@north-light/crouter 0.3.312 → 0.3.314

package/dist/core/__tests__/integration/profile-pause.test.js

@@ -4,7 +4,7 @@ import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { contextDir } from '../../canvas/paths.js';
 import { getRow } from '../../canvas/canvas.js';
 import { bashJobPaths, bashJobsDir } from '../../bash-jobs.js';
-import { readCursor } from '../../feed/inbox.js';
+import { acknowledgedNodeMailCount } from '../../canvas/deliveries.js';
 import { transition } from '../../runtime/lifecycle.js';
 import { ensureRootProfile, pauseProfile } from '../../profiles/manifest.js';
 import { createHeadlessHarness } from '../helpers/harness.js';
@@ -22,7 +22,7 @@ function runningJob(nodeId) {
     }
     return undefined;
 }
-test('profile pause backgrounds real bash, retains its inbox cursor, and recovers after a quick resume without failure', { timeout: 120_000 }, async () => {
+test('profile pause backgrounds real bash, retains its queued SQL delivery, and recovers after a quick resume without failure', { timeout: 120_000 }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-profile-pause' });
     try {
         const profile = ensureRootProfile();
@@ -39,7 +39,7 @@ test('profile pause backgrounds real bash, retains its inbox cursor, and recover
         assert.equal(retained.code, 0, retained.stderr);
         const retainedEntry = h.inbox(child).find((entry) => entry.data?.['body'] === 'mail retained while profile is paused');
         assert.ok(retainedEntry, 'the message was durably appended');
-        assert.equal(readCursor(child), undefined, 'pause leaves the durable inbox cursor unadvanced');
+        assert.equal(acknowledgedNodeMailCount(child), 0, 'pause leaves the queued SQL delivery unacknowledged');
         const resumed = h.cli(null, ['profile', 'resume', profile.profileId]);
         assert.equal(resumed.code, 0, resumed.stderr);
         await h.awaitFleetExit(child);
@@ -47,7 +47,7 @@ test('profile pause backgrounds real bash, retains its inbox cursor, and recover
         assert.equal(existsSync(job.jobRun), false, 'the foreground valve ownership is gone');
         await h.waitFor(() => existsSync(job.jobExit), { label: 'background bash completion' });
         assert.equal(readFileSync(job.jobExit, 'utf8').trim(), '0', 'the handoff command completed after its broker exited');
-        assert.equal(readCursor(child), undefined, 'neither retained message nor background completion advanced the stopped broker cursor');
+        assert.equal(acknowledgedNodeMailCount(child), 0, 'neither retained message nor background completion acknowledges the stopped broker delivery');
         await h.tick();
         assert.equal(h.bootCount(child), 1, 'the first resumed policy pass only consumes the pause interruption');
         assert.equal(getRow(child)?.respawn_failures, 0, 'the intentional SIGTERM never counts as a crash');

package/dist/core/__tests__/integration/refresh-stall-recycle.test.js

@@ -21,13 +21,10 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { utimesSync } from 'node:fs';
-import { join } from 'node:path';
 import { createHeadlessHarness } from '../helpers/harness.js';
-import { getRow, recordLaunch, recordPid } from '../../canvas/canvas.js';
-import { jobDir } from '../../canvas/paths.js';
+import { getRow } from '../../canvas/canvas.js';
+import { abortExecution, beginExecution, recordExecutionPid } from '../../canvas/executions.js';
 import { isPidAlive } from '../../canvas/pid.js';
-import { markBusy } from '../../runtime/busy.js';
 import { BrokerSupervisionReconciler, yieldStallVerdict, YIELD_STALL_GRACE_MS } from '../../../daemon/reconcilers/broker-supervision.js';
 // D4a — the pure refresh-stall truth table.
 test('D4a yieldStallVerdict: kill ONLY a live, not-busy, refresh engine past the grace', () => {
@@ -61,7 +58,8 @@ test('D4b daemon force-recycles a stuck refresh: a live, not-busy refresh engine
         // A live broker records its launch-time identity with its pid. The force
         // signal re-verifies that identity, so this fixture must model the
         // production record rather than a legacy identity-less row.
-        recordPid(id, enginePid);
+        const executionId = beginExecution(id, { daemonEpoch: h.fleet.epoch() });
+        recordExecutionPid(executionId, id, enginePid);
         // Post-cutover the live-fleet pass iterates fleet ENTRIES, not rows: a
         // live broker IS a fleet entry (design D-1). Model the launch-time
         // registration the production host performs, with a never-resolving
@@ -103,8 +101,8 @@ test('D4c yield escalation is scoped to the broker that received SIGTERM', { tim
             pi_pid: original.pid,
             pi_session_id: 'sess-d4c',
         });
-        recordLaunch(id, new Date(T0).toISOString());
-        recordPid(id, original.pid);
+        const originalExecution = beginExecution(id, { daemonEpoch: h.fleet.epoch() });
+        recordExecutionPid(originalExecution, id, original.pid);
         h.fleet.register(id, { pid: original.pid, exited: new Promise(() => { }) });
         const supervisor = new BrokerSupervisionReconciler();
         const context = () => ({
@@ -119,15 +117,14 @@ test('D4c yield escalation is scoped to the broker that received SIGTERM', { tim
             timeoutMs: 10_000,
         });
         h.fleet.forget(id);
-        markBusy(id); // interrupted predecessor witness must not block the replacement's refresh timer
-        utimesSync(join(jobDir(id), 'busy'), T_KILL / 1_000, T_KILL / 1_000);
+        abortExecution(originalExecution, { reason: 'test replacement' });
         replacement = spawn(process.execPath, ['-e', 'process.on("SIGTERM", () => {}); console.log("ready"); setInterval(() => {}, 1000)'], { stdio: ['ignore', 'pipe', 'ignore'] });
         await new Promise((resolve, reject) => {
             replacement.stdout.once('data', () => resolve());
             replacement.once('error', reject);
         });
-        recordLaunch(id, new Date(T_KILL + 1).toISOString());
-        recordPid(id, replacement.pid);
+        const replacementExecution = beginExecution(id, { daemonEpoch: h.fleet.epoch() });
+        recordExecutionPid(replacementExecution, id, replacement.pid);
         h.fleet.register(id, { pid: replacement.pid, exited: new Promise(() => { }) });
         const replacementStarted = T_KILL + KILL_ESCALATE_MS + 1;
         await supervisor.run(replacementStarted, context());

package/dist/core/__tests__/integration/revive.test.js

@@ -34,8 +34,12 @@ import { join } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createNode, deleteNode, getNode, subscribe, updateNode } from '../../canvas/canvas.js';
 import { armCron, getCron } from '../../canvas/crons.js';
-import { readInboxSince } from '../../feed/inbox.js';
-import { closeDb } from '../../canvas/db.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
+import { closeScopedStores } from '../../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
+import { userScopeRoot } from '../../scope.js';
+import { resetSession } from '../../canvas/sessions.js';
+import { liveExecutionForNode } from '../../canvas/executions.js';
 import { apiSocketPath } from '../../canvas/paths.js';
 import { buildPiArgv } from '../../runtime/launch.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
@@ -45,12 +49,15 @@ import { parseCard } from '../../../shared/generated-context.js';
 import { seedRoadmap } from '../../runtime/roadmap.js';
 import { InputError } from '../../io.js';
 import { CrtrClient } from '../../../api/client.js';
-import { readFault } from '../../runtime/fault.js';
+import { readFault } from '../../canvas/recovery.js';
 import { createHarness } from '../helpers/harness.js';
 import { bindTestFleet } from '../helpers/fleet.js';
 import { resetFleetForTests } from '../../runtime/fleet.js';
 import { emptyContextExposureState, exposureTarget, initializeForkContextExposure, loadContextExposureState, registerExposure, saveContextExposureState, } from '../../substrate/injected-store.js';
 let home;
+let scopeCwd;
+let originalCwd;
+let originalHome;
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -64,6 +71,26 @@ function node(id, over = {}) {
         ...over,
     };
 }
+function fabricateInScope(h, options = {}) {
+    const id = h.fabricateBrokerNode(options);
+    updateNode(id, { cwd: scopeCwd });
+    return id;
+}
+function createNodeWithSession(meta) {
+    createNode(meta);
+    if (meta.pi_session_id !== undefined || meta.pi_session_file !== undefined) {
+        resetSession(meta.node_id, { sessionId: meta.pi_session_id ?? '', transcriptPath: meta.pi_session_file ?? null });
+    }
+}
+function wakeMail(nodeId) {
+    return openDb().prepare(`SELECT m.sender_node_id AS "from", m.body_json AS data
+    FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+    WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 1
+    ORDER BY m.seq`).all(nodeId).map((row) => {
+        const mail = row;
+        return { from: mail.from, data: mail.data === null ? null : JSON.parse(mail.data) };
+    });
+}
 /** A launch prompt is the fresh-revive kickoff when it carries that card kind. */
 function isReviveKickoff(arg) {
     return parseCard({ role: 'user', content: arg })?.kind === 'revive';
@@ -88,16 +115,33 @@ before(() => {
     // to /private/var, and the runtime resolves a fork's durable source file, so a
     // raw temp path would compare unequal to the very path the runtime replays.
     home = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-revive-')));
+    scopeCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-revive-scope-')));
+    originalCwd = process.cwd();
+    originalHome = process.env['HOME'];
+    process.chdir(scopeCwd);
+    process.env['HOME'] = scopeCwd;
     process.env['CRTR_HOME'] = home;
 });
 beforeEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    rmSync(userScopeRoot(), { recursive: true, force: true });
+    migrate(openDb());
+    initializeFreshScopedStore({ kind: 'user', root: userScopeRoot() });
 });
 after(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    rmSync(userScopeRoot(), { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    process.chdir(originalCwd);
+    rmSync(scopeCwd, { recursive: true, force: true });
+    if (originalHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = originalHome;
     for (const pid of livePids) {
         try {
             process.kill(pid, 'SIGKILL');
@@ -188,7 +232,7 @@ test('a resumed revive replays the persisted LaunchSpec (model, tools, extension
             env: { FOO: 'bar' },
         },
     });
-    createNode(m); // scaffolds the node dir so the system prompt persists to a file
+    createNodeWithSession(m); // scaffolds the node dir so the system prompt persists to a file
     const { argv, env } = buildPiArgv(m, resumeArgs(m, true));
     // Persona extensions, in order.
     const ea = argv.indexOf('/ext/a.js');
@@ -223,7 +267,7 @@ test('reviveNode no-ops when the node has a live fleet entry — double-revive g
         // synchronously, so a live entry means a broker is already on this .jsonl
         // and re-launching would double-spawn onto it. No pid probe is involved
         // anywhere — the entry alone is the authority.
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active',
             intent: null,
             pi_pid: deadPid(),
@@ -251,7 +295,7 @@ test('reviveNode PROCEEDS when the node has NO fleet entry — cycle counter bum
         const stalePid = deadPid();
         mkdirSync(join(home, 'sessions'), { recursive: true });
         writeFileSync(sessionFile, '{}\n', 'utf8');
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active',
             intent: null,
             pi_pid: stalePid,
@@ -301,11 +345,11 @@ function armDeadline(anchor, cronId) {
 test('a recovery relaunch keeps the armed deadline; a wake revive consumes it', async () => {
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-deadline' });
     try {
-        const recovered = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
+        const recovered = fabricateInScope(h, { status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-1' });
         armDeadline(recovered, 'cron-recovery');
         await reviveNode(recovered, { resume: true, recovery: true, capacity: 'freeze' });
         assert.equal(getCron('cron-recovery') !== null, true, 'the daemon replacing a dead broker is not a wake — the deadline survives so the wait can still settle');
-        const woken = h.fabricateBrokerNode({ status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
+        const woken = fabricateInScope(h, { status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'uuid-2' });
         armDeadline(woken, 'cron-wake');
         await reviveNode(woken, { resume: true, capacity: 'freeze' });
         assert.equal(getCron('cron-wake'), null, 'a wake revive won the race and cancels the deadline');
@@ -320,15 +364,17 @@ test('a second broker session-bound request is shut down instead of adopting a l
         const sessionFile = join(home, 'sessions', 'owned.jsonl');
         mkdirSync(join(home, 'sessions'), { recursive: true });
         writeFileSync(sessionFile, '{}\n', 'utf8');
-        const owner = h.fabricateBrokerNode({
+        const owner = fabricateInScope(h, {
             id: 'live-session-owner',
             pi_pid: process.pid,
             pi_session_id: 'owner-session',
             pi_session_file: sessionFile,
         });
-        const claimant = h.fabricateBrokerNode({ id: 'session-claimant', pi_pid: deadPid() });
+        const claimant = fabricateInScope(h, { id: 'session-claimant', pi_pid: process.pid });
         const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
+        assert.equal(getNode(owner)?.pi_pid, process.pid, 'the owner has a live SQL execution');
         const result = await client.bindBrokerSession(claimant, {
+            executionId: liveExecutionForNode(claimant).executionId,
             piSessionId: 'claimant-session', sessionFile, pid: process.pid, reason: 'startup', reviewBoundaryIds: [],
         });
         assert.deepEqual(result, { action: 'shutdown' }, 'the second broker is refused before it can bind the live transcript');
@@ -351,7 +397,7 @@ test('reviveNode fresh-fallback clears the stale session identity (Major-3: no p
         // retried forever instead of surfaced as a boot failure.
         const missingFile = join(home, 'sessions', 'never-written.jsonl');
         const stalePid = deadPid();
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active',
             intent: null,
             pi_pid: stalePid,
@@ -378,7 +424,7 @@ test('unbound forks replay one durable source file for node-id, path, and UUID o
     try {
         mkdirSync(home, { recursive: true });
         writeFileSync(forkFile, '{}\n', 'utf8');
-        createNode(node('ordinary-fork-source', { cwd: home, pi_session_file: forkFile }));
+        createNodeWithSession(node('ordinary-fork-source', { cwd: home, pi_session_file: forkFile }));
         const sourceExposure = emptyContextExposureState();
         registerExposure(exposureTarget(sourceExposure, 'system'), 'source-system-only', 'content');
         registerExposure(exposureTarget(sourceExposure, 'transcript'), 'source-transcript', 'content');
@@ -392,7 +438,7 @@ test('unbound forks replay one durable source file for node-id, path, and UUID o
         const operands = ['ordinary-fork-source', forkFile, '019e8ce3-322e-7000-8000-000000000001'];
         for (const [index, operand] of operands.entries()) {
             const destination = `ordinary-fork-${index}`;
-            createNode(node(destination, {
+            createNodeWithSession(node(destination, {
                 cwd: home,
                 fork_from: operand,
                 fork_source_file: forkFile,
@@ -431,7 +477,7 @@ test('reviveNode throws a typed cwd_missing error and does NOT crash the node wh
     const h = await createHarness({ headless: true, sessionPrefix: 'crtr-revive-cwdmissing' });
     try {
         const missingCwd = join(home, 'never-created-cwd');
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active',
             intent: null,
             pi_pid: deadPid(),
@@ -452,7 +498,7 @@ test('reviveNode relaunches fresh when the session header cwd was removed (NL-14
         const sessionFile = join(home, 'sessions', 'stale-cwd.jsonl');
         mkdirSync(join(home, 'sessions'), { recursive: true });
         writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'stale-session', cwd: removedCwd })}\n`, 'utf8');
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active', intent: null, pi_pid: deadPid(), pi_session_id: 'stale-session', pi_session_file: sessionFile,
         });
         const result = await reviveNode(M, { resume: true, capacity: 'freeze', recovery: true });
@@ -471,7 +517,7 @@ test('reviveNode crashes and clears pid when launch/preflight throws', async ()
         const sessionFile = join(home, 'sessions', 'crtr-revive-fail.jsonl');
         mkdirSync(join(home, 'sessions'), { recursive: true });
         writeFileSync(sessionFile, '{}\n', 'utf8');
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             status: 'active',
             intent: null,
             pi_pid: deadPid(),
@@ -500,7 +546,7 @@ test('reviveNode fans a doctrine wake to subscribers when launch/preflight throw
         const sessionFile = join(home, 'sessions', 'crtr-revive-crashwake.jsonl');
         mkdirSync(join(home, 'sessions'), { recursive: true });
         writeFileSync(sessionFile, '{}\n', 'utf8');
-        const M = h.fabricateBrokerNode({
+        const M = fabricateInScope(h, {
             parent: root,
             status: 'active',
             intent: null,
@@ -514,7 +560,7 @@ test('reviveNode fans a doctrine wake to subscribers when launch/preflight throw
         headlessBrokerHost.launch = (_nodeId, _inv, _opts) => { throw new Error('boom'); };
         await assert.rejects(reviveNode(M, { resume: true, capacity: 'freeze' }), /refusing to revive/i);
         assert.equal(h.node(M).status, 'dead', 'failed revive marks the node dead');
-        const entries = readInboxSince(root, undefined);
+        const entries = wakeMail(root);
         const notice = entries.find((e) => e.data?.['reason'] === 'child-crashed' && e.data?.['child'] === M);
         assert.ok(notice !== undefined, 'the surviving parent got a doctrine wake for the dead child');
         assert.equal(notice.from, M, 'the notice is attributed to the crashed child');
@@ -546,18 +592,18 @@ test('an unstarted node relaunches as a birth, not a "revived fresh" kickoff', a
         };
         const missing = join(home, 'sessions', 'never-written.jsonl');
         // (1) Bare interactive node — nothing on disk anywhere: launch promptless.
-        createNode(node('bare-unstarted', { cwd: home, pi_session_id: 'uuid-a', pi_session_file: missing }));
+        createNodeWithSession(node('bare-unstarted', { cwd: home, pi_session_id: 'uuid-a', pi_session_file: missing }));
         await reviveNode('bare-unstarted', { resume: true, capacity: 'freeze' });
         const bare = launches[0];
         assert.equal(bare.some((a) => isReviveKickoff(a)), false, 'an unstarted node is never told it lost context it never had');
         assert.deepEqual(bare, buildPiArgv(getNode('bare-unstarted'), {}).argv, 'a promptless boot — the argv carries no trailing prompt positional at all');
         // (2) Spawned with a mandate whose first turn never persisted: replay it.
-        createNode(node('mandate-unstarted', { cwd: home, pi_session_id: 'uuid-b', pi_session_file: missing }));
+        createNodeWithSession(node('mandate-unstarted', { cwd: home, pi_session_id: 'uuid-b', pi_session_file: missing }));
         writeGoal('mandate-unstarted', 'do the thing');
         await reviveNode('mandate-unstarted', { resume: true, capacity: 'freeze' });
         assert.equal(launches[1].at(-1), 'do the thing', 'a birth replays the spawn mandate');
         // (3) Real durable progress on disk → still a genuine fresh revive.
-        createNode(node('progressed', { cwd: home, pi_session_id: 'uuid-c', pi_session_file: missing }));
+        createNodeWithSession(node('progressed', { cwd: home, pi_session_id: 'uuid-c', pi_session_file: missing }));
         seedRoadmap('progressed', { goal: 'ship it' });
         await reviveNode('progressed', { resume: true, capacity: 'freeze' });
         assert.equal(isReviveKickoff(launches[2].at(-1)), true, 'a node with a roadmap still rebuilds from the kickoff');

package/dist/core/__tests__/integration/spawn-root.test.js

@@ -9,9 +9,13 @@ import { join } from 'node:path';
 import { createServer } from 'node:net';
 import { spawn as spawnProcess } from 'node:child_process';
 import { createNode, getNode, getRow, subscribersOf } from '../../canvas/canvas.js';
-import { coalesce, readInboxSince } from '../../feed/inbox.js';
+import { coalesce } from '../../feed/inbox.js';
 import { coalesceBrokerInbox } from '../../runtime/broker/inbox.js';
-import { closeDb } from '../../canvas/db.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
+import { resetSession } from '../../canvas/sessions.js';
+import { closeScopedStores } from '../../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
+import { userScopeRoot } from '../../scope.js';
 import { nodeDir } from '../../canvas/paths.js';
 import { spawnNode } from '../../runtime/nodes.js';
 import { readGoal } from '../../runtime/kickoff.js';
@@ -19,12 +23,35 @@ import { spawnChild, resolveSpawner } from '../../runtime/spawn.js';
 import { headlessBrokerHost } from '../../runtime/host.js';
 import { resetFleetForTests } from '../../runtime/fleet.js';
 import { bindTestFleet } from '../helpers/fleet.js';
-import { recordFault } from '../../runtime/fault.js';
+import { recordFault } from '../../canvas/recovery.js';
 import { piSessionsRoot } from '../../runtime/pi-vendored.js';
 import { emptyContextExposureState, exposureTarget, loadContextExposureState, registerExposure, saveContextExposureState, } from '../../substrate/injected-store.js';
 import { ROOT_PROFILE_ID } from '../../profiles/manifest.js';
 let home;
+let scopedHome;
+let previousHome;
 let previousPidfile;
+function initializeTestUserScope() {
+    initializeFreshScopedStore({ kind: 'user', root: userScopeRoot() });
+}
+function mailFor(nodeId) {
+    return openDb().prepare(`SELECT m.message_id, m.operation_id, m.created_at, m.sender_node_id, m.sender_name, m.kind, m.label, m.body_ref, m.body_json, m.disposition, d.urgency
+       FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+      WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.canceled_at IS NULL
+      ORDER BY m.seq`).all(nodeId).map((row) => ({
+        entry_id: row['message_id'],
+        operation_id: row['operation_id'],
+        ts: row['created_at'],
+        from: row['sender_node_id'],
+        ...(row['sender_name'] === null ? {} : { from_name: row['sender_name'] }),
+        tier: row['urgency'],
+        kind: row['kind'],
+        ...(row['body_ref'] === null ? {} : { ref: row['body_ref'] }),
+        label: row['label'],
+        ...(row['body_json'] === null ? {} : { data: JSON.parse(row['body_json']) }),
+        ...(row['disposition'] === null ? {} : { disposition: row['disposition'] }),
+    }));
+}
 function spawner(id) {
     return {
         node_id: id,
@@ -41,6 +68,9 @@ before(() => {
     // Unix-domain socket paths are capped at ~104 bytes on macOS; keep the
     // canvas home short because root readiness now opens a real view.sock.
     home = mkdtempSync('/tmp/crtr-spawn-root-');
+    scopedHome = mkdtempSync('/tmp/crtr-spawn-root-scope-');
+    previousHome = process.env['HOME'];
+    process.env['HOME'] = scopedHome;
     process.env['CRTR_HOME'] = home;
     previousPidfile = process.env['CRTR_PIDFILE'];
     process.env['CRTR_PIDFILE'] = join(home, 'crtrd.pid');
@@ -50,8 +80,12 @@ before(() => {
 });
 beforeEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    rmSync(userScopeRoot(), { recursive: true, force: true });
     mkdirSync(home, { recursive: true });
+    migrate(openDb());
+    initializeTestUserScope();
     // These tests exercise direct spawn behavior, not daemon autostart. Keep
     // ensureDaemon() from launching a background daemon whose startup verifier
     // would outlive the test's next CRTR_HOME reset.
@@ -59,8 +93,14 @@ beforeEach(() => {
 });
 after(() => {
     closeDb();
+    closeScopedStores();
     resetFleetForTests();
     rmSync(home, { recursive: true, force: true });
+    rmSync(scopedHome, { recursive: true, force: true });
+    if (previousHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = previousHome;
     if (previousPidfile === undefined)
         delete process.env['CRTR_PIDFILE'];
     else
@@ -84,7 +124,7 @@ test('external child birth is deferred, persists its creator, and renders its ag
     const child = await spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: creator.node_id, name: 'worker' });
     const saved = getNode(child.node_id);
     assert.equal(saved.creator, creator.node_id, 'creator persists through meta.json and getNode');
-    const [entry] = readInboxSince('A');
+    const [entry] = mailFor('A');
     assert.ok(entry, 'the parent receives exactly one birth entry');
     assert.equal(entry.from, child.node_id, 'birth groups with the child’s future reports');
     assert.equal(entry.tier, 'deferred', 'birth never starts a parent cycle');
@@ -107,9 +147,9 @@ test('external child birth is deferred, persists its creator, and renders its ag
         }
     }
     await spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: 'A', creator: 'A' });
-    assert.equal(readInboxSince('A').length, 1, 'a parent-created child stays silent');
+    assert.equal(mailFor('A').length, 1, 'a parent-created child stays silent');
     await spawnNode({ kind: 'developer', cwd: '/tmp/work', parent: null });
-    assert.equal(readInboxSince('A').length, 1, 'a root never announces');
+    assert.equal(mailFor('A').length, 1, 'a root never announces');
 });
 test('independent root: provenance only, no parent, no subscription', async () => {
     createNode(spawner('A'));
@@ -178,6 +218,7 @@ test('fork spawn resolves path and UUID provenance to the same transcript-only e
     const launched = [];
     try {
         process.env['HOME'] = localHome;
+        initializeTestUserScope();
         process.env['PI_CODING_AGENT_DIR'] = join(localHome, 'pi-agent');
         process.env['CRTR_NODE_ID'] = 'fork-source';
         delete process.env['TMUX'];
@@ -195,9 +236,8 @@ test('fork spawn resolves path and UUID provenance to the same transcript-only e
         createNode({
             ...spawner('fork-source'),
             cwd: localCwd,
-            pi_session_id: sessionId,
-            pi_session_file: sourceFile,
         });
+        resetSession('fork-source', { sessionId, transcriptPath: sourceFile });
         const canonicalSourceFile = getNode('fork-source').pi_session_file;
         const sourceExposure = emptyContextExposureState();
         registerExposure(exposureTarget(sourceExposure, 'system'), 'source-system', 'content');
@@ -243,6 +283,7 @@ test('fork spawn resolves path and UUID provenance to the same transcript-only e
     }
     finally {
         headlessBrokerHost.launch = originalLaunch;
+        closeScopedStores();
         if (previousHome === undefined)
             delete process.env['HOME'];
         else
@@ -281,6 +322,7 @@ test('spawnChild: a root from a shell gets the stable root profile id', async ()
     const previousStdoutTty = Object.getOwnPropertyDescriptor(process.stdout, 'isTTY');
     try {
         process.env.HOME = localHome;
+        initializeTestUserScope();
         Object.defineProperty(process.stdin, 'isTTY', { value: false, configurable: true, writable: true });
         Object.defineProperty(process.stdout, 'isTTY', { value: false, configurable: true, writable: true });
         Reflect.deleteProperty(env, 'CRTR_NODE_ID');
@@ -303,6 +345,7 @@ test('spawnChild: a root from a shell gets the stable root profile id', async ()
     }
     finally {
         headlessBrokerHost.launch = originalLaunch;
+        closeScopedStores();
         if (previousHome === undefined)
             delete process.env.HOME;
         else

package/dist/core/__tests__/integration/subscription-delivery.test.js

@@ -1,7 +1,7 @@
 // Run with: npm run test:integration
 //
 // THE DAEMON WAKE HALF of delivery-vs-wake, on a graph >=2 levels deep. Routing
-// itself (active → inbox.jsonl, passive → passive.jsonl) is owned by
+// itself (active → wake delivery, passive → non-waking delivery) is owned by
 // passive-subscription.test.ts; what this file owns is the decision ONE real
 // `superviseTick` makes on that routing: the ACTIVE subscriber of a finished
 // target is revived, the PASSIVE subscriber on the same target is not.
@@ -30,27 +30,40 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
 import { createHarness } from '../helpers/harness.js';
-import { closeDb } from '../../canvas/db.js';
+import { openDb } from '../../canvas/db.js';
 import { subscribe } from '../../canvas/canvas.js';
 import { pushFinal } from '../../feed/feed.js';
-import { passivePath } from '../../canvas/paths.js';
 // A pid reaped (dead) by the time spawnSync returns — a released broker's exited
 // process (the headless analog of a closed pane).
 function deadPid() {
     const r = spawnSync('true', [], { stdio: 'ignore' });
     return r.pid ?? 0x7ffffffe;
 }
-// LOCAL helper: read a node's PASSIVE accumulator (passive.jsonl) straight off
-// the data layer, mirroring the harness's own `inbox()` reader. The harness
-// exposes inbox() but NOT passive() — this fills that gap.
+// Read the canonical non-waking delivery rows, mirroring the harness's SQL
+// wake-delivery reader.
 function passive(nodeId) {
-    closeDb();
-    const path = passivePath(nodeId);
-    if (!existsSync(path))
-        return [];
-    return readFileSync(path, 'utf8').split('\n').filter(Boolean).map((line) => JSON.parse(line));
+    return openDb().prepare(`SELECT m.message_id AS entry_id, m.operation_id, m.created_at AS ts,
+    m.sender_node_id AS "from", m.sender_name AS from_name, d.urgency AS tier,
+    m.kind, m.body_ref AS ref, m.label, m.body_json AS data, m.disposition
+    FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+    WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND d.wake = 0
+    ORDER BY m.seq`).all(nodeId).map((row) => {
+        const value = row;
+        return {
+            entry_id: value['entry_id'],
+            operation_id: value['operation_id'],
+            ts: value['ts'],
+            from: value['from'],
+            ...(value['from_name'] === null ? {} : { from_name: value['from_name'] }),
+            tier: value['tier'],
+            kind: value['kind'],
+            ...(value['ref'] === null ? {} : { ref: value['ref'] }),
+            label: value['label'],
+            ...(value['data'] === null ? {} : { data: JSON.parse(value['data']) }),
+            ...(value['disposition'] === null ? {} : { disposition: value['disposition'] }),
+        };
+    });
 }
 // `{node_id, active}` arrays → a stable comparable set of `id:active|passive`.
 function edgeSet(arr) {
@@ -87,15 +100,14 @@ test('one daemon tick revives the active subscriber of a finished target and lea
         assert.equal(h.node(B).cycles ?? 0, 0, 'B not yet revived');
         assert.equal(h.node(P).cycles ?? 0, 0, 'P not yet revived');
         // T FINISHES via the model layer — the precondition the daemon decides on:
-        // B's pointer lands in inbox.jsonl (the wake channel), P's in passive.jsonl.
+        // B gets a wake delivery, P gets a non-waking delivery.
         await pushFinal(T, 'TARGET-FINAL-BODY: the worker completed');
-        closeDb();
-        assert.ok(h.inbox(B).find((e) => e.from === T && e.kind === 'final'), 'ACTIVE subscriber B: T-final pointer delivered to inbox.jsonl');
-        assert.equal(h.inbox(P).length, 0, 'PASSIVE subscriber P: inbox.jsonl stays empty (no wake channel)');
-        assert.equal(passive(P).length, 1, 'PASSIVE subscriber P: exactly one passive entry');
+        assert.ok(h.inbox(B).find((e) => e.from === T && e.kind === 'final'), 'ACTIVE subscriber B: T-final wake delivery is durable');
+        assert.equal(h.inbox(P).length, 0, 'PASSIVE subscriber P: wake-delivery set stays empty');
+        assert.equal(passive(P).length, 1, 'PASSIVE subscriber P: exactly one non-waking delivery');
         // The DAEMON decision pass. Its 2nd pass revives an idle-released node
-        // ONLY on an unseen INBOX entry. B has one (active) → REVIVED. P has none
-        // (its entry went to passive.jsonl) → stays idle. Decided in ONE tick.
+        // ONLY on an unseen wake delivery. B has one (active) → REVIVED. P has none
+        // (its entry is non-waking) → stays idle. Decided in ONE tick.
         await h.tick();
         // ACTIVE subscriber: WOKEN — reviveNode bumped cycles + transition(revive).
         {
@@ -111,8 +123,8 @@ test('one daemon tick revives the active subscriber of a finished target and lea
             assert.equal(p.status, 'idle', 'P STILL idle — daemon did NOT wake it');
             assert.equal(p.intent, 'idle-release', 'P still intent=idle-release (untouched)');
         }
-        assert.equal(passive(P).length, 1, "P's passive entry is still pending (drained only on its next message)");
-        assert.equal(h.inbox(P).length, 0, "P's inbox still empty");
+        assert.equal(passive(P).length, 1, "P's non-waking delivery is still pending (drained only on its next message)");
+        assert.equal(h.inbox(P).length, 0, "P's wake-delivery set is still empty");
     }
     finally {
         await h.dispose();

package/dist/core/__tests__/integration/worktree-land.test.js

@@ -13,7 +13,8 @@ import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollb
 import { closeManagedWorktreeAsync } from '../../worktree-close.js';
 import { reconcileManagedWorktree } from '../../worktree-sweep.js';
 import { createNode, getNode } from '../../canvas/canvas.js';
-import { closeDb } from '../../canvas/db.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
+import { resetSession } from '../../canvas/sessions.js';
 let home;
 let remoteDir;
 let sourceDir;
@@ -61,6 +62,7 @@ beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     process.env['CRTR_HOME'] = home;
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -81,7 +83,8 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     mkdirSync(sessionDir, { recursive: true });
     const sessionFile = join(sessionDir, 'session.jsonl');
     writeFileSync(sessionFile, `${JSON.stringify({ type: 'session', version: 3, id: 'wt-session', cwd: wt.path })}\n`);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt, pi_session_id: 'wt-session', pi_session_file: sessionFile }));
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    resetSession(nodeId, { sessionId: 'wt-session', transcriptPath: sessionFile });
     const result = closeManagedWorktree(nodeId);
     assert.equal(result.worktree_removed, false);
     assert.match(result.worktree_remove_error ?? '', /cleanup pending/);