@north-light/crouter 0.3.312 → 0.3.314

package/dist/core/__tests__/migration.test.js

@@ -10,9 +10,10 @@ import { canvasDbPath, ensureHome } from '../canvas/paths.js';
 import { customExtensionPaths } from '../canvas/extensions.js';
 import { assertMandatoryCanvasExtensions, CANVAS_EXTENSIONS, mergeCanvasExtensions } from '../runtime/canvas-extensions.js';
 import { updateNode } from '../canvas/canvas.js';
+import { parsePage, parsePageDelivery } from '../human/page.js';
 import { spawn, spawnSync } from 'node:child_process';
 const HERE = dirname(fileURLToPath(import.meta.url));
-const RUNTIME_COLUMNS = ['intent', 'pi_pid', 'window', 'tmux_session'];
+const RUNTIME_COLUMNS = ['intent', 'window', 'tmux_session'];
 const RACE_FIXTURE = join(HERE, 'fixtures', 'metadata-migration-race.ts');
 const PRE_TOOL_GUIDE_CANVAS_EXTENSION_NAMES = [
     'canvas-inbox-watcher', 'canvas-stophook', 'canvas-recap',
@@ -53,6 +54,11 @@ function userVersion(db) {
     return db.prepare('PRAGMA user_version').get()
         .user_version;
 }
+function openMigratedDb() {
+    const db = openDb();
+    migrate(db);
+    return db;
+}
 function nodeColumns(db) {
     return db.prepare('PRAGMA table_info(nodes)').all().map((r) => r.name);
 }
@@ -77,8 +83,11 @@ after(() => {
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
 });
-test('opening a fresh home migrates to the latest user_version', () => {
+test('opening a fresh home leaves schema initialization explicit', () => {
     const db = openDb();
+    assert.equal(userVersion(db), 0);
+    assert.equal(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'nodes'").get(), undefined);
+    migrate(db);
     assert.equal(userVersion(db), MIGRATIONS.length);
 });
 test('a persisted review-boundary canvas prefix is not treated as custom extensions', () => {
@@ -120,7 +129,7 @@ test('a v14 canvas normalizes historical canvas paths while retaining custom lau
     const saved = JSON.parse(readFileSync(metaPath, 'utf8'));
     assert.deepEqual(saved.launch.extensions, ['/plugins/canvas-inbox-watcher.js']);
 });
-test('a v14 migration is protected against concurrent writeback by normal updateNode writes', async () => {
+test('an explicit v14 migration preserves legacy metadata while node updates use SQL state', async () => {
     const metaPath = join(home, 'nodes', 'saved', 'meta.json');
     mkdirSync(join(home, 'nodes', 'saved'), { recursive: true });
     writeFileSync(metaPath, JSON.stringify({
@@ -143,16 +152,17 @@ test('a v14 migration is protected against concurrent writeback by normal update
     rmSync(marker, { force: true });
     const { done } = await spawnMigrationRace(metaPath, marker);
     await waitForPath(marker);
+    migrate(raw);
+    await done;
+    raw.close();
     const update = updateNode('saved', { name: 'saved-raced' });
     assert.equal(update.name, 'saved-raced');
-    await done;
     const settled = JSON.parse(readFileSync(metaPath, 'utf8'));
     assert.equal(customExtensionPaths(settled.launch.extensions).length, settled.launch.extensions.length);
-    assert.deepEqual(settled.launch.extensions, ['/plugins/canvas-inbox-watcher.js'], 'concurrent migration + metadata writes cannot restore retired hook prefixes');
-    assert.equal(settled.name, 'saved-raced');
-    raw.close();
+    assert.deepEqual(settled.launch.extensions, ['/plugins/canvas-inbox-watcher.js'], 'migration writeback cannot restore retired hook prefixes');
+    assert.equal(settled.name, 'saved', 'the legacy conversion input remains unchanged after a SQL node update');
 });
-test('a fresh db has the four additive runtime columns', () => {
+test('a v0 db retains its runtime fields while process state moves to executions', () => {
     // Build a v0 db by hand: the baseline tables only, user_version 0, no runtime
     // columns — exactly the shape of the live fleet before this phase.
     ensureHome();
@@ -189,14 +199,14 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(userVersion(raw), 0);
     assert.ok(!nodeColumns(raw).includes('intent'));
     raw.close();
-    // openDb() runs the migration runner forward.
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
-    // Runtime columns now exist.
+    // Node runtime columns now exist; process state is projected from executions.
     const cols = nodeColumns(db);
     for (const c of RUNTIME_COLUMNS) {
         assert.ok(cols.includes(c), `expected nodes.${c} after migration`);
     }
+    assert.ok(!cols.includes('pi_pid'), 'nodes no longer stores process state');
     // Pre-existing data is intact — no loss, no mutation of existing columns.
     const row = db
         .prepare('SELECT node_id, status, cwd FROM nodes WHERE node_id = ?')
@@ -208,10 +218,9 @@ test('a fresh db has the four additive runtime columns', () => {
     assert.equal(edgeCount, 1);
     // The new columns are seeded NULL for the migrated row — nothing observed.
     const rt = db
-        .prepare('SELECT intent, pi_pid, "window", tmux_session FROM nodes WHERE node_id = ?')
+        .prepare('SELECT intent, "window", tmux_session FROM nodes WHERE node_id = ?')
         .get('n1');
     assert.equal(rt['intent'], null);
-    assert.equal(rt['pi_pid'], null);
     assert.equal(rt['window'], null);
     assert.equal(rt['tmux_session'], null);
 });
@@ -240,7 +249,7 @@ test('session-file ownership migration reconciles authoritative metas before cle
     insert.run('later-claimant', 'later-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-02T00:00:00.000Z', aliasedSessionFile);
     insert.run('recovered-claimant', 'recovered-claimant', 'developer', 'base', 'terminal', 'active', '/tmp', '2026-01-03T00:00:00.000Z', sessionFile);
     assert.doesNotThrow(() => migrate(raw), 'a real canvas with pre-existing duplicates must migrate');
-    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM node_rows ORDER BY created, node_id').all();
     assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
         ['first-owner', sessionFile],
         ['later-claimant', null],
@@ -252,7 +261,7 @@ test('session-file ownership migration reconciles authoritative metas before cle
     const recovered = JSON.parse(readFileSync(join(home, 'nodes', 'recovered-claimant', 'meta.json'), 'utf8'));
     assert.equal(recovered.pi_session_id, 'recovered-claimant-session', 'a stale row cannot clear the authoritative session id');
     assert.equal(recovered.pi_session_file, recoveredSessionFile, 'a stale row cannot clear the authoritative session file');
-    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(sessionFile, 'later-claimant'), /UNIQUE/, 'the schema enforces the repaired invariant');
+    assert.throws(() => raw.prepare("INSERT INTO sessions (binding_id, session_id, node_id, transcript_path, source_session_id, fork_entry_id, created_at, bound_at, unbound_at) VALUES ('later-duplicate', 'later-duplicate-session', 'later-claimant', ?, NULL, NULL, '2026-01-02T00:00:00.000Z', '2026-01-02T00:00:00.000Z', NULL)").run(sessionFile), /UNIQUE/, 'the SQL session table enforces the repaired invariant');
     raw.close();
 });
 test('forward session-file repair reprojects a surviving v36 meta coordinate before restoring its UNIQUE index', () => {
@@ -280,7 +289,7 @@ test('forward session-file repair reprojects a surviving v36 meta coordinate bef
     raw.exec('DROP INDEX IF EXISTS idx_nodes_pi_session_file; CREATE UNIQUE INDEX idx_nodes_pi_session_file ON nodes(pi_session_file); PRAGMA user_version = 36;');
     assert.doesNotThrow(() => migrate(raw));
     assert.equal(userVersion(raw), MIGRATIONS.length);
-    const rows = raw.prepare('SELECT node_id, pi_session_file FROM nodes ORDER BY created, node_id').all();
+    const rows = raw.prepare('SELECT node_id, pi_session_file FROM node_rows ORDER BY created, node_id').all();
     assert.deepEqual(rows.map((row) => [row.node_id, row.pi_session_file]), [
         ['surviving-owner', recoveredSessionFile],
         ['stale-row', null],
@@ -288,7 +297,7 @@ test('forward session-file repair reprojects a surviving v36 meta coordinate bef
     const survivor = JSON.parse(readFileSync(join(home, 'nodes', 'surviving-owner', 'meta.json'), 'utf8'));
     assert.equal(survivor.pi_session_id, 'surviving-session');
     assert.equal(survivor.pi_session_file, recoveredSessionFile);
-    assert.throws(() => raw.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(recoveredSessionFile, 'stale-row'), /UNIQUE/);
+    assert.throws(() => raw.prepare("INSERT INTO sessions (binding_id, session_id, node_id, transcript_path, source_session_id, fork_entry_id, created_at, bound_at, unbound_at) VALUES ('stale-duplicate', NULL, 'stale-row', ?, NULL, NULL, '2026-01-02T00:00:00.000Z', '2026-01-02T00:00:00.000Z', NULL)").run(recoveredSessionFile), /UNIQUE/);
     raw.close();
 });
 test('node lifecycle substrate migration adds six columns and backfills terminal reasons', () => {
@@ -314,7 +323,7 @@ test('node lifecycle substrate migration adds six columns and backfills terminal
     insert.run('crashed', 'crashed', 'general', 'dead', null, null, '/tmp', created);
     insert.run('active', 'active', 'general', 'active', null, null, '/tmp', created);
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     for (const column of lifecycleColumns)
         assert.ok(nodeColumns(db).includes(column));
@@ -331,8 +340,8 @@ test('node lifecycle substrate migration adds six columns and backfills terminal
 // v4: edges FK ON DELETE CASCADE (the one irreversible rebuild)
 /** Build a hand-rolled db at exactly v3 (baseline tables + the four runtime
  *  columns, edges with NO foreign key, `user_version = 3`) — the shape the live
- *  fleet reaches just before v4. Caller seeds it, we close it; the next openDb()
- *  runs only v4 over it. */
+ *  fleet reaches just before v4. Caller seeds it, then explicitly runs v4 and
+ *  later steps. */
 function buildV3Db() {
     ensureHome();
     const raw = new DatabaseSync(canvasDbPath());
@@ -382,8 +391,8 @@ test('v4 migrates a db with a pre-existing orphan edge without throwing', () =>
     assert.equal(userVersion(raw), 3);
     assert.equal(edgeCount(raw), 2);
     raw.close();
-    // openDb() runs v4. It must NOT throw on the orphan, and must drop it.
-    const db = openDb();
+    // Explicit migration must not throw on the orphan, and must drop it.
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length); // migrated forward to the head
     // The orphan edge is filtered; the non-orphan edge + its count are preserved.
     assert.equal(edgeCount(db), 1);
@@ -435,7 +444,7 @@ test('bug #99: a stale v4 db with later columns already present migrates cleanly
     assert.equal(userVersion(raw), 4);
     assert.equal(nodeColumns(raw).includes('pane'), true, 'precondition: pane already exists even though user_version is stale');
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const cols = nodeColumns(db);
     assert.ok(cols.includes('pane'), 'pane survives the migration');
@@ -536,7 +545,7 @@ test('v22 converts existing schedules into self-contained crons and removes the
         payload: { kind: 'general', mode: 'base', cwd: '/tmp/work', prompt: 'go', parent: 'owner' },
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name);
     assert.ok(!tables.includes('triggers'));
@@ -571,8 +580,7 @@ test('v22 converts existing schedules into self-contained crons and removes the
     assert.match(birth.command, /crtr node new --kind 'general'/);
     assert.match(birth.command, /go/);
 });
-// The v22 migration runs on EVERY openDb(), so it must never fail on data shape:
-// a throw would make every crtr process unable to open the canvas forever. These
+// The explicit v22 migration must handle every declared-legal data shape. These
 // cases are all shapes the retired schema declared legal.
 function insertNodeAt(db, id, cwd, created, parent) {
     db.prepare('INSERT INTO nodes (node_id, name, kind, status, cwd, parent, created) VALUES (?,?,?,?,?,?,?)').run(id, id, 'general', 'active', cwd, parent, created);
@@ -671,7 +679,7 @@ test('v22 converts the legal edge rows and records the ones it cannot express',
         payload: { body: 'nope' },
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances despite the unconvertible row');
     const cron = (id) => db.prepare('SELECT * FROM crons WHERE cron_id = ?').get(id);
     const pruned = cron('pruned-owner');
@@ -706,7 +714,7 @@ test('v22 re-run over already-converted crons converges instead of colliding on
     VALUES ('scheduled-message', 'stale', 'owner', 'echo stale', '2026-01-01T00:00:00.000Z', '/tmp/work', '{}', '2020-01-01T00:00:00Z', '2020-01-01T00:00:00Z')
   `).run();
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     assert.equal(userVersion(db), MIGRATIONS.length);
     const row = db.prepare('SELECT command FROM crons WHERE cron_id = ?').get('scheduled-message');
     assert.match(row.command, /crtr node message send --to 'target'/, 'the re-run replaces the half-written row');
@@ -754,8 +762,8 @@ test('v22 recovers a db wedged by an interrupted pre-atomicity run', () => {
   `).run();
     raw.exec('DROP TABLE triggers');
     raw.close();
-    const db = openDb();
-    assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances rather than failing every open');
+    const db = openMigratedDb();
+    assert.equal(userVersion(db), MIGRATIONS.length, 'the schema advances rather than failing every explicit migration');
     assert.notEqual(db.prepare('SELECT 1 FROM crons WHERE cron_id = ?').get('half-written'), undefined);
 });
 // The generated cron scripts are the migration's real product, so the M4
@@ -784,6 +792,112 @@ function runMigratedScript(script, opts) {
     rmSync(dir, { recursive: true, force: true });
     return { code: result.status ?? -1, log: written };
 }
+function buildV39Db() {
+    ensureHome();
+    const raw = new DatabaseSync(canvasDbPath());
+    migrateToVersion(raw, 39);
+    return raw;
+}
+function resetV39Home() {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    return buildV39Db();
+}
+function writeLegacyPage(id, source, dialect = 'jsx') {
+    const dir = join(home, 'nodes', id);
+    mkdirSync(dir, { recursive: true });
+    const document = dialect === 'jsx'
+        ? 'export default function LegacyPage() { return <Page title="The gate is gone" subtitle="This page was sent with page_surface off — the refusal that used to block it no longer exists. Nothing to answer; it is here to prove delivery." placement="panel" />; }\n'
+        : '---\ntitle: The gate is gone\n---\nThis is the stored Markdown page.\n';
+    writeFileSync(join(dir, dialect === 'jsx' ? 'page.tsx' : 'page.md'), document);
+    writeFileSync(join(dir, 'page.json'), JSON.stringify({
+        schema: 'crtr.page/v1', dialect, title: 'The gate is gone',
+        subtitle: 'This page was sent with page_surface off — the refusal that used to block it no longer exists. Nothing to answer; it is here to prove delivery.',
+        placement: 'panel', document: dialect === 'jsx' ? 'page.tsx' : 'page.md', steps: 1, slots: [], source,
+    }));
+    return dir;
+}
+test('v40 imports pre-envelope v1 pages and still rejects invalid v2 delivery envelopes', () => {
+    const raw = buildV39Db();
+    const blocked = writeLegacyPage('page-bba481b2', {
+        sessionName: 'general', blockedSince: '2026-08-11T17:32:21.979Z', profileName: 'crouter', nodeId: '3zl47w7d-msowsany-ee8e2bba',
+    });
+    const emitted = writeLegacyPage('nfy-3b21bc8a', {
+        sessionName: 'notify', nodeId: '3zl47w7d-msmeye7h-cb3ff1da',
+    }, 'md');
+    const legacyBytes = readFileSync(join(blocked, 'page.json'));
+    migrate(raw);
+    for (const [dir, id, delivery] of [[blocked, 'page-bba481b2', { placement: 'panel', inbox: true, reply: true }], [emitted, 'nfy-3b21bc8a', { placement: 'panel', inbox: true, reply: false }]]) {
+        const stored = raw.prepare('SELECT presentation_dir, specification_json FROM human_requests WHERE request_id = ?').get(id);
+        const manifest = parsePage(stored.presentation_dir);
+        assert.deepEqual(manifest.delivery, delivery);
+        assert.deepEqual(parsePageDelivery(stored.presentation_dir), delivery);
+        assert.deepEqual(JSON.parse(stored.specification_json), manifest);
+    }
+    assert.deepEqual(readFileSync(join(blocked, 'page.json')), legacyBytes, 'the source manifest remains untouched');
+    raw.close();
+    const invalid = resetV39Home();
+    const valid = writeLegacyPage('valid-v1-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    const validBytes = readFileSync(join(valid, 'page.json'));
+    const dir = writeLegacyPage('broken-v2-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(dir, 'page.json'), JSON.stringify({ schema: 'crtr.page/v2', title: 'Broken', delivery: { placement: 'panel', inbox: true, reply: false, extra: true } }));
+    assert.throws(() => migrate(invalid), (error) => error instanceof Error && error.message.includes(join(dir, 'page.json')));
+    assert.equal(userVersion(invalid), 39, 'the failed migration rolls back');
+    assert.deepEqual(readFileSync(join(valid, 'page.json')), validBytes, 'a failed migration does not alter an earlier v1 input');
+    invalid.close();
+    const malformedV2 = resetV39Home();
+    const malformedV2Dir = writeLegacyPage('malformed-v2-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(malformedV2Dir, 'page.json'), JSON.stringify({ schema: 'crtr.page/v2', title: 'Broken', delivery: { placement: 'panel', inbox: true, reply: false } }));
+    assert.throws(() => migrate(malformedV2), (error) => error instanceof Error && error.message.includes(join(malformedV2Dir, 'page.json')));
+    malformedV2.close();
+    const malformedV1 = resetV39Home();
+    const malformedV1Dir = writeLegacyPage('malformed-v1-page', { blockedSince: '2026-08-11T17:32:21.979Z' });
+    writeFileSync(join(malformedV1Dir, 'page.json'), JSON.stringify({
+        schema: 'crtr.page/v1', dialect: 'jsx', title: 'Broken', placement: 'panel', document: 'page.tsx', steps: 1,
+        slots: [{ id: 'out-of-range', kind: 'options', step: 1, config: {} }], source: { blockedSince: '2026-08-11T17:32:21.979Z' },
+    }));
+    assert.throws(() => migrate(malformedV1), (error) => error instanceof Error && error.message.includes(join(malformedV1Dir, 'page.json')));
+    malformedV1.close();
+    const malformedMarkdown = resetV39Home();
+    const malformedMarkdownDir = writeLegacyPage('malformed-markdown-page', {}, 'md');
+    const malformedMarkdownManifest = JSON.parse(readFileSync(join(malformedMarkdownDir, 'page.json'), 'utf8'));
+    malformedMarkdownManifest.steps = 2;
+    writeFileSync(join(malformedMarkdownDir, 'page.json'), JSON.stringify(malformedMarkdownManifest));
+    assert.throws(() => migrate(malformedMarkdown), (error) => error instanceof Error && error.message.includes(join(malformedMarkdownDir, 'page.json')));
+    malformedMarkdown.close();
+});
+test('v40 skips recovery witnesses without identity while retaining failures for indexed nodes', () => {
+    const raw = buildV39Db();
+    const faultDir = join(home, 'nodes', 'orphan-fault', 'job');
+    const retryDir = join(home, 'nodes', 'orphan-retry', 'job');
+    mkdirSync(faultDir, { recursive: true });
+    mkdirSync(retryDir, { recursive: true });
+    writeFileSync(join(faultDir, 'fault'), JSON.stringify({
+        link: 'viewer↔broker', op: 'connect', kind: 'connection', message: 'ENOENT', since: '2026-09-10T00:00:00.000Z', operation_id: '11111111111111111111111111111111', retry: { disposition: 'fatal' },
+    }));
+    writeFileSync(join(retryDir, 'provider-retry'), JSON.stringify({
+        state: 'pending', sessionFile: '/tmp/orphan-retry.jsonl', anchorEntryId: null,
+        fault: { link: 'pi→provider', op: 'request', kind: 'connection', message: 'ECONNRESET', since: '2026-09-10T00:00:00.000Z', operation_id: '22222222222222222222222222222222', retry: { disposition: 'auto', by: 'daemon' } },
+    }));
+    const resident = join(home, 'nodes', 'metadata-node');
+    mkdirSync(join(resident, 'job'), { recursive: true });
+    writeFileSync(join(resident, 'meta.json'), JSON.stringify({
+        node_id: 'metadata-node', name: 'metadata-node', created: '2026-09-10T00:00:00.000Z', cwd: '/tmp', kind: 'developer', mode: 'base', lifecycle: 'terminal',
+    }));
+    writeFileSync(join(resident, 'job', 'busy'), '');
+    migrate(raw);
+    assert.notEqual(raw.prepare('SELECT 1 FROM nodes WHERE node_id = ?').get('metadata-node'), undefined);
+    assert.equal(raw.prepare('SELECT COUNT(*) AS count FROM executions WHERE node_id = ?').get('metadata-node').count, 1);
+    assert.equal(raw.prepare("SELECT 1 FROM nodes WHERE node_id IN ('orphan-fault', 'orphan-retry')").get(), undefined);
+    raw.close();
+    const invalid = resetV39Home();
+    insertNode(invalid, 'indexed-node');
+    const invalidPath = join(home, 'nodes', 'indexed-node', 'job', 'fault');
+    mkdirSync(dirname(invalidPath), { recursive: true });
+    writeFileSync(invalidPath, 'not json');
+    assert.throws(() => migrate(invalid), (error) => error instanceof Error && error.message.includes(invalidPath));
+    invalid.close();
+});
 test('a migrated predicate script delivers its exact body and self-cancels only when the action succeeds', () => {
     const raw = buildV21Db();
     insertLegacySchedule(raw, {
@@ -811,7 +925,7 @@ test('a migrated predicate script delivers its exact body and self-cancels only
         timeoutAt: '2026-01-04T00:00:00.000Z',
     });
     raw.close();
-    const db = openDb();
+    const db = openMigratedDb();
     const script = (id) => db.prepare('SELECT command FROM crons WHERE cron_id = ?').get(id).command;
     const stored = script('conditional-message');
     const satisfied = runMigratedScript(stored, { gateReady: true });

package/dist/core/__tests__/model-pin-durability.test.js

@@ -20,9 +20,10 @@ import { join } from 'node:path';
 import { buildLaunchSpec, isProviderPinnedModelToken, normalizeModel } from '../runtime/launch.js';
 import { defaultModelLaddersConfig } from '../../types.js';
 import { persistDormantModel } from '../runtime/model-swap.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { promote, reshapeNode } from '../runtime/promote.js';
 import { createNode, getNode } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 const ladders = defaultModelLaddersConfig();
 // The concrete cell the `ultra` tier normalizes to — the byte-equal collision at
 // the heart of #328. A raw `ultra` token is UNpinned; this concrete cell is
@@ -36,9 +37,11 @@ before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-model-pin-durability-'));
     process.env['HOME'] = home; // buildLaunchSpec reads merged launch config here
     process.env['CRTR_HOME'] = home; // the canvas db lives here
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
 });
 beforeEach(() => {
     closeDb();
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/core/__tests__/model-routes-config.test.js

@@ -1,10 +1,12 @@
 import { after, afterEach, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { persistModelRoute, readConfig, readMergedLaunchConfig } from '../config.js';
+import { persistModelRoute, readConfig, readMergedLaunchConfig, readRawConfigAtRoot, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { expandModelCandidates } from '../model-routes.js';
+import { piAgentDir } from '../runtime/package-health.js';
 import { resetScopeCache } from '../scope.js';
 let home;
 let work;
@@ -23,6 +25,10 @@ function route(providerId = 'provider-x', family = 'family-x', credentialSource
     };
 }
 function writeConfig(root, config) {
+    if (root === join(home, '.crouter')) {
+        writeRawConfig('user', config);
+        return;
+    }
     mkdirSync(root, { recursive: true });
     writeFileSync(join(root, 'config.json'), JSON.stringify(config));
 }
@@ -34,6 +40,8 @@ beforeEach(() => {
     work = mkdtempSync(join(tmpdir(), 'crtr-model-routes-work-'));
     process.env.HOME = home;
     resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    initializeFreshScopedStore({ kind: 'provider', root: piAgentDir() });
 });
 afterEach(() => {
     resetScopeCache();
@@ -87,7 +95,7 @@ test('route records retain __proto__ ids when read and persisted', () => {
     writeConfig(root, JSON.parse(JSON.stringify({ modelRoutes: { ['__proto__']: route() } })));
     assert.deepEqual(readMergedLaunchConfig(work, null).modelRoutes?.['__proto__'], route());
     persistModelRoute(root, '__proto__', route('persisted-provider'));
-    const raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    const raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes['__proto__'], route('persisted-provider'));
 });
 test('route candidate identity distinguishes delimiter-containing route and provider ids', () => {
@@ -131,12 +139,12 @@ test('persistModelRoute touches only its raw route and deletes by restoring inhe
     const other = route('other-provider');
     writeConfig(root, { modelRoutes: { other }, max_panes_per_window: 7 });
     persistModelRoute(root, 'edited', route('edited-provider'));
-    let raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    let raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes.other, other);
     assert.deepEqual(raw.modelRoutes.edited, route('edited-provider'));
     assert.equal(raw.modelLadders, undefined);
     assert.equal(raw.max_panes_per_window, 7);
     persistModelRoute(root, 'edited', undefined);
-    raw = JSON.parse(readFileSync(join(root, 'config.json'), 'utf8'));
+    raw = readRawConfigAtRoot(root);
     assert.deepEqual(raw.modelRoutes, { other });
 });

package/dist/core/__tests__/node-outcome.test.js

@@ -4,15 +4,80 @@ import { DatabaseSync } from 'node:sqlite';
 import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb, MIGRATIONS } from '../canvas/db.js';
-import { createNode, getRow } from '../canvas/canvas.js';
-import { armOutcomeDelivery, claimOutcomeDelivery, readOutcomeDelivery, recoverRunningOutcomeDeliveries, settleOutcomeDelivery, } from '../canvas/node-outcome-deliveries.js';
+import { closeDb, MIGRATIONS, migrate, openDb, withCanvasWrite } from '../canvas/db.js';
+import { createNode, getNode, getRow } from '../canvas/canvas.js';
+import { activateArmedExternalActionDelivery, armExternalActionDelivery, claimExternalActionDelivery, messageBodyForDelivery, readExternalActionDelivery, resetHandedOffDeliveries, settleDelivery, } from '../canvas/deliveries.js';
 import { transition } from '../runtime/lifecycle.js';
 import { composeNodeOutcomeDocument } from '../runtime/outcome-document.js';
 import { pushFinal } from '../feed/feed.js';
 import { OUTCOME_PAYLOAD_MAX_BYTES } from '../canvas/types.js';
 let home;
 const priorHome = process.env['CRTR_HOME'];
+function outcomeKey(nodeId) {
+    return `node-outcome:${nodeId}`;
+}
+function outcomeDelivery(nodeId) {
+    return readExternalActionDelivery(outcomeKey(nodeId));
+}
+function nodeAtOutcome(node) {
+    const reason = node.outcome_reason;
+    let status;
+    let intent;
+    if (node.outcome_kind === 'result' || reason === 'finished' || reason === 'declined') {
+        status = 'done';
+        intent = 'done';
+    }
+    else if (reason === 'parked') {
+        status = 'done';
+        intent = 'parked';
+    }
+    else if (reason === 'closed' || reason === 'retired' || reason === 'stranded' || reason === 'deadline_exceeded') {
+        status = 'canceled';
+        intent = null;
+    }
+    else {
+        status = 'dead';
+        intent = null;
+    }
+    return { ...node, status, intent, terminal_reason: reason };
+}
+function armOutcomeAction(input) {
+    const payload = input.payload ?? null;
+    const json = JSON.stringify(payload);
+    if (json === undefined)
+        throw new TypeError('outcome delivery payload must be JSON-serializable');
+    if (Buffer.byteLength(json, 'utf8') > OUTCOME_PAYLOAD_MAX_BYTES)
+        throw new RangeError(`outcome delivery payload exceeds ${OUTCOME_PAYLOAD_MAX_BYTES} bytes`);
+    return withCanvasWrite((db) => {
+        const existing = outcomeDelivery(input.nodeId);
+        if (existing !== null && existing.state !== 'armed')
+            return null;
+        armExternalActionDelivery(db, {
+            destinationId: input.actionName,
+            adapter: { adapter: 'subprocess', argv: input.argv, cwd: input.cwd, config_origin: input.configOrigin, payload },
+            idempotencyKey: outcomeKey(input.nodeId),
+        }, input.now);
+        const node = getNode(input.nodeId);
+        if (node === null)
+            throw new Error(`unknown node ${input.nodeId}`);
+        if (node.outcome_at !== null) {
+            if (node.outcome_kind === null || node.outcome_reason === null)
+                throw new Error(`outcome latch is incomplete for node ${input.nodeId}`);
+            activateArmedExternalActionDelivery(db, {
+                idempotencyKey: outcomeKey(input.nodeId),
+                label: input.nodeId,
+                bodyJson: JSON.stringify(composeNodeOutcomeDocument({
+                    node: nodeAtOutcome(node),
+                    outcome: { kind: node.outcome_kind, reason: node.outcome_reason, at: node.outcome_at, revision: node.outcome_revision, detailJson: node.outcome_detail_json ?? null },
+                    action: { name: input.actionName, payload },
+                    finalReport: node.final_report,
+                })),
+                supersede: false,
+            }, input.now);
+        }
+        return outcomeDelivery(input.nodeId);
+    });
+}
 function node(nodeId) {
     return {
         node_id: nodeId,
@@ -29,6 +94,7 @@ beforeEach(() => {
     closeDb();
     home = mkdtempSync(join(tmpdir(), 'crtr-node-outcome-'));
     process.env['CRTR_HOME'] = home;
+    migrate(openDb());
 });
 afterEach(() => {
     closeDb();
@@ -105,23 +171,24 @@ test('a canonical final supersedes a prior failure outcome and increments revisi
 });
 test('outcome delivery rejects an oversized payload before a node is armed', () => {
     createNode(node('oversized-payload'));
-    assert.throws(() => armOutcomeDelivery({
+    assert.throws(() => armOutcomeAction({
         nodeId: 'oversized-payload', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { value: 'x'.repeat(OUTCOME_PAYLOAD_MAX_BYTES) },
     }), /exceeds/);
-    assert.equal(readOutcomeDelivery('oversized-payload'), null);
+    assert.equal(outcomeDelivery('oversized-payload'), null);
 });
 test('outcome delivery armed after settlement is born pending with its document', () => {
     createNode(node('settled-delivery'));
     transition('settled-delivery', 'crash');
-    const delivery = armOutcomeDelivery({
+    const delivery = armOutcomeAction({
         nodeId: 'settled-delivery', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { callback: 'one' }, now: 123,
     });
     assert.equal(delivery?.state, 'pending');
     assert.equal(delivery?.nextAttemptAt, 123);
-    assert.deepEqual(delivery?.document && {
-        schema: delivery.document.schema,
-        outcomeId: delivery.document.outcomeId,
-        action: delivery.document.action,
+    const document = delivery === null ? null : messageBodyForDelivery(delivery.deliveryId);
+    assert.deepEqual(document && {
+        schema: document.schema,
+        outcomeId: document.outcomeId,
+        action: document.action,
     }, {
         schema: 'crtr.node-outcome/v1',
         outcomeId: 'settled-delivery:1',
@@ -130,28 +197,28 @@ test('outcome delivery armed after settlement is born pending with its document'
 });
 test('outcome delivery state is fenced, recoverable, and follows the durable backoff', () => {
     createNode(node('delivery'));
-    assert.ok(armOutcomeDelivery({
+    assert.ok(armOutcomeAction({
         nodeId: 'delivery', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', payload: { callback: 'one' }, now: 100,
     }));
     transition('delivery', 'crash');
-    assert.equal(readOutcomeDelivery('delivery')?.state, 'pending');
-    assert.ok(readOutcomeDelivery('delivery')?.document, 'the armed row is stamped with its outcome document');
-    const first = claimOutcomeDelivery('delivery', Date.now(), 'daemon-a');
-    assert.equal(first.state, 'running');
-    assert.equal(settleOutcomeDelivery('delivery', first.attempt, 'daemon-b', { state: 'accepted' }, Date.now()), false, 'a stale claimant cannot settle');
-    assert.equal(settleOutcomeDelivery('delivery', first.attempt, 'daemon-a', { state: 'accepted' }, Date.now()), true);
-    assert.equal(readOutcomeDelivery('delivery')?.state, 'accepted');
+    assert.equal(outcomeDelivery('delivery')?.state, 'pending');
+    assert.ok(messageBodyForDelivery(outcomeDelivery('delivery').deliveryId), 'the armed row is stamped with its outcome document');
+    const first = claimExternalActionDelivery(outcomeDelivery('delivery').deliveryId, Date.now(), 'daemon-a');
+    assert.equal(first.state, 'handed_off');
+    assert.equal(settleDelivery(first.deliveryId, first.attempts, 'daemon-b', { state: 'accepted' }, Date.now()), false, 'a stale claimant cannot settle');
+    assert.equal(settleDelivery(first.deliveryId, first.attempts, 'daemon-a', { state: 'accepted' }, Date.now()), true);
+    assert.equal(outcomeDelivery('delivery')?.state, 'acknowledged');
     createNode(node('recover'));
-    armOutcomeDelivery({ nodeId: 'recover', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', now: 100 });
+    armOutcomeAction({ nodeId: 'recover', actionName: 'test-action', argv: ['/bin/true'], cwd: home, configOrigin: 'test', now: 100 });
     transition('recover', 'crash');
-    const running = claimOutcomeDelivery('recover', Date.now(), 'daemon-a');
-    assert.equal(running.state, 'running');
+    const running = claimExternalActionDelivery(outcomeDelivery('recover').deliveryId, Date.now(), 'daemon-a');
+    assert.equal(running.state, 'handed_off');
     const recoveredAt = Date.now();
-    assert.equal(recoverRunningOutcomeDeliveries(recoveredAt), 1);
-    assert.deepEqual(readOutcomeDelivery('recover') && {
-        state: readOutcomeDelivery('recover').state,
-        nextAttemptAt: readOutcomeDelivery('recover').nextAttemptAt,
-        claimOwner: readOutcomeDelivery('recover').claimOwner,
+    assert.equal(resetHandedOffDeliveries(recoveredAt), 1);
+    assert.deepEqual(outcomeDelivery('recover') && {
+        state: outcomeDelivery('recover').state,
+        nextAttemptAt: outcomeDelivery('recover').nextAttemptAt,
+        claimOwner: outcomeDelivery('recover').claimOwner,
     }, { state: 'pending', nextAttemptAt: recoveredAt, claimOwner: null });
 });
 test('v39 migrates a v38 database and backfills finalized and terminal rows', () => {

package/dist/core/__tests__/on-read-crouter-home-fence.test.js

@@ -10,7 +10,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs } from '../substrate/on-read-node.js';
@@ -32,6 +32,7 @@ beforeEach(() => {
     // touch the fake user home; the read path we test is constructed by hand.
     canvasHome = mkdtempSync(join(tmpdir(), 'crtr-fence-canvas-'));
     process.env['CRTR_HOME'] = canvasHome;
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/core/__tests__/on-read-dedup-resume.test.js

@@ -10,7 +10,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs } from '../substrate/on-read-node.js';
@@ -44,6 +44,7 @@ beforeEach(() => {
     else
         process.env['HOME'] = prevHomeEnv;
     work = mkdtempSync(join(tmpdir(), 'crtr-onread-work-'));
+    migrate(openDb());
 });
 after(() => {
     closeDb();