@north-light/crouter 0.3.312 → 0.3.314

package/dist/daemon/api/__tests__/seam/api-server.test.js

@@ -35,9 +35,11 @@ import { createAttachKit } from '../../../../core/__tests__/helpers/broker-clien
 import { ApiError, CrtrClient } from '../../../../api/index.js';
 import { createApiServer } from '../../server.js';
 import { createNode } from '../../../../core/canvas/canvas.js';
-import { apiSocketPath, inboxPath } from '../../../../core/canvas/paths.js';
+import { apiSocketPath } from '../../../../core/canvas/paths.js';
+import { beginExecution, recordExecutionPid } from '../../../../core/canvas/executions.js';
+import { closeTurn, openTurn } from '../../../../core/canvas/recovery.js';
 import { isPidAlive } from '../../../../core/canvas/pid.js';
-import { clearBusy, markBusy } from '../../../../core/runtime/busy.js';
+import { initializeFreshScopedStore } from '../../../../core/scoped-state/migrate.js';
 let h;
 let server;
 let client;
@@ -64,17 +66,6 @@ function seedAssistantSession(sessionFile) {
     mkdirSync(dirname(sessionFile), { recursive: true });
     writeFileSync(sessionFile, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
 }
-// Count non-empty lines in a jsonl file (raw, cursor-independent — the live
-// broker's inbox-watcher advances a SEPARATE cursor sidecar, so reading the
-// append-only file directly is stable regardless of consumption).
-function countLines(path) {
-    try {
-        return readFileSync(path, 'utf8').split('\n').filter((l) => l.trim() !== '').length;
-    }
-    catch {
-        return 0;
-    }
-}
 // A1 — /healthz ok + socket mode 0600
 test('A1: /healthz is ok and the unix socket is bound mode 0600', async () => {
     const health = await client.healthz();
@@ -83,10 +74,10 @@ test('A1: /healthz is ok and the unix socket is bound mode 0600', async () => {
     assert.equal(mode, 0o600, `socket mode is 0600 (fs-perms-as-auth), got 0o${mode.toString(8)}`);
 });
 test('status counts only live, busy non-human engine rows', async () => {
-    const agent = h.fabricateBrokerNode({ pi_pid: process.pid });
+    const agent = h.fabricateBrokerNode();
     const deadPid = spawnSync(process.execPath, ['-e', '']).pid;
     assert.ok(deadPid !== undefined, 'dead-pid fixture process started');
-    const deadAgent = h.fabricateBrokerNode({ pi_pid: deadPid });
+    const deadAgent = h.fabricateBrokerNode();
     const bridge = `human-status-${process.pid}`;
     createNode({
         node_id: bridge,
@@ -101,16 +92,21 @@ test('status counts only live, busy non-human engine rows', async () => {
         pi_pid: process.pid,
     });
     const baseline = (await client.status()).busy_node_count;
-    markBusy(agent);
-    markBusy(deadAgent);
-    markBusy(bridge);
+    const executions = [agent, deadAgent, bridge].map((nodeId) => beginExecution(nodeId, { daemonEpoch: null }));
+    for (const [executionId, nodeId, pid] of [
+        [executions[0], agent, process.pid],
+        [executions[1], deadAgent, deadPid],
+        [executions[2], bridge, process.pid],
+    ]) {
+        recordExecutionPid(executionId, nodeId, pid);
+        openTurn(executionId, { reason: 'agent-start' });
+    }
     try {
         assert.equal((await client.status()).busy_node_count, baseline + 1);
     }
     finally {
-        clearBusy(agent);
-        clearBusy(deadAgent);
-        clearBusy(bridge);
+        for (const executionId of executions)
+            closeTurn(executionId, { endReason: 'settled' });
     }
 });
 test('attention counts reads only the requested node slice', async () => {
@@ -172,18 +168,15 @@ process.stdin.on('end', () => {
     chmodSync(executable, 0o755);
     return { started, release };
 }
-// A3 — POST .../messages appends inbox.jsonl; POST .../reports {tier:'final'}
+// A3 — POST .../messages creates a durable SQL delivery; POST .../reports {tier:'final'}
 //      writes the report, notifies subscribers, transitions the row
-test('A3: messages append inbox.jsonl; final report writes + notifies subscriber + transitions row', async () => {
+test('A3: messages create SQL deliveries; final report writes + notifies subscriber + transitions row', async () => {
     const A = h.spawnRoot('a3 mgr');
     const B = (await client.createNode({ kind: 'developer', parent: A, prompt: 'a3 worker' })).node_id;
     await h.awaitBoot(B);
-    // messages append inbox.jsonl (raw line count is cursor-independent)
-    const inboxFile = inboxPath(B);
-    const before = countLines(inboxFile);
     const msg = await client.sendMessage(B, { body: 'hello inbox' });
     assert.equal(msg.delivered, true, 'message reports delivered');
-    await h.waitFor(() => countLines(inboxFile) > before, { label: 'inbox.jsonl appended', timeoutMs: 10_000 });
+    await h.waitFor(() => h.inbox(B).some((entry) => entry.data?.['body'] === 'hello inbox'), { label: 'durable SQL delivery', timeoutMs: 10_000 });
     // final report: file written + subscriber notified + row transitioned
     const res = await client.pushReport(B, { tier: 'final', body: 'a3 done result' });
     assert.ok(existsSync(res.report_path), `report file written at ${res.report_path}`);
@@ -195,12 +188,10 @@ test('A3: messages append inbox.jsonl; final report writes + notifies subscriber
 test('A3b: a durable send acknowledges while the lifecycle tick is blocked launching its idle target', async () => {
     const target = h.fabricateBrokerNode({ lifecycle: 'resident', status: 'idle', intent: 'idle-release' });
     const hook = installBlockedStartHook(target);
-    const inboxFile = inboxPath(target);
-    const before = countLines(inboxFile);
     const sending = client.sendMessage(target, { body: 'wake after durable acknowledgment' });
     let tick;
     try {
-        await h.waitFor(() => countLines(inboxFile) === before + 1, { label: 'durable inbox append' });
+        await h.waitFor(() => h.inbox(target).some((entry) => entry.data?.['body'] === 'wake after durable acknowledgment'), { label: 'durable SQL delivery' });
         assert.equal(h.node(target)?.cycles ?? 0, 0, 'the send has not launched the target');
         tick = h.tick();
         await h.waitFor(() => existsSync(hook.started), { label: 'blocked lifecycle launch' });
@@ -210,11 +201,11 @@ test('A3b: a durable send acknowledges while the lifecycle tick is blocked launc
         ]);
         assert.equal(acknowledged.delivered, true, 'the API acknowledges the durable append');
         assert.equal(acknowledged.revived, false, 'the response honestly reports no synchronous revive');
-        assert.equal(countLines(inboxFile), before + 1, 'exactly one inbox entry is durable while launch is blocked');
+        assert.equal(h.inbox(target).filter((entry) => entry.data?.['body'] === 'wake after durable acknowledgment').length, 1, 'exactly one SQL delivery is durable while launch is blocked');
         writeFileSync(hook.release, 'release');
         await tick;
         assert.equal(h.node(target)?.cycles, 1, 'the one queued entry drove lifecycle revival');
-        assert.equal(countLines(inboxFile), before + 1, 'revival did not append a second inbox entry');
+        assert.equal(h.inbox(target).filter((entry) => entry.data?.['body'] === 'wake after durable acknowledgment').length, 1, 'revival did not append a second SQL delivery');
     }
     finally {
         if (!existsSync(hook.release))
@@ -383,6 +374,7 @@ test('A6b: PUT /model-auth/{provider} writes auth.json (reload fan asserted as f
     const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
     const piDir = mkdtempSync(join(tmpdir(), 'crtr-apisrv-pi-'));
     process.env['PI_CODING_AGENT_DIR'] = piDir;
+    initializeFreshScopedStore({ kind: 'provider', root: piDir });
     try {
         const res = await client.installCredential('anthropic', { kind: 'api_key', api_key: 'sk-test-xyz' });
         assert.equal(res.installed, true, 'credential reports installed');

package/dist/daemon/api/__tests__/seam/b10-attach-modelauth.test.js

@@ -35,6 +35,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { readAuthCredentials, setAuthCredential } from '../../../../core/auth-file.js';
 import { readSubscriptionPool, writeSubscriptionPool } from '../../../../core/subscription-state.js';
+import { initializeFreshScopedStore } from '../../../../core/scoped-state/migrate.js';
 import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harness.js';
 import { createAttachKit } from '../../../../core/__tests__/helpers/broker-clients.js';
 import { CrtrClient } from '../../../../api/index.js';
@@ -118,6 +119,7 @@ test('B2-modelauth: installCredential writes auth.json and the reload fan acks a
     const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
     const apiDir = mkdtempSync(join(tmpdir(), 'crtr-b10-api-'));
     process.env['PI_CODING_AGENT_DIR'] = apiDir;
+    initializeFreshScopedStore({ kind: 'provider', root: apiDir });
     let liveId;
     try {
         // A live broker to receive the fan.
@@ -190,8 +192,9 @@ test('B2-modelauth-oauth: installCredential(oauth) preserves extra fields (enter
 // clears exactly its provider's durable store.
 test('B2-modelauth-status: list is sanitized and delete clears only the selected provider', async () => {
     const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
-    const apiDir = mkdtempSync(join(tmpdir(), 'crtr-b10-status-'));
+    const apiDir = mkdtempSync(join(h.agentHome, 'crtr-b10-status-'));
     process.env['PI_CODING_AGENT_DIR'] = apiDir;
+    initializeFreshScopedStore({ kind: 'provider', root: apiDir });
     const expires = 1_900_000_000_000;
     const cooldown = 1_900_000_100_000;
     try {

package/dist/daemon/api/__tests__/seam/leaf-api-parity.test.js

@@ -30,7 +30,7 @@ import { registerPush } from '../../../../commands/push.js';
 import { registerNode } from '../../../../commands/node.js';
 import { createNode, getNode } from '../../../../core/canvas/canvas.js';
 import { branchIsPushedAtCurrentTip, createManagedWorktree } from '../../../../core/worktree.js';
-import { readInboxSince } from '../../../../core/feed/inbox.js';
+import { openDb } from '../../../../core/canvas/db.js';
 import { gitSync } from '../../../../core/git.js';
 import { InputError } from '../../../../core/io.js';
 // A terminal fabricated node (no broker needed) that OWNS a managed worktree —
@@ -161,9 +161,10 @@ test('`crtr push update --tier deferred` fans a deferred pointer while preservin
     await h.awaitBoot(child);
     const out = await runPushAs(child, 'update', 'deferred progress', { tier: 'deferred' });
     assert.ok(out['notified'].includes(parent), 'the subscribed parent receives the report pointer');
-    const entry = readInboxSince(parent).find((candidate) => candidate.from === child && candidate.label === 'deferred progress');
-    assert.equal(entry?.kind, 'update', 'the stored report remains an update');
-    assert.equal(entry?.tier, 'deferred', 'the requested delivery tier reaches the parent');
+    const entry = openDb().prepare(`SELECT m.kind, d.urgency FROM deliveries d JOIN messages m ON m.message_id = d.message_id
+      WHERE d.destination_kind = 'node_inbox' AND d.destination_id = ? AND m.sender_node_id = ? AND m.label = ?`).get(parent, child, 'deferred progress');
+    assert.equal(entry?.kind, 'update', 'the stored SQL message remains an update');
+    assert.equal(entry?.urgency, 'deferred', 'the requested delivery urgency reaches the parent');
 });
 // Re-homed worktree guard/auto-drop (ambiguity-2 follow-up): the pre-B-5 CLI
 // `push final` worktree behavior now lives SERVER-side in handlers/reports.ts,

package/dist/daemon/api/__tests__/seam/profile-delete.test.js

@@ -11,10 +11,12 @@ import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harnes
 import { updateNode } from '../../../../core/canvas/canvas.js';
 import { armCron, getCron } from '../../../../core/canvas/crons.js';
 import { closeDb } from '../../../../core/canvas/db.js';
+import { closeWorktree, openWorktree } from '../../../../core/canvas/worktrees.js';
 import { getDefaultProfileId, setDefaultProfileId, } from '../../../../core/profiles/default-binding.js';
 import { loadProfileManifest } from '../../../../core/profiles/manifest.js';
 import { createComment, getComment, listReviewEvents } from '../../../../core/review/comments.js';
-import { commitBindingReview, getReview } from '../../../../core/review/store.js';
+import { commitBindingRequest, openRequest } from '../../../../core/human/requests.js';
+import { getReview } from '../../../../core/review/store.js';
 import { apiSocketPath, nodeDir, nodesRoot, reviewDir, } from '../../../../core/canvas/paths.js';
 import { isPidAlive } from '../../../../core/canvas/pid.js';
 import { spawnNode } from '../../../../core/runtime/nodes.js';
@@ -66,47 +68,32 @@ function seedTicket(dir, sourceNodeId) {
     writeFileSync(join(dir, 'page.json'), JSON.stringify({ source: { nodeId: sourceNodeId } }));
     writeFileSync(join(dir, 'reply-route.json'), JSON.stringify({ nodeId: sourceNodeId }));
 }
-function reviewRow(reviewId, originNodeId, sourceFile) {
+function reviewRequest(reviewId, originNodeId, sourceFile) {
     const dir = reviewDir(reviewId);
     return {
-        review_id: reviewId,
+        request_id: reviewId,
         idempotency_key: `request-${reviewId}`,
-        origin_kind: 'inline',
-        origin_node_id: originNodeId,
-        bridge_node_id: null,
+        requester_node_id: originNodeId,
         companion_node_id: `companion-${reviewId}`,
-        review_dir: dir,
+        request_dir: dir,
         file: sourceFile,
-        origin_session_file: join(h.agentHome, `${reviewId}-origin.jsonl`),
-        origin_session_id: `session-${reviewId}`,
-        origin_leaf_id: `leaf-${reviewId}`,
-        model_spec: 'anthropic/sonnet',
-        branch_file: join(dir, 'branch-point.jsonl'),
-        baseline_sha256: 'baseline',
-        baseline_bytes: 6,
+        specification: {
+            origin_kind: 'inline',
+            origin_session_file: join(h.agentHome, `${reviewId}-origin.jsonl`),
+            origin_session_id: `session-${reviewId}`,
+            origin_leaf_id: `leaf-${reviewId}`,
+            model_spec: 'anthropic/sonnet',
+            branch_file: join(dir, 'branch-point.jsonl'),
+            baseline_sha256: 'baseline',
+            baseline_bytes: 6,
+            captured_at: new Date().toISOString(),
+            output_path: null,
+        },
         anchor_base_sha256: 'anchor',
         anchor_base_bytes: Buffer.from('source'),
-        state: 'binding',
-        created: new Date().toISOString(),
-        captured_at: new Date().toISOString(),
-        opened_at: null,
-        submit_requested_at: null,
-        output_path: null,
+        created_at: new Date().toISOString(),
         subtitle: null,
-        approved_at: null,
-        approved_sha256: null,
-        changed: null,
-        comments_total: null,
-        comments_unresolved: null,
-        result_json: null,
-        canceled_at: null,
-        cancel_reason: null,
-        cancel_actor: null,
-        delivery_entry_id: null,
-        delivered_at: null,
-        delivery_error: null,
-        projected_at: null,
-        projection_error: null,
+        inbox_listed: false,
     };
 }
 function seedReview(reviewId, originNodeId) {
@@ -115,7 +102,8 @@ function seedReview(reviewId, originNodeId) {
     writeFileSync(sourceFile, 'source\n');
     mkdirSync(dir, { recursive: true });
     writeFileSync(join(dir, 'branch-point.jsonl'), '{}\n');
-    commitBindingReview(reviewRow(reviewId, originNodeId, sourceFile));
+    commitBindingRequest(reviewRequest(reviewId, originNodeId, sourceFile));
+    assert.equal(openRequest(reviewId, new Date().toISOString()), true, 'fixture review becomes visible before its comment is created');
     const { comment } = createComment({
         review_id: reviewId,
         text: 'keep or delete with its review',
@@ -167,10 +155,8 @@ test('forced profile deletion owns the complete daemon lifecycle', { timeout: 90
     // An open managed worktree blocks before any profile-owned state mutates.
     const blockedProfile = await client.ensureProfile('delete-blocked');
     const blockedNode = h.spawnRoot('profile delete blocker', { id: 'blocked-profile-deadbeef' });
-    updateNode(blockedNode, {
-        profile_id: blockedProfile.id,
-        managed_worktree: managedWorktree(),
-    });
+    updateNode(blockedNode, { profile_id: blockedProfile.id });
+    openWorktree(blockedNode, managedWorktree());
     const blockedPin = join(h.agentHome, 'blocked-pin');
     mkdirSync(blockedPin, { recursive: true });
     setDefaultProfileId(blockedPin, blockedProfile.id);
@@ -368,12 +354,12 @@ test('forced profile deletion owns the complete daemon lifecycle', { timeout: 90
     });
     assert.equal(h.node(selfNode)?.profile_id, selfProfile.id, 'the 202 response settles before node mutation');
     assert.equal(isPidAlive(selfPid), true, 'the 202 response settles before broker teardown');
-    updateNode(selfNode, { managed_worktree: managedWorktree() });
+    openWorktree(selfNode, managedWorktree());
     const repeatedAccepted = await rawDelete(selfProfile.id, {
         force: true,
         caller_node_id: selfNode,
     });
-    updateNode(selfNode, { managed_worktree: null });
+    closeWorktree(selfNode, { cleanup: 'complete', closedAt: new Date().toISOString() });
     assert.equal(repeatedAccepted.status, 202, 'a retry returns the accepted result before observing new blockers');
     assert.deepEqual(repeatedAccepted.body, accepted.body, 'a pending self-deletion is idempotent by profile identity');
     await h.waitFor(() => h.node(selfNode) === null, {

package/dist/daemon/api/__tests__/submit-result.test.js

@@ -7,8 +7,8 @@ import { after, before, beforeEach, test } from 'node:test';
 import assert from 'node:assert/strict';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { createNode, getNode, openDb } from '../../../core/canvas/index.js';
-import { closeDb } from '../../../core/canvas/db.js';
+import { createNode, getNode } from '../../../core/canvas/index.js';
+import { closeDb, migrate, openDb } from '../../../core/canvas/db.js';
 import { InputError } from '../../../core/io.js';
 import { outputResultPath, outputSchemaPath, writeOutputSchema, } from '../../../core/runtime/structured-output.js';
 import { reportRoutes } from '../handlers/reports.js';
@@ -23,6 +23,7 @@ before(() => {
 beforeEach(() => {
     closeDb();
     rmSync(home, { recursive: true, force: true });
+    migrate(openDb());
 });
 after(() => {
     closeDb();

package/dist/daemon/api/bridge.js

@@ -25,7 +25,7 @@ import { isSafeNodeId, viewSocketPath } from '../../core/canvas/paths.js';
 import { getNode } from '../../core/canvas/index.js';
 import { BROKER_READ_CAPS, CLIENT_READ_CAPS, FrameDecoder, FrameOverflowError, } from '../../core/runtime/broker-protocol.js';
 import { classify } from '../../core/fault-classifier.js';
-import { clearFault, recordFault } from '../../core/runtime/fault.js';
+import { clearFault, recordFault } from '../../core/canvas/recovery.js';
 import { decideAttachRevive } from '../../core/runtime/revive.js';
 import { probeViewSocket, waitForBrokerViewSocket } from '../../core/runtime/view-socket.js';
 /** Our own noServer WS server: A-9 routes matched attach upgrades to

package/dist/daemon/api/handlers/bash-jobs.js

@@ -1,10 +1,9 @@
 // Daemon-owned read and stop surfaces for one node's file-backed background
 // bash jobs. The attach roster continues to read the same directory directly;
 // these routes exist for remote presenters that cannot see the node host.
-import { appendInbox } from '../../../core/feed/inbox.js';
+import { enqueueNodeMail } from '../../../core/feed/messages.js';
 import { contextDir, isSafeNodeId } from '../../../core/canvas/paths.js';
 import { getNode } from '../../../core/canvas/canvas.js';
-import { cancelCronsOnWake } from '../../../core/canvas/crons.js';
 import { isBrokerLive } from '../../../core/runtime/model-swap.js';
 import { assertNotFinalized } from '../../../core/runtime/reopen.js';
 import { reviveNode } from '../../../core/runtime/revive.js';
@@ -68,14 +67,14 @@ async function handleStop(ctx) {
     assertNotFinalized(nodeId);
     const paths = bashJobPaths(dir, jobId);
     const body = `Background bash job ${jobId} was stopped by the user before it finished. Log: ${paths.jobLog}  Command: ${paths.cmdSh}`;
-    appendInbox(nodeId, {
-        from: null,
-        tier: 'urgent',
+    enqueueNodeMail(nodeId, {
+        senderNodeId: null,
+        urgency: 'urgent',
+        wake: 1,
         kind: 'message',
         label: body.split('\n')[0].slice(0, 120),
-        data: { body },
+        bodyJson: { body },
     });
-    cancelCronsOnWake(nodeId);
     const node = getNode(nodeId);
     if (node !== null && !isBrokerLive(node)) {
         try {

package/dist/daemon/api/handlers/broker-ops.js

@@ -1,26 +1,28 @@
 // Broker-originated canvas operations. The broker sends Pi lifecycle facts;
 // crtrd validates and commits their durable effects while the handler stays
 // strictly canvas-write-only — no broker launch, kill, or view.sock round trip.
-import { canonicalSessionFile, findNodeBySessionFile, getNode, isWarmSpare, listNodeIdentities, recordPid, recordSettledTurn, setPresence, subscriptionsOf, updateNode } from '../../../core/canvas/canvas.js';
+import { canonicalSessionFile, findNodeBySessionFile, getNode, isWarmSpare, listNodeIdentities, recordSettledTurn, setPresence, subscriptionsOf, updateNode } from '../../../core/canvas/canvas.js';
+import { recordExecutionPid } from '../../../core/canvas/executions.js';
+import { bindSession, readLiveSession, transferSession } from '../../../core/canvas/sessions.js';
 import { isSafeNodeId } from '../../../core/canvas/paths.js';
 import { isPidAlive } from '../../../core/canvas/pid.js';
 import { editorLabel } from '../../../core/canvas/labels.js';
 import { assembleNodeSubject } from '../../../core/substrate/subject.js';
 import { withCanvasWrite } from '../../../core/canvas/db.js';
 import { notFound, usage } from '../../../core/errors.js';
-import { hasUnseenWakeMail, readCursor, readInboxSince, writeCursor } from '../../../core/feed/inbox.js';
+import { hasUnseenWakeMail } from '../../../core/canvas/deliveries.js';
 import { clearYieldMessage } from '../../../core/runtime/kickoff.js';
 import { transition } from '../../../core/runtime/lifecycle.js';
 import { focusOf, tearDownNode } from '../../../core/runtime/placement.js';
 import { hasAttachedBrokerViewers } from '../../../core/runtime/broker/client-registry.js';
-import { handleNewSession } from '../../../core/runtime/reset.js';
 import { evaluateStop } from '../../../core/runtime/stop-guard.js';
-import { clearFault, recordFault } from '../../../core/runtime/fault.js';
+import { clearFault, recordFault } from '../../../core/canvas/recovery.js';
 import { updateModelRecipe } from '../../../core/runtime/model-swap.js';
 import { completeCompanionRequestedSubmit } from '../../review/finish.js';
 import { emitEvent } from '../../../core/events/emit.js';
 import { consumePendingPark, recordPendingParkActivity } from '../../park-pending.js';
 import { shouldParkAfterSummary } from '../../park-activity.js';
+import { requireCurrentExecution } from './broker-recovery.js';
 function objectBody(body, operation) {
     if (typeof body !== 'object' || body === null || Array.isArray(body)) {
         throw usage(`${operation} requires a JSON body`);
@@ -29,6 +31,9 @@ function objectBody(body, operation) {
 }
 function parseSessionBoundBody(body) {
     const value = objectBody(body, 'broker session-bound');
+    if (typeof value['executionId'] !== 'string' || value['executionId'] === '') {
+        throw usage('executionId must be a non-empty string');
+    }
     if (typeof value['piSessionId'] !== 'string' || value['piSessionId'] === '') {
         throw usage('piSessionId must be a non-empty string');
     }
@@ -64,18 +69,6 @@ function parseParkCompleteBody(body) {
     }
     return value;
 }
-function parseInboxCursorBody(body) {
-    const value = objectBody(body, 'broker inbox-cursor');
-    const throughEntryId = value['throughEntryId'];
-    if (typeof throughEntryId !== 'string' || !/^(?!0{32}$)[0-9a-f]{32}$/.test(throughEntryId)) {
-        throw usage('throughEntryId must be a non-zero 32-character lowercase hexadecimal inbox entry id');
-    }
-    const brokerPid = value['brokerPid'];
-    if (!Number.isSafeInteger(brokerPid) || brokerPid <= 0) {
-        throw usage('brokerPid must be a positive safe integer');
-    }
-    return { throughEntryId, brokerPid: brokerPid };
-}
 function parseModelCommitBody(body) {
     const value = objectBody(body, 'broker model');
     if (typeof value['spec'] !== 'string' || value['spec'].trim() === '')
@@ -167,14 +160,14 @@ function parseGeneratedNameBody(body) {
         throw usage('description, title, and icon must be strings');
     }
     if (value['kind'] === 'initial') {
-        return { kind: 'initial', description: value['description'], title: value['title'], icon: value['icon'] };
+        return value;
     }
     const expected = value['expected'];
     if (typeof expected !== 'object' || expected === null || Array.isArray(expected)
         || ['name', 'description', 'title', 'icon', 'kind'].some((key) => typeof expected[key] !== 'string')) {
         throw usage('recap expected must contain name, description, title, icon, and kind strings');
     }
-    return { kind: 'recap', description: value['description'], title: value['title'], icon: value['icon'], expected: expected };
+    return value;
 }
 function parsePersonaAckBody(body) {
     const value = objectBody(body, 'broker persona-ack');
@@ -188,7 +181,7 @@ function parsePersonaAckBody(body) {
         }
         return persona;
     };
-    return { from: parse('from'), to: parse('to') };
+    return { expected_execution_id: value['expected_execution_id'], from: parse('from'), to: parse('to') };
 }
 function handleSessionBound(ctx) {
     const nodeId = ctx.params['id'];
@@ -196,9 +189,18 @@ function handleSessionBound(ctx) {
     const sessionFile = request.sessionFile === null ? null : canonicalSessionFile(request.sessionFile);
     const result = withCanvasWrite(() => {
         const before = requireNode(nodeId);
-        // A transcript is one broker's identity. Check ownership before every
-        // session-bound mutation: a live owner wins, and the claimant must stop
-        // rather than overwrite its own process-scoped identity onto that file.
+        if (recordExecutionPid(request.executionId, nodeId, request.pid) === 'shutdown') {
+            return { action: 'shutdown' };
+        }
+        const reviewId = before.review_binding?.review_id;
+        if (reviewId !== undefined && !request.reviewBoundaryIds.includes(reviewId)) {
+            return { action: 'shutdown' };
+        }
+        if (request.reason === 'new' && before.parent == null)
+            return { action: 'relaunch_root' };
+        if (request.reason !== 'new' && before.fork_from != null && before.pi_session_id == null && sessionFile === null) {
+            return { action: 'shutdown' };
+        }
         const owner = sessionFile === null ? null : findNodeBySessionFile(sessionFile);
         if (owner !== null && owner.node_id !== nodeId) {
             if (isPidAlive(owner.pi_pid)) {
@@ -211,46 +213,29 @@ function handleSessionBound(ctx) {
                 });
                 return { action: 'shutdown' };
             }
-            // The prior owner is dead, so transfer the durable coordinate before the
-            // claimant writes it; the UNIQUE projection and both meta files agree.
-            updateNode(owner.node_id, { pi_session_id: null, pi_session_file: null });
+            const source = readLiveSession(owner.node_id);
+            if (source === null || transferSession({
+                fromNodeId: owner.node_id,
+                fromBindingId: source.bindingId,
+                toNodeId: nodeId,
+                executionId: request.executionId,
+                sessionId: request.piSessionId,
+                transcriptPath: sessionFile,
+            }) !== 'transferred')
+                return { action: 'shutdown' };
         }
-        // The broker reports the markers present in Pi's current branch; crtrd owns
-        // the review binding and decides whether that branch belongs to this node.
-        const reviewId = before.review_binding?.review_id;
-        if (reviewId !== undefined && !request.reviewBoundaryIds.includes(reviewId)) {
+        else if (bindSession(nodeId, {
+            executionId: request.executionId,
+            sessionId: request.piSessionId,
+            transcriptPath: sessionFile,
+        }) === 'shutdown')
             return { action: 'shutdown' };
-        }
-        let action = 'none';
-        if (request.reason === 'new') {
-            if (before.parent == null) {
-                // Root relaunch launches and tears down brokers. Return a directive for
-                // the calling extension rather than re-entering that broker here.
-                action = 'relaunch_root';
-            }
-            else {
-                handleNewSession(nodeId, request.piSessionId, sessionFile);
-            }
-        }
-        else if (before.fork_from != null && before.pi_session_id == null && sessionFile === null) {
-            // Pi has not exposed complete writable coordinates for this ordinary fork.
-            // Leave it unbound so recovery cannot fork provenance twice.
-            action = 'shutdown';
-        }
-        else {
-            // Confirmed boot: consume the one-shot yield note, bind the new Pi session
-            // coordinates, stamp broker liveness, and commit any pending refresh.
+        if (request.reason !== 'new') {
             clearYieldMessage(nodeId);
-            updateNode(nodeId, {
-                pi_session_id: request.piSessionId,
-                pi_session_file: sessionFile,
-                cycle_pending: false,
-            });
-            recordPid(nodeId, request.pid);
             if (before.intent === 'refresh')
                 transition(nodeId, 'revive');
         }
-        return { action };
+        return { action: 'none' };
     });
     return { status: 200, body: result };
 }
@@ -324,6 +309,7 @@ function settleBroker(nodeId, request) {
 function handleSettle(ctx) {
     const nodeId = ctx.params['id'];
     const request = parseSettleBody(ctx.body);
+    requireCurrentExecution(nodeId, request.expected_execution_id);
     const directive = withCanvasWrite(() => settleBroker(nodeId, request));
     // A review companion that just went quiet releases any submit the human left
     // waiting on it. A reprompt is not going quiet, so it waits for the turn that
@@ -340,6 +326,7 @@ function handleSettle(ctx) {
 function handleParkComplete(ctx) {
     const nodeId = ctx.params['id'];
     const request = parseParkCompleteBody(ctx.body);
+    requireCurrentExecution(nodeId, request.expected_execution_id);
     const directive = withCanvasWrite(() => {
         const pending = consumePendingPark(nodeId);
         if (pending === undefined)
@@ -367,41 +354,16 @@ function handleParkComplete(ctx) {
  * never terminalize a viewer or live-delivery input that won admission. */
 function handleParkActivity(ctx) {
     const nodeId = ctx.params['id'];
+    requireCurrentExecution(nodeId, objectBody(ctx.body, 'broker park-activity')['expected_execution_id']);
     const result = withCanvasWrite(() => ({
         activity: recordPendingParkActivity(nodeId) ? 'recorded' : 'none',
     }));
     return { status: 200, body: result };
 }
-/** Commit a watcher cursor only while this broker generation remains current.
- * A refresh or a replacement binding must leave the cursor untouched so the
- * replacement replays every handoff that may have reached the discarded Pi
- * conversation. */
-function handleInboxCursor(ctx) {
-    const nodeId = ctx.params['id'];
-    const request = parseInboxCursorBody(ctx.body);
-    const directive = withCanvasWrite(() => {
-        const node = requireNode(nodeId);
-        if (node.intent === 'refresh' || node.pi_pid !== request.brokerPid)
-            return { action: 'hold_refresh' };
-        const entries = readInboxSince(nodeId);
-        const throughIndex = entries.findIndex((entry) => entry.entry_id === request.throughEntryId);
-        if (throughIndex < 0)
-            throw usage('throughEntryId must identify an entry in this node inbox');
-        const cursor = readCursor(nodeId);
-        const cursorIndex = cursor === undefined ? -1 : entries.findIndex((entry) => entry.entry_id === cursor);
-        if (cursor !== undefined && cursorIndex < 0)
-            throw new Error(`inbox cursor entry_id not found: ${cursor}`);
-        if (throughIndex < cursorIndex)
-            throw usage('throughEntryId must not precede the durable inbox cursor');
-        if (throughIndex > cursorIndex)
-            writeCursor(nodeId, request.throughEntryId);
-        return { action: 'advanced' };
-    });
-    return { status: 200, body: directive };
-}
 function handleModelCommit(ctx) {
     const nodeId = ctx.params['id'];
     const request = parseModelCommitBody(ctx.body);
+    requireCurrentExecution(nodeId, request.expected_execution_id);
     const updated = withCanvasWrite(() => updateModelRecipe(requireNode(nodeId), request.spec, request.pinnedOverride, request.userSelected));
     return { status: 200, body: { modelOverride: updated.model_override } };
 }
@@ -414,6 +376,7 @@ function handleExtensionState(ctx) {
 function handleGeneratedName(ctx) {
     const nodeId = ctx.params['id'];
     const request = parseGeneratedNameBody(ctx.body);
+    requireCurrentExecution(nodeId, request.expected_execution_id);
     const result = withCanvasWrite(() => {
         const node = requireNode(nodeId);
         if (request.kind === 'initial') {
@@ -457,6 +420,7 @@ function handleGeneratedName(ctx) {
 function handlePersonaAck(ctx) {
     const nodeId = ctx.params['id'];
     const request = parsePersonaAckBody(ctx.body);
+    requireCurrentExecution(nodeId, request.expected_execution_id);
     const result = withCanvasWrite(() => {
         const node = requireNode(nodeId);
         const current = { kind: node.kind, mode: node.mode, lifecycle: node.lifecycle };
@@ -476,7 +440,6 @@ export const brokerOperationRoutes = [
     { method: 'POST', pattern: '/v1/nodes/:id/broker/settle', handler: handleSettle },
     { method: 'POST', pattern: '/v1/nodes/:id/broker/park-complete', handler: handleParkComplete },
     { method: 'POST', pattern: '/v1/nodes/:id/broker/park-activity', handler: handleParkActivity },
-    { method: 'POST', pattern: '/v1/nodes/:id/broker/inbox-cursor', handler: handleInboxCursor },
     { method: 'POST', pattern: '/v1/nodes/:id/broker/model', handler: handleModelCommit },
     { method: 'GET', pattern: '/v1/nodes/:id/broker/extension-state', handler: handleExtensionState },
     { method: 'POST', pattern: '/v1/nodes/:id/broker/generated-name', handler: handleGeneratedName },

package/dist/daemon/api/handlers/broker-recovery.d.ts

@@ -0,0 +1,4 @@
+import type { RouteTable } from '../router.js';
+export declare function requireCurrentExecution(nodeId: string, expectedExecutionId: unknown): void;
+export declare const brokerRecoveryRoutes: RouteTable;
+export declare const nodeFaultRoutes: RouteTable;