@north-light/crouter 0.3.312 → 0.3.313

package/dist/core/worktree-close.js

@@ -1,6 +1,6 @@
 import { existsSync, realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { getNode, updateNode } from './canvas/index.js';
+import { getNode, recordDisposalGrant, recordLandIntent } from './canvas/index.js';
 import { withExclusiveDirectoryLockAsync } from './exclusive-lock.js';
 import { gitAsync } from './git.js';
 import { proveBranchContained } from './worktree-containment.js';
@@ -66,8 +66,7 @@ function recordBlockedLandIntent(nodeId, blocked) {
     const current = getNode(nodeId)?.managed_worktree;
     if (current === undefined || current === null || current.state !== 'open')
         return;
-    const { sweep: _sweep, ...retained } = current;
-    updateNode(nodeId, { managed_worktree: { ...retained, land_intent: { at: new Date().toISOString(), blocked } } });
+    recordLandIntent(nodeId, { at: new Date().toISOString(), blocked });
 }
 async function dropStashIfStillTip(cwd, stashSha) {
     const tip = await gitAsync(['rev-parse', '--verify', '--quiet', 'refs/stash'], cwd);
@@ -144,7 +143,8 @@ async function closeLocked(nodeId) {
         if (!(await registeredWorktree(wt.repo_root, wt.path, branch)) || (await runGit(wt.path, ['rev-parse', '--abbrev-ref', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.')) !== branch || (await runGit(wt.path, ['rev-parse', 'HEAD'], 'branch_check_failed', 'Inspect the worktree manually, then retry.')) !== head) {
             throw new WorktreeError('wrong_branch', `managed worktree at ${wt.path} changed while closing`, `Inspect ${wt.path}, then rerun \`crtr node worktree close\`.`);
         }
-        persistClosedWorktreeState(nodeId, { ...wt, disposal: { observed_branch: branch, observed_sha: head, common_dir: commonDir, authorized: new Date().toISOString() } }, 'pending');
+        recordDisposalGrant(nodeId, { observed_branch: branch, observed_sha: head, common_dir: commonDir, authorized: new Date().toISOString() });
+        persistClosedWorktreeState(nodeId, wt, 'pending');
         return { node_id: nodeId, branch, worktree_path: wt.path, landed_sha: head, ...deferredCleanupResult(wt), branch_delete_error: `${branch} is not a crtr-managed branch and will never be deleted automatically; it is preserved once the checkout above is removed.` };
     }
     // Decide whether landing remains before resolving a destination. A diverged

package/dist/core/worktree-mutation-async.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { getNode, updateNode } from './canvas/index.js';
+import { abandonWorktreeAndRepoint, getNode } from './canvas/index.js';
 import { isPidAlive } from './canvas/pid.js';
 import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
 import { withExclusiveDirectoryLockAsync } from './exclusive-lock.js';
@@ -211,7 +211,7 @@ async function rebaseInProgress(cwd) {
     return false;
 }
 function persistAbandoned(nodeId, wt, tip, at, by, branch = wt.branch) {
-    updateNode(nodeId, { cwd: wt.repo_root, managed_worktree: { ...wt, state: 'abandoned', abandoned: { branch, tip_sha: tip, at, by } } });
+    abandonWorktreeAndRepoint(nodeId, { cwd: wt.repo_root, abandoned: { branch, tip_sha: tip, at, by } });
 }
 export async function abandonManagedWorktreeAsync(nodeId, by) {
     const wt = getNode(nodeId)?.managed_worktree;

package/dist/core/worktree-sweep.js

@@ -18,13 +18,13 @@
 import { createHash } from 'node:crypto';
 import { existsSync, realpathSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { getNode, updateNode } from './canvas/index.js';
+import { completeCleanup, getNode, recordSweepAttempt } from './canvas/index.js';
 import { withExclusiveDirectoryLockAsync } from './exclusive-lock.js';
 import { gitAsync } from './git.js';
 import { proveBranchContained, upstreamTip } from './worktree-containment.js';
 import { parseStatusPorcelain, planLandIntoCheckout, refDeleteTransactionStdin } from './worktree-landing.js';
 import { shellQuote } from '../shared/shell-quote.js';
-import { WORKTREE_LOCK_WAIT_MS, checkoutPathForBranchInList, persistClosedWorktreeState, samePath, worktreeLockPathForCommonDir } from './worktree.js';
+import { WORKTREE_LOCK_WAIT_MS, checkoutPathForBranchInList, samePath, worktreeLockPathForCommonDir } from './worktree.js';
 /** Escalating recheck interval, in minutes, indexed by consecutive refusal. The
  *  last tier is the cap AND the quarantine threshold: at that point the record
  *  needs a human, so it is listed by `crtr sys worktrees` and costs one cheap
@@ -147,19 +147,14 @@ function recordUnfinished(nodeId, wt, outcome, observed, now, guard) {
     const current = getNode(nodeId)?.managed_worktree;
     if (current == null || !isReconcilable(current))
         return;
-    updateNode(nodeId, {
-        managed_worktree: {
-            ...current,
-            sweep: {
-                reason: outcome.reason,
-                ...(outcome.detail === undefined ? {} : { detail: outcome.detail }),
-                observed,
-                attempts,
-                last_attempt: new Date(now).toISOString(),
-                next_attempt: new Date(now + minutes * 60_000).toISOString(),
-                ...(attempts >= QUARANTINE_ATTEMPTS ? { quarantined: true } : {}),
-            },
-        },
+    recordSweepAttempt(nodeId, {
+        reason: outcome.reason,
+        ...(outcome.detail === undefined ? {} : { detail: outcome.detail }),
+        observed,
+        attempts,
+        lastAttemptAt: new Date(now).toISOString(),
+        nextAttemptAt: new Date(now + minutes * 60_000).toISOString(),
+        quarantined: attempts >= QUARANTINE_ATTEMPTS,
     });
 }
 // Landing a blocked close the sweep is allowed to finish
@@ -327,7 +322,7 @@ function persistComplete(nodeId, wt, guard) {
     if (current == null || current.path !== wt.path || current.branch !== wt.branch) {
         return { status: 'skipped', reason: 'record_changed' };
     }
-    persistClosedWorktreeState(nodeId, current, 'complete');
+    completeCleanup(nodeId);
     return { status: 'complete' };
 }
 /** Resume a record whose checkout is already gone — the crash-after-removal

package/dist/core/worktree.js

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { gitAsync, gitSync } from './git.js';
 import { crtrHome } from './canvas/paths.js';
-import { getNode, updateNode } from './canvas/index.js';
+import { closeWorktreeAndRepoint, getNode, recordLandIntent } from './canvas/index.js';
 import { CONFIG_FILE, CRTR_DIR_NAME, STATE_FILE } from '../types.js';
 import { withExclusiveDirectoryLock } from './exclusive-lock.js';
 import { parseStatusPorcelain, planLandIntoCheckout, refDeleteTransactionStdin } from './worktree-landing.js';
@@ -344,16 +344,11 @@ export function isRebaseInProgress(cwd) {
  * sync. */
 export function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
     const node = getNode(nodeId);
-    const sessionInvalidated = node?.pi_session_id != null || node?.pi_session_file != null;
-    // Every caller reaches this only after CONCLUDING the land — it succeeded, or
-    // the record was proven to have nothing to land. So a recorded land intent is
-    // discharged here, and a recorded refusal describes a state that no longer
-    // holds; dropping both leaves the sweep re-examining this record fresh.
-    const { land_intent: _landIntent, sweep: _sweep, ...retained } = wt;
-    updateNode(nodeId, {
+    closeWorktreeAndRepoint(nodeId, {
         cwd: wt.repo_root,
-        ...(sessionInvalidated ? { pi_session_id: null, pi_session_file: null } : {}),
-        managed_worktree: { ...retained, state: 'closed', cleanup, closed: new Date().toISOString() },
+        cleanup,
+        closedAt: new Date().toISOString(),
+        unbindSession: node?.pi_session_id != null || node?.pi_session_file != null,
     });
 }
 /** Record that this node ASKED to land and was blocked, so the daemon sweep may
@@ -366,8 +361,7 @@ function recordBlockedLandIntent(nodeId, blocked) {
     const current = getNode(nodeId)?.managed_worktree;
     if (current == null || current.state !== 'open')
         return;
-    const { sweep: _sweep, ...retained } = current;
-    updateNode(nodeId, { managed_worktree: { ...retained, land_intent: { at: new Date().toISOString(), blocked } } });
+    recordLandIntent(nodeId, { at: new Date().toISOString(), blocked });
 }
 /** Fast-forward a base branch that is CHECKED OUT somewhere, landing underneath
  *  whatever local changes that checkout holds.

package/dist/daemon/__tests__/autostart-storm.test.js

@@ -3,9 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { spawn } from 'node:child_process';
-import { DaemonStartupBlockedError, daemonAutostartSuppression, ensureDaemon, resetDaemonAutostart, verifyDaemonStartup, } from '../manage.js';
-import { DAEMON_EXIT_STARTUP_BLOCKED } from '../startup-policy.js';
+import { ensureDaemon, resetDaemonAutostart, } from '../manage.js';
 import { withExclusiveDirectoryLockAsync } from '../../core/exclusive-lock.js';
 // REGRESSION (daemon respawn storm): a daemon whose startup hit a STANDING
 // condition — a blocked on-disk migration — exited, its attach clients saw a
@@ -31,42 +29,6 @@ after(() => {
         process.env['CRTR_NO_DAEMON_AUTOSTART'] = autostartEnv;
     resetDaemonAutostart();
 });
-test('the blocked-startup exit code surfaces as a typed terminal error, not a generic exit', async () => {
-    let exited = null;
-    const child = spawn(process.execPath, ['-e', `process.exit(${DAEMON_EXIT_STARTUP_BLOCKED})`], { stdio: 'ignore' });
-    child.once('exit', (code, signal) => {
-        exited = { code, signal };
-    });
-    await assert.rejects(async () => verifyDaemonStartup(77, 2_000, {
-        readPidfile: () => null,
-        isPidAlive: () => false,
-        isDaemonServing: async () => false,
-        childExited: () => exited,
-    }), (error) => {
-        assert.ok(error instanceof DaemonStartupBlockedError, 'must be typed, so the spawner can stop retrying');
-        assert.match(error.message, /crtr sys migrate/);
-        return true;
-    });
-});
-test('a blocked start suppresses every later autostart instead of respawning into the same wall', async () => {
-    let spawns = 0;
-    const deps = {
-        isDaemonRunning: () => false,
-        spawnDaemon: async () => {
-            spawns += 1;
-            throw new DaemonStartupBlockedError(4242);
-        },
-    };
-    ensureDaemon(deps);
-    await settle();
-    assert.equal(spawns, 1);
-    assert.match(daemonAutostartSuppression() ?? '', /crtr sys migrate/);
-    // The storm: every redial of every attach client lands here. None may spawn.
-    for (let i = 0; i < 50; i++)
-        ensureDaemon(deps);
-    await settle();
-    assert.equal(spawns, 1, 'a standing failure must never be retried');
-});
 test('an ordinary spawn failure backs off, then retries once the window passes', async () => {
     let spawns = 0;
     let now = 1_000_000;

package/dist/daemon/__tests__/helpers/source-daemon.d.ts

@@ -22,8 +22,8 @@ export interface SourceDaemonProcess {
         signal: NodeJS.Signals | null;
     }>;
 }
-export declare function createSourceDaemonFixture(): Promise<SourceDaemonFixture>;
-export declare function startSourceDaemon(fixture: SourceDaemonFixture): SourceDaemonProcess;
+export declare function createSourceDaemonFixture(opts?: Partial<Pick<SourceDaemonFixture, 'root' | 'home' | 'cwd' | 'canvasHome'>>): Promise<SourceDaemonFixture>;
+export declare function startSourceDaemon(fixture: SourceDaemonFixture, envOverrides?: NodeJS.ProcessEnv): SourceDaemonProcess;
 export declare function healthRequest(port: number, timeoutMs?: number): Promise<boolean>;
 export declare function waitForHealth(process: SourceDaemonProcess, port: number, timeoutMs?: number): Promise<void>;
 export declare function healthWasReadyBeforeExit(process: SourceDaemonProcess, port: number): Promise<boolean>;

package/dist/daemon/__tests__/helpers/source-daemon.js

@@ -20,11 +20,11 @@ async function reserveTcpPort() {
     await new Promise((resolve, reject) => server.close((error) => error === undefined ? resolve() : reject(error)));
     return address.port;
 }
-export async function createSourceDaemonFixture() {
-    const root = mkdtempSync('/tmp/crtr-migration-daemon-');
-    const home = join(root, 'home');
-    const cwd = join(home, 'work');
-    const canvasHome = join(root, 'canvas');
+export async function createSourceDaemonFixture(opts = {}) {
+    const root = opts.root ?? mkdtempSync('/tmp/crtr-migration-daemon-');
+    const home = opts.home ?? join(root, 'home');
+    const cwd = opts.cwd ?? join(home, 'work');
+    const canvasHome = opts.canvasHome ?? join(root, 'canvas');
     const pidfile = join(canvasHome, 'ready.pid');
     const socket = join(canvasHome, 'crtrd.sock');
     mkdirSync(cwd, { recursive: true });
@@ -41,7 +41,7 @@ export async function createSourceDaemonFixture() {
         dispose: () => rmSync(root, { recursive: true, force: true }),
     };
 }
-export function startSourceDaemon(fixture) {
+export function startSourceDaemon(fixture, envOverrides = {}) {
     const require = createRequire(import.meta.url);
     const tsxLoader = pathToFileURL(require.resolve('tsx/esm')).href;
     const entry = fileURLToPath(new URL('../../crtrd-cli.ts', import.meta.url));
@@ -72,6 +72,7 @@ export function startSourceDaemon(fixture) {
         'NODE_OPTIONS',
     ])
         delete env[key];
+    Object.assign(env, envOverrides);
     const child = spawn(process.execPath, [
         '--conditions=crtr-src',
         '--import', tsxLoader,

package/dist/daemon/__tests__/integration/migration-startup.test.js

@@ -1,9 +1,9 @@
 import assert from 'node:assert/strict';
-import { existsSync, mkdirSync, readFileSync, statSync, watch, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import test from 'node:test';
 import { onDiskMigrationIdentity } from '../../../migrations/registry.js';
-import { brokerPidsForCanvas, createSourceDaemonFixture, healthWasReadyBeforeExit, startSourceDaemon, waitForHealth, } from '../helpers/source-daemon.js';
+import { brokerPidsForCanvas, createSourceDaemonFixture, startSourceDaemon, waitForHealth, } from '../helpers/source-daemon.js';
 const PRE_MIGRATION_DOC = `---
 kind: knowledge
 name: daemon-ordering
@@ -24,7 +24,11 @@ function writeUserMemory(home, name, source) {
     writeFileSync(path, source, 'utf8');
     return path;
 }
-test('source daemon migrates the pre-migration corpus and writes its marker before API readiness', { timeout: 30_000 }, async () => {
+async function requestJson(port, path, init = {}) {
+    const response = await fetch(`http://127.0.0.1:${port}${path}`, init);
+    return { status: response.status, body: await response.json() };
+}
+test('source daemon migrates the pre-migration corpus before full readiness', { timeout: 30_000 }, async () => {
     const fixture = await createSourceDaemonFixture();
     const docPath = writeUserMemory(fixture.home, 'daemon-ordering.md', PRE_MIGRATION_DOC);
     const markerPath = join(fixture.canvasHome, 'on-disk-migrations.json');
@@ -41,8 +45,8 @@ test('source daemon migrates the pre-migration corpus and writes its marker befo
         assert.equal(existsSync(markerPath), true, `marker was not written; stderr:\n${daemon.stderr()}`);
         const migratedAtMarker = readFileSync(docPath, 'utf8');
         assert.doesNotMatch(migratedAtMarker, /system-prompt-visibility:|file-read-visibility:|applies-to:|read-when:/);
-        assert.equal(existsSync(fixture.pidfile), false, 'pidfile readiness is not published when the marker first appears');
-        assert.equal(existsSync(fixture.socket), false, 'API readiness is not published when the marker first appears');
+        assert.equal(existsSync(fixture.pidfile), true, 'the live owner mirror is published at the restricted repair boundary');
+        assert.equal(existsSync(fixture.socket), true, 'the repair listener is bound before corpus activation completes');
         await waitForHealth(daemon, fixture.tcpPort);
         const migrated = readFileSync(docPath, 'utf8');
         assert.doesNotMatch(migrated, /system-prompt-visibility:|file-read-visibility:|applies-to:|read-when:/);
@@ -53,8 +57,8 @@ test('source daemon migrates the pre-migration corpus and writes its marker befo
         assert.equal(existsSync(fixture.pidfile), true, 'health readiness follows the pidfile readiness mirror');
         assert.equal(existsSync(fixture.socket), true, 'the unique unix API listener is bound at readiness');
         assert.equal(existsSync(dbPath), true, 'daemon ownership has opened canvas.db by readiness');
-        assert.ok(statSync(markerPath).mtimeMs <= statSync(fixture.pidfile).mtimeMs, 'the completion marker is written no later than the readiness pidfile');
-        assert.ok(statSync(markerPath).mtimeMs <= statSync(fixture.socket).mtimeMs, 'the completion marker is written no later than the API listener');
+        assert.ok(statSync(fixture.pidfile).mtimeMs <= statSync(markerPath).mtimeMs, 'the pidfile is written before the completion marker');
+        assert.ok(statSync(fixture.socket).mtimeMs <= statSync(markerPath).mtimeMs, 'the repair listener is bound before the completion marker');
     }
     finally {
         const exit = await daemon.stop();
@@ -62,33 +66,62 @@ test('source daemon migrates the pre-migration corpus and writes its marker befo
         assert.deepEqual(exit, { code: 0, signal: null }, `daemon must stop cleanly; stderr:\n${daemon.stderr()}`);
     }
 });
-test('a real migration blocker exits before pidfile, listeners, or broker effects', { timeout: 30_000 }, async () => {
+test('a real migration blocker keeps a restricted daemon alive for repair', { timeout: 30_000 }, async () => {
     const fixture = await createSourceDaemonFixture();
     const blockerPath = writeUserMemory(fixture.home, 'blocked.md', `---\nkind: knowledge\nbroken: [\n---\n# Blocked\n`);
-    const effectNames = new Set();
-    const effects = watch(fixture.canvasHome, (_event, filename) => {
-        if (filename !== null)
-            effectNames.add(filename.toString());
-    });
     const daemon = startSourceDaemon(fixture);
-    const readiness = healthWasReadyBeforeExit(daemon, fixture.tcpPort);
-    const exit = await daemon.exited;
-    const wasReady = await readiness;
-    await new Promise((resolve) => setTimeout(resolve, 20));
-    effects.close();
     try {
-        assert.equal(exit.signal, null);
-        assert.notEqual(exit.code, 0, `blocker must exit nonzero; stderr:\n${daemon.stderr()}`);
-        assert.match(daemon.stderr(), new RegExp(blockerPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
-        assert.match(daemon.stderr(), /Repair: crtr sys migrate/);
-        assert.equal(wasReady, false, 'the unique TCP endpoint never answered health');
-        assert.equal(existsSync(fixture.pidfile), false, 'readiness pidfile was never created');
-        assert.equal(existsSync(fixture.socket), false, 'unix API listener was never created');
+        const deadline = Date.now() + 20_000;
+        let health;
+        while (Date.now() < deadline) {
+            try {
+                const response = await requestJson(fixture.tcpPort, '/healthz');
+                if (response.status === 503) {
+                    health = response;
+                    break;
+                }
+            }
+            catch {
+                // The repair listener has not bound yet.
+            }
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+        assert.ok(health, `source daemon did not reach restricted startup:\n${daemon.stderr()}`);
+        assert.equal(daemon.child.exitCode, null, `blocker must keep daemon alive; stderr:\n${daemon.stderr()}`);
+        assert.deepEqual(health.body, {
+            ok: false,
+            daemon_up: true,
+            store_accessible: true,
+            brokers_reconciled: false,
+            startup_phase: 'blocked',
+            startup_blocked: health.body.startup_blocked,
+        });
+        assert.match(health.body.startup_blocked, new RegExp(blockerPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+        assert.match(health.body.startup_blocked, /Repair: crtr sys migrate/);
+        const status = await requestJson(fixture.tcpPort, '/v1/status');
+        assert.equal(status.status, 200, 'restricted startup keeps daemon status diagnostic available');
+        const refused = await requestJson(fixture.tcpPort, '/v1/nodes', { method: 'POST', body: '{}' });
+        assert.equal(refused.status, 503, 'normal node creation is refused during restricted startup');
+        assert.deepEqual(refused.body, {
+            error: { code: 'startup_blocked', message: health.body.startup_blocked },
+        });
+        const repair = await requestJson(fixture.tcpPort, '/v1/daemon/migrate', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ dry_run: true }),
+        });
+        assert.equal(repair.status, 200, 'the restricted daemon serves a repair preview');
+        assert.equal(repair.body.blocked, true);
+        assert.equal(repair.body.dryRun, true);
+        assert.equal(repair.body.resumed, false);
+        assert.equal(existsSync(fixture.pidfile), true, 'the live owner mirror remains while startup is blocked');
+        assert.equal(existsSync(fixture.socket), true, 'the repair socket remains while startup is blocked');
         assert.equal(existsSync(join(fixture.canvasHome, 'on-disk-migrations.json')), false, 'blocker never gets a completion marker');
         assert.deepEqual(brokerPidsForCanvas(fixture.canvasHome), [], 'no broker process declares the isolated canvas');
-        assert.deepEqual([...effectNames].filter((name) => name === 'ready.pid' || name === 'crtrd.sock'), [], `filesystem watcher saw no transient readiness or broker effects (all events: ${[...effectNames].join(', ')})`);
     }
     finally {
+        const exit = await daemon.stop();
         fixture.dispose();
+        assert.deepEqual(exit, { code: 0, signal: null }, `daemon must stop cleanly; stderr:\n${daemon.stderr()}`);
     }
 });

package/dist/daemon/__tests__/node-deadline-lane.test.js

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../../core/canvas/db.js';
+import { closeDb, migrate, openDb } from '../../core/canvas/db.js';
 import { createNode, dueNodeDeadlines, getRow } from '../../core/canvas/canvas.js';
 import { pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
@@ -30,6 +30,7 @@ beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-node-deadline-'));
     process.env['CRTR_HOME'] = home;
+    migrate(openDb());
 });
 afterEach(() => {
     closeDb();

package/dist/daemon/__tests__/node-outcome-birth-invariants.test.js

@@ -3,15 +3,17 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../../core/canvas/db.js';
+import { closeDb, migrate, openDb, withCanvasWrite } from '../../core/canvas/db.js';
+import { initializeFreshScopedStore } from '../../core/scoped-state/migrate.js';
 import { createNode, getRow, transitionStatusIntent } from '../../core/canvas/canvas.js';
-import { armOutcomeDelivery, readOutcomeDelivery } from '../../core/canvas/node-outcome-deliveries.js';
+import { armExternalActionDelivery, messageBodyForDelivery, readExternalActionDelivery } from '../../core/canvas/deliveries.js';
 import { pushFinal } from '../../core/feed/feed.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { spawnNode } from '../../core/runtime/nodes.js';
 import { spawnChildPrepared } from '../../core/runtime/spawn.js';
 let home;
 const priorHome = process.env.CRTR_HOME;
+const priorUserHome = process.env.HOME;
 function node(nodeId, opts = {}) {
     return {
         node_id: nodeId,
@@ -32,10 +34,27 @@ const binding = {
     configOrigin: 'test',
     payload: { callback: 'one' },
 };
+function outcomeDelivery(nodeId) {
+    return readExternalActionDelivery(`node-outcome:${nodeId}`);
+}
+function outcomePayload(nodeId) {
+    const adapter = outcomeDelivery(nodeId)?.adapter;
+    return adapter?.payload ?? null;
+}
+function armOutcomeAction(nodeId, input = binding) {
+    withCanvasWrite((db) => armExternalActionDelivery(db, {
+        destinationId: input.actionName,
+        adapter: { adapter: 'subprocess', argv: input.argv, cwd: input.cwd, config_origin: input.configOrigin, payload: input.payload },
+        idempotencyKey: `node-outcome:${nodeId}`,
+    }));
+}
 beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-outcome-birth-'));
     process.env.CRTR_HOME = home;
+    process.env.HOME = home;
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
 });
 afterEach(() => {
     closeDb();
@@ -46,6 +65,10 @@ after(() => {
         delete process.env.CRTR_HOME;
     else
         process.env.CRTR_HOME = priorHome;
+    if (priorUserHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = priorUserHome;
 });
 test('birth commits the requested deadline and outcome registration before spawn orchestration can launch a broker', async () => {
     const deadlineAt = '2026-01-01T00:00:00.000Z';
@@ -57,10 +80,10 @@ test('birth commits the requested deadline and outcome registration before spawn
         outcomeDelivery: binding,
     });
     assert.equal(getRow(born.node_id)?.deadline_at, deadlineAt);
-    assert.deepEqual(readOutcomeDelivery(born.node_id) && {
-        state: readOutcomeDelivery(born.node_id).state,
-        action: readOutcomeDelivery(born.node_id).actionName,
-        payload: readOutcomeDelivery(born.node_id).payload,
+    assert.deepEqual(outcomeDelivery(born.node_id) && {
+        state: outcomeDelivery(born.node_id).state,
+        action: outcomeDelivery(born.node_id).destinationId,
+        payload: outcomePayload(born.node_id),
     }, {
         state: 'armed',
         action: 'test-action',
@@ -71,7 +94,7 @@ test('a pre-launch spawn failure leaves its caller-requested outcome delivery pe
     let nodeId;
     await assert.rejects(() => spawnChildPrepared({
         kind: 'general',
-        cwd: process.cwd(),
+        cwd: home,
         root: true,
         profile: null,
         prompt: '',
@@ -83,12 +106,12 @@ test('a pre-launch spawn failure leaves its caller-requested outcome delivery pe
     }), /simulated pre-launch failure/);
     assert.ok(nodeId);
     assert.equal(getRow(nodeId)?.outcome_reason, 'launch_failed');
-    assert.equal(readOutcomeDelivery(nodeId)?.state, 'pending');
-    assert.ok(readOutcomeDelivery(nodeId)?.document);
+    assert.equal(outcomeDelivery(nodeId)?.state, 'pending');
+    assert.ok(messageBodyForDelivery(outcomeDelivery(nodeId).deliveryId));
 });
 test('an armed delivery cannot become pending without its outcome document', () => {
     createNode(node('guarded'));
-    armOutcomeDelivery({ nodeId: 'guarded', ...binding });
+    armOutcomeAction('guarded');
     transitionStatusIntent('guarded', { status: 'dead', terminal_reason: 'crashed' }, {
         outcome: {
             kind: 'failure',
@@ -98,16 +121,17 @@ test('an armed delivery cannot become pending without its outcome document', ()
             documentJson: null,
         },
     });
-    const delivery = readOutcomeDelivery('guarded');
+    const delivery = outcomeDelivery('guarded');
     assert.equal(delivery?.state, 'armed');
-    assert.equal(delivery?.document, null);
+    assert.equal(messageBodyForDelivery(delivery.deliveryId), null);
 });
-test('late registration composes the latched terminal view from hydrated node identity', () => {
+test('terminal transition composes the latched terminal view from hydrated node identity', () => {
     createNode(node('late', { spawned_by: 'origin' }));
+    armOutcomeAction('late');
     transition('late', 'crash');
     transition('late', 'revive');
-    const delivery = armOutcomeDelivery({ nodeId: 'late', ...binding });
-    const document = delivery?.document;
+    const delivery = outcomeDelivery('late');
+    const document = messageBodyForDelivery(delivery.deliveryId);
     assert.equal(document.node.status, 'dead');
     assert.equal(document.node.terminalReason, 'crashed');
     assert.equal(document.node.spawnedBy, 'origin');

package/dist/daemon/__tests__/node-outcome-delivery.test.js

@@ -3,27 +3,48 @@ import assert from 'node:assert/strict';
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../../core/canvas/db.js';
+import { closeDb, migrate, openDb, withCanvasWrite } from '../../core/canvas/db.js';
+import { initializeFreshScopedStore } from '../../core/scoped-state/migrate.js';
+import { closeScopedStores } from '../../core/scoped-state/db.js';
 import { createNode } from '../../core/canvas/canvas.js';
 import { isPidAlive, killProcessGroup } from '../../core/canvas/pid.js';
-import { armOutcomeDelivery, claimOutcomeDelivery, readOutcomeDelivery } from '../../core/canvas/node-outcome-deliveries.js';
+import { armExternalActionDelivery, claimExternalActionDelivery, messageBodyForDelivery, readExternalActionDelivery, settleDelivery } from '../../core/canvas/deliveries.js';
 import { transition } from '../../core/runtime/lifecycle.js';
 import { DELIVERY_TIMEOUT_MS } from '../delivery/run-delivery.js';
-import { deliverOutcome } from '../node-outcome/deliver-outcome.js';
+import { runDelivery } from '../delivery/run-delivery.js';
 let home;
 let processGroupFiles;
 const priorHome = process.env.CRTR_HOME;
+const priorUserHome = process.env.HOME;
 function node(nodeId) {
     return { node_id: nodeId, name: nodeId, created: new Date().toISOString(), cwd: home, kind: 'general', mode: 'base', lifecycle: 'terminal', status: 'active' };
 }
+function outcomeDelivery(nodeId) {
+    return readExternalActionDelivery(`node-outcome:${nodeId}`);
+}
+async function deliverOutcome(delivery, claimOwner) {
+    const adapter = delivery.adapter;
+    if (adapter?.adapter !== 'subprocess' || !Array.isArray(adapter.argv) || !adapter.argv.every((entry) => typeof entry === 'string') || typeof adapter.cwd !== 'string')
+        throw new Error(`outcome delivery ${delivery.deliveryId} has an invalid subprocess adapter`);
+    const document = messageBodyForDelivery(delivery.deliveryId);
+    if (document === null)
+        throw new Error(`outcome delivery ${delivery.deliveryId} has no document`);
+    await runDelivery({ argv: adapter.argv, cwd: adapter.cwd, document, attempt: delivery.attempts }, (settlement) => settleDelivery(delivery.deliveryId, delivery.attempts, claimOwner, settlement, Date.now()));
+}
 function claimScript(id, script) {
     const path = join(home, `${id}.sh`);
     writeFileSync(path, script);
     chmodSync(path, 0o755);
     createNode(node(id));
-    armOutcomeDelivery({ nodeId: id, actionName: 'test', argv: [path], cwd: home, configOrigin: 'test' });
+    withCanvasWrite((db) => armExternalActionDelivery(db, {
+        destinationId: 'test',
+        adapter: { adapter: 'subprocess', argv: [path], cwd: home, config_origin: 'test' },
+        idempotencyKey: `node-outcome:${id}`,
+    }));
     transition(id, 'crash');
-    const delivery = claimOutcomeDelivery(id, Date.now(), 'test-daemon');
+    const action = outcomeDelivery(id);
+    assert.ok(action);
+    const delivery = claimExternalActionDelivery(action.deliveryId, Date.now(), 'test-daemon');
     assert.ok(delivery);
     return delivery;
 }
@@ -31,6 +52,9 @@ beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-outcome-delivery-'));
     process.env.CRTR_HOME = home;
+    process.env.HOME = home;
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
     processGroupFiles = [];
 });
 afterEach(() => {
@@ -42,6 +66,7 @@ afterEach(() => {
             killProcessGroup(pid, 'SIGKILL');
     }
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
 });
 after(() => {
@@ -49,19 +74,23 @@ after(() => {
         delete process.env.CRTR_HOME;
     else
         process.env.CRTR_HOME = priorHome;
+    if (priorUserHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = priorUserHome;
 });
 test('exit acknowledgments settle outcome delivery durably', async () => {
     const accepted = claimScript('accepted', '#!/bin/sh\necho ignored\necho diagnostic >&2\nexit 0\n');
     await deliverOutcome(accepted, 'test-daemon');
-    assert.equal(readOutcomeDelivery('accepted')?.state, 'accepted');
+    assert.equal(outcomeDelivery('accepted')?.state, 'acknowledged');
     const permanent = claimScript('permanent', '#!/bin/sh\nexit 78\n');
     await deliverOutcome(permanent, 'test-daemon');
-    assert.equal(readOutcomeDelivery('permanent')?.state, 'permanent_failed');
+    assert.equal(outcomeDelivery('permanent')?.state, 'permanent_failed');
     const retry = claimScript('retry', '#!/bin/sh\necho retry-stderr >&2\nexit 1\n');
     await deliverOutcome(retry, 'test-daemon');
-    const row = readOutcomeDelivery('retry');
+    const row = outcomeDelivery('retry');
     assert.equal(row?.state, 'pending');
-    assert.ok(row.nextAttemptAt > Date.now());
+    assert.ok(row?.nextAttemptAt !== null && row?.nextAttemptAt !== undefined && row.nextAttemptAt > Date.now());
     assert.equal(row?.lastFailure?.kind, 'exit');
     assert.equal(row?.lastFailure?.stderr, 'retry-stderr\n');
 });
@@ -78,7 +107,7 @@ test('timeout SIGKILL escalation reaps a SIGTERM-ignoring descendant after its l
     finally {
         global.setTimeout = originalSetTimeout;
     }
-    const row = readOutcomeDelivery('timeout');
+    const row = outcomeDelivery('timeout');
     assert.equal(row?.state, 'pending');
     assert.equal(row?.lastFailure?.kind, 'timeout');
     const pid = Number(readFileSync(childPid, 'utf8').trim());

package/dist/daemon/__tests__/reconciler-signature.test.js

@@ -12,7 +12,7 @@ import { BrokerSupervisionReconciler } from '../reconcilers/broker-supervision.j
 import { ControllerDeathReconciler } from '../reconcilers/controller-death.js';
 import { NodeLifecycleReconciler } from '../reconcilers/node-lifecycle/tick.js';
 import { CronLaneReconciler } from '../reconcilers/cron-lane.js';
-import { HumanDeliveryLaneReconciler } from '../reconcilers/human-delivery-lane.js';
+import { DeliveryLaneReconciler } from '../reconcilers/delivery-lane.js';
 import { PendingReviewSubmitReconciler } from '../reconcilers/pending-review-submit.js';
 import { StorageMaintenanceReconciler } from '../reconcilers/storage-maintenance.js';
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -21,7 +21,7 @@ const RECONCILERS = [
     ['ControllerDeathReconciler', ControllerDeathReconciler],
     ['NodeLifecycleReconciler', NodeLifecycleReconciler],
     ['CronLaneReconciler', CronLaneReconciler],
-    ['HumanDeliveryLaneReconciler', HumanDeliveryLaneReconciler],
+    ['DeliveryLaneReconciler', DeliveryLaneReconciler],
     ['PendingReviewSubmitReconciler', PendingReviewSubmitReconciler],
     ['StorageMaintenanceReconciler', StorageMaintenanceReconciler],
 ];