.test.js

@@ -4,7 +4,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { transition } from '../runtime/lifecycle.js';
 let home;
 function seed(nodeId) {
@@ -30,6 +30,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/core/__tests__/lifecycle.test.js

@@ -11,7 +11,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, setStatus, setIntent } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { isParked, transition } from '../runtime/lifecycle.js';
 let home;
 function node(id) {
@@ -39,6 +39,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/core/__tests__/live-lifecycle-prompt.test.js

@@ -6,10 +6,13 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, updateNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { ensureScopeInitialized } from '../config.js';
+import { closeScopedStores } from '../scoped-state/db.js';
 import { renderPreferencesSection } from '../substrate/render-node.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
 let home;
+let priorUserHome;
 function node(id) {
     return {
         node_id: id,
@@ -24,18 +27,27 @@ function node(id) {
 }
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-live-lifecycle-prompt-'));
+    priorUserHome = process.env['HOME'];
+    process.env['HOME'] = home;
     process.env['CRTR_HOME'] = home;
 });
 beforeEach(() => {
     closeDb();
     clearSessionCache();
     rmSync(home, { recursive: true, force: true });
+    ensureScopeInitialized('user', join(home, '.crouter'));
+    migrate(openDb());
 });
 after(() => {
     closeDb();
     clearSessionCache();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    if (priorUserHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = priorUserHome;
 });
 test('a cached resident prompt becomes terminal after a live lifecycle change', () => {
     createNode(node('live'));

package/dist/core/__tests__/memory-resolver-precedence.test.js

@@ -23,6 +23,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../git.js';
 import { createProfile } from '../profiles/manifest.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { resetScopeCache } from '../scope.js';
 import { loadMemoryStoreView, openProjectMemoryStore, resolveMemoryCandidates, resolveMemoryDoc, resolveMemoryDocInStore, resolveMemoryDocs, } from '../memory-resolver.js';
 let home;
@@ -54,6 +55,7 @@ before(() => {
     prevHome = process.env.HOME;
     prevProfile = process.env.CRTR_PROFILE_ID;
     process.env.HOME = home;
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
     // A wider user-scope doc whose name a project doc used to shadow.
     mkdirSync(join(home, '.crouter', 'memory'), { recursive: true });
     writeFileSync(join(home, '.crouter', 'memory', 'testing-stance.md'), '---\nkind: preference\n---\nUSER PREFERENCE BODY\n', 'utf8');

package/dist/core/__tests__/migration.test.js

@@ -10,9 +10,10 @@ import { canvasDbPath, ensureHome } from '../canvas/paths.js';
 import { customExtensionPaths } from '../canvas/extensions.js';
 import { assertMandatoryCanvasExtensions, CANVAS_EXTENSIONS, mergeCanvasExtensions } from '../runtime/canvas-extensions.js';
 import { updateNode } from '../canvas/canvas.js';
+import { parsePage, parsePageDelivery } from '../human/page.js';
 import { spawn, spawnSync } from 'node:child_process';
 const HERE = dirname(fileURLToPath(import.meta.url));
-const RUNTIME_COLUMNS = ['intent', 'pi_pid', 'window', 'tmux_session'];
+const RUNTIME_COLUMNS = ['intent', 'window', 'tmux_session'];
 const RACE_FIXTURE = join(HERE, 'fixtures', 'metadata-migration-race.ts');
 const PRE_TOOL_GUIDE_CANVAS_EXTENSION_NAMES = [
     'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
@@ -53,6 +54,11 @@ function userVersion(db) {
     return db.prepare('PRAGMA user_version').get()
         .user_version;
 }
+function openMigratedDb() {
+    const db = openDb();
+    migrate(db);
+    return db;
+}
 function nodeColumns(db) {
     return db.prepare('PRAGMA table_info(nodes)').all().map((r) => r.name);
 }
@@ -77,8 +83,11 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-test('opening a fresh home migrates to the latest user_version', () => {
+test('opening a fresh home leaves schema initialization explicit', () => {
     const db = openDb();
+    assert.equal(userVersion(db), 0);
+    assert.equal(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'nodes'").get(), undefined);
+    migrate(db);
     assert.equal(userVersion(db), MIGRATIONS.length);
 });
 test('a persisted review-boundary canvas prefix is not treated as custom extensions', () => {
@@ -120,7 +129,7 @@ test('a v14 canvas normalizes historical canvas paths while retaining custom lau
     const saved = JSON.parse(readFileSync(metaPath, 'utf8'));
     assert.deepEqual(saved.launch.extensions, ['/plugins/canvas-inbox-watcher.js']);
 });
-test('a v14 migration is protected against concurrent writeback by normal updateNode writes', async () => {
+test('an explicit v14 migration preserves legacy metadata while node updates use SQL state', async () => {
     const metaPath = join(home, 'nodes', 'saved', 'meta.json');
     mkdirSync(join(home, 'nodes', 'saved'), { recursive: true });
     writeFileSync(metaPath, JSON.stringify({
@@ -143,16 +152,17 @@ test('a v14 migration is protected against concurrent writeback by normal update
     rmSync(marker, { force: true });
     const { done } = await spawnMigrationRace(metaPath, marker);
     await waitForPath(marker);
+    migrate(raw);
+    await done;
+    raw.close();
     const update = updateNode('saved', { name: 'saved-raced' });
     assert.equal(update.name, 'saved-raced');
-    await done;
     const settled = JSON.parse(readFileSync(metaPath, 'utf8'));
     assert.equal(customExtensionPaths(settled.launch.extensions).length, settled.launch.extensions.length);
-    assert.deepEqual(settled.launch.extensions, ['/plugins/canvas-inbox-watcher.js'], 'concurrent migration + metadata writes cannot restore retired hook prefixes');
-    assert.equal(settled.name, 'saved-raced');
-    raw.close();
+    assert.deepEqual(settled.launch.extensions, ['/plugins/canvas-inbox-watcher.js'], 'migration writeback cannot restore retired hook prefixes');
+    assert.equal(settled.name, 'saved', 'the legacy conversion input remains unchanged after a SQL node update');
 });
-test('a fresh db has the four additive runtime columns', () => {
+test('a v0 db retains its runtime fields while process state moves to executions', () => {
     // Build a v0 db by hand: the baseline tables only, user_version 0, no runtime
     // columns — exactly the shape of the live fleet before this phase.
     ensureHome();
@@ -189,14 +199,14 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(userVersion(raw), 0);
     assert.ok(!nodeColumns(raw).includes('intent'));
     raw.close();
-    // openDb() runs the migration runner forward.
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
-    // Runtime columns now exist.
+    // Node runtime columns now exist; process state is projected from executions.
     const cols = nodeColumns(db);
     for (const c of RUNTIME_COLUMNS) {
         assert.ok(cols.includes(c), `expected nodes.${c} after migration`);
     }
+    assert.ok(!cols.includes('pi_pid'), 'nodes no longer stores process state');
     // Pre-existing data is intact — no loss, no mutation of existing columns.
     const row = db
         .prepare('SELECT node_id, status, cwd FROM nodes WHERE node_id = ?')
@@ -208,10 +218,9 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(edgeCount, 1);
     // The new columns are seeded NULL for the migrated row — nothing observed.
     const rt = db
-        .prepare('SELECT intent, pi_pid, "window", tmux_session FROM nodes WHERE node_id = ?')
+        .prepare('SELECT intent, "window", tmux_session FROM nodes WHERE node_id = ?')
         .get('n1');
     assert.equal(rt['intent'], null);
-    assert.equal(rt['pi_pid'], null);
     assert.equal(rt['window'], null);
     assert.equal(rt['tmux_session'], null);
 });
@@ -240,7 +249,7 @@ test('session-file ownership migration reconciles authoritative metas before cle
     insert.run('later-claimant', 'later-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-02T00:00:00.000Z', aliasedSessionFile);
     insert.run('recovered-claimant', 'recovered-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-03T00:00:00.000Z', sessionFile);
     assert.doesNotThrow(() => migrate(raw), 'a real canvas with pre-existing duplicates must migrate');
-    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM node_rows ORDER BY created, node_id').all();
     assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
         ['first-owner', sessionFile],
         ['later-claimant', null],
@@ -252,7 +261,7 @@ test('session-file ownership migration reconciles authoritative metas before cle
     const recovered = JSON.parse(readFileSync(join(home, 'nodes', 'recovered-claimant', 'meta.json'), 'utf8'));
     assert.equal(recovered.pi_session_id, 'recovered-claimant-session', 'a stale row cannot clear the authoritative session id');
     assert.equal(recovered.pi_session_file, recoveredSessionFile, 'a stale row cannot clear the authoritative session file');
-    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(sessionFile, 'later-claimant'), /UNIQUE/, 'the schema enforces the repaired invariant');
+    assert.throws(() => raw.prepare("INSERT INTO sessions (binding_id, session_id, node_id, transcript_path, source_session_id, fork_entry_id, created_at, bound_at, unbound_at) VALUES ('later-duplicate', 'later-duplicate-session', 'later-claimant', ?, NULL, NULL, '2026-01-02T00:00:00.000Z', '2026-01-02T00:00:00.000Z', NULL)").run(sessionFile), /UNIQUE/, 'the SQL session table enforces the repaired invariant');
     raw.close();
 });
 test('forward session-file repair reprojects a surviving v36 meta coordinate before restoring its UNIQUE index', () => {
@@ -280,7 +289,7 @@ test('forward session-file repair reprojects a surviving v36 meta coordinate bef
     raw.exec('DROP INDEX IF EXISTS idx_nodes_pi_session_file; CREATE UNIQUE INDEX idx_nodes_pi_session_file ON nodes(pi_session_file); PRAGMA user_version = 36;');
     assert.doesNotThrow(() => migrate(raw));
     assert.equal(userVersion(raw), MIGRATIONS.length);
-    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM node_rows ORDER BY created, node_id').all();
     assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
         ['surviving-owner', recoveredSessionFile],
         ['stale-row', null],
@@ -288,7 +297,7 @@ test('forward session-file repair reprojects a surviving v36 meta coordinate bef
     const survivor = JSON.parse(readFileSync(join(home, 'nodes', 'surviving-owner', 'meta.json'), 'utf8'));
     assert.equal(survivor.pi_session_id, 'surviving-session');
     assert.equal(survivor.pi_session_file, recoveredSessionFile);
-    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(recoveredSessionFile, 'stale-row'), /UNIQUE/);
+    assert.throws(() => raw.prepare("INSERT INTO sessions (binding_id, session_id, node_id, transcript_path, source_session_id, fork_entry_id, created_at, bound_at, unbound_at) VALUES ('stale-duplicate', NULL, 'stale-row', ?, NULL, NULL, '2026-01-02T00:00:00.000Z', '2026-01-02T00:00:00.000Z', NULL)").run(recoveredSessionFile), /UNIQUE/);
     raw.close();
 });
 test('node lifecycle substrate migration adds six columns and backfills terminal reasons', () => {
@@ -314,7 +323,7 @@ test('node lifecycle substrate migration adds six columns and backfills terminal
     insert.run('crashed', 'crashed', 'general', 'dead', null, null, '/tmp', created);
     insert.run('active', 'active', 'general', 'active', null, null, '/tmp', created);
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     for (const column of lifecycleColumns)
         assert.ok(nodeColumns(db).includes(column));
@@ -331,8 +340,8 @@ test('node lifecycle substrate migration adds six columns and backfills terminal
 // v4: edges FK ON DELETE CASCADE (the one irreversible rebuild)
 /** Build a hand-rolled db at exactly v3 (baseline tables + the four runtime
  *  columns, edges with NO foreign key, `user_version = 3`) — the shape the live
- *  fleet reaches just before v4. Caller seeds it, we close it; the next openDb()
- *  runs only v4 over it. */
+ *  fleet reaches just before v4. Caller seeds it, then explicitly runs v4 and
+ *  later steps. */
 function buildV3Db() {
     ensureHome();
     const raw = new DatabaseSync(canvasDbPath());
@@ -382,8 +391,8 @@ test('v4 migrates a db with a pre-existing orphan edge without throwing', () =>
     assert.equal(userVersion(raw), 3);
     assert.equal(edgeCount(raw), 2);
     raw.close();
-    // openDb() runs v4. It must NOT throw on the orphan, and must drop it.
-    const db = openDb();
+    // Explicit migration must not throw on the orphan, and must drop it.
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length); // migrated forward to the head
     // The orphan edge is filtered; the non-orphan edge + its count are preserved.
     assert.equal(edgeCount(db), 1);
@@ -435,7 +444,7 @@ test('bug #99: a stale v4 db with later columns already present migrates cleanly
     assert.equal(userVersion(raw), 4);
     assert.equal(nodeColumns(raw).includes('pane'), true, 'precondition: pane already exists even though user_version is stale');
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const cols = nodeColumns(db);
     assert.ok(cols.includes('pane'), 'pane survives the migration');
@@ -536,7 +545,7 @@ test('v22 converts existing schedules into self-contained crons and removes the
         payload: { kind: 'general', mode: 'base', cwd: '/tmp/work', prompt: 'go', parent: 'owner' },
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name);
     assert.ok(!tables.includes('triggers'));
@@ -571,8 +580,7 @@ test('v22 converts existing schedules into self-contained crons and removes the
     assert.match(birth.command, /crtr node new --kind 'general'/);
     assert.match(birth.command, /go/);
 });
-// The v22 migration runs on EVERY openDb(), so it must never fail on data shape:
-// a throw would make every crtr process unable to open the canvas forever. These
+// The explicit v22 migration must handle every declared-legal data shape. These
 // cases are all shapes the retired schema declared legal.
 function insertNodeAt(db, id, cwd, created, parent) {
     db.prepare('INSERT INTO nodes (node_id, name, kind, status, cwd, parent, created) VALUES (?,?,?,?,?,?,?)').run(id, id, 'general', 'active', cwd, parent, created);
@@ -671,7 +679,7 @@ test('v22 converts the legal edge rows and records the ones it cannot express',
         payload: { body: 'nope' },
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances despite the unconvertible row');
     const cron = (id) => db.prepare('SELECT * FROM crons WHERE cron_id = ?').get(id);
     const pruned = cron('pruned-owner');
@@ -706,7 +714,7 @@ test('v22 re-run over already-converted crons converges instead of colliding on
     VALUES ('scheduled-message', 'stale', 'owner', 'echo stale', '2026-01-01T00:00:00.000Z', '/tmp/work', '{}', '2020-01-01T00:00:00Z', '2020-01-01T00:00:00Z')
   `).run();
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const row = db.prepare('SELECT command FROM crons WHERE cron_id = ?').get('scheduled-message');
     assert.match(row.command, /crtr node message send --to 'target'/, 'the re-run replaces the half-written row');
@@ -754,8 +762,8 @@ test('v22 recovers a db wedged by an interrupted pre-atomicity run', () => {
   `).run();
     raw.exec('DROP TABLE triggers');
     raw.close();
-    const db = openDb();
-    assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances rather than failing every open');
+    const db = openMigratedDb();
+    assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances rather than failing every explicit migration');
     assert.notEqual(db.prepare('SELECT 1 FROM crons WHERE cron_id = ?').get('half-written'), undefined);
 });
 // The generated cron scripts are the migration's real product, so the M4
@@ -784,6 +792,112 @@ function runMigratedScript(script, opts) {
     rmSync(dir, { recursive: true, force: true });
     return { code: result.status ?? -1, log: written };
 }
+function buildV39Db() {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    migrateToVersion(raw, 39);
+    return raw;
+}
+function resetV39Home() {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    return buildV39Db();
+}
+function writeLegacyPage(id, source, dialect = 'jsx') {
+    const dir = join(home, 'nodes', id);
+    mkdirSync(dir, { recursive: true });
+    const document = dialect === 'jsx'
+        ? 'export default function LegacyPage() { return <Page title="The gate is gone" subtitle="This page was sent with page_surface off — the refusal that used to block it no longer exists. Nothing to answer; it is here to prove delivery." placement="panel" />; }\n'
+        : '---\ntitle: The gate is gone\n---\nThis is the stored Markdown page.\n';
+    writeFileSync(join(dir, dialect === 'jsx' ? 'page.tsx' : 'page.md'), document);
+    writeFileSync(join(dir, 'page.json'), JSON.stringify({
+        schema: 'crtr.page/v1', dialect, title: 'The gate is gone',
+        subtitle: 'This page was sent with page_surface off — the refusal that used to block it no longer exists. Nothing to answer; it is here to prove delivery.',
+        placement: 'panel', document: dialect === 'jsx' ? 'page.tsx' : 'page.md', steps: 1, slots: [], source,
+    }));
+    return dir;
+}
+test('v40 imports pre-envelope v1 pages and still rejects invalid v2 delivery envelopes', () => {
+    const raw = buildV39Db();
+    const blocked = writeLegacyPage('page-bba481b2', {
+        sessionName: 'general', blockedSince: '2026-08-11T17:32:21.979Z', profileName: 'crouter', nodeId: '3zl47w7d-msowsany-ee8e2bba',
+    });
+    const emitted = writeLegacyPage('nfy-3b21bc8a', {
+        sessionName: 'notify', nodeId: '3zl47w7d-msmeye7h-cb3ff1da',
+    }, 'md');
+    const legacyBytes = readFileSync(join(blocked, 'page.json'));
+    migrate(raw);
+    for (const [dir, id, delivery] of [[blocked, 'page-bba481b2', { placement: 'panel', inbox: true, reply: true }], [emitted, 'nfy-3b21bc8a', { placement: 'panel', inbox: true, reply: false }]]) {
+        const stored = raw.prepare('SELECT presentation_dir, specification_json FROM human_requests WHERE request_id = ?').get(id);
+        const manifest = parsePage(stored.presentation_dir);
+        assert.deepEqual(manifest.delivery, delivery);
+        assert.deepEqual(parsePageDelivery(stored.presentation_dir), delivery);
+        assert.deepEqual(JSON.parse(stored.specification_json), manifest);
+    }
+    assert.deepEqual(readFileSync(join(blocked, 'page.json')), legacyBytes, 'the source manifest remains untouched');
+    raw.close();
+    const invalid = resetV39Home();
+    const valid = writeLegacyPage('valid-v1-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    const validBytes = readFileSync(join(valid, 'page.json'));
+    const dir = writeLegacyPage('broken-v2-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(dir, 'page.json'), JSON.stringify({ schema: 'crtr.page/v2', title: 'Broken', delivery: { placement: 'panel', inbox: true, reply: false, extra: true } }));
+    assert.throws(() => migrate(invalid), (error) => error instanceof Error && error.message.includes(join(dir, 'page.json')));
+    assert.equal(userVersion(invalid), 39, 'the failed migration rolls back');
+    assert.deepEqual(readFileSync(join(valid, 'page.json')), validBytes, 'a failed migration does not alter an earlier v1 input');
+    invalid.close();
+    const malformedV2 = resetV39Home();
+    const malformedV2Dir = writeLegacyPage('malformed-v2-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(malformedV2Dir, 'page.json'), JSON.stringify({ schema: 'crtr.page/v2', title: 'Broken', delivery: { placement: 'panel', inbox: true, reply: false } }));
+    assert.throws(() => migrate(malformedV2), (error) => error instanceof Error && error.message.includes(join(malformedV2Dir, 'page.json')));
+    malformedV2.close();
+    const malformedV1 = resetV39Home();
+    const malformedV1Dir = writeLegacyPage('malformed-v1-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(malformedV1Dir, 'page.json'), JSON.stringify({
+        schema: 'crtr.page/v1', dialect: 'jsx', title: 'Broken', placement: 'panel', document: 'page.tsx', steps: 1,
+        slots: [{ id: 'out-of-range', kind: 'options', step: 1, config: {} }], source: { blockedSince: '2026-08-11T17:32:21.979Z' },
+    }));
+    assert.throws(() => migrate(malformedV1), (error) => error instanceof Error && error.message.includes(join(malformedV1Dir, 'page.json')));
+    malformedV1.close();
+    const malformedMarkdown = resetV39Home();
+    const malformedMarkdownDir = writeLegacyPage('malformed-markdown-page', {}, 'md');
+    const malformedMarkdownManifest = JSON.parse(readFileSync(join(malformedMarkdownDir, 'page.json'), 'utf8'));
+    malformedMarkdownManifest.steps = 2;
+    writeFileSync(join(malformedMarkdownDir, 'page.json'), JSON.stringify(malformedMarkdownManifest));
+    assert.throws(() => migrate(malformedMarkdown), (error) => error instanceof Error && error.message.includes(join(malformedMarkdownDir, 'page.json')));
+    malformedMarkdown.close();
+});
+test('v40 skips recovery witnesses without identity while retaining failures for indexed nodes', () => {
+    const raw = buildV39Db();
+    const faultDir = join(home, 'nodes', 'orphan-fault', 'job');
+    const retryDir = join(home, 'nodes', 'orphan-retry', 'job');
+    mkdirSync(faultDir, { recursive: true });
+    mkdirSync(retryDir, { recursive: true });
+    writeFileSync(join(faultDir, 'fault'), JSON.stringify({
+        link: 'viewer↔broker', op: 'connect', kind: 'connection', message: 'ENOENT', since: '2026-09-10T00:00:00.000Z', operation_id: '11111111111111111111111111111111', retry: { disposition: 'fatal' },
+    }));
+    writeFileSync(join(retryDir, 'provider-retry'), JSON.stringify({
+        state: 'pending', sessionFile: '/tmp/orphan-retry.jsonl', anchorEntryId: null,
+        fault: { link: 'pi→provider', op: 'request', kind: 'connection', message: 'ECONNRESET', since: '2026-09-10T00:00:00.000Z', operation_id: '22222222222222222222222222222222', retry: { disposition: 'auto', by: 'daemon' } },
+    }));
+    const resident = join(home, 'nodes', 'metadata-node');
+    mkdirSync(join(resident, 'job'), { recursive: true });
+    writeFileSync(join(resident, 'meta.json'), JSON.stringify({
+        node_id: 'metadata-node', name: 'metadata-node', created: '2026-09-10T00:00:00.000Z', cwd: '/tmp', kind: 'developer', mode: 'base', lifecycle: 'terminal',
+    }));
+    writeFileSync(join(resident, 'job', 'busy'), '');
+    migrate(raw);
+    assert.notEqual(raw.prepare('SELECT 1 FROM nodes WHERE node_id = ?').get('metadata-node'), undefined);
+    assert.equal(raw.prepare('SELECT COUNT(*) AS count FROM executions WHERE node_id = ?').get('metadata-node').count, 1);
+    assert.equal(raw.prepare("SELECT 1 FROM nodes WHERE node_id IN ('orphan-fault', 'orphan-retry')").get(), undefined);
+    raw.close();
+    const invalid = resetV39Home();
+    insertNode(invalid, 'indexed-node');
+    const invalidPath = join(home, 'nodes', 'indexed-node', 'job', 'fault');
+    mkdirSync(dirname(invalidPath), { recursive: true });
+    writeFileSync(invalidPath, 'not json');
+    assert.throws(() => migrate(invalid), (error) => error instanceof Error && error.message.includes(invalidPath));
+    invalid.close();
+});
 test('a migrated predicate script delivers its exact body and self-cancels only when the action succeeds', () => {
     const raw = buildV21Db();
     insertLegacySchedule(raw, {
@@ -811,7 +925,7 @@ test('a migrated predicate script delivers its exact body and self-cancels only
         timeoutAt: '2026-01-04T00:00:00.000Z',
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     const script = (id) => db.prepare('SELECT command FROM crons WHERE cron_id = ?').get(id).command;
     const stored = script('conditional-message');
     const satisfied = runMigratedScript(stored, { gateReady: true });

package/dist/core/__tests__/model-pin-durability.test.js

@@ -20,9 +20,10 @@ import { join } from 'node:path';
 import { buildLaunchSpec, isProviderPinnedModelToken, normalizeModel } from '../runtime/launch.js';
 import { defaultModelLaddersConfig } from '../../types.js';
 import { persistDormantModel } from '../runtime/model-swap.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { promote, reshapeNode } from '../runtime/promote.js';
 import { createNode, getNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 const ladders = defaultModelLaddersConfig();
 // The concrete cell the `ultra` tier normalizes to — the byte-equal collision at
 // the heart of #328. A raw `ultra` token is UNpinned; this concrete cell is
@@ -36,9 +37,11 @@ before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-model-pin-durability-'));
     process.env['HOME'] = home; // buildLaunchSpec reads merged launch config here
     process.env['CRTR_HOME'] = home; // the canvas db lives here
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
 });
 beforeEach(() => {
     closeDb();
+    migrate(openDb());
 });
 after(() => {
     closeDb();