@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/canvas/attention.d.ts

@@ -3,13 +3,10 @@ export interface TicketEntry {
     name: string;
     cwd: string;
     count: number;
-    /** Open ticket titles for this node, newest first (scan order). */
+    /** Open ticket titles for this node, newest first. */
     subjects: string[];
 }
-/** Drop the cached walk. Callers that swap the canvas home out from under a live
- *  process (tests, and any in-process home switch) must call this: the cache is
- *  keyed only by time, so a stale window would otherwise serve the old home's
- *  counts. */
+/** Kept for callers that reset a canvas home in process. SQL has no directory-scan cache to invalidate. */
 export declare function invalidateTicketCounts(): void;
 /** Count pending tickets asked by one node. */
 export declare function countTickets(nodeId: string): number;

package/dist/core/canvas/attention.js

@@ -1,66 +1,22 @@
-// attention.ts — pending human-ticket counters across the canvas.
-//
-// Reply-bearing tickets carry an explicit bridge route. The bridge's parent is
-// the asking node; standalone pages have no bridge and do not contribute to a
-// node's pending-reply count.
-import { scanInbox } from '../human/scan.js';
-import { filterTerminalReviewTickets } from '../review/ticket-filter.js';
-import { readTicketReplyRoute } from '../human/convention.js';
+// Pending human-request counters across the canvas. The indexed request query is the authority; request directories are retained artifacts, never an inbox index.
+import { listOpenReplyBearingRequests } from '../human/requests.js';
 import { getNode, listNodes, view } from './canvas.js';
-function askingNodeId(ticketDir) {
-    const replyRoute = readTicketReplyRoute(ticketDir);
-    if (replyRoute === null)
-        return null;
-    const bridge = getNode(replyRoute.bridge_node_id);
-    if (bridge === null)
-        return null;
-    return bridge.parent ?? bridge.node_id;
-}
-/** `scanInbox` walks EVERY node dir under `<canvas>/nodes` (thousands on a large
- *  canvas, ~50ms) and returns the same map for every caller in a moment, yet the
- *  per-node/per-view count reads fan out — the canvas browser alone asks once per
- *  forest root (hundreds of calls per snapshot). Uncached, that serialized
- *  crtrd's single-threaded event loop behind minutes of identical disk walks and
- *  stalled the browse open. One walk per window serves the whole burst; a ticket
- *  raised or answered inside the window badges on the next one (the viewers that
- *  read this poll on a multi-second cadence). */
-const TICKET_COUNT_TTL_MS = 1000;
-let ticketCountCache = null;
-/** Drop the cached walk. Callers that swap the canvas home out from under a live
- *  process (tests, and any in-process home switch) must call this: the cache is
- *  keyed only by time, so a stale window would otherwise serve the old home's
- *  counts. */
-export function invalidateTicketCounts() {
-    ticketCountCache = null;
-}
+/** Kept for callers that reset a canvas home in process. SQL has no directory-scan cache to invalidate. */
+export function invalidateTicketCounts() { }
 function ticketSubjects() {
-    const now = Date.now();
-    if (ticketCountCache !== null && now - ticketCountCache.at < TICKET_COUNT_TTL_MS) {
-        return ticketCountCache.subjects;
-    }
     const subjects = new Map();
-    try {
-        for (const ticket of filterTerminalReviewTickets(scanInbox())) {
-            const nodeId = askingNodeId(ticket.dir);
-            if (nodeId === null)
-                continue;
-            const list = subjects.get(nodeId);
-            if (list === undefined)
-                subjects.set(nodeId, [ticket.title]);
-            else
-                list.push(ticket.title);
-        }
+    for (const request of listOpenReplyBearingRequests()) {
+        const nodeId = request.requester_node_id;
+        const list = subjects.get(nodeId);
+        if (list === undefined)
+            subjects.set(nodeId, [request.title]);
+        else
+            list.push(request.title);
     }
-    catch {
-        // An unavailable ticket store or absent root has no display consequence.
-    }
-    ticketCountCache = { at: Date.now(), subjects };
     return subjects;
 }
 /** Count pending tickets asked by one node. */
-export function countTickets(nodeId) {
-    return ticketSubjects().get(nodeId)?.length ?? 0;
-}
+export function countTickets(nodeId) { return ticketSubjects().get(nodeId)?.length ?? 0; }
 /** Pending tickets for every reachable asking node, including the root. */
 export function pendingTicketsForView(rootId) {
     const found = ticketSubjects();
@@ -68,19 +24,15 @@ export function pendingTicketsForView(rootId) {
     for (const id of [rootId, ...view(rootId)]) {
         const node = getNode(id);
         const subjects = found.get(id) ?? [];
-        if (node !== null && subjects.length > 0) {
+        if (node !== null && subjects.length > 0)
             entries.push({ node_id: id, name: node.name, cwd: node.cwd, count: subjects.length, subjects });
-        }
     }
     return entries;
 }
 /** Per-node pending ticket counts for an explicit node set. */
 export function ticketCountsForNodes(ids) {
     const found = ticketSubjects();
-    const counts = {};
-    for (const id of ids)
-        counts[id] = found.get(id)?.length ?? 0;
-    return counts;
+    return Object.fromEntries(ids.map((id) => [id, found.get(id)?.length ?? 0]));
 }
 /** Pending tickets across the entire canvas, attributed to asking nodes. */
 export function ticketsAcrossCanvas() {
@@ -88,9 +40,8 @@ export function ticketsAcrossCanvas() {
     const entries = [];
     for (const node of listNodes()) {
         const subjects = found.get(node.node_id) ?? [];
-        if (subjects.length > 0) {
+        if (subjects.length > 0)
             entries.push({ node_id: node.node_id, name: node.name, cwd: node.cwd, count: subjects.length, subjects });
-        }
     }
     return entries;
 }

package/dist/core/canvas/boot.d.ts

@@ -65,12 +65,11 @@ export interface BootReconcileResult {
  *  `current` defaults to the real identity; tests inject a synthetic one against
  *  an isolated CRTR_HOME to simulate a boot change without a real reboot. */
 export declare function reconcileBootLiveness(current?: BootIdentity): BootReconcileResult;
-/** The one-time legacy pid-identity migration, injected into the startup
- *  composition. In production this is `migrateLegacyPidIdentities` from
- *  canvas.ts; it is a parameter (not a direct import) because canvas.ts already
- *  depends on pid.ts which depends on this module — injecting it keeps the
- *  dependency one-directional and lets tests exercise this exact composition. */
-export type MigrateLegacyPidIdentities = (captureIdentity?: (pid: number) => string | undefined) => {
+/** The one-time execution-identity migration, injected into the startup
+ *  composition. In production this is `migrateLegacyExecutionIdentities` from
+ *  executions.ts. It remains injected so tests can exercise this composition
+ *  without reaching process inspection. */
+export type MigrateLegacyExecutionIdentities = (captureIdentity?: (pid: number) => string | undefined) => {
     migrated: string[];
 };
 export interface BootStartupResult {
@@ -90,4 +89,4 @@ export interface BootStartupResult {
  *
  *  `migrate` is injected (see `MigrateLegacyPidIdentities`); `current` and
  *  `captureIdentity` pass through to the two steps for test injection. */
-export declare function reconcileAndMigrateBoot(migrate: MigrateLegacyPidIdentities, current?: BootIdentity, captureIdentity?: (pid: number) => string | undefined): BootStartupResult;
+export declare function reconcileAndMigrateBoot(migrate: MigrateLegacyExecutionIdentities, current?: BootIdentity, captureIdentity?: (pid: number) => string | undefined): BootStartupResult;

package/dist/core/canvas/boot.js

@@ -146,18 +146,14 @@ export function reconcileBootLiveness(current = currentBootIdentity()) {
             return { changed: false, cleared: [], sameBootProven };
         }
         const rows = db
-            .prepare('SELECT node_id FROM nodes WHERE pi_pid IS NOT NULL')
+            .prepare("SELECT execution_id, node_id FROM executions WHERE state != 'exited'")
             .all();
-        // Clear the launch-time identity baseline
-        // alongside `pi_pid` — a boot resets the OS process table, so any recorded
-        // identity is as meaningless as the pid it was captured for; leaving it
-        // behind would let a coincidentally-reused pid on the NEW boot compare
-        // against a stale baseline from the OLD one.
-        const upd = db.prepare('UPDATE nodes SET pi_pid = NULL, pi_pid_identity = NULL WHERE node_id = ?');
+        const ended = db.prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'boot-change' WHERE execution_id = ? AND state != 'exited'");
         const cleared = [];
+        const at = new Date().toISOString();
         for (const row of rows) {
-            upd.run(row.node_id);
-            cleared.push(row.node_id);
+            if (ended.run(at, row.execution_id).changes > 0)
+                cleared.push(row.node_id);
         }
         writeBootMarker(db, current);
         db.exec('COMMIT');

package/dist/core/canvas/canvas.d.ts

@@ -1,8 +1,4 @@
-import type { NodeMeta, NodeIdentity, NodeRow, NodeStatus, ExitIntent, SubscriptionRef, Mode, Lifecycle, TerminalReason, NodeOutcomeKind } from './types.js';
-/** Seed a node's row at BIRTH: identity columns + runtime columns taken from the
- *  incoming meta (defaults: status='active', the rest null). The only writer
- *  that sets runtime columns alongside identity in one statement — afterwards
- *  the atomic setters are the sole runtime writers. */
+import type { ExitIntent, Lifecycle, Mode, NodeIdentity, NodeMemoryTarget, NodeMeta, NodeOutcomeKind, NodeRow, NodeStatus, SubscriptionRef, TerminalReason } from './types.js';
 export interface OutcomeDeliveryBinding {
     actionName: string;
     argv: string[];
@@ -10,13 +6,11 @@ export interface OutcomeDeliveryBinding {
     configOrigin: string;
     payload?: unknown;
 }
-/** Create a node: scaffold its dirs, persist identity to meta.json, and seed the
- *  row (identity + runtime from the incoming meta). Returns the hydrated view. */
+/** Create a SQL-authoritative node, then ensure its artifact directories exist. */
 export declare function createNode(meta: NodeMeta, opts?: {
     outcomeDelivery?: OutcomeDeliveryBinding;
 }): NodeMeta;
-/** The canonical node record: durable identity (meta.json) ∪ authoritative
- *  runtime (the row). Null if unknown. */
+/** The canonical node record, hydrated from SQL. Null if unknown. */
 export declare function getNode(nodeId: string): NodeMeta | null;
 export declare function canonicalSessionFile(sessionFile: string): string;
 /** Resolve the crouter node that owns one exact Pi session file. */
@@ -34,11 +28,9 @@ export declare function dueNodeDeadlines(nowIso: string): NodeRow[];
 export declare function setNodeDeadline(nodeId: string, deadlineAt: string | null): boolean;
 /** Shift active/idle profile deadlines by a completed profile pause duration. */
 export declare function shiftProfileNodeDeadlines(profileId: string, pauseDurationMs: number): number;
-/** Merge an IDENTITY patch into a node's meta.json and re-index its identity
- *  columns. Identity has a single writer per node, so this read-modify-write is
- *  safe (the contended runtime fields were moved out — see the atomic setters
- *  below). Returns the hydrated view (runtime included). */
-export declare function updateNode(nodeId: string, patch: Partial<NodeIdentity>): NodeMeta;
+type NodeUpdate = Partial<Omit<NodeIdentity, 'node_id' | 'pi_session_id' | 'pi_session_file' | 'managed_worktree'>>;
+/** Update node identity/configuration columns. Sessions and worktrees have named stores. */
+export declare function updateNode(nodeId: string, patch: NodeUpdate): NodeMeta;
 /** Set a node's status. Atomic single-column write. */
 export declare function setStatus(nodeId: string, status: NodeStatus): void;
 /** Set a node's exit intent. Atomic single-column write. */
@@ -88,25 +80,6 @@ export declare function setPresence(nodeId: string, presence: {
     window?: string | null;
     pane?: string | null;
 }): void;
-/** Record the live pi pid (daemon liveness signal) PLUS its launch-time
- *  identity fingerprint, in one atomic write:
- *  `capturePidIdentities([pid])` is a signal-0-adjacent `ps -p <pid>` probe
- *  taken RIGHT NOW, while `pid` is the process we just spawned/bound and
- *  therefore definitely still exists — this is the LAUNCH-time baseline
- *  `headlessBrokerHost.teardown()` later compares against before signaling
- *  anything. A failed probe (rare — `ps` itself misbehaving) or a probe that
- *  finds no row for `pid` (raced away in the instant between spawn and this
- *  call) both write `NULL`: no baseline recorded, so the teardown guard fails
- *  open exactly like a node booted before this column existed — never a false
- *  identity that could itself cause a false mismatch later. */
-export declare function recordPid(nodeId: string, pid: number): void;
-/** Clear the pi pid (window-backed relaunch, before the fresh pi re-records it)
- *  AND its recorded launch-time identity — the two are written together by
- *  `recordPid` and must be cleared together, or a subsequent relaunch that
- *  reuses the pid namespace could compare its own fresh pid against a STALE
- *  identity left over from the pid this row held before. */
-export declare function clearRecordedPid(nodeId: string): void;
-export declare const clearPid: typeof clearRecordedPid;
 export declare function recordLaunch(nodeId: string, at: string): void;
 export declare function recordSettledTurn(nodeId: string, at: string): void;
 export declare function setFrozen(nodeId: string, at: string): void;
@@ -115,51 +88,13 @@ export declare function recordRespawnAttempt(nodeId: string, attempt: {
     failures: number;
     notBefore: string | null;
 }): void;
-/** ONE-TIME completion of the boot-scoped-identity format migration, run once
- *  at daemon startup (the natural boot-reconciliation chokepoint, right after
- *  `reconcileBootLiveness`). It closes the gap the `identitiesMatch` legacy
- *  lane only TOLERATES: a broker that survives an in-place crouter upgrade
- *  keeps its old `lstart#ticks` row indefinitely (`recordPid` only fires on
- *  launch/revive/session_start), so the cross-boot ticks-collision exposure the
- *  boot-scoped base was added to close never provably shuts for those rows.
- *
- *  For every row whose RECORDED identity is legacy-format while this platform
- *  now composes new-format (a readable kernel boot_id):
- *   - if the recorded pid's CURRENT live identity matches the recorded one via
- *     the migration lane (same live process, `identitiesMatch` true) AND that
- *     current identity is itself boot-scoped — re-record it with the new
- *     composer, completing the migration in place;
- *   - otherwise (pid gone, probe failed, reused — no match, or no readable
- *     boot_id for it) — leave the row untouched for the normal liveness
- *     handling that already runs each tick.
- *
- *  After this runs once, the legacy compare lane only ever engages for
- *  genuinely no-boot_id platforms. NOT a per-caller reconciliation layer — a
- *  single startup sweep. `captureIdentity` is injectable for unit tests.
- *
- *  GATED on proven same-boot provenance by its caller (daemon startup runs it
- *  only when `reconcileBootLiveness` returned `sameBootProven` — see
- *  `bootProvenSame`). This is what makes a bare ticks match safe to bless as a
- *  current-boot identity: without that proof an equal-ticks collision with an
- *  unrelated process from a DIFFERENT boot could be rewritten as
- *  `<currentBootId>#<ticks>`, permanently baptizing a stranger.
- *
- *  Not transactional by design: it never HOLDS the write lock across the (slow,
- *  per-row) `ps` probe. Each re-record is a compare-and-swap single-row UPDATE
- *  constrained by ALL three snapshotted values (`node_id`, `pi_pid`,
- *  `pi_pid_identity`), counted only when a row actually changed. So if the old
- *  broker exits and a concurrent revive atomically records a fresh
- *  `(pi_pid, pi_pid_identity)` between this sweep's probe and its update, the
- *  CAS matches zero rows and the migration is skipped rather than clobbering
- *  the newer identity with the stale one. */
-export declare function migrateLegacyPidIdentities(captureIdentity?: (pid: number) => string | undefined): {
-    migrated: string[];
-};
 /** Every hydrated node whose durable profile identity equals `profileId`.
  *  Unlike `listNodes`, this includes unclaimed warm-pool spares: profile
  *  deletion owns every matching row, whether or not it is user-visible. */
 export declare function listNodesByProfile(profileId: string): NodeMeta[];
 /** All rows, optionally filtered by status and terminal execution traces. Unclaimed warm spares are excluded. */
+/** Every node's durable memory-resolution coordinates, including unclaimed warm-pool spares. */
+export declare function listNodeMemoryTargets(): NodeMemoryTarget[];
 export declare function listNodes(filter?: {
     status?: NodeStatus | NodeStatus[];
     withRecordedPid?: boolean;
@@ -211,8 +146,7 @@ export declare function isWarmSpare(nodeId: string): boolean;
  *  The claim also restamps the row's `created` to `created` — birth time is a
  *  spare's MINT time, and consumers sort conversations on it, so an hour-old
  *  spare must not sort as an hour-old conversation. This is the one sanctioned
- *  write of `created` after birth (`upsertRow` deliberately never touches it);
- *  the caller mirrors the same stamp into meta.json. */
+ *  write of `created` after birth. */
 export declare function claimWarmSpare(recipeKey: string, created: string, opts?: {
     deadlineAt?: string;
     outcomeDelivery?: OutcomeDeliveryBinding;
@@ -225,8 +159,8 @@ export declare function warmSpareCount(recipeKey: string): number;
 /** Direct children of `id`, oldest first — an indexed point query
  *  (`idx_nodes_parent`) instead of a full-table `listNodes()` scan. */
 export declare function childrenOf(id: string): string[];
-/** One lean roster row: only the `nodes` columns already native to the row
- *  (no meta.json read). Backs `GET /v1/canvas/roster` — the recurring attach /
+/** One lean roster row: only the `nodes` columns needed by the roster. Backs
+ *  `GET /v1/canvas/roster` — the recurring attach /
  *  browser topology poll, distinct from the enriched per-row
  *  `dashboardRowsAll`+`enrichRows` snapshot (`GET /v1/canvas/snapshot`). */
 export interface RosterRow {
@@ -242,7 +176,7 @@ export interface RosterRow {
     created: string;
 }
 /** Every node's lean roster row, oldest first — a single scan indexed by
- *  `idx_nodes_created`. No per-row `getNode`/meta.json read, no N+1. */
+ *  `idx_nodes_created`, with no per-row hydration or N+1 query. */
 export declare function rosterNodes(): RosterRow[];
 /** One `subscribes_to` edge, both endpoints — the roster's topology half. */
 export interface RosterEdge {
@@ -351,16 +285,6 @@ export declare function withFreshTerminalGuard<T>(nodeId: string, isTerminal: (r
     final_report: string | null;
     frozen_at: string | null;
 }) => boolean, body: () => T): TerminalGuardResult<T>;
-/** Rebuild node rows from on-disk metas (the db node table is a derived index).
- *  Only the IDENTITY columns are rebuilt — they are a projection of meta. The
- *  runtime columns (status/intent/pi_pid/window/tmux_session/pane) are NOT in meta
- *  and NOT re-derivable from it: they describe live process/presence state, so
- *  an existing row keeps them and a freshly re-created row takes the schema's
- *  quiescent defaults (status='active', the rest null). The daemon reconciles
- *  liveness from tmux reality, not from a stale file.
- *  Edges are left intact — subscribes_to is db-authoritative; spawned_by is
- *  re-derived from each meta's `spawned_by` (fallback: `parent` for legacy metas). */
-export declare function rebuildIndex(): void;
 /** A node selected for pruning (or that would be, under --dry-run). */
 export interface PrunedNode {
     node_id: string;
@@ -416,27 +340,6 @@ export declare function pruneNodes(opts: {
     dryRun?: boolean;
     includeStale?: boolean;
 }): PruneResult;
-/** Drop rows whose on-disk `nodes/<id>/` dir is gone — a node that no longer
- *  exists in the only place it is durably stored.
- *
- *  `createNode` scaffolds the dir and writes meta.json BEFORE seeding the row, and
- *  both delete paths ({@link deleteNode}, `deletePrunedNodes`) commit the row
- *  removal BEFORE removing the dir, so a row with no dir is never a transient of
- *  either — it is a node whose durable state was lost. Nothing about it is
- *  recoverable: `getNode` reads meta.json and returns null, so every surface that
- *  resolves a node (revive, focus, close, rename, message) rejects it as unknown
- *  while the roster keeps listing it. The row IS the residue, so deleting it is
- *  the whole repair; there is no dir left to remove.
- *
- *  Because `active`/`idle` ghosts are the ones that jam surfaces, status is not a
- *  filter here — count-based pruning protects those rows precisely so daemon
- *  crash-recovery can resume them, and that reason does not survive the dir being
- *  gone.
- *
- *  Refuses to act on "can't tell": an unreadable nodes root, or a readable one
- *  holding no node dirs at all while rows exist, reads as a detached or wiped
- *  store rather than per-node loss, and reaps nothing. Returns the reaped ids. */
-export declare function reapGhostRows(): string[];
 /** Count-based retention sweep: retain the `maxNodes` MOST-RECENTLY-ACTIVE
  *  nodes plus every row the collection authority retains, so the real retained
  *  floor is `max(maxNodes, retainedCount)`. Bounds the otherwise-unbounded growth
@@ -454,3 +357,4 @@ export declare function pruneToLimit(opts: {
     maxNodes: number;
     dryRun?: boolean;
 }): PruneResult;
+export {};