@north-light/crouter 0.3.312 → 0.3.313

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/integration/provider-rotation.test.ts

@@ -1,11 +1,13 @@
 import { before, after, test } from "node:test";
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { LockedJsonFile } from "../../../../../core/locked-file.ts";
+import { initializeFreshScopedStore } from "../../../../../core/scoped-state/migrate.ts";
+import { writeRawConfig } from "../../../../../core/config.ts";
 import { expandModelCandidates } from "../../../../../core/model-routes.ts";
 import type { SubscriptionCredential } from "../../../lib/subscription-state.ts";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { tmpdir } from "node:os";
 
 // Child processes reach crouter's locked-file primitive by absolute URL: they run under
@@ -24,44 +26,32 @@ const previousModelIntent = process.env.CRTR_MODEL_INTENT;
 const previousNodeCwd = process.env.CRTR_NODE_CWD;
 
 function writeLadderConfig() {
-  const configPath = join(nodeCwd, ".crouter", "config.json");
-  mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(
-    configPath,
-    `${JSON.stringify(
-      {
-        modelLadders: {
-          anthropic: {
-            ultra: "anthropic/claude-fable-5:high",
-            strong: "anthropic/claude-opus-4-8:high",
-            medium: "anthropic/claude-sonnet-4-6:high",
-            light: "anthropic/custom-light-x",
-          },
-          openai: {
-            ultra: "openai-codex/gpt-5.6-sol:max",
-            strong: "openai-codex/gpt-5.6-sol:high",
-            medium: "openai-codex/gpt-5.6-terra:medium",
-            light: "openai-codex/gpt-5.6-luna:low",
-          },
-        },
+  writeRawConfig("user", {
+    modelLadders: {
+      anthropic: {
+        ultra: "anthropic/claude-fable-5:high",
+        strong: "anthropic/claude-opus-4-8:high",
+        medium: "anthropic/claude-sonnet-4-6:high",
+        light: "anthropic/custom-light-x",
       },
-      null,
-      2,
-    )}\n`,
-    "utf8",
-  );
+      openai: {
+        ultra: "openai-codex/gpt-5.6-sol:max",
+        strong: "openai-codex/gpt-5.6-sol:high",
+        medium: "openai-codex/gpt-5.6-terra:medium",
+        light: "openai-codex/gpt-5.6-luna:low",
+      },
+    },
+  });
 }
 
 function writeSameModelRouteConfig() {
-  const configPath = join(nodeCwd, ".crouter", "config.json");
-  mkdirSync(dirname(configPath), { recursive: true });
-  writeFileSync(configPath, `${JSON.stringify({
+  writeRawConfig("user", {
     modelRoutes: {
-      primary: { family: "openai", credentialSource: "primary", providerId: "openai-codex", models: { strong: "openai-codex/gpt-5.6-sol:high" } },
-      alternate: { family: "openai", credentialSource: "alternate", providerId: "anthropic", models: { strong: "anthropic/gpt-5.6-sol:high" } },
+      primary: { family: "openai", credentialSource: "primary", providerId: "openai-codex", models: { ultra: "openai-codex/gpt-5.6-sol:high", strong: "openai-codex/gpt-5.6-sol:high", medium: "openai-codex/gpt-5.6-sol:high", light: "openai-codex/gpt-5.6-sol:high" } },
+      alternate: { family: "openai", credentialSource: "alternate", providerId: "anthropic", models: { ultra: "anthropic/gpt-5.6-sol:high", strong: "anthropic/gpt-5.6-sol:high", medium: "anthropic/gpt-5.6-sol:high", light: "anthropic/gpt-5.6-sol:high" } },
     },
     modelRouting: { credentialSourceOrder: ["primary", "alternate"], familyOrder: ["openai"] },
-  }, null, 2)}\n`, "utf8");
+  });
 }
 
 function credential(label: string, overrides: Partial<SubscriptionCredential> = {}): SubscriptionCredential {
@@ -121,6 +111,8 @@ before(async () => {
   process.env.HOME = home;
   process.env.PI_CODING_AGENT_DIR = join(home, ".pi", "agent");
   process.env.CRTR_NODE_CWD = nodeCwd;
+  initializeFreshScopedStore({ kind: "user", root: join(home, ".crouter") });
+  initializeFreshScopedStore({ kind: "provider", root: process.env.PI_CODING_AGENT_DIR });
   helpers = await import("../../../lib/subscription-state.ts");
   providerManagement = await import("../../../../../core/provider-management.ts");
   rotationModule = await import("../../provider-rotation.ts");
@@ -363,7 +355,7 @@ test("the synthesized ladder registry preserves family preference before configu
     family: "anthropic",
     strength: "strong",
     spec: "anthropic/claude-opus-4-8:high",
-  }, home, null);
+  }, nodeCwd, null);
 
   assert.deepEqual(candidates.map((candidate) => `${candidate.family}/${candidate.strength}`), [
     "anthropic/strong", "openai/strong", "anthropic/medium", "openai/medium",
@@ -473,7 +465,7 @@ test("a stale success cannot reopen a slot cooled down by a newer 429", async ()
 test("pool mutations take the cross-process pool-file lock", async () => {
   await resetRotationState();
   await helpers.writeSubscriptionPool("openai-codex", [credential("work")]);
-  const poolFile = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+  const poolFile = join(home, ".pi", "agent", "openai-codex-credentials.json");
 
   const lockHolder = spawn(
     process.execPath,
@@ -531,14 +523,8 @@ await backend.withLockAsync(async () => {
         readyTimer = setTimeout(() => reject(new Error("lock-holder did not signal readiness within 60s")), 60_000);
       }),
     ]);
-    const mutation = helpers.markSubscriptionAttempt("openai-codex", "work", 123);
-    // Let the async acquirer observe the held cross-process lock before releasing it. The
-    // single asynchronous lock path waits without blocking the event loop, then commits once
-    // the holder releases.
-    await new Promise((resolve) => setTimeout(resolve, 300));
-    lockHolder.stdin!.write("release\n");
-    lockHolder.stdin!.end();
-    const pool = await mutation;
+    // Health is SQL-only, so the credential-file lock cannot delay it.
+    const pool = await within(helpers.markSubscriptionAttempt("openai-codex", "work", 123), 1_000, "health write waited on the credential-file lock");
     assert.equal(pool[0].lastAttemptAt, 123);
   } finally {
     if (readyTimer) clearTimeout(readyTimer);
@@ -806,6 +792,7 @@ function makeRotationCtx(modelIntent?: string) {
   const ctx = {
     model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
     thinkingLevel: "high",
+    cwd: nodeCwd,
     ui: { setStatus() {} },
     modelRegistry: {
       find(provider: string, id: string) {
@@ -1376,7 +1363,7 @@ test("self-terminates after consecutive transport-only exhausted passes; an HTTP
   const terminateCalls: string[] = [];
   let resolveTerminated: (tried: string) => void;
   const terminated = new Promise<string>((resolve) => { resolveTerminated = resolve; });
-  rotationModule.__setTerminatePoisonedProcessForTest((tried) => {
+  rotationModule.__setTerminatePoisonedProcessForTest(async (tried) => {
     terminateCalls.push(tried);
     resolveTerminated(tried);
     return true;
@@ -1837,13 +1824,14 @@ test("emits an actionable 'not authenticated' error without switching models whe
   assert.match(emitted[0].error.errorMessage, /All provider routes exhausted \(tried openai\)/);
 });
 
-// The builtin ladder is available even with no ~/.crouter/config.json, so a config-less
-// user can still resolve cross-provider fallbacks.
+// The builtin ladder is available with no user configuration, so a config-less user can still
+// resolve cross-provider fallbacks.
 test("degrades gracefully via the builtin ladder when a config-less user has no cross-provider credentials", async () => {
   await resetRotationState();
-  rmSync(join(nodeCwd, ".crouter", "config.json"), { force: true });
+  writeRawConfig("user", {});
 
   const ctx = {
+    cwd: nodeCwd,
     model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
     ui: { setStatus() {} },
     modelRegistry: {

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.d.ts

@@ -21,7 +21,7 @@ declare function defaultSleep(ms: number): Promise<void>;
 /** Test-only seam: override the sleep implementation used for in-place/wait-out retries. Pass undefined to restore the default. */
 export declare function __setSleepForTest(fn: typeof defaultSleep | undefined): void;
 export declare const POISONED_TRANSPORT_PASS_LIMIT = 2;
-declare function defaultTerminatePoisonedProcess(tried: string): boolean;
+declare function defaultTerminatePoisonedProcess(tried: string): Promise<boolean>;
 /** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
 export declare function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void;
 /** Test-only seam for the bounded, non-fatal subscription bookkeeping path. */

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.js

@@ -6,7 +6,7 @@ import { readMergedLaunchConfig } from '../../../core/config.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
 import { envModelExact, envNodeId } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
-import { recordTransportPoisonVerdict } from '../../../core/runtime/busy.js';
+import { recordBrokerTurn } from '../../../core/runtime/broker/daemon-ops.js';
 import { recognizeProviderError } from '../../../core/provider-error-recognition.js';
 import { normalizeProviderFailure, providerFailureDiagnostic } from '../../../core/provider-failure.js';
 // A response without Retry-After proves only that THIS attempt was throttled; it
@@ -110,7 +110,7 @@ export function __setSleepForTest(fn) {
 // offline box parks the node until the network returns instead of spending its
 // respawn budget (daemon/fleet.ts, `deferRespawnWhileOffline`).
 export const POISONED_TRANSPORT_PASS_LIMIT = 2;
-function defaultTerminatePoisonedProcess(tried) {
+async function defaultTerminatePoisonedProcess(tried) {
     // Only the broker process itself may self-terminate: runBroker stamps
     // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
     // keeps the ordinary terminal-error path.
@@ -118,9 +118,16 @@ function defaultTerminatePoisonedProcess(tried) {
         return false;
     const routes = tried.split(', ').filter((route) => route !== '');
     const nodeId = envNodeId();
-    if (nodeId !== undefined && routes.length > 0) {
-        recordTransportPoisonVerdict(nodeId, { consecutivePasses: POISONED_TRANSPORT_PASS_LIMIT, routes });
+    if (nodeId === undefined || routes.length === 0) {
+        throw new Error('poisoned broker is missing CRTR_NODE_ID or attempted routes');
     }
+    await recordBrokerTurn(nodeId, {
+        event: 'exit-diagnostic',
+        exit_diagnostic: {
+            schema: 'crtr.execution-exit-diagnostic/v1',
+            transport_poison: { consecutive_passes: POISONED_TRANSPORT_PASS_LIMIT, routes },
+        },
+    });
     logRotation(`process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`);
     process.kill(process.pid, "SIGTERM");
     return true;
@@ -705,7 +712,7 @@ async function runManagedProvider(state, model, context, options, stream) {
     const tried = [...attemptedRoutes].join(', ');
     if (lastTransientFailure !== undefined) {
         state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
-        if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+        if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && await activeTerminatePoisonedProcess(tried)) {
             // The stream is deliberately left OPEN: the SIGTERM handler sees a live
             // turn, so it either certifies a clean abort (→ the daemon respawns and
             // resumes with a continuation prompt) or marks the turn dirty (→ the

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -42,7 +42,7 @@ import type { ProviderOptionsConfig } from '../../../types.js';
 import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../../../core/model-routes.js';
 import { envModelExact, envNodeId } from '../../../shared/env.js';
 import { ManagedProviderCoolingError } from '../../../core/runtime/managed-provider-cooling.js';
-import { recordTransportPoisonVerdict } from '../../../core/runtime/busy.js';
+import { recordBrokerTurn } from '../../../core/runtime/broker/daemon-ops.js';
 import { recognizeProviderError, type ProviderErrorSignal } from '../../../core/provider-error-recognition.js';
 import { normalizeProviderFailure, providerFailureDiagnostic, type NormalizedProviderFailure } from '../../../core/provider-failure.js';
 
@@ -213,16 +213,23 @@ export function __setSleepForTest(fn: typeof defaultSleep | undefined): void {
 // respawn budget (daemon/fleet.ts, `deferRespawnWhileOffline`).
 export const POISONED_TRANSPORT_PASS_LIMIT = 2;
 
-function defaultTerminatePoisonedProcess(tried: string): boolean {
+async function defaultTerminatePoisonedProcess(tried: string): Promise<boolean> {
   // Only the broker process itself may self-terminate: runBroker stamps
   // CRTR_BROKER_PID with its own pid at boot. Any other host (tests, tooling)
   // keeps the ordinary terminal-error path.
   if (process.env["CRTR_BROKER_PID"] !== String(process.pid)) return false;
   const routes = tried.split(', ').filter((route) => route !== '');
   const nodeId = envNodeId();
-  if (nodeId !== undefined && routes.length > 0) {
-    recordTransportPoisonVerdict(nodeId, { consecutivePasses: POISONED_TRANSPORT_PASS_LIMIT, routes });
+  if (nodeId === undefined || routes.length === 0) {
+    throw new Error('poisoned broker is missing CRTR_NODE_ID or attempted routes');
   }
+  await recordBrokerTurn(nodeId, {
+    event: 'exit-diagnostic',
+    exit_diagnostic: {
+      schema: 'crtr.execution-exit-diagnostic/v1',
+      transport_poison: { consecutive_passes: POISONED_TRANSPORT_PASS_LIMIT, routes },
+    },
+  });
   logRotation(
     `process transport poisoned: ${POISONED_TRANSPORT_PASS_LIMIT} consecutive route-queue passes failed with no HTTP response (tried ${tried}); exiting so the daemon respawns this broker fresh`,
   );
@@ -892,7 +899,7 @@ async function runManagedProvider(
   const tried = [...attemptedRoutes].join(', ');
   if (lastTransientFailure !== undefined) {
     state.transportOnlyExhaustedPasses = sawHttpEvidence ? 0 : state.transportOnlyExhaustedPasses + 1;
-    if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && activeTerminatePoisonedProcess(tried)) {
+    if (state.transportOnlyExhaustedPasses >= POISONED_TRANSPORT_PASS_LIMIT && await activeTerminatePoisonedProcess(tried)) {
       // The stream is deliberately left OPEN: the SIGTERM handler sees a live
       // turn, so it either certifies a clean abort (→ the daemon respawns and
       // resumes with a continuation prompt) or marks the turn dirty (→ the

package/dist/cli.js

@@ -3,12 +3,13 @@ import './suppress-experimental-warnings.js';
 import { openSync } from 'node:fs';
 import { enableCompileCache } from 'node:module';
 import { fileURLToPath } from 'node:url';
-import { resolveRoot } from './build-root.js';
+import { isDaemonControlInvocation, resolveDaemonControlRoot, resolveRoot } from './build-root.js';
 import { maybeBootRoot } from './core/runtime/front-door.js';
 import { maybeAutoUpdate } from './core/auto-update.js';
 import { ensureProjectScope } from './core/bootstrap.js';
 import { provisionExports, pruneLegacyExports } from './core/host-exports/export.js';
 import { revalidateBundlePlugins } from './core/command-plugins/revalidate.js';
+import { runCli } from './core/command.js';
 import { dispatchWithStaleRecovery } from './core/manifest-recovery.js';
 import { installStdoutErrorPolicy } from './core/stdout-errors.js';
 import { handle } from './core/io.js';
@@ -47,6 +48,14 @@ async function main() {
         // bootRoot exec'd pi inline and exited; unreachable.
     }
     mark('cli.front_door_passed');
+    // Daemon control must remain callable immediately after an upgrade: its
+    // selected successor performs the user/provider store conversion, so this
+    // dispatch cannot first read scoped settings, installed plugins, or hooks.
+    // The compact tree reuses the daemon definitions and the normal dispatcher.
+    if (isDaemonControlInvocation(process.argv)) {
+        await runCli(await resolveDaemonControlRoot(), process.argv);
+        return;
+    }
     // Bring installed bundle plugins back in step with their endpoints before the
     // tree is built, so a package this pass replaces is the one this invocation
     // dispatches against. TTL-gated and non-fatal — see revalidate.ts.

package/dist/clients/__tests__/helpers/human-daemon.d.ts

@@ -0,0 +1,11 @@
+export interface HumanDaemon {
+    /** The isolated canvas home, and the value of both `CRTR_HOME` and `HOME`. */
+    home: string;
+    /** A scratch directory for the page sources a fixture authors. */
+    sources: string;
+    dispose(): Promise<void>;
+}
+/** Bind the human routes on an isolated home's socket. Every environment
+ *  change is undone by `dispose`, so a fixture can run beside the developer's
+ *  own canvas without touching it. */
+export declare function startHumanDaemon(prefix: string): Promise<HumanDaemon>;

package/dist/clients/__tests__/helpers/human-daemon.js

@@ -0,0 +1,60 @@
+// A crtrd the human client surfaces can actually talk to.
+//
+// The inbox and the attach viewer now read every page and request over the
+// daemon's human routes, so a fixture that exercises them needs a daemon on the
+// socket `cliClient()` resolves. It gets the REAL route tables rather than a
+// re-implementation: the projections under test are the daemon's, and a second
+// copy of them in a fixture would pass while the shipped ones drifted.
+//
+// The routes read an on-disk canvas, so the helper also stands up an isolated
+// home with the canvas schema and the scope store crtrd installs at startup —
+// opening a page resolves its components from scope settings rooted at HOME.
+import { createServer } from 'node:http';
+import { mkdtempSync, realpathSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { migrate, openDb } from '#core/canvas/db';
+import { resetScopeCache } from '#core/scope';
+import { initializeFreshScopedStore } from '#core/scoped-state/migrate';
+import { Router } from '#daemon/api/router';
+import { humanRequestRoutes } from '#daemon/api/handlers/human-requests';
+import { inboxRoutes } from '#daemon/api/handlers/inbox';
+/** Bind the human routes on an isolated home's socket. Every environment
+ *  change is undone by `dispose`, so a fixture can run beside the developer's
+ *  own canvas without touching it. */
+export async function startHumanDaemon(prefix) {
+    // Canonical, because a request row stores its directory as given while every
+    // read path resolves one first: a home behind a symlink (every macOS tmpdir)
+    // would make the two disagree.
+    const home = realpathSync(mkdtempSync(join(tmpdir(), `${prefix}-`)));
+    const sources = mkdtempSync(join(tmpdir(), `${prefix}-src-`));
+    const previousHome = process.env['HOME'];
+    const previousCrtrHome = process.env['CRTR_HOME'];
+    process.env['HOME'] = home;
+    process.env['CRTR_HOME'] = home;
+    resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
+    const router = new Router().registerAll(inboxRoutes).registerAll(humanRequestRoutes);
+    const server = createServer((req, res) => { void router.handle(req, res); });
+    await new Promise((resolve) => server.listen(join(home, 'crtrd.sock'), resolve));
+    return {
+        home,
+        sources,
+        async dispose() {
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+            rmSync(home, { recursive: true, force: true });
+            rmSync(sources, { recursive: true, force: true });
+            if (previousCrtrHome === undefined)
+                delete process.env['CRTR_HOME'];
+            else
+                process.env['CRTR_HOME'] = previousCrtrHome;
+            if (previousHome === undefined)
+                delete process.env['HOME'];
+            else
+                process.env['HOME'] = previousHome;
+            resetScopeCache();
+        },
+    };
+}

package/dist/clients/attach/chrome/canvas-panels.js

@@ -151,7 +151,7 @@ export async function buildCanvasPanelLines(nodeId, asks, palette, source, crons
         const kind = faint(nameCell(n?.kind ?? '', KIND_W));
         const tokens = muted(padStartVisible(tokensCell(id, remote), TOK_W));
         const badges = `${cycleBadge(n)}${await childBadgeFor(n)}${liveBelowBadgeFor(n)}${askBadge(id, asks)}${activityCell(id, n, remote)}`;
-        const line = ` ${direction} ${nodeGlyph(n, remote)} ${name}  ${kind} ${tokens}${badges}`;
+        const line = ` ${direction} ${nodeGlyph(n)} ${name}  ${kind} ${tokens}${badges}`;
         return truncate(line);
     };
     const reportIds = [...(mgr !== undefined ? [mgr] : []), ...live];

package/dist/clients/attach/chrome/inbox-strip.d.ts

@@ -1,5 +1,5 @@
 import { Container } from '@earendil-works/pi-tui';
-import type { TicketSummary } from '../../../core/human/types.js';
+import { type InboxRow } from '../../inbox/dto-adapt.js';
 import type { AttachSession } from '../session/context.js';
 export type StripSession = Pick<AttachSession, 'nodeId' | 'remote' | 'canvasSource' | 'tui' | 'pal'>;
 export interface InboxStripHooks {
@@ -8,7 +8,7 @@ export interface InboxStripHooks {
     /** Drop the below-editor roster's highlight — the two lists are mutually exclusive. */
     exitRoster: () => void;
     /** Open this ticket — the inline ticket panel, or its fallbacks. */
-    openTicket: (ticket: TicketSummary) => void;
+    openTicket: (ticket: InboxRow) => void;
     /** True while the ticket panel is open — it IS the expanded notification,
      *  so the strip's own rows hide rather than duplicate the flag. */
     suppressed: () => boolean;
@@ -26,6 +26,6 @@ export interface InboxStrip {
     /** True while the strip holds the highlight. */
     active(): boolean;
     /** The cached pending tickets, for the inbox surface's scan merge. */
-    pendingTickets(): TicketSummary[];
+    pendingTickets(): InboxRow[];
 }
 export declare function createInboxStrip(s: StripSession, hooks: InboxStripHooks): InboxStrip;

package/dist/clients/attach/chrome/inbox-strip.js

@@ -13,7 +13,8 @@
 // child ticket is present in the surface it seats.
 import { Container, Text, decodeKittyPrintable, matchesKey } from '@earendil-works/pi-tui';
 import { DynamicBorder } from '@earendil-works/pi-coding-agent';
-import { scanInbox, scanPageHistory } from '../../../core/human/scan.js';
+import { byNewestFirst, inboxRowFromDTO } from '../../inbox/dto-adapt.js';
+import { cliClient } from '../../../commands/api-client.js';
 import { fillBar, fillWidth, navLabel, stripSgr, truncate, REVERSE, YELLOW, RESET } from '../../../core/canvas/nav-render.js';
 /** Ticket rows shown at once; the window follows the selection. */
 const MAX_ROWS = 3;
@@ -91,14 +92,21 @@ export function createInboxStrip(s, hooks) {
         // Same pending merge the inbox surface does — inbox-projected tickets plus
         // reply-bearing no-inbox pages — but for every subtree node, then scoped to
         // tickets whose origin is in the subtree.
-        // ONE page-history walk for the whole subtree, filtered by origin here.
-        // Calling `scanPageHistory(id)` per node re-walked every ticket directory
-        // once per subtree node — the same O(all tickets) scan repeated N times for
-        // a result that is just the union over subtree origins.
+        // ONE home-wide page-history read for the whole subtree, filtered by origin
+        // here. Asking the daemon per node would repeat the same O(all tickets)
+        // projection N times for a result that is just the union over subtree
+        // origins.
+        const client = cliClient();
+        const [inbox, history] = await Promise.all([client.listHumanInbox(), client.getInboxHistory()]);
         const merged = new Map();
-        for (const item of scanInbox())
-            merged.set(item.dir, item);
-        for (const page of scanPageHistory()) {
+        for (const item of inbox.tickets) {
+            const row = inboxRowFromDTO(item);
+            merged.set(row.dir, row);
+        }
+        for (const item of history.tickets) {
+            const page = inboxRowFromDTO(item);
+            if (page.kind !== 'page')
+                continue;
             if (page.source.nodeId === undefined || !nodes.has(page.source.nodeId))
                 continue;
             if (page.state !== 'pending' || !page.awaitsResponse || page.inbox)
@@ -108,7 +116,7 @@ export function createInboxStrip(s, hooks) {
         }
         tickets = [...merged.values()]
             .filter((t) => t.source.nodeId !== undefined && nodes.has(t.source.nodeId))
-            .sort((a, b) => ticketTime(b).localeCompare(ticketTime(a)) || a.id.localeCompare(b.id));
+            .sort(byNewestFirst);
         // The selected row may have vanished (answered, canceled) — drop back to
         // the editor so no ghost highlight lingers.
         if (selDir !== undefined && !tickets.some((t) => t.dir === selDir))

package/dist/clients/attach/chrome/ticket-panel.d.ts

@@ -1,5 +1,5 @@
 import type { Component } from '@earendil-works/pi-tui';
-import type { TicketSummary } from '../../../core/human/types.js';
+import type { InboxRow } from '../../inbox/dto-adapt.js';
 import type { AttachSession } from '../session/context.js';
 export type PanelSession = Pick<AttachSession, 'tui' | 'pal'>;
 export interface TicketPanelHooks {
@@ -17,7 +17,7 @@ export interface TicketPanel {
     /** Mounted once into the frame's `ticketPanel` slot; empty while closed. */
     readonly component: Component;
     /** Open a ticket's page inline; review/unreadable tickets fall back. */
-    open(ticket: TicketSummary): void;
+    open(ticket: InboxRow): Promise<void>;
     /** Panel key routing — consumes EVERY chunk while open. */
     handleKey(data: string): boolean;
     close(): void;