@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/canvas/worktrees.js

@@ -0,0 +1,93 @@
+import { openDb, withCanvasWrite } from './db.js';
+function json(value) {
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined)
+        throw new TypeError('worktree value must be JSON-serializable');
+    return encoded;
+}
+function parse(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    return JSON.parse(value);
+}
+export function readWorktree(nodeId) {
+    const row = openDb().prepare('SELECT * FROM worktrees WHERE node_id = ?').get(nodeId);
+    if (row === undefined)
+        return null;
+    const sweepObserved = parse(row['sweep_observed_json']);
+    const attempts = row['attempts'];
+    const sweep = sweepObserved === undefined ? undefined : {
+        reason: row['sweep_reason'],
+        ...(row['sweep_detail'] === null ? {} : { detail: row['sweep_detail'] }),
+        observed: sweepObserved,
+        attempts,
+        last_attempt: row['sweep_last_at'],
+        next_attempt: row['next_attempt_at'],
+        ...(row['quarantined'] === 1 ? { quarantined: true } : {}),
+    };
+    return {
+        state: row['state'],
+        ...(row['cleanup_state'] === null ? {} : { cleanup: row['cleanup_state'] }),
+        path: row['path'],
+        branch: row['branch'],
+        repo_root: row['repo_root'],
+        base_ref: row['base_ref'],
+        base_sha: row['base_sha'],
+        created: row['created_at'],
+        ...(row['closed_at'] === null ? {} : { closed: row['closed_at'] }),
+        ...(parse(row['abandoned_json']) === undefined ? {} : { abandoned: parse(row['abandoned_json']) }),
+        ...(parse(row['land_intent_json']) === undefined ? {} : { land_intent: parse(row['land_intent_json']) }),
+        ...(sweep === undefined ? {} : { sweep }),
+        ...(parse(row['disposal_json']) === undefined ? {} : { disposal: parse(row['disposal_json']) }),
+    };
+}
+export function openWorktree(nodeId, worktree, db = openDb()) {
+    db.prepare(`INSERT INTO worktrees (node_id, state, cleanup_state, path, branch, repo_root, base_ref, base_sha, created_at, closed_at, next_attempt_at, attempts, quarantined, sweep_reason, sweep_detail, sweep_last_at, sweep_observed_json, abandoned_json, land_intent_json, disposal_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL)`).run(nodeId, worktree.state, worktree.cleanup ?? null, worktree.path, worktree.branch, worktree.repo_root, worktree.base_ref, worktree.base_sha, worktree.created, worktree.closed ?? null);
+}
+export function closeWorktree(nodeId, input) {
+    openDb().prepare("UPDATE worktrees SET state = 'closed', cleanup_state = ?, closed_at = ?, land_intent_json = NULL, sweep_reason = NULL, sweep_detail = NULL, sweep_last_at = NULL, sweep_observed_json = NULL, next_attempt_at = NULL, attempts = 0, quarantined = 0 WHERE node_id = ?").run(input.cleanup, input.closedAt, nodeId);
+}
+/** Complete a worktree close and repoint the node in the same SQL transaction.
+ * A close invalidates the active transcript because Pi remains in the old
+ * checkout; the next launch starts from the durable base checkout. */
+export function closeWorktreeAndRepoint(nodeId, input) {
+    withCanvasWrite((db) => {
+        db.prepare('UPDATE nodes SET cwd = ? WHERE node_id = ?').run(input.cwd, nodeId);
+        if (input.unbindSession)
+            db.prepare('UPDATE sessions SET unbound_at = ? WHERE node_id = ? AND unbound_at IS NULL').run(input.closedAt, nodeId);
+        db.prepare("UPDATE worktrees SET state = 'closed', cleanup_state = ?, closed_at = ?, land_intent_json = NULL, sweep_reason = NULL, sweep_detail = NULL, sweep_last_at = NULL, sweep_observed_json = NULL, next_attempt_at = NULL, attempts = 0, quarantined = 0 WHERE node_id = ?").run(input.cleanup, input.closedAt, nodeId);
+    });
+}
+export function abandonWorktree(nodeId, abandoned) {
+    openDb().prepare("UPDATE worktrees SET state = 'abandoned', abandoned_json = ? WHERE node_id = ? AND abandoned_json IS NULL").run(json(abandoned), nodeId);
+}
+export function abandonWorktreeAndRepoint(nodeId, input) {
+    withCanvasWrite((db) => {
+        db.prepare('UPDATE nodes SET cwd = ? WHERE node_id = ?').run(input.cwd, nodeId);
+        db.prepare("UPDATE worktrees SET state = 'abandoned', abandoned_json = ? WHERE node_id = ? AND abandoned_json IS NULL").run(json(input.abandoned), nodeId);
+    });
+}
+export function recordLandIntent(nodeId, intent) {
+    openDb().prepare('UPDATE worktrees SET land_intent_json = ? WHERE node_id = ? AND land_intent_json IS NULL').run(json(intent), nodeId);
+}
+export function recordDisposalGrant(nodeId, disposal) {
+    openDb().prepare('UPDATE worktrees SET disposal_json = ? WHERE node_id = ? AND disposal_json IS NULL').run(json(disposal), nodeId);
+}
+export function recordSweepAttempt(nodeId, input) {
+    openDb().prepare('UPDATE worktrees SET sweep_reason = ?, sweep_detail = ?, sweep_observed_json = ?, attempts = ?, sweep_last_at = ?, next_attempt_at = ?, quarantined = ? WHERE node_id = ?').run(input.reason, input.detail ?? null, json(input.observed), input.attempts, input.lastAttemptAt, input.nextAttemptAt, input.quarantined ? 1 : 0, nodeId);
+}
+export function completeCleanup(nodeId) {
+    openDb().prepare("UPDATE worktrees SET state = 'closed', cleanup_state = 'complete', sweep_reason = NULL, sweep_detail = NULL, sweep_last_at = NULL, sweep_observed_json = NULL, next_attempt_at = NULL, attempts = 0, quarantined = 0 WHERE node_id = ?").run(nodeId);
+}
+export function hasUnreconciledWorktree(nodeId) {
+    return openDb().prepare("SELECT 1 FROM worktrees WHERE node_id = ? AND state != 'abandoned' AND (state = 'open' OR cleanup_state IS NULL OR cleanup_state != 'complete')").get(nodeId) !== undefined;
+}
+export function sweepCandidates(now) {
+    return openDb().prepare(`SELECT w.node_id FROM worktrees w JOIN nodes n ON n.node_id = w.node_id WHERE n.status IN ('done', 'dead', 'canceled') AND n.frozen_at IS NULL AND w.state IN ('open', 'closed') AND (w.state = 'open' OR w.cleanup_state IS NULL OR w.cleanup_state != 'complete') AND (w.state = 'closed' OR (n.status = 'done' AND n.final_report IS NOT NULL)) AND (w.next_attempt_at IS NULL OR w.next_attempt_at <= ?) ORDER BY w.next_attempt_at, w.node_id`).all(now).map(({ node_id }) => node_id);
+}
+export function quarantinedWorktrees() {
+    return openDb().prepare('SELECT node_id FROM worktrees WHERE quarantined = 1 ORDER BY sweep_last_at').all().flatMap(({ node_id }) => {
+        const worktree = readWorktree(node_id);
+        return worktree === null ? [] : [{ nodeId: node_id, worktree }];
+    });
+}

package/dist/core/config.d.ts

@@ -3,23 +3,28 @@ import { type BindingId } from './keybindings/catalog.js';
 export declare function configPath(scope: Scope): string | null;
 export declare function statePath(scope: Scope): string | null;
 export declare function readConfig(scope: Scope): ResolvedScopeConfig;
-/** Read the config that lives at an EXACT scope-root dir, rather than the
- *  resolved nearest root for a scope. Lets a caller iterate each visible
- *  project root's own config when several are in scope (nested `.crouter` dirs
- *  or a profile-widened stack), instead of collapsing them onto the nearest. */
 export declare function readConfigAtRoot(root: string): ResolvedScopeConfig;
 export declare function readState(scope: Scope): ScopeState;
+export type RawSettingsTarget = {
+    scope: 'user';
+} | {
+    scope: 'profile';
+    profileId: string;
+};
+export declare class InvalidRawSettingsError extends Error {
+    constructor(cause: unknown);
+}
+export declare function readRawSettingsForTarget(target: RawSettingsTarget): {
+    settings: Record<string, unknown> | null;
+    revision: string;
+};
+export declare function replaceRawSettingsForTarget(target: RawSettingsTarget, next: Record<string, unknown>, ifRevision: string): {
+    revision: string;
+    changed: boolean;
+};
 type RawConfig = Record<string, unknown>;
 export declare function updateRawConfigAtomically(scope: Scope, mutate: (latest: RawConfig) => RawConfig): RawConfig;
 export declare function writeConfig(scope: Scope, config: ScopeConfig): void;
-/** Persist a RAW PARTIAL config to a scope's config.json exactly as given.
- *  Unlike `writeConfig`, this makes no promise that every field is present --
- *  callers pass the sparse partial that should live on disk, so an untouched
- *  key stays absent (and `readConfig`/`mergeConfig` re-derive it live from
- *  whichever build is running). This is the single central primitive every
- *  mutation path funnels through so no writer ever freezes a fully
- *  materialized `modelLadders` (concrete model ids that go stale across
- *  builds -- the live-Hearth freeze bug) onto disk. */
 export declare function writeRawConfig(scope: Scope, config: Partial<ScopeConfig>): void;
 export declare function writeState(scope: Scope, state: ScopeState): void;
 export declare function ensureScopeInitialized(scope: Scope, root: string): void;

package/dist/core/config.js

@@ -1,14 +1,17 @@
 import { envProfileId } from '../shared/env.js';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { CONFIG_FILE, STATE_FILE, CONDENSED_HISTORY_MODES, MOUSE_MODE_DEFAULTS, WHIP_MESSAGE_MODES, DEFAULT_WHIP_MESSAGES, defaultScopeConfig, defaultScopeState, defaultModelLaddersConfig, defaultKindsConfig, defaultRemoteCanvasConfig } from '../types.js';
 import { BINDING_CATALOG, BINDING_IDS, isAttachPaneBinding } from './keybindings/catalog.js';
-import { usage } from './errors.js';
+import { notFound, usage } from './errors.js';
 import { emitEvent } from './events/emit.js';
-import { atomicWriteJson, readJsonIfExists, writeJson, ensureDir } from './fs-utils.js';
-import { scopeRoot, requireScopeRoot, findProjectScopeRoots } from './scope.js';
+import { atomicWriteJson, readJsonIfExists, ensureDir } from './fs-utils.js';
+import { scopeRoot, requireScopeRoot, findProjectScopeRoots, userScopeRoot } from './scope.js';
 import { listInstalledPluginsInRoot } from './installed-plugins.js';
-import { profileRoot } from './profiles/manifest.js';
+import { profileRoot, listProfiles } from './profiles/manifest.js';
+import { canonicalRoot, projectStore, userStore } from './scoped-state/paths.js';
+import { convertLegacyScopedStore, initializeFreshScopedStore } from './scoped-state/migrate.js';
+import { mutateRawSettings, readBookkeeping, readRawSettings, readRawSettingsWithRevision, replaceRawSettings, writeBookkeeping, writeRawSettings } from './scoped-state/settings.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
 import { SCOPE_CONFIG_KEYS } from './user-settings.js';
 import { normalizeWorkingGerunds } from '../shared/working-activity.js';
@@ -16,6 +19,10 @@ import { mergePageComponentLayers, normalizePageComponents } from './human/page-
 function configPathFor(root) {
     return join(root, CONFIG_FILE);
 }
+function withConfigPathLock(path, run) {
+    ensureDir(dirname(path));
+    return withExclusiveDirectoryLock(`${path}.lock`, () => run(path), { timeoutError: () => new Error(`timed out waiting for config lock: ${path}`) });
+}
 function statePathFor(root) {
     return join(root, STATE_FILE);
 }
@@ -27,100 +34,83 @@ export function statePath(scope) {
     const root = scopeRoot(scope);
     return root ? statePathFor(root) : null;
 }
-export function readConfig(scope) {
-    const root = scopeRoot(scope);
-    if (!root)
-        return defaultScopeConfig();
-    return readConfigAtRoot(root);
-}
-/** Read the config that lives at an EXACT scope-root dir, rather than the
- *  resolved nearest root for a scope. Lets a caller iterate each visible
- *  project root's own config when several are in scope (nested `.crouter` dirs
- *  or a profile-widened stack), instead of collapsing them onto the nearest. */
-export function readConfigAtRoot(root) {
-    const existing = readJsonIfExists(configPathFor(root));
-    if (!existing)
-        return defaultScopeConfig();
-    return mergeConfig(existing);
-}
-export function readState(scope) {
-    const root = scopeRoot(scope);
-    if (!root)
-        return defaultScopeState();
-    const existing = readJsonIfExists(statePathFor(root));
-    if (!existing)
-        return defaultScopeState();
-    return {
-        marketplaces: existing.marketplaces ?? {},
-        plugins: existing.plugins ?? {},
-        last_self_check: existing.last_self_check,
-        activeCanvas: existing.activeCanvas ?? null,
-    };
-}
-function withConfigPathLock(path, run) {
-    ensureDir(dirname(path));
-    return withExclusiveDirectoryLock(`${path}.lock`, () => run(path), {
-        timeoutError: () => new Error(`timed out waiting for config lock: ${path}`),
-    });
+function settingsOwnerForRoot(root) {
+    const canonical = canonicalRoot(root);
+    const userRoot = canonicalRoot(userScopeRoot());
+    if (canonical === userRoot)
+        return { store: userStore(userRoot), key: 'user', kind: 'user', root: userRoot };
+    // Project roots can be classified without opening the user store. This keeps a
+    // fresh project usable when an unrelated legacy user root still needs conversion.
+    if (basename(canonical) === '.crouter') {
+        convertLegacyScopedStore({ kind: 'project', root: canonical });
+        return { store: projectStore(canonical), key: 'project', kind: 'project', root: canonical };
+    }
+    for (const profile of listProfiles()) {
+        const profilePath = canonicalRoot(profileRoot(profile.profileId));
+        if (canonical === profilePath)
+            return { store: userStore(userRoot), key: `profile:${profile.profileId}`, kind: 'profile', root: profilePath, profileId: profile.profileId };
+    }
+    throw new Error(`settings root is not a recognized owner: ${root}`);
+}
+function readRawAtRoot(root) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project')
+        return readJsonIfExists(configPathFor(owner.root));
+    return readRawSettings(owner);
+}
+function writeRawAtRoot(root, raw) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project') {
+        withConfigPathLock(configPathFor(owner.root), (path) => atomicWriteJson(path, raw));
+        return;
+    }
+    writeRawSettings(owner, raw);
+}
+function mutateRawAtRoot(root, mutate) {
+    const owner = settingsOwnerForRoot(root);
+    if (owner.kind === 'project')
+        return withConfigPathLock(configPathFor(owner.root), (path) => { const result = mutate(readJsonIfExists(path) ?? {}); atomicWriteJson(path, result.next); return result.value; });
+    return mutateRawSettings(owner, (raw) => mutate(raw));
+}
+export function readConfig(scope) { const root = scopeRoot(scope); return root ? readConfigAtRoot(root) : defaultScopeConfig(); }
+export function readConfigAtRoot(root) { const existing = readRawAtRoot(root); return existing ? mergeConfig(existing) : defaultScopeConfig(); }
+export function readState(scope) { const root = scopeRoot(scope); if (!root)
+    return defaultScopeState(); return readBookkeeping(settingsOwnerForRoot(root)); }
+export class InvalidRawSettingsError extends Error {
+    constructor(cause) {
+        super(`settings cannot be merged: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'InvalidRawSettingsError';
+    }
 }
-function withConfigLock(scope, run) {
-    const root = requireScopeRoot(scope);
-    return withConfigPathLock(configPathFor(root), run);
+function rawSettingsOwnerForTarget(target) {
+    if (target.scope === 'user')
+        return settingsOwnerForRoot(userScopeRoot());
+    if (!listProfiles().some((profile) => profile.profileId === target.profileId)) {
+        throw notFound(`profile not found: ${target.profileId}`, { received: target.profileId, next: 'Run `crtr profile list` to see available profiles.' });
+    }
+    return settingsOwnerForRoot(profileRoot(target.profileId));
 }
-export function updateRawConfigAtomically(scope, mutate) {
-    return withConfigLock(scope, (path) => {
-        const latest = readJsonIfExists(path) ?? {};
-        const next = mutate(latest);
-        atomicWriteJson(path, next);
-        return next;
-    });
+export function readRawSettingsForTarget(target) {
+    return readRawSettingsWithRevision(rawSettingsOwnerForTarget(target));
 }
-export function writeConfig(scope, config) {
-    withConfigLock(scope, (path) => atomicWriteJson(path, config));
-}
-/** Persist a RAW PARTIAL config to a scope's config.json exactly as given.
- *  Unlike `writeConfig`, this makes no promise that every field is present --
- *  callers pass the sparse partial that should live on disk, so an untouched
- *  key stays absent (and `readConfig`/`mergeConfig` re-derive it live from
- *  whichever build is running). This is the single central primitive every
- *  mutation path funnels through so no writer ever freezes a fully
- *  materialized `modelLadders` (concrete model ids that go stale across
- *  builds -- the live-Hearth freeze bug) onto disk. */
-export function writeRawConfig(scope, config) {
-    withConfigLock(scope, (path) => atomicWriteJson(path, config));
-}
-export function writeState(scope, state) {
-    const root = requireScopeRoot(scope);
-    ensureDir(root);
-    writeJson(statePathFor(root), state);
-}
-export function ensureScopeInitialized(scope, root) {
-    ensureDir(root);
-    withConfigPathLock(configPathFor(root), (cfgPath) => {
-        if (readJsonIfExists(cfgPath))
-            return;
-        // Persist no materialized model ladder or keybinding defaults. `modelLadders` holds concrete model ids (e.g.
-        // "openai-codex/gpt-5.6-sol:high") that are only valid as long as they match whatever
-        // pi model registry this crouter build ships. Baking a materialized snapshot here would
-        // freeze this scope's ladder to whatever ids happened to be current the moment it was
-        // first initialized -- a later crouter/pi upgrade (or a rollback) that changes the
-        // registry can then never reach it: the stale persisted override still wins over the
-        // new build's compiled defaults in `mergeConfig`/`mergeModelLadders`, producing a
-        // fallback rung `resolveViableFallback` rejects as unregistered while the terminal
-        // error misleadingly claims the fallback provider needs authenticating (see live
-        // incident: a home's config.json was seeded with `gpt-5.6-*` ladder entries from a
-        // build newer than the one actually installed, so its own model registry never had
-        // them). Omitting the key here is safe: `readConfig`/`mergeConfig` already default-fill
-        // a missing `modelLadders` from whatever build is CURRENTLY running, and an explicit
-        // user override (`sys config set modelLadders...`) still persists and still wins.
-        // Keybindings are sparse user overrides, so an untouched scope omits that member too.
-        const { modelLadders: _omittedModelLadders, keybindings: _omittedKeybindings, tmux_passthrough: _omittedTmuxPassthrough, brokerThresholds, lifecycle, ...rest } = defaultScopeConfig();
-        // Broker thresholds and lifecycle timing are host-wide daemon policy, so
-        // only user scope persists them. Project config must never acquire a
-        // machine setting.
-        atomicWriteJson(cfgPath, scope === 'user' ? { ...rest, brokerThresholds, lifecycle } : rest);
+export function replaceRawSettingsForTarget(target, next, ifRevision) {
+    return replaceRawSettings(rawSettingsOwnerForTarget(target), next, ifRevision, (settings) => {
+        try {
+            mergeConfig(settings);
+        }
+        catch (error) {
+            throw new InvalidRawSettingsError(error);
+        }
     });
 }
+export function updateRawConfigAtomically(scope, mutate) { const root = requireScopeRoot(scope); return mutateRawAtRoot(root, (latest) => { const next = mutate(latest); return { value: next, next }; }); }
+export function writeConfig(scope, config) { writeRawAtRoot(requireScopeRoot(scope), config); }
+export function writeRawConfig(scope, config) { writeRawAtRoot(requireScopeRoot(scope), config); }
+export function writeState(scope, state) { const root = requireScopeRoot(scope); writeBookkeeping(settingsOwnerForRoot(root), state); }
+export function ensureScopeInitialized(scope, root) { ensureDir(root); const owner = scope === 'user' ? settingsOwnerForRoot(userScopeRoot()) : settingsOwnerForRoot(root); initializeFreshScopedStore({ kind: owner.kind === 'user' ? 'user' : 'project', root: owner.store.root }); if (owner.kind === 'project' && readJsonIfExists(configPathFor(owner.root)) === null) {
+    const { modelLadders: _a, keybindings: _b, tmux_passthrough: _c, brokerThresholds, lifecycle, ...rest } = defaultScopeConfig();
+    writeRawAtRoot(owner.root, rest);
+} }
 function normalizeKeybindings(raw) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
         return {};
@@ -798,7 +788,7 @@ function mergeConfig(partial) {
  *  for why `readConfig(scope)`, which already defaults-fills, is unusable
  *  for cross-scope layering). */
 export function readRawConfigAtRoot(root) {
-    return readJsonIfExists(configPathFor(root));
+    return readRawAtRoot(root);
 }
 export function readRawScopeConfig(scope) {
     const root = scopeRoot(scope);
@@ -814,7 +804,7 @@ function readRawProfileConfig(profileId) {
     if (profileId === null || profileId === '')
         return null;
     try {
-        return readJsonIfExists(configPathFor(profileRoot(profileId)));
+        return readRawAtRoot(profileRoot(profileId));
     }
     catch {
         return null;
@@ -832,7 +822,7 @@ function readRawProjectScopeConfigs(targetCwd, targetProfileId) {
     const farthestFirst = [...nearestFirst].reverse();
     // A root with no config.json still contributes: its installed plugins may
     // declare kinds, so the ROOT rides along and `raw` stays null.
-    return farthestFirst.map((root) => ({ root, raw: readJsonIfExists(configPathFor(root)) }));
+    return farthestFirst.map((root) => ({ root, raw: readRawAtRoot(root) }));
 }
 /** Merge launch knobs (`kinds`, `modelLadders`) across scopes in
  *  project stack > profile > user > builtin precedence — the same precedence
@@ -994,27 +984,21 @@ function sparseModelLaddersToPersist(rawLadders, baseline, mutated) {
  *  `sys config set` never freezes a full concrete `modelLadders` to disk,
  *  and a direct ladder-rung set still persists only the touched rung -- all
  *  through one lock-protected atomic update path. */
-function mutateConfigAtPath(path, mutate) {
-    return withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
+function mutateConfigAtRoot(root, mutate) {
+    return mutateRawAtRoot(root, (raw) => {
         const baseline = mergeConfig(raw);
         const cfg = mergeConfig(raw);
         mutate(cfg);
         const partial = { ...raw };
-        for (const key of SCOPE_CONFIG_KEYS) {
-            if (key === 'modelLadders')
-                continue;
-            if (!isDeepStrictEqual(cfg[key], baseline[key])) {
+        for (const key of SCOPE_CONFIG_KEYS)
+            if (key !== 'modelLadders' && !isDeepStrictEqual(cfg[key], baseline[key]))
                 partial[key] = cfg[key];
-            }
-        }
         const ladders = sparseModelLaddersToPersist(raw.modelLadders, baseline.modelLadders, cfg.modelLadders);
         if (ladders !== undefined)
             partial.modelLadders = ladders;
         else
             delete partial.modelLadders;
-        atomicWriteJson(lockedPath, partial);
-        return cfg;
+        return { value: cfg, next: partial };
     });
 }
 /** Persist an EXPLICIT sparse `modelLadders` intent at one config root: the
@@ -1029,21 +1013,10 @@ function mutateConfigAtPath(path, mutate) {
  *  evaporates as soon as the default moves. Explicit intent is recorded as
  *  written. Mirrors `persistDefaultKindModel`. */
 export function persistModelLadders(root, patch) {
-    const path = configPathFor(root);
-    ensureDir(root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const current = (raw.modelLadders ?? {});
-        const next = { ...current };
-        if (patch.defaultProvider !== undefined)
-            next.defaultProvider = patch.defaultProvider;
-        for (const provider of ['anthropic', 'openai']) {
-            const rungs = patch[provider];
-            if (rungs !== undefined)
-                next[provider] = { ...(current[provider] ?? {}), ...rungs };
-        }
-        atomicWriteJson(lockedPath, { ...raw, modelLadders: next });
-    });
+    mutateRawAtRoot(root, (raw) => { const current = (raw.modelLadders ?? {}); const next = { ...current }; if (patch.defaultProvider !== undefined)
+        next.defaultProvider = patch.defaultProvider; for (const provider of ['anthropic', 'openai'])
+        if (patch[provider] !== undefined)
+            next[provider] = { ...(current[provider] ?? {}), ...patch[provider] }; return { value: undefined, next: { ...raw, modelLadders: next } }; });
 }
 /** Persist one complete route at one exact config root. The route is the only
  * raw route entry touched; unrelated routes and local ladder defaults remain
@@ -1054,33 +1027,18 @@ export function persistModelRoute(root, routeId, route) {
         assertCompleteModelRoute(routeId, route);
     else if (routeId.trim() === '')
         throw new Error('model route id must be a non-empty string');
-    const path = configPathFor(root);
-    ensureDir(root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const routes = copyRouteRecord((raw.modelRoutes ?? {}));
-        if (route === undefined)
-            delete routes[routeId];
-        else {
-            const current = routes[routeId];
-            setRouteRecord(routes, routeId, {
-                ...(current !== null && typeof current === 'object' && !Array.isArray(current) ? current : {}),
-                ...route,
-                models: { ...route.models },
-            });
-        }
-        const next = { ...raw };
-        if (Object.keys(routes).length === 0)
-            delete next.modelRoutes;
-        else
-            next.modelRoutes = routes;
-        atomicWriteJson(lockedPath, next);
-    });
+    mutateRawAtRoot(root, (raw) => { const routes = copyRouteRecord((raw.modelRoutes ?? {})); if (route === undefined)
+        delete routes[routeId];
+    else
+        setRouteRecord(routes, routeId, { ...route, models: { ...route.models } }); const next = { ...raw }; if (Object.keys(routes).length === 0)
+        delete next.modelRoutes;
+    else
+        next.modelRoutes = routes; return { value: undefined, next }; });
 }
 /** Mutate one exact config root. Setup uses this for profile and explicit
  * project targets that cannot be represented by the user/project Scope enum. */
 export function updateConfigAtRoot(root, mutate) {
-    return mutateConfigAtPath(configPathFor(root), mutate);
+    return mutateConfigAtRoot(root, mutate);
 }
 export function updateConfig(scope, mutate) {
     return updateConfigAtRoot(requireScopeRoot(scope), mutate);
@@ -1090,15 +1048,8 @@ export function updateConfig(scope, mutate) {
  * scopes instead of freezing a materialized registry snapshot. */
 export function persistDefaultKindModel(opts) {
     const field = opts.orchestrator === true ? 'orchestratorModel' : 'model';
-    const path = configPathFor(opts.root);
-    ensureDir(opts.root);
-    withConfigPathLock(path, (lockedPath) => {
-        const raw = readJsonIfExists(lockedPath) ?? {};
-        const kinds = { ...(raw.kinds ?? {}) };
-        kinds[opts.kind] = { ...(kinds[opts.kind] ?? {}), [field]: opts.model };
-        atomicWriteJson(lockedPath, { ...raw, kinds });
-    });
-    return { path, field };
+    mutateRawAtRoot(opts.root, (raw) => { const kinds = { ...(raw.kinds ?? {}), [opts.kind]: { ...(raw.kinds ?? {})[opts.kind], [field]: opts.model } }; return { value: undefined, next: { ...raw, kinds: kinds } }; });
+    return { path: configPathFor(opts.root), field };
 }
 export function updateState(scope, mutate) {
     const s = readState(scope);

package/dist/core/feed/__tests__/inbox-migrate.test.js

@@ -1,49 +1,45 @@
-// Regression (2026-07-22 revive-loop flap): removing legacy inbox compat
-// (e2904a09) with no on-host cutover left every pre-cutover node fatally
-// unreadable — the broker crashed at inbox seed and the daemon revived it
-// forever, flashing "node refreshing — reconnecting…" in every attached
-// viewer. The boot migration must rewrite identity-less rows and map the
-// ISO-timestamp cursor boundary onto an exact entry identity the strict
-// reader accepts.
+// Retained legacy mailbox import: the SQL cutover preserves historical inbox
+// bytes by importing them into messages and deliveries without leaving a
+// runtime filesystem reader.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { migrateLegacyInboxIdentities } from '../inbox-migrate.js';
-import { readCursor, readInboxSince } from '../inbox.js';
-import { nodeDir, inboxPath } from '../../canvas/paths.js';
-test('legacy inbox rows and ISO cursor migrate to strict identities once', () => {
+import { migrateMessagingState } from '../../canvas/deliveries.js';
+import { inboxPath, nodeDir } from '../../canvas/paths.js';
+test('legacy inbox rows and cursor import once into acknowledged and pending SQL deliveries', () => {
     const home = mkdtempSync(join(tmpdir(), 'crtr-inboxmigrate-'));
     const orig = process.env['CRTR_HOME'];
     process.env['CRTR_HOME'] = home;
     const nodeId = 'mrtest01-aabbccdd';
+    const db = new DatabaseSync(join(home, 'canvas.db'));
     try {
+        db.exec('CREATE TABLE nodes (node_id TEXT PRIMARY KEY, waiting_for TEXT, waiting_for_generation INTEGER)');
+        db.prepare('INSERT INTO nodes (node_id, waiting_for, waiting_for_generation) VALUES (?, NULL, 0)').run(nodeId);
+        db.exec('CREATE TABLE human_action_deliveries (request_id TEXT, state TEXT, attempt INTEGER, argv_json TEXT, cwd TEXT, completion_json TEXT, next_attempt_at INTEGER, claimed_at INTEGER, claim_owner TEXT, accepted_at INTEGER, permanent_failed_at INTEGER, last_failure_json TEXT, created_at INTEGER, updated_at INTEGER)');
+        db.exec('CREATE TABLE node_outcome_deliveries (node_id TEXT, state TEXT, attempt INTEGER, action_name TEXT, argv_json TEXT, cwd TEXT, config_origin TEXT, payload_json TEXT, document_json TEXT, next_attempt_at INTEGER, claimed_at INTEGER, claim_owner TEXT, accepted_at INTEGER, permanent_failed_at INTEGER, last_failure_json TEXT, created_at INTEGER, updated_at INTEGER)');
         mkdirSync(nodeDir(nodeId), { recursive: true });
         const lines = [
-            '{"ts":"2026-07-09T22:54:06.294Z","from":"mrpeer1-00000001","tier":"normal","kind":"final","label":"one"}',
-            '{"ts":"2026-07-10T01:00:00.000Z","from":"mrpeer1-00000001","tier":"normal","kind":"update","label":"two"}',
+            '{"entry_id":"11111111111111111111111111111111","operation_id":"22222222222222222222222222222222","ts":"2026-07-09T22:54:06.294Z","from":"mrpeer1-00000001","tier":"normal","kind":"final","label":"one"}',
+            '{"entry_id":"33333333333333333333333333333333","operation_id":"44444444444444444444444444444444","ts":"2026-07-10T01:00:00.000Z","from":"mrpeer1-00000001","tier":"normal","kind":"update","label":"two"}',
         ];
         writeFileSync(inboxPath(nodeId), `${lines.join('\n')}\n`, 'utf8');
-        writeFileSync(`${inboxPath(nodeId)}.cursor`, '2026-07-09T22:54:06.294Z', 'utf8');
-        const first = migrateLegacyInboxIdentities();
-        assert.equal(first.nodes, 1);
-        assert.equal(first.entries, 2);
-        assert.equal(first.cursors, 1);
-        assert.equal(first.failures, 0);
-        // The strict reader consumes the migrated state: cursor covers entry one,
-        // exactly entry two is unread.
-        const cursor = readCursor(nodeId);
-        assert.notEqual(cursor, undefined);
-        const unread = readInboxSince(nodeId, cursor);
-        assert.equal(unread.length, 1);
-        assert.equal(unread[0].ts, '2026-07-10T01:00:00.000Z');
-        const migratedRaw = readFileSync(inboxPath(nodeId), 'utf8');
-        const second = migrateLegacyInboxIdentities();
-        assert.deepEqual(second, { nodes: 0, entries: 0, cursors: 0, failures: 0 });
-        assert.equal(readFileSync(inboxPath(nodeId), 'utf8'), migratedRaw, 'second run is a no-op');
+        writeFileSync(`${inboxPath(nodeId)}.cursor`, '11111111111111111111111111111111', 'utf8');
+        migrateMessagingState(db);
+        const deliveries = db.prepare(`SELECT m.message_id, m.created_at, d.state, d.acknowledged_at
+         FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+        WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? ORDER BY m.seq`).all(nodeId);
+        assert.deepEqual(deliveries.map(({ message_id, state }) => ({ message_id, state })), [
+            { message_id: '11111111111111111111111111111111', state: 'acknowledged' },
+            { message_id: '33333333333333333333333333333333', state: 'pending' },
+        ], 'the retained file rows become ordered SQL message/delivery facts and the legacy cursor becomes acknowledgement');
+        assert.equal(deliveries[0].acknowledged_at, Date.parse('2026-07-09T22:54:06.294Z'));
+        assert.equal(deliveries[1].created_at, '2026-07-10T01:00:00.000Z');
     }
     finally {
+        db.close();
         if (orig === undefined)
             delete process.env['CRTR_HOME'];
         else

package/dist/core/feed/feed.d.ts

@@ -27,12 +27,6 @@ export declare class FinalizationError extends Error {
     readonly reportPath?: string | undefined;
     constructor(code: 'already_finalized' | 'finalization_forbidden' | 'unknown_node', reportPath?: string | undefined);
 }
-export declare class FinalDeliveryError extends Error {
-    readonly reportPath: string;
-    readonly deliveredTo: string[];
-    readonly failedTo: string[];
-    constructor(reportPath: string, deliveredTo: string[], failedTo: string[]);
-}
 export declare function push(nodeId: string, opts: PushOpts): Promise<PushResult>;
 export declare function pushUpdate(nodeId: string, body: string, opts?: {
     from?: string;