@north-light/crouter 0.3.312 → 0.3.314

package/dist/core/__tests__/on-read-nested-store.test.js

@@ -11,7 +11,7 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { renderOnReadDocs, renderWorkspaceOpenDocs } from '../substrate/on-read-node.js';
@@ -36,6 +36,7 @@ beforeEach(() => {
     process.env['HOME'] = fakeHome;
     canvasHome = mkdtempSync(join(tmpdir(), 'crtr-nested-canvas-'));
     process.env['CRTR_HOME'] = canvasHome;
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/core/__tests__/passive-subscription.test.js

@@ -1,49 +1,17 @@
-// End-to-end tests for passive subscriptions:
-//   1. A passive subscriber's pushes land in passive.jsonl, NOT inbox.jsonl
-//      (so the inbox-watcher never wakes it); an active subscriber's land in
-//      inbox.jsonl as before.
-//   2. the broker drain reads + clears the accumulator (surfaces exactly once).
-//   3. canvas-passive-context formats drained entries as timestamped XML and
-//      transforms an `input` event into pre-text + the original message.
-//
-// Run: node --import tsx/esm --test src/core/__tests__/passive-subscription.test.ts
-import { test, before, beforeEach, afterEach, after } from 'node:test';
+import { after, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, existsSync, readFileSync, appendFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
 import { createNode, subscribe } from '../canvas/canvas.js';
 import { armCron, getCron } from '../canvas/crons.js';
-import { closeDb } from '../canvas/db.js';
-import { inboxPath, passivePath, apiSocketPath } from '../canvas/paths.js';
-import { createApiServer } from '../../daemon/api/server.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { acknowledgeNodeMail, claimNodeMail, hasUnseenWakeMail } from '../canvas/deliveries.js';
+import { beginExecution } from '../canvas/executions.js';
 import { push } from '../feed/feed.js';
-import { appendPassive } from '../feed/passive.js';
-import { readInboxSince } from '../feed/inbox.js';
-import { drainBrokerPassive } from '../runtime/broker/passive.js';
-import { readLeaf } from '../../commands/canvas-history/read.js';
-import registerCanvasPassiveContext from '../../pi-extensions/canvas-passive-context.js';
+import { nodeMailEntry } from '../feed/inbox.js';
+import { formatPassive } from '../../pi-extensions/canvas-passive-context.js';
 let home;
-function readPassiveEntries(nodeId) {
-    const path = passivePath(nodeId);
-    if (!existsSync(path))
-        return [];
-    return readFileSync(path, 'utf8').split('\n').filter(Boolean).map((line) => JSON.parse(line));
-}
-// The one test that resolves an emitted feed ref drives `canvas history read`'s
-// leaf (`readLeaf`), a thin CLI forwarder to crtrd since the API re-plumb. Stand
-// up a real in-process `createApiServer()` on the isolated CRTR_HOME's socket so
-// that read resolves through the genuine daemon seam — no autostarted
-// subprocess, no mock client.
-let server;
-async function waitForSocket(path) {
-    for (let i = 0; i < 200; i++) {
-        if (existsSync(path))
-            return;
-        await new Promise((r) => setTimeout(r, 25));
-    }
-    throw new Error(`api socket never bound at ${path}`);
-}
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -57,53 +25,44 @@ function node(id, over = {}) {
         ...over,
     };
 }
+function execution(nodeId) {
+    return beginExecution(nodeId, { daemonEpoch: 'test' });
+}
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-passive-'));
     process.env['CRTR_HOME'] = home;
 });
-beforeEach(async () => {
+beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     mkdirSync(home, { recursive: true });
-    server = createApiServer();
-    await waitForSocket(apiSocketPath());
-});
-afterEach(async () => {
-    await server?.close();
+    migrate(openDb());
 });
 after(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
-    delete process.env['CRTR_NODE_ID'];
 });
-test('passive push accumulates in passive.jsonl, not inbox.jsonl', async () => {
+test('a passive subscriber receives a non-waking SQL delivery with the canonical report ref', async () => {
     createNode(node('pub'));
     createNode(node('observer'));
-    subscribe('observer', 'pub', false); // PASSIVE
+    subscribe('observer', 'pub', false);
     const result = await push('pub', { kind: 'update', body: 'first observation\nmore detail' });
-    // The emitted feed ref is the same canonical handle accepted by `canvas
-    // history read`, while PushResult.reportPath remains an absolute path.
-    const acc = readPassiveEntries('observer');
-    const ref = acc[0].ref;
-    assert.equal(ref, `pub:reports/${basename(result.reportPath)}`);
-    const resolved = await readLeaf.run({ ref });
-    assert.equal(resolved?.['ref'], ref, 'canvas history read accepts the emitted ref verbatim');
-    assert.equal(resolved?.['content'], 'first observation\nmore detail');
-    assert.equal(result.reportPath.startsWith('/'), true);
-    // No inbox entry → the inbox-watcher would never see it → no wake.
-    assert.equal(existsSync(inboxPath('observer')), false);
-    assert.equal(readInboxSince('observer').length, 0);
-    // It landed in the passive accumulator instead.
-    assert.equal(acc.length, 1);
-    assert.equal(acc[0].from, 'pub');
-    assert.equal(acc[0].label, 'first observation');
-    assert.match(acc[0].ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/, 'report refs use a compact random suffix');
+    const executionId = execution('observer');
+    const claim = claimNodeMail('observer', executionId, 'passive');
+    assert.equal(hasUnseenWakeMail('observer'), false, 'passive mail does not wake a node');
+    assert.equal(claim.action, 'claimed');
+    assert.equal(claim.deliveries.length, 1);
+    const entry = nodeMailEntry(claim.deliveries[0]);
+    assert.equal(entry.from, 'pub');
+    assert.equal(entry.label, 'first observation');
+    assert.equal(entry.ref, `pub:reports/${basename(result.reportPath)}`);
+    assert.match(entry.ref ?? '', /^pub:reports\/\d{8}T\d{9}-[0-9a-f]{8}-update\.md$/);
 });
-test('active push still lands in inbox.jsonl (wakes) and clears the manager deadline', async () => {
+test('an active subscriber receives waking SQL mail and clears its deadline', async () => {
     createNode(node('pub'));
     createNode(node('worker-mgr'));
-    subscribe('worker-mgr', 'pub', true); // ACTIVE
+    subscribe('worker-mgr', 'pub', true);
     armCron({
         cron_id: 'manager-deadline',
         name: 'manager deadline',
@@ -126,102 +85,36 @@ test('active push still lands in inbox.jsonl (wakes) and clears the manager dead
         tier: 'normal',
     });
     await push('pub', { kind: 'update', body: 'active report' });
-    assert.equal(existsSync(passivePath('worker-mgr')), false);
-    const inbox = readInboxSince('worker-mgr');
-    assert.equal(inbox.length, 1);
-    assert.equal(inbox[0].from, 'pub');
-    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
-    assert.equal(getCron('manager-deadline'), null, 'the child report won the deadline race');
-});
-test('a deferred update still lands in an active subscriber inbox at deferred tier', async () => {
-    createNode(node('pub'));
-    // Resident: deferred mail to a TERMINAL target is bumped to urgent by the
-    // shipped tier bump, so only a resident subscriber shows the requested tier.
-    createNode(node('worker-mgr', { lifecycle: 'resident' }));
-    subscribe('worker-mgr', 'pub', true); // ACTIVE
-    await push('pub', { kind: 'update', deliveryTier: 'deferred', body: 'active report' });
-    assert.equal(existsSync(passivePath('worker-mgr')), false);
-    const inbox = readInboxSince('worker-mgr');
-    assert.equal(inbox.length, 1);
-    assert.equal(inbox[0].from, 'pub');
-    assert.equal(inbox[0].tier, 'deferred', 'requested delivery urgency reaches the subscriber unchanged');
-    assert.equal(inbox[0].kind, 'update', 'the stored report kind is untouched by delivery urgency');
-    assert.match(inbox[0].ref ?? '', /^pub:reports\/.+-update\.md$/);
+    const claim = claimNodeMail('worker-mgr', execution('worker-mgr'), 'wake');
+    assert.equal(hasUnseenWakeMail('worker-mgr'), true);
+    assert.equal(getCron('manager-deadline'), null, 'the report won the deadline race');
+    assert.equal(claim.deliveries.length, 1);
+    assert.equal(nodeMailEntry(claim.deliveries[0]).from, 'pub');
 });
-test('mixed active + passive subscribers route to their own stores', async () => {
+test('a passive delivery is acknowledged only after it has been claimed', async () => {
     createNode(node('pub'));
-    createNode(node('active-sub'));
-    createNode(node('passive-sub'));
-    subscribe('active-sub', 'pub', true);
-    subscribe('passive-sub', 'pub', false);
-    const res = await push('pub', { kind: 'urgent', body: 'something happened' });
-    assert.deepEqual(new Set(res.deliveredTo), new Set(['active-sub', 'passive-sub']));
-    assert.equal(readInboxSince('active-sub').length, 1);
-    assert.equal(existsSync(passivePath('active-sub')), false);
-    assert.equal(readPassiveEntries('passive-sub').length, 1);
-    assert.equal(existsSync(inboxPath('passive-sub')), false);
-});
-test('broker passive drain reads then clears (surfaces exactly once)', () => {
-    createNode(node('observer'));
-    appendPassive('observer', { from: 'a', tier: 'normal', kind: 'update', label: 'one' });
-    appendPassive('observer', { from: 'b', tier: 'normal', kind: 'update', label: 'two' });
-    const drained = drainBrokerPassive('observer');
-    assert.equal(drained.length, 2);
-    assert.deepEqual(drained.map((e) => e.label), ['one', 'two']); // oldest first
-    // Cleared — a second drain is empty.
-    assert.equal(drainBrokerPassive('observer').length, 0);
-    assert.equal(readPassiveEntries('observer').length, 0);
-});
-test('broker passive drain tolerates a corrupt line — keeps every good entry, loses only the bad one', () => {
     createNode(node('observer'));
-    appendPassive('observer', { from: 'a', tier: 'normal', kind: 'update', label: 'one' });
-    appendPassive('observer', { from: 'b', tier: 'normal', kind: 'update', label: 'two' });
-    // A torn/garbage line lands between good entries (a partial write, a crash
-    // mid-append). The whole feed must NOT be discarded over it.
-    appendFileSync(passivePath('observer'), '{not valid json\n', 'utf8');
-    appendPassive('observer', { from: 'c', tier: 'normal', kind: 'update', label: 'three' });
-    const drained = drainBrokerPassive('observer');
-    assert.equal(drained.length, 3, 'all three good entries survive the corrupt line');
-    assert.deepEqual(drained.map((e) => e.label), ['one', 'two', 'three']);
-    // And it still cleared: a second drain is empty (snapshot removed).
-    assert.equal(drainBrokerPassive('observer').length, 0);
-    assert.equal(existsSync(passivePath('observer')), false);
+    subscribe('observer', 'pub', false);
+    await push('pub', { kind: 'update', body: 'one' });
+    await push('pub', { kind: 'update', body: 'two' });
+    const executionId = execution('observer');
+    const claim = claimNodeMail('observer', executionId, 'passive');
+    assert.deepEqual(claim.deliveries.map((delivery) => nodeMailEntry(delivery).label), ['one', 'two']);
+    const receipt = acknowledgeNodeMail('observer', executionId, claim.deliveries.map((delivery) => ({
+        deliveryId: delivery.deliveryId,
+        attempts: delivery.attempts,
+        disposition: 'acknowledged',
+    })));
+    assert.deepEqual(receipt.results.map((result) => result.outcome), ['acknowledged', 'acknowledged']);
+    assert.deepEqual(claimNodeMail('observer', executionId, 'passive').deliveries, []);
 });
-function makeFakePi() {
-    return { on(e, h) { if (e === 'input')
-            this.handler = h; } };
-}
-test('input handler injects drained backlog as pre-text, then clears it', async () => {
+test('passive SQL mail retains the existing timestamped backlog rendering', async () => {
     createNode(node('pub'));
     createNode(node('observer'));
     subscribe('observer', 'pub', false);
     await push('pub', { kind: 'update', body: 'the body of the report\nsecond line' });
-    process.env['CRTR_NODE_ID'] = 'observer';
-    const pi = makeFakePi();
-    registerCanvasPassiveContext(pi);
-    assert.ok(pi.handler, 'input handler registered');
-    // First message → backlog drains in as pre-text before the user's text.
-    const out = await pi.handler({ type: 'input', text: 'hey what happened', source: 'interactive' });
-    assert.equal(out.action, 'transform');
-    assert.match(out.text, /<passive-subscription-backlog/);
-    assert.match(out.text, /the body of the report/); // dereferenced report body
-    assert.match(out.text, /hey what happened$/); // original message preserved at the end
-    // Second message → nothing accumulated → left untouched.
-    const out2 = await pi.handler({ type: 'input', text: 'still there?', source: 'interactive' });
-    assert.ok(out2 === undefined || out2.action === 'continue');
-    // Oversized canonical reports must leave an actionable reader command in the
-    // truncation tail, using the exact ref emitted into the passive feed.
-    await push('pub', { kind: 'update', body: 'oversized report line '.repeat(250) });
-    const oversizedRef = readPassiveEntries('observer')[0].ref;
-    const out3 = await pi.handler({ type: 'input', text: 'show me the rest', source: 'interactive' });
-    assert.equal(out3.action, 'transform');
-    assert.ok(out3.text.includes(`crtr canvas history read ${oversizedRef}`), 'truncation tail names the canonical reader and emitted ref');
-});
-test('input handler is inert when nothing is accumulated', async () => {
-    createNode(node('observer'));
-    process.env['CRTR_NODE_ID'] = 'observer';
-    const pi = makeFakePi();
-    registerCanvasPassiveContext(pi);
-    const out = await pi.handler({ type: 'input', text: 'plain message', source: 'interactive' });
-    assert.ok(out === undefined || out.action === 'continue');
+    const claim = claimNodeMail('observer', execution('observer'), 'passive');
+    const text = formatPassive(claim.deliveries.map(nodeMailEntry));
+    assert.match(text, /<passive-subscription-backlog/);
+    assert.match(text, /the body of the report/);
 });

package/dist/core/__tests__/plugin-kinds.test.js

@@ -17,7 +17,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import * as tar from 'tar';
 import { resetScopeCache } from '../scope.js';
-import { readMergedLaunchConfig } from '../config.js';
+import { readMergedLaunchConfig, updateRawConfigAtomically, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { validatePluginBundle } from '../command-plugins/bundle.js';
 let isolatedHome;
 let isolatedCwd;
@@ -32,6 +33,7 @@ beforeEach(() => {
     isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-plugin-kinds-cwd-')));
     process.env.HOME = isolatedHome;
     process.chdir(isolatedCwd);
+    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
     resetScopeCache();
 });
 afterEach(() => {
@@ -76,7 +78,7 @@ test('the scope\u2019s own config.json overrides its plugins; a disabled plugin
     const root = userRoot();
     plantPlugin(root, 'northlight', { 'applet-builder': { whenToUse: 'plugin gloss', model: 'anthropic/strong' } });
     plantPlugin(root, 'zzz-disabled', { ghost: { whenToUse: 'never registers' } });
-    writeFileSync(join(root, 'config.json'), JSON.stringify({
+    updateRawConfigAtomically('user', () => ({
         plugins: { 'zzz-disabled': { enabled: false } },
         kinds: { 'applet-builder': { model: 'openai/medium' } },
     }));
@@ -91,7 +93,7 @@ test('a whenToUse-only entry re-glosses an existing kind without stripping its m
     // Now every entry field-merges over an existing kind; only a NEW kind
     // requires whenToUse (a whenToUse-less new kind is dropped).
     const root = userRoot();
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ kinds: { explore: { whenToUse: 'custom explore gloss' }, 'new-glossless': { model: 'openai/light' } } }));
+    updateRawConfigAtomically('user', () => ({ kinds: { explore: { whenToUse: 'custom explore gloss' }, 'new-glossless': { model: 'openai/light' } } }));
     const kinds = readMergedLaunchConfig().kinds;
     assert.equal(kinds['explore']?.whenToUse, 'custom explore gloss');
     assert.equal(kinds['explore']?.model, 'openai/light'); // builtin tier survives
@@ -100,7 +102,7 @@ test('a whenToUse-only entry re-glosses an existing kind without stripping its m
 });
 test('a project-root plugin layers above user config, and the project config above the plugin', () => {
     const uRoot = userRoot();
-    writeFileSync(join(uRoot, 'config.json'), JSON.stringify({ kinds: { shared: { whenToUse: 'user gloss', model: 'openai/light' } } }));
+    writeRawConfig('user', { kinds: { shared: { whenToUse: 'user gloss', model: 'openai/light' } } });
     const pRoot = projectRoot();
     plantPlugin(pRoot, 'proj-plugin', { shared: { model: 'anthropic/strong' }, 'proj-kind': { whenToUse: 'project plugin kind' } });
     writeFileSync(join(pRoot, 'config.json'), JSON.stringify({ kinds: { 'proj-kind': { model: 'openai/medium' } } }));

package/dist/core/__tests__/plugin-link-symlinked-scope-root.test.js

@@ -11,8 +11,11 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { realpathSync } from 'node:fs';
 import { linkOrCopy } from '../fs-utils.js';
 import { listInstalledPluginsInRoot } from '../resolver.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 describe('plugin link through a symlinked scope-root ancestor', () => {
     test('the installed plugin resolves on the next invocation', () => {
         const base = mkdtempSync(join(tmpdir(), 'crtr-plugin-link-'));
@@ -28,10 +31,12 @@ describe('plugin link through a symlinked scope-root ancestor', () => {
             symlinkSync(join('physical', 'home'), join(base, 'home'), 'dir');
             const scopeRootPath = join(base, 'home', '.crouter');
             mkdirSync(join(scopeRootPath, 'plugins'), { recursive: true });
+            initializeFreshScopedStore({ kind: 'user', root: scopeRootPath });
             linkOrCopy(source, join(scopeRootPath, 'plugins', 'search'));
-            assert.deepEqual(listInstalledPluginsInRoot('user', scopeRootPath).map((p) => p.name), ['search']);
+            assert.deepEqual(listInstalledPluginsInRoot('user', realpathSync(scopeRootPath)).map((p) => p.name), ['search']);
         }
         finally {
+            closeScopedStores();
             rmSync(base, { recursive: true, force: true });
         }
     });

package/dist/core/__tests__/plugin-page-components.test.js

@@ -15,7 +15,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import * as tar from 'tar';
 import { resetScopeCache } from '../scope.js';
-import { resolvePageComponents } from '../config.js';
+import { resolvePageComponents, updateRawConfigAtomically, writeRawConfig } from '../config.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { validatePluginBundle } from '../command-plugins/bundle.js';
 let isolatedHome;
 let isolatedCwd;
@@ -30,6 +31,7 @@ beforeEach(() => {
     isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-page-components-cwd-')));
     process.env.HOME = isolatedHome;
     process.chdir(isolatedCwd);
+    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
     resetScopeCache();
 });
 afterEach(() => {
@@ -60,7 +62,7 @@ test('an enabled user-scope plugin contributes its page components; a disabled o
         { kind: 'applet-card', display: true },
     ]);
     plantPlugin(root, 'zzz-disabled', ['ghost']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ plugins: { 'zzz-disabled': { enabled: false } } }));
+    writeRawConfig('user', { plugins: { 'zzz-disabled': { enabled: false } } });
     const components = resolvePageComponents();
     assert.deepEqual(components, [
         { kind: 'connector', description: 'Connector decision', useWhen: 'Use for a connector decision.', doc: 'Product contract.' },
@@ -70,9 +72,9 @@ test('an enabled user-scope plugin contributes its page components; a disabled o
 test('user config entries and plugin contributions resolve together, and a colliding kind is rejected', () => {
     const root = userRoot();
     plantPlugin(root, 'northlight', ['connector']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['approval'] }));
+    updateRawConfigAtomically('user', () => ({ page_components: ['approval'] }));
     assert.deepEqual(resolvePageComponents().map((component) => component.kind), ['approval', 'connector']);
-    writeFileSync(join(root, 'config.json'), JSON.stringify({ page_components: ['connector'] }));
+    updateRawConfigAtomically('user', () => ({ page_components: ['connector'] }));
     assert.throws(() => resolvePageComponents(), /page component kind "connector" is registered by both config.json and plugin "northlight"/);
 });
 test('two plugins whose kinds derive one JSX tag are rejected, naming both sources', () => {

package/dist/core/__tests__/preview-registry-sync.test.js

@@ -16,6 +16,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { buildRoot } from '../../build-root.js';
 import { SUPPRESS_OUTPUT_LEAVES, LEAF_ICON_CP, SUMMARIZERS } from '../preview-registry.js';
+import { ensureScopeInitialized } from '../config.js';
 import { resetScopeCache } from '../scope.js';
 // buildRoot() composes external command-plugin branches from the effective
 // enabled plugins (user scope + project ancestors). Pin HOME + profile to an
@@ -31,6 +32,7 @@ before(() => {
     process.env['HOME'] = home;
     delete process.env['CRTR_PROFILE_ID'];
     resetScopeCache();
+    ensureScopeInitialized('user', join(home, '.crouter'));
 });
 after(() => {
     if (realHome !== undefined)

package/dist/core/__tests__/profile-project-memory-delivery.test.js

@@ -18,9 +18,10 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
 import { resetScopeCache } from '../scope.js';
 import { createProfile } from '../profiles/manifest.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { spawnNode } from '../runtime/nodes.js';
 import { memoryDir } from '../runtime/memory.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
@@ -115,6 +116,8 @@ before(() => {
     canvasHome = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-ppm-canvas-')));
     process.env['HOME'] = home;
     process.env['CRTR_HOME'] = canvasHome;
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
     // A project store answers only under the namespace its root INDEX.md
     // declares; without that declaration the store does not mount at all.
     const store = (slug, namespace) => {

package/dist/core/__tests__/prune.test.js

@@ -3,8 +3,9 @@ import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { createNode, getRow, subscribe, recordPid, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
-import { closeDb, openDb } from '../canvas/db.js';
+import { createNode, getRow, subscribe, recordSpawn, subscribersOf, subscriptionsOf, pruneNodes, pruneToLimit, transitionStatusIntent, } from '../canvas/canvas.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
 import { nodeDir } from '../canvas/paths.js';
 let home;
 const DAY = 86_400_000;
@@ -33,6 +34,10 @@ function totalEdges() {
 function markCollectibleTerminal(nodeId) {
     transitionStatusIntent(nodeId, { terminal_reason: 'closed' });
 }
+function recordExecution(nodeId, pid) {
+    const executionId = beginExecution(nodeId, { daemonEpoch: 'test' });
+    recordExecutionPid(executionId, nodeId, pid);
+}
 /** The standard fixture: three prunable terminal nodes (old), three survivors
  *  (two old-but-live, one recent-but-dead), and edges that touch a pruned node
  *  so cascade is observable. */
@@ -55,6 +60,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();
@@ -146,7 +152,7 @@ test('count pruning keeps all live nodes even when liveCount exceeds the cap', (
     // fall beyond rank 5 and are pruned.
     for (let i = 0; i < 5; i++) {
         createNode(node(`live-${i}`, { status: 'active', created: at(i) }));
-        recordPid(`live-${i}`, process.pid); // process.pid is alive → isPidAlive true
+        recordExecution(`live-${i}`, process.pid); // process.pid is alive → isPidAlive true
     }
     createNode(node('old-a', { status: 'dead', created: at(100) }));
     createNode(node('old-b', { status: 'done', created: at(101) }));
@@ -164,7 +170,7 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
     // Ranked by recency DESC: live-0, term-0, term-1 (top 3, kept), then
     // term-2, term-3, term-4 (rank >= 3, pruned).
     createNode(node('live-0', { status: 'idle', created: at(0) }));
-    recordPid('live-0', process.pid);
+    recordExecution('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
         const id = `term-${i}`;
         createNode(node(id, { status: 'dead', created: at(10 + i) }));
@@ -185,7 +191,7 @@ test('count pruning deletes the oldest terminal nodes beyond max(cap, liveCount)
 });
 test('count pruning dry-run reports candidates without deleting rows or dirs', () => {
     createNode(node('live-0', { status: 'idle', created: at(0) }));
-    recordPid('live-0', process.pid);
+    recordExecution('live-0', process.pid);
     for (let i = 0; i < 5; i++) {
         const id = `term-${i}`;
         createNode(node(id, { status: 'dead', created: at(10 + i) }));

package/dist/core/__tests__/push-final-guard.test.js

@@ -4,21 +4,28 @@ import { mkdtempSync, rmSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createNode, getNode, setStatus } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { closeDb, openDb, migrate } from '../canvas/db.js';
 import { InputError } from '../io.js';
 import { messageRoutes } from '../../daemon/api/handlers/messages.js';
 import { pushFinal, FinalizationError } from '../feed/feed.js';
 import { assertNotFinalized, assertFinalizedForReopen, commitReopen } from '../runtime/reopen.js';
 import { reviveNode } from '../runtime/revive.js';
 import { headlessBrokerHost } from '../runtime/host.js';
-import { readInboxSince } from '../feed/inbox.js';
+function nodeMailCount(nodeId) {
+    return Number(openDb().prepare(`SELECT COUNT(*) AS count FROM deliveries
+    WHERE destination_kind = 'node_inbox' AND destination_id = ?`).get(nodeId).count);
+}
 import { writeGoal } from '../runtime/kickoff.js';
 import { situationalContextPath } from '../canvas/paths.js';
 let home;
 const prevNodeId = process.env['CRTR_NODE_ID'];
 function node(id) { return { node_id: id, name: id, created: new Date().toISOString(), cwd: '/tmp/work', kind: 'general', mode: 'base', lifecycle: 'terminal', status: 'active' }; }
 before(() => { home = mkdtempSync(join(tmpdir(), 'crtr-pushfinal-')); process.env['CRTR_HOME'] = home; });
-beforeEach(() => { closeDb(); rmSync(home, { recursive: true, force: true }); });
+beforeEach(() => {
+    closeDb();
+    rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
+});
 after(() => { closeDb(); rmSync(home, { recursive: true, force: true }); delete process.env['CRTR_HOME']; if (prevNodeId === undefined)
     delete process.env['CRTR_NODE_ID'];
 else
@@ -66,13 +73,13 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
     const firstFinal = getNode(id)?.final_report;
     assert.ok(firstFinal);
     // A message to the now-finalized node, no --reopen: rejected before the
-    // handler ever reaches appendInbox/reviveNode. Prove BOTH: the latch is
+    // handler ever creates a delivery or reaches reviveNode. Prove BOTH: the latch is
     // untouched, AND (per #340's Minor finding) no side effect landed first —
     // spy on the exact revive seam reviveNode calls (headlessBrokerHost.launch,
     // the same seam revive.test.ts already uses to instrument reviveNode without
     // a real engine) and assert it was never invoked, plus the inbox is
     // unchanged.
-    const inboxBefore = readInboxSince(id, undefined).length;
+    const inboxBefore = nodeMailCount(id);
     const originalLaunch = headlessBrokerHost.launch;
     let launchCalls = 0;
     headlessBrokerHost.launch = ((...args) => { launchCalls++; return originalLaunch(...args); });
@@ -84,7 +91,7 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
     }
     assert.equal(launchCalls, 0, 'a rejected retask must never attempt a revive');
     assert.equal(getNode(id)?.final_report, firstFinal, 'a rejected retask must not touch the latch');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore, 'a rejected retask must not append an inbox entry');
+    assert.equal(nodeMailCount(id), inboxBefore, 'a rejected retask must not create a delivery');
     // The successful path, driven through the ACTUAL daemon message handler (the
     // real seam --reopen now lives behind, not a direct call into the gate
     // internals) — stub the revive seam so no real engine process is spawned,
@@ -105,7 +112,7 @@ test('a finalized node re-tasked via node message send without --reopen is rejec
         headlessBrokerHost.launch = originalLaunch;
     }
     assert.equal(getNode(id)?.final_report, null, '--reopen cleared the latch through the real handler seam');
-    assert.equal(readInboxSince(id, undefined).length, inboxBefore + 1, 'the re-task message was actually appended to the inbox');
+    assert.equal(nodeMailCount(id), inboxBefore + 1, 'the re-task message created one durable delivery');
     // The re-tasked node can now finish its new mandate and re-latch cleanly.
     process.env['CRTR_NODE_ID'] = id;
     await pushFinal(id, 'round 2 verdict');

package/dist/core/__tests__/relaunch-root.test.js

@@ -15,13 +15,19 @@ import { CrtrClient } from '../../api/client.js';
 import { createApiServer } from '../../daemon/api/server.js';
 import registerCanvasStophook from '../../pi-extensions/canvas-stophook.js';
 import { createNode, getNode, subscribe } from '../canvas/canvas.js';
-import { closeDb } from '../canvas/db.js';
+import { beginExecution, recordExecutionPid } from '../canvas/executions.js';
+import { closeDb, migrate, openDb } from '../canvas/db.js';
+import { resetScopeCache } from '../scope.js';
+import { closeScopedStores } from '../scoped-state/db.js';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
 import { apiSocketPath } from '../canvas/paths.js';
 import { brokerCapReached, resetFleetForTests } from '../runtime/fleet.js';
 import { buildPiArgv } from '../runtime/launch.js';
 import { relaunchRoot } from '../runtime/reset.js';
 import { bindTestFleet } from './helpers/fleet.js';
 let home;
+let tf;
+const previousHome = process.env['HOME'];
 function node(id, over = {}) {
     return {
         node_id: id,
@@ -67,16 +73,30 @@ function makeDeps(pid) {
 }
 before(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-relaunch-'));
-    process.env['CRTR_HOME'] = home;
+    process.env['HOME'] = home;
+    process.env['CRTR_HOME'] = join(home, 'canvas');
 });
 beforeEach(() => {
     closeDb();
+    closeScopedStores();
     rmSync(home, { recursive: true, force: true });
+    resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
+    migrate(openDb());
+    tf = bindTestFleet();
 });
 after(() => {
     closeDb();
+    closeScopedStores();
+    tf.fleet.dispose();
+    resetFleetForTests();
     rmSync(home, { recursive: true, force: true });
     delete process.env['CRTR_HOME'];
+    if (previousHome === undefined)
+        delete process.env['HOME'];
+    else
+        process.env['HOME'] = previousHome;
+    resetScopeCache();
 });
 test('relaunchRoot parks the old root done and mints a fresh active root, reaping descendants', async () => {
     // root → child → grandchild (a parent that subscribes to its workers).
@@ -169,6 +189,10 @@ test('root /new capacity refusal reaches the attached human through broker UI no
     process.env['CRTR_NODE_ID'] = 'root';
     createNode(node('root', { parent: null, lifecycle: 'resident' }));
     const tf = bindTestFleet();
+    const executionId = beginExecution('root', { daemonEpoch: tf.fleet.epoch() });
+    assert.equal(recordExecutionPid(executionId, 'root', process.pid), 'recorded');
+    const previousExecutionId = process.env['CRTR_EXECUTION_ID'];
+    process.env['CRTR_EXECUTION_ID'] = executionId;
     const never = new Promise(() => { });
     tf.fleet.register('filler-a', { pid: 700_001, exited: never });
     tf.fleet.register('filler-b', { pid: 700_002, exited: never });
@@ -207,6 +231,10 @@ test('root /new capacity refusal reaches the attached human through broker UI no
         resetFleetForTests();
         delete process.env['CRTR_MAX_LIVE_BROKERS'];
         delete process.env['CRTR_NODE_ID'];
+        if (previousExecutionId === undefined)
+            delete process.env['CRTR_EXECUTION_ID'];
+        else
+            process.env['CRTR_EXECUTION_ID'] = previousExecutionId;
     }
 });
 test('relaunchRoot is a no-op for a non-root child and an already-parked root', async () => {