@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/canvas/migrations.js

@@ -1,52 +1,4 @@
-// canvas.db's versioned schema chain — the FIRST of this repo's three
-// migration homes. This module owns the v1..vN sequence gated by
-// `PRAGMA user_version`: schema DDL, one-time data backfills, and the
-// journaled on-disk-lane splice (`../../migrations/registry.ts`'s
-// `journaled` entries, appended at the tail of `MIGRATIONS`). A step here
-// runs through the daemon's explicit `migrate()` startup call, exactly once per database,
-// transactionally.
-//
-// The other two homes:
-//   - `../../migrations/registry.ts` — the `STATE_MIGRATIONS` registry for
-//     on-disk memory documents, profile manifests, and the corpus lane,
-//     driven by `crtr sys migrate`. Its registrants may import ONLY
-//     fs/frontmatter utilities — never canvas-db or canvas accessors — so
-//     the file stays legal in every CLI leaf's import graph. That is why
-//     this chain (which reads node meta, queries other tables mid-step, and
-//     builds shell commands from canvas data) is NOT a registrant there.
-//   - `../../daemon/boot-migrations.ts` — filesystem repairs that run
-//     unconditionally at every daemon boot, outside any version gate
-//     (idempotent by their own convergence, not `user_version`).
-//
-// `db.ts` itself keeps only connection management (`openDb`/`withCanvasWrite`
-// /`closeDb`) and re-exports `migrate`/`MIGRATIONS` from here so external
-// imports are unaffected by this split.
-import { importNodeSqlAuthority } from './node-sql-migration.js';
-import { migrateRecoveryWitnesses } from './recovery.js';
-import { migrateMessagingState } from './deliveries.js';
-import { migrateHumanRequestsState } from '../human/requests.js';
-import { existsSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
-import { basename, join, resolve } from 'node:path';
-import { crtrHome, isSafeNodeId, nodesRoot, nodeMetaPath } from './paths.js';
-import { STATE_MIGRATIONS } from '../../migrations/registry.js';
-import { customExtensionPaths } from './extensions.js';
-import { readMetaObject, updateJsonFileDurably, withMetaLock, writeMetaObjectLocked } from './meta-file.js';
-// Schema as a forward-only migration list
-//
-// The schema is the migration list: one place a schema change is expressed,
-// one gate (`PRAGMA user_version`) that applies it. `migrate()` runs every
-// pending step in order and bumps `user_version` after each, so a fresh db and
-// the live fleet (all at `user_version 0`) converge on the same final shape.
-// Migrations are append-only and forward-only — never edit a shipped step. The
-// v36 body below is the sole corrective exception: v0.3.250 shipped a destructive
-// stale-row decision, so v36 is narrowed for databases still below its gate while
-// appended v37 repairs databases that already crossed it. Do not repeat this
-// exception; an appended migration is required unless it would run too late to
-// prevent destruction at an existing version boundary.
-/** v1 — the baseline tables + indexes. `IF NOT EXISTS` makes this a no-op on
- *  any existing db (the live fleet already has these tables). */
-function baselineSchema(db) {
-    db.exec(`
+var J=Object.defineProperty;var i=(e,n)=>J(e,"name",{value:n,configurable:!0});import{importNodeSqlAuthority as Q}from"./node-sql-migration.js";import{migrateRecoveryWitnesses as V}from"./recovery.js";import{migrateMessagingState as Z}from"./deliveries.js";import{migrateHumanRequestsState as ee}from"../human/requests.js";import{existsSync as A,readFileSync as h,readdirSync as X,realpathSync as ne}from"node:fs";import{basename as te,join as y,resolve as H}from"node:path";import{crtrHome as oe,isSafeNodeId as ie,nodesRoot as S,nodeMetaPath as I}from"./paths.js";import{STATE_MIGRATIONS as re}from"../../migrations/registry.js";import{customExtensionPaths as se}from"./extensions.js";import{readMetaObject as P,updateJsonFileDurably as b,withMetaLock as Te,writeMetaObjectLocked as Ee}from"./meta-file.js";function ae(e){e.exec(`
 CREATE TABLE IF NOT EXISTS nodes (
   node_id    TEXT PRIMARY KEY,
   name       TEXT NOT NULL,
@@ -71,97 +23,7 @@ CREATE TABLE IF NOT EXISTS edges (
 CREATE INDEX IF NOT EXISTS idx_edges_to   ON edges(type, to_id);
 CREATE INDEX IF NOT EXISTS idx_edges_from ON edges(type, from_id);
 CREATE INDEX IF NOT EXISTS idx_nodes_status ON nodes(status);
-`);
-}
-/** A table's current columns, used to make additive migrations safe to re-run
- *  against a partially applied schema. Shared across every table this chain
- *  alters in place (`nodes`, `consult_outbox`, `crons`) instead of each step
- *  hand-rolling its own `PRAGMA table_info` + `Set` build. */
-function tableColumns(db, table) {
-    return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((r) => r.name));
-}
-function addColumnIfMissing(db, columns, name, ddl) {
-    if (columns.has(name))
-        return;
-    db.exec(ddl);
-    columns.add(name);
-}
-/** `nodes`-table convenience alias — every existing call site names it this
- *  way, and the table this chain adds columns to most is `nodes`. */
-function nodeColumns(db) {
-    return tableColumns(db, 'nodes');
-}
-const addNodeColumnIfMissing = addColumnIfMissing;
-/** v2 — the additive runtime columns: `intent, pi_pid, window, tmux_session`.
- *  `status` already lives in the baseline row, so it is NOT re-added here. All
- *  four default to NULL; v3 backfills them. */
-function addRuntimeColumns(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'intent', `ALTER TABLE nodes ADD COLUMN intent TEXT;`);
-    addNodeColumnIfMissing(db, columns, 'pi_pid', `ALTER TABLE nodes ADD COLUMN pi_pid INTEGER;`);
-    addNodeColumnIfMissing(db, columns, 'window', `ALTER TABLE nodes ADD COLUMN window TEXT;`);
-    addNodeColumnIfMissing(db, columns, 'tmux_session', `ALTER TABLE nodes ADD COLUMN tmux_session TEXT;`);
-}
-/** v3 — DATA backfill. The runtime fields
- *  (`intent, pi_pid, window, tmux_session`) become authoritative in the row;
- *  copy each existing node's values out of its meta.json into the row columns
- *  once, so the version boundary loses no live state. `status` already mirrors
- *  the row, so it is not re-copied.
- *
- *  LAYERING NOTE — a sanctioned exception: a *data* migration must read
- *  meta.json, which db.ts normally would not. Reading it
- *  directly here — via paths.ts, a one-time, clearly-labeled boot-time data
- *  migration — is the deliberate choice over splitting the `user_version`
- *  counter across two modules. Idempotent and gated: it runs exactly once at the
- *  v2→v3 boundary. An UPDATE for a node with no row yet hits 0 rows (harmless). */
-function backfillRuntime(db) {
-    const root = nodesRoot();
-    if (!existsSync(root))
-        return;
-    const upd = db.prepare('UPDATE nodes SET intent = ?, pi_pid = ?, "window" = ?, tmux_session = ? WHERE node_id = ?');
-    for (const id of readdirSync(root)) {
-        const p = nodeMetaPath(id);
-        if (!existsSync(p))
-            continue;
-        let meta;
-        try {
-            meta = JSON.parse(readFileSync(p, 'utf8'));
-        }
-        catch {
-            continue; // a single unreadable meta never aborts the migration
-        }
-        upd.run(meta['intent'] ?? null, meta['pi_pid'] ?? null, meta['window'] ?? null, meta['tmux_session'] ?? null, id);
-    }
-}
-/** v4 — edges referential integrity (IRREVERSIBLE table rebuild). Rebuild the
- *  `edges` table so `from_id`/`to_id` are FOREIGN KEYs to `nodes(node_id)` with
- *  `ON DELETE CASCADE`: after this, deleting a node can NEVER orphan an edge —
- *  the schema GCs them, so prune (and any future delete) doesn't have to. The
- *  cargo-cult `PRAGMA foreign_keys = ON` (openDb) finally enforces something.
- *
- *  GOTCHA — pre-existing orphan edges. Nothing ever deleted a node before this
- *  phase, but manual dir removals / failed spawns can have left `edges` whose
- *  endpoint has no `nodes` row. Copying those into the FK-constrained table
- *  would violate the constraint, so the rebuild runs with `foreign_keys = OFF`
- *  (it MUST be toggled in autocommit — a no-op inside a txn) and the
- *  INSERT…SELECT FILTERS orphans: only edges whose BOTH endpoints have a row
- *  survive. `PRAGMA foreign_key_check` then confirms the rebuilt table is clean,
- *  and a row-count assertion guards that every NON-orphan edge is preserved.
- *
- *  CRASH-SAFETY — the whole rebuild is one transaction. A throw ROLLs it back to
- *  the pre-v4 state (the `edges_new` scratch table and all copies vanish) and
- *  `user_version` stays at 3, so the next open re-runs v4 cleanly: no half-state.
- *  Even a crash between COMMIT and the version bump is safe — re-running v4 over
- *  an already-rebuilt (clean) `edges` is idempotent in effect. */
-function edgesForeignKeyCascade(db) {
-    // Degenerate db with no `edges` table (a real db always has it — v1 created it
-    // — but a hand-seeded fixture may not). Nothing to rebuild; create the
-    // FK-shaped table fresh so the schema still converges, then we're done.
-    const hasEdges = db
-        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'edges'")
-        .get() !== undefined;
-    if (!hasEdges) {
-        db.exec(`
+`)}i(ae,"baselineSchema");function w(e,n){return new Set(e.prepare(`PRAGMA table_info(${n})`).all().map(t=>t.name))}i(w,"tableColumns");function Y(e,n,t,o){n.has(t)||(e.exec(o),n.add(t))}i(Y,"addColumnIfMissing");function l(e){return w(e,"nodes")}i(l,"nodeColumns");const a=Y;function de(e){const n=l(e);a(e,n,"intent","ALTER TABLE nodes ADD COLUMN intent TEXT;"),a(e,n,"pi_pid","ALTER TABLE nodes ADD COLUMN pi_pid INTEGER;"),a(e,n,"window","ALTER TABLE nodes ADD COLUMN window TEXT;"),a(e,n,"tmux_session","ALTER TABLE nodes ADD COLUMN tmux_session TEXT;")}i(de,"addRuntimeColumns");function _e(e){const n=S();if(!A(n))return;const t=e.prepare('UPDATE nodes SET intent = ?, pi_pid = ?, "window" = ?, tmux_session = ? WHERE node_id = ?');for(const o of X(n)){const s=I(o);if(!A(s))continue;let T;try{T=JSON.parse(h(s,"utf8"))}catch{continue}t.run(T.intent??null,T.pi_pid??null,T.window??null,T.tmux_session??null,o)}}i(_e,"backfillRuntime");function ce(e){if(!(e.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'edges'").get()!==void 0)){e.exec(`
 CREATE TABLE edges (
   type     TEXT NOT NULL,
   from_id  TEXT NOT NULL,
@@ -174,21 +36,9 @@ CREATE TABLE edges (
 );
 CREATE INDEX IF NOT EXISTS idx_edges_to   ON edges(type, to_id);
 CREATE INDEX IF NOT EXISTS idx_edges_from ON edges(type, from_id);
-`);
-        return;
-    }
-    // FK enforcement must be toggled OUTSIDE a transaction (a no-op within one).
-    db.exec('PRAGMA foreign_keys = OFF;');
-    try {
-        // Non-orphan edges that MUST survive the rebuild (both endpoints present).
-        const expected = db
-            .prepare(`SELECT COUNT(*) AS n FROM edges
+`);return}e.exec("PRAGMA foreign_keys = OFF;");try{const t=e.prepare(`SELECT COUNT(*) AS n FROM edges
            WHERE from_id IN (SELECT node_id FROM nodes)
-             AND to_id   IN (SELECT node_id FROM nodes)`)
-            .get().n;
-        db.exec('BEGIN');
-        try {
-            db.exec(`
+             AND to_id   IN (SELECT node_id FROM nodes)`).get().n;e.exec("BEGIN");try{e.exec(`
 CREATE TABLE edges_new (
   type     TEXT NOT NULL,
   from_id  TEXT NOT NULL,
@@ -207,74 +57,14 @@ DROP TABLE edges;
 ALTER TABLE edges_new RENAME TO edges;
 CREATE INDEX IF NOT EXISTS idx_edges_to   ON edges(type, to_id);
 CREATE INDEX IF NOT EXISTS idx_edges_from ON edges(type, from_id);
-`);
-            // Row-count assertion: every non-orphan edge preserved across the rebuild.
-            const after = db.prepare('SELECT COUNT(*) AS n FROM edges').get().n;
-            if (after !== expected) {
-                throw new Error(`edges FK rebuild lost rows: expected ${expected} non-orphan edge(s), got ${after}`);
-            }
-            // Belt-and-suspenders: the rebuilt table must hold no FK violations (the
-            // orphan filter above should guarantee this).
-            const violations = db.prepare('PRAGMA foreign_key_check').all();
-            if (violations.length > 0) {
-                throw new Error(`edges FK rebuild left ${violations.length} foreign-key violation(s)`);
-            }
-            db.exec('COMMIT');
-        }
-        catch (e) {
-            db.exec('ROLLBACK');
-            throw e;
-        }
-    }
-    finally {
-        db.exec('PRAGMA foreign_keys = ON;');
-    }
-}
-/** v5 — additive runtime column `pane`: LOCATION's authoritative handle, the
- *  durable tmux `%pane_id` a node's pane is anchored on. Unlike the derived
- *  `window`/`tmux_session` cache (v2), the pane id survives a user
- *  `move-pane`/`join-pane`/`break-pane` and window renumbering, so a later step
- *  reconciles window/session FROM it and uses pane-existence for liveness.
- *  Defaults NULL — nothing reads it until the placement layer lands, so this
- *  observes no behavior change. Additive, forward-only. */
-function addPaneColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'pane', `ALTER TABLE nodes ADD COLUMN pane TEXT;`);
-}
-/** v6 — the `focuses` table: durable, PLURAL on-screen viewports, one row per
- *  viewport (Q7 widens canvas.db from "topology" to "topology + focuses"). Each
- *  row is anchored on the durable tmux `%pane_id`; `session` is a derived cache
- *  reconciled from the pane; `node_id` is UNIQUE so a node occupies at most one
- *  focus (Q5). The focuses table is the CANONICAL focus store — there is no
- *  focus.ptr file and no dual-write bridge; placement writes focus rows directly. */
-function addFocusesTable(db) {
-    db.exec(`
+`);const o=e.prepare("SELECT COUNT(*) AS n FROM edges").get().n;if(o!==t)throw new Error(`edges FK rebuild lost rows: expected ${t} non-orphan edge(s), got ${o}`);const s=e.prepare("PRAGMA foreign_key_check").all();if(s.length>0)throw new Error(`edges FK rebuild left ${s.length} foreign-key violation(s)`);e.exec("COMMIT")}catch(o){throw e.exec("ROLLBACK"),o}}finally{e.exec("PRAGMA foreign_keys = ON;")}}i(ce,"edgesForeignKeyCascade");function Ne(e){const n=l(e);a(e,n,"pane","ALTER TABLE nodes ADD COLUMN pane TEXT;")}i(Ne,"addPaneColumn");function ue(e){e.exec(`
 CREATE TABLE IF NOT EXISTS focuses (
   focus_id  TEXT PRIMARY KEY,   -- stable internal id for the viewport
   pane      TEXT,               -- the durable %pane_id realizing the focus
   session   TEXT,               -- derived cache of the user session (reconciled from pane)
-  node_id   TEXT NOT NULL UNIQUE -- the node shown; UNIQUE → a node occupies <=1 focus
+  node_id   TEXT NOT NULL UNIQUE -- the node shown; UNIQUE \u2192 a node occupies <=1 focus
 );
-`);
-}
-/** v7 — the `wakeups` table: durable store for scheduled wake-ups (the
- *  scheduled-wakeups feature). One row per armed wake. `node_id` is the TARGET
- *  and the node-anchored cancel anchor — it carries a `ON DELETE CASCADE` FK to
- *  `nodes(node_id)` so a pruned/deleted node's node-anchored wakes are reaped in
- *  the same transaction (mirroring the edges v4 cascade; works because
- *  `PRAGMA foreign_keys = ON` is set at every open). NULL `node_id` = a
- *  canvas-detached wake (deferred spawn / spawn-cron) that survives.
- *
- *  `owner_id` is the ARMER, set on EVERY row, and is deliberately a PLAIN indexed
- *  column with NO FK (design D1/D2): an FK on `owner_id` would cascade-drop a
- *  crashed-then-pruned armer's detached cron, violating Invariant E. A detached
- *  wake is never reaped by node-row cascade.
- *
- *  `fire_at` is an ISO 8601 UTC string for the NEXT occurrence, so the per-tick
- *  due query is a lexicographic `<=` compare. The partial unique index
- *  `idx_wakeups_deadline` enforces ≤1 deadline per node. Additive, forward-only. */
-function appendWakeupsTable(db) {
-    db.exec(`
+`)}i(ue,"addFocusesTable");function le(e){e.exec(`
 CREATE TABLE IF NOT EXISTS wakeups (
   wakeup_id  TEXT PRIMARY KEY,
   node_id    TEXT,                       -- TARGET + node-anchored cancel anchor; NULL = canvas-detached
@@ -290,26 +80,7 @@ CREATE INDEX IF NOT EXISTS idx_wakeups_fire  ON wakeups(fire_at);
 CREATE INDEX IF NOT EXISTS idx_wakeups_node  ON wakeups(node_id);                 -- by-node cancel / list
 CREATE INDEX IF NOT EXISTS idx_wakeups_owner ON wakeups(owner_id);               -- by-owner reap (ruling A)
 CREATE UNIQUE INDEX IF NOT EXISTS idx_wakeups_deadline ON wakeups(node_id) WHERE kind = 'deadline';
-`);
-}
-/** v9 — generalize the `wakeups` table (v7) into the `triggers` table (the
- *  unified node-trigger-grammar substrate). The old `kind` axis (bare/noted/
- *  deadline/spawn) splits into three orthogonal axes: `action` (what enacts:
- *  'msg'|'new') x `action_mode` (how: 'inbox_message'|'fresh_revive'|
- *  'deadline_message'|'node_birth') x `trigger_type` (when: 'at'|'every'|
- *  'when'|'until') — so a daemon-owned predicate (`--when`) trigger can live in
- *  the same table as a clock trigger. Predicate-only columns (`when_script`
- *  through `last_stderr`) are additive null/idle for every migrated clock row.
- *
- *  Migration mapping, preserving every existing `wakeup_id` as `trigger_id`
- *  (so an old wake's id stays cancelable): bare→fresh_revive, noted→
- *  inbox_message, deadline→deadline_message (trigger_type='until'), spawn→
- *  node_birth. `payload` JSON carries over unchanged — the old per-kind
- *  payload shapes (plus SpawnChildOpts) map 1:1 onto the intermediate row, so
- *  no JSON transform is needed. The `wakeups` table is then DROPPED — not kept
- *  as a parallel table. Additive, forward-only. */
-function migrateWakeupsToTriggers(db) {
-    db.exec(`
+`)}i(le,"appendWakeupsTable");function Le(e){e.exec(`
 CREATE TABLE IF NOT EXISTS triggers (
   trigger_id        TEXT PRIMARY KEY,
   owner_id          TEXT NOT NULL,
@@ -360,134 +131,12 @@ SELECT
 FROM wakeups;
 
 DROP TABLE wakeups;
-`);
-}
-/** v8 — additive identity column `host_kind`: which HOST launches + supervises a
- *  node — `'tmux'` (a pane) or `'broker'` (the headless in-process engine). It is
- *  durable IDENTITY mirrored from meta.json like `cwd` (NOT runtime like `pane`),
- *  so it survives an index rebuild via the `IDENTITY_KEYS`/`upsertRow` path.
- *  Defaults NULL ⇒ `'tmux'` (every existing node is tmux-hosted); no data
- *  backfill. Additive, forward-only. */
-function addHostKindColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'host_kind', `ALTER TABLE nodes ADD COLUMN host_kind TEXT;`);
-}
-/** v10 — the `canvas_meta` key/value table: a single durable place for
- *  small, cross-process canvas-wide scalars that aren't node rows. First user:
- *  the boot marker (boot.ts), which records the last-seen kernel boot identity
- *  so boot-liveness reconciliation is a single-writer SQLite transaction on
- *  this row rather than a race-prone JSON file. Additive, forward-only. */
-function addCanvasMetaTable(db) {
-    db.exec(`
+`)}i(Le,"migrateWakeupsToTriggers");function pe(e){const n=l(e);a(e,n,"host_kind","ALTER TABLE nodes ADD COLUMN host_kind TEXT;")}i(pe,"addHostKindColumn");function Oe(e){e.exec(`
 CREATE TABLE IF NOT EXISTS canvas_meta (
   key   TEXT PRIMARY KEY,
   value TEXT NOT NULL
 );
-`);
-}
-/** v11 — additive identity column `profile_id`: the profile-directory id
- *  (`<slug>-<id>`) a node runs under, chosen once at spawn (inherited from the
- *  spawner, or `--profile`). Durable IDENTITY mirrored from meta.json like
- *  `cwd`/`host_kind` (NOT runtime like `pane`), so it survives an index rebuild
- *  via the `IDENTITY_KEYS`/`upsertRow` path. Defaults NULL for historical
- *  root/no-profile rows; new root conversations use the stable root profile
- *  id instead. No data backfill. Additive, forward-only. */
-function addProfileIdColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'profile_id', `ALTER TABLE nodes ADD COLUMN profile_id TEXT;`);
-}
-/** v12 — additive runtime column `pi_pid_identity`: the LAUNCH-time process-
- *  identity fingerprint (`pid.ts`'s `composeIdentity`) recorded alongside
- *  `pi_pid` (v2) by `recordPid`, so `headlessBrokerHost.teardown()` can refuse
- *  to signal a `pi_pid` the OS has since recycled for an unrelated process
- *  (see `NodeRuntime.pi_pid_identity`).
- *  Defaults NULL ⇒ no baseline ⇒ the guard fails open, exactly like a node
- *  booted before this column existed. No data backfill: an existing `pi_pid`
- *  with no recorded identity simply has no launch-time baseline to compare
- *  against. Additive, forward-only. */
-function addPidIdentityColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'pi_pid_identity', `ALTER TABLE nodes ADD COLUMN pi_pid_identity TEXT;`);
-}
-/** v13 — mutable controller-message wait state. It belongs with runtime state,
- * not meta identity: both the waiting node and an incoming sender can settle it. */
-function addMessageWaitColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'waiting_for', `ALTER TABLE nodes ADD COLUMN waiting_for TEXT;`);
-}
-/** v14 — canonical final identity. Existing done rows receive their newest valid
- * final report once; runtime never infers canonical state from report files. */
-function addCanonicalFinalColumns(db) {
-    const columns = nodeColumns(db);
-    // Metadata-only migration harnesses can legitimately advance user_version on
-    // an otherwise empty database. There is no node index to repair in that case.
-    if (columns.size === 0)
-        return;
-    addNodeColumnIfMissing(db, columns, 'final_report', `ALTER TABLE nodes ADD COLUMN final_report TEXT;`);
-    addNodeColumnIfMissing(db, columns, 'finalized_at', `ALTER TABLE nodes ADD COLUMN finalized_at TEXT;`);
-    const rows = db.prepare("SELECT node_id FROM nodes WHERE status = 'done' AND final_report IS NULL").all();
-    const update = db.prepare('UPDATE nodes SET final_report = ?, finalized_at = ? WHERE node_id = ? AND final_report IS NULL');
-    for (const { node_id } of rows) {
-        const dir = join(nodesRoot(), node_id, 'reports');
-        if (!existsSync(dir))
-            continue;
-        let winner = null;
-        for (const name of readdirSync(dir)) {
-            if (!name.endsWith('.md'))
-                continue;
-            try {
-                const raw = readFileSync(join(dir, name), 'utf8');
-                const match = /^---\nnode: [^\n]+\nkind: final\nts: ([^\n]+)\n---\n/.exec(raw);
-                if (match === null || Number.isNaN(Date.parse(match[1])))
-                    continue;
-                const candidate = { name, ts: match[1] };
-                if (winner === null || candidate.ts > winner.ts || (candidate.ts === winner.ts && candidate.name > winner.name))
-                    winner = candidate;
-            }
-            catch { /* malformed historical reports are not canonical */ }
-        }
-        if (winner !== null)
-            update.run(winner.name, winner.ts, node_id);
-    }
-}
-/** v15 — canonicalize persisted launch metadata after a retired generation-root
- * experiment. Canvas hooks are launch-owned; retain every genuine custom extra. */
-function normalizePersistedLaunchExtensions(_db) {
-    const root = nodesRoot();
-    if (!existsSync(root))
-        return;
-    for (const id of readdirSync(root)) {
-        const path = nodeMetaPath(id);
-        if (!existsSync(path))
-            continue;
-        updateJsonFileDurably(path, (meta) => {
-            const launch = meta['launch'];
-            if (typeof launch !== 'object' || launch === null || Array.isArray(launch))
-                return false;
-            const extensions = launch.extensions;
-            if (!Array.isArray(extensions) || !extensions.every((value) => typeof value === 'string'))
-                return false;
-            const custom = customExtensionPaths(extensions);
-            if (custom.length === extensions.length)
-                return false;
-            launch.extensions = custom;
-            return true;
-        });
-    }
-}
-/** v17 — monotonically identifies each explicit wait arm. Delivery settlement
- * uses this watermark as well as the controller identity. */
-function addMessageWaitGenerationColumn(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'waiting_for_generation', `ALTER TABLE nodes ADD COLUMN waiting_for_generation INTEGER NOT NULL DEFAULT 0;`);
-}
-/** v18 — create the historical `consult_outbox` table. The old schema stays
- *  replayable for existing databases until its later migration removes it.
- *  No current user-facing flow creates rows. Its remaining diagnostics and
- *  retention readers keep armed/pending legacy rows from losing their node
- *  before startup or crash reconciliation terminalizes those rows. */
-function addHumanWorkOutboxTable(db) {
-    db.exec(`
+`)}i(Oe,"addCanvasMetaTable");function Ae(e){const n=l(e);a(e,n,"profile_id","ALTER TABLE nodes ADD COLUMN profile_id TEXT;")}i(Ae,"addProfileIdColumn");function fe(e){const n=l(e);a(e,n,"pi_pid_identity","ALTER TABLE nodes ADD COLUMN pi_pid_identity TEXT;")}i(fe,"addPidIdentityColumn");function Re(e){const n=l(e);a(e,n,"waiting_for","ALTER TABLE nodes ADD COLUMN waiting_for TEXT;")}i(Re,"addMessageWaitColumn");function $(e){const n=l(e);if(n.size===0)return;a(e,n,"final_report","ALTER TABLE nodes ADD COLUMN final_report TEXT;"),a(e,n,"finalized_at","ALTER TABLE nodes ADD COLUMN finalized_at TEXT;");const t=e.prepare("SELECT node_id FROM nodes WHERE status = 'done' AND final_report IS NULL").all(),o=e.prepare("UPDATE nodes SET final_report = ?, finalized_at = ? WHERE node_id = ? AND final_report IS NULL");for(const{node_id:s}of t){const T=y(S(),s,"reports");if(!A(T))continue;let r=null;for(const E of X(T))if(E.endsWith(".md"))try{const d=h(y(T,E),"utf8"),_=/^---\nnode: [^\n]+\nkind: final\nts: ([^\n]+)\n---\n/.exec(d);if(_===null||Number.isNaN(Date.parse(_[1])))continue;const c={name:E,ts:_[1]};(r===null||c.ts>r.ts||c.ts===r.ts&&c.name>r.name)&&(r=c)}catch{}r!==null&&o.run(r.name,r.ts,s)}}i($,"addCanonicalFinalColumns");function me(e){const n=S();if(A(n))for(const t of X(n)){const o=I(t);A(o)&&b(o,s=>{const T=s.launch;if(typeof T!="object"||T===null||Array.isArray(T))return!1;const r=T.extensions;if(!Array.isArray(r)||!r.every(d=>typeof d=="string"))return!1;const E=se(r);return E.length===r.length?!1:(T.extensions=E,!0)})}}i(me,"normalizePersistedLaunchExtensions");function Ie(e){const n=l(e);a(e,n,"waiting_for_generation","ALTER TABLE nodes ADD COLUMN waiting_for_generation INTEGER NOT NULL DEFAULT 0;")}i(Ie,"addMessageWaitGenerationColumn");function Xe(e){e.exec(`
 CREATE TABLE IF NOT EXISTS consult_outbox (
   node_id      TEXT PRIMARY KEY,   -- legacy work node id
   dir          TEXT NOT NULL,      -- legacy ticket directory
@@ -501,56 +150,15 @@ CREATE INDEX IF NOT EXISTS idx_consult_outbox_status ON consult_outbox(status);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_dir ON consult_outbox(dir);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_dir_request_status ON consult_outbox(dir, request_id, status);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_dir_status ON consult_outbox(dir, status);
-`);
-}
-/** v19 — generalize the physical `consult_outbox` ABI into human work without
- * changing its table name. Existing rows and old literal follow-up inserts gain
- * `follow_up` by default; Visual reserves namespaced statuses so old
- * `armed`/`pending` reconcilers cannot select it. */
-function addHumanWorkColumns(db) {
-    const columns = tableColumns(db, 'consult_outbox');
-    const add = (name, ddl) => addColumnIfMissing(db, columns, name, ddl);
-    add('work_kind', "ALTER TABLE consult_outbox ADD COLUMN work_kind TEXT NOT NULL DEFAULT 'follow_up';");
-    add('interaction_id', 'ALTER TABLE consult_outbox ADD COLUMN interaction_id TEXT;');
-    add('generation_id', 'ALTER TABLE consult_outbox ADD COLUMN generation_id TEXT;');
-    add('interaction_snapshot', 'ALTER TABLE consult_outbox ADD COLUMN interaction_snapshot TEXT;');
-    add('handler_command', 'ALTER TABLE consult_outbox ADD COLUMN handler_command TEXT;');
-    add('handler_args_json', 'ALTER TABLE consult_outbox ADD COLUMN handler_args_json TEXT;');
-    add('claim_token', 'ALTER TABLE consult_outbox ADD COLUMN claim_token TEXT;');
-    db.exec(`
+`)}i(Xe,"addHumanWorkOutboxTable");function Se(e){const n=w(e,"consult_outbox"),t=i((o,s)=>Y(e,n,o,s),"add");t("work_kind","ALTER TABLE consult_outbox ADD COLUMN work_kind TEXT NOT NULL DEFAULT 'follow_up';"),t("interaction_id","ALTER TABLE consult_outbox ADD COLUMN interaction_id TEXT;"),t("generation_id","ALTER TABLE consult_outbox ADD COLUMN generation_id TEXT;"),t("interaction_snapshot","ALTER TABLE consult_outbox ADD COLUMN interaction_snapshot TEXT;"),t("handler_command","ALTER TABLE consult_outbox ADD COLUMN handler_command TEXT;"),t("handler_args_json","ALTER TABLE consult_outbox ADD COLUMN handler_args_json TEXT;"),t("claim_token","ALTER TABLE consult_outbox ADD COLUMN claim_token TEXT;"),e.exec(`
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_human_work_status ON consult_outbox(work_kind, status);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_human_work_dir_status ON consult_outbox(dir, work_kind, status);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_human_work_request_status ON consult_outbox(dir, request_id, work_kind, status);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_consult_outbox_visual_request ON consult_outbox(dir, request_id, work_kind) WHERE work_kind = 'visual';
-`);
-}
-/** v20 — index `nodes(parent)` and `nodes(created)`. `listNodes()`'s
- *  `ORDER BY created` and the `children = rows.filter(r => r.parent === id)`
- *  child lookup (`daemon/api/handlers/nodes.ts`'s `edgesFor`) were both
- *  full-table scans under the daemon's single event loop; a live fleet's
- *  `GET /v1/nodes/:id` measured >15s under concurrent-viewer load. Additive,
- *  forward-only — `IF NOT EXISTS` makes re-running a no-op. */
-function addNodeParentCreatedIndexes(db) {
-    db.exec(`
+`)}i(Se,"addHumanWorkColumns");function Ue(e){e.exec(`
 CREATE INDEX IF NOT EXISTS idx_nodes_parent  ON nodes(parent);
 CREATE INDEX IF NOT EXISTS idx_nodes_created ON nodes(created);
-`);
-}
-/** v21 — the `crons` + `cron_runs` tables. One scheduling primitive: run this
- *  bash, then. Key contracts pinned by the spec:
- *   - `created_by` is provenance ONLY — no FK, never cascades; a lifelong job
- *     is not hostage to the window that typed it.
- *   - `anchor_node` is the OPT-IN node coupling, carrying the one FK
- *     (ON DELETE CASCADE); NULL = outlives every node on the canvas.
- *   - the partial unique index `idx_crons_deadline` is the ≤1-deadline-per-node
- *     backstop for the future `node wait deadline` sugar (cancel_on_wake rows).
- *   - execution context (cwd/env/profile) is SNAPSHOTTED at arm time, never
- *     resolved at run time.
- *   - `cron_runs` is a bounded ring (last 20 per cron, pruned by the DAO's
- *     recordCronRun).
- *  Additive and forward-only. */
-function addCronsTables(db) {
-    db.exec(`
+`)}i(Ue,"addNodeParentCreatedIndexes");function ge(e){e.exec(`
 CREATE TABLE IF NOT EXISTS crons (
   cron_id          TEXT PRIMARY KEY,
   name             TEXT NOT NULL,          -- agent-legible label; how it shows in list
@@ -605,411 +213,38 @@ CREATE TABLE IF NOT EXISTS cron_runs (                -- bounded ring, last 20 p
   FOREIGN KEY (cron_id) REFERENCES crons(cron_id) ON DELETE CASCADE
 );
 CREATE INDEX IF NOT EXISTS idx_cron_runs_cron ON cron_runs(cron_id, started);
-`);
-}
-function shellSingleQuote(value) {
-    return `'${value.replace(/'/g, `'"'"'`)}'`;
-}
-function uniqueHeredocDelimiter(body, stem) {
-    let suffix = 0;
-    while (true) {
-        const delimiter = `${stem}_${suffix}`;
-        if (!body.split('\n').includes(delimiter))
-            return delimiter;
-        suffix++;
-    }
-}
-function heredocCommand(command, body, stem) {
-    const delimiter = uniqueHeredocDelimiter(body, stem);
-    return `${command} <<'${delimiter}'\n${body}\n${delimiter}`;
-}
-/** `payload` was a NULLABLE text column, so NULL, non-string, and legacy or
- *  hand-edited JSON are all shapes the retired schema declared legal. A schema
- *  migration must never fail on data shape, so anything unreadable degrades to
- *  an empty payload; the per-key readers below then decide whether what is left
- *  is enough to convert the row. */
-function migrationPayload(raw) {
-    if (typeof raw !== 'string')
-        return {};
-    try {
-        const parsed = JSON.parse(raw);
-        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
-            return {};
-        return parsed;
-    }
-    catch {
-        return {};
-    }
-}
-function requiredString(payload, key, triggerId) {
-    const value = payload[key];
-    if (typeof value !== 'string' || value.trim() === '') {
-        throw new Error(`trigger ${triggerId} payload requires non-empty ${key}`);
-    }
-    return value;
-}
-function optionalString(payload, key) {
-    const value = payload[key];
-    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
-}
-/** The same reader over a `triggers` ROW rather than its payload: returns the
- *  column when it holds a usable string, `undefined` otherwise. */
-function optionalColumn(row, key) {
-    const value = row[key];
-    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
-}
-function migratedMessageCommand(target, tier, body, triggerId) {
-    return heredocCommand(`crtr node message send --to ${shellSingleQuote(target)} --tier ${shellSingleQuote(tier)}`, body, `CRTR_MIGRATED_${triggerId.replace(/[^A-Za-z0-9]/g, '_')}`);
-}
-/** A body-less predicate message: the retired daemon filled the body from the
- *  gate's stdout at fire time (`p.body ?? outcome.stdout`), so the migrated
- *  script pipes the captured gate output into the send. */
-function migratedGateStdoutMessageCommand(target, tier) {
-    return `printf '%s\\n' "$CRTR_GATE_STDOUT" | crtr node message send --to ${shellSingleQuote(target)} --tier ${shellSingleQuote(tier)}`;
-}
-function migratedSpawnCommand(payload, triggerId) {
-    const flags = [`crtr node new --kind ${shellSingleQuote(requiredString(payload, 'kind', triggerId))}`];
-    const strings = [
-        ['mode', 'mode'],
-        ['cwd', 'cwd'],
-        ['name', 'name'],
-        ['parent', 'parent'],
-        ['worktreeBase', 'worktree'],
-        ['forkFrom', 'fork-from'],
-        ['model', 'model'],
-        ['profile', 'profile'],
-        ['situationalContext', 'situational-context'],
-    ];
-    for (const [key, flag] of strings) {
-        const value = optionalString(payload, key);
-        if (value !== undefined)
-            flags.push(`--${flag} ${shellSingleQuote(value)}`);
-    }
-    if (payload['root'] === true)
-        flags.push('--root');
-    const prompt = requiredString(payload, 'prompt', triggerId);
-    return heredocCommand(flags.join(' '), prompt, `CRTR_MIGRATED_${triggerId.replace(/[^A-Za-z0-9]/g, '_')}`);
-}
-/** The `canvas_meta` key holding the v22 skip ledger: a JSON array of
- *  `{ trigger_id, reason }` for every retired schedule the migration could not
- *  express as a cron. Written only when at least one row is skipped. */
-const V22_SKIPPED_META_KEY = 'migration.v22.skipped';
-/** The execution-context cwd for a schedule whose armer is gone. `owner_id`
- *  carries NO foreign key by design (see v7), so a crashed-then-pruned armer's
- *  detached schedule is an EXPECTED row, not a corrupt one — it must still
- *  convert. Falls back to the oldest root node's cwd (the ambient canvas root),
- *  then to this process's cwd. */
-function ambientMigrationCwd(db) {
-    const root = db
-        .prepare('SELECT cwd FROM nodes WHERE parent IS NULL ORDER BY created LIMIT 1')
-        .get();
-    return (root !== undefined ? optionalColumn(root, 'cwd') : undefined) ?? process.cwd();
-}
-/** Best-effort reap of in-flight predicate evaluations before the table that
- *  records them is dropped. The retired cancel path killed the evaluation's
- *  process GROUP; without this the migration would orphan a running gate
- *  script with nothing left on disk that names it. */
-function reapRunningPredicateEvaluations(db) {
-    let running;
-    try {
-        running = db
-            .prepare("SELECT eval_pid FROM triggers WHERE eval_state = 'running' AND eval_pid IS NOT NULL")
-            .all();
-    }
-    catch {
-        return; // a drifted table shape has no evaluations we can name; never fatal
-    }
-    for (const row of running) {
-        const pid = row['eval_pid'];
-        if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 1)
-            continue;
-        try {
-            process.kill(-pid, 'SIGTERM');
-        }
-        catch {
-            /* the evaluation already exited, or the group is gone — nothing to reap */
-        }
-    }
-}
-/** v22 — migrate each scheduled action into a shell cron, preserving its id and
- * execution context, then remove the superseded table.
- *
- * SKIP-AND-RECORD, never throw. A migration that hard-fails on data shape would
- * block daemon startup. Rows the retired schema declared legal but this step
- * cannot express (unknown action/timing pairs, a missing fire time, drifted
- * JSON) are skipped, named in the `canvas_meta` ledger under
- * `migration.v22.skipped`, and warned about — the schema always advances.
- * `INSERT OR REPLACE` makes a re-run over already-converted ids converge rather
- * than collide on the `cron_id` primary key. */
-function migrateTriggersToCrons(db) {
-    const skipped = [];
-    // A db already wedged by an interrupted pre-atomicity run (crons committed,
-    // the table dropped, `user_version` still 21) re-runs this step with nothing
-    // left to convert; it must advance, not throw.
-    const hasTriggers = db
-        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'triggers'")
-        .get() !== undefined;
-    if (hasTriggers)
-        reapRunningPredicateEvaluations(db);
-    let rows = [];
-    if (hasTriggers) {
-        try {
-            rows = db.prepare('SELECT * FROM triggers ORDER BY created, trigger_id').all();
-        }
-        catch (err) {
-            // A column-drifted table (no `created`/`trigger_id`) must not brick every
-            // open either: record that its rows were unreadable and advance.
-            skipped.push({
-                trigger_id: '<unreadable table>',
-                reason: `triggers table could not be read: ${err instanceof Error ? err.message : String(err)}`,
-            });
-        }
-    }
-    const fallbackCwd = ambientMigrationCwd(db);
-    const insert = db.prepare(`
+`)}i(ge,"addCronsTables");function f(e){return`'${e.replace(/'/g,`'"'"'`)}'`}i(f,"shellSingleQuote");function Ce(e,n){let t=0;for(;;){const o=`${n}_${t}`;if(!e.split(`
+`).includes(o))return o;t++}}i(Ce,"uniqueHeredocDelimiter");function W(e,n,t){const o=Ce(n,t);return`${e} <<'${o}'
+${n}
+${o}`}i(W,"heredocCommand");function De(e){if(typeof e!="string")return{};try{const n=JSON.parse(e);return typeof n!="object"||n===null||Array.isArray(n)?{}:n}catch{return{}}}i(De,"migrationPayload");function L(e,n,t){const o=e[n];if(typeof o!="string"||o.trim()==="")throw new Error(`trigger ${t} payload requires non-empty ${n}`);return o}i(L,"requiredString");function U(e,n){const t=e[n];return typeof t=="string"&&t.trim()!==""?t:void 0}i(U,"optionalString");function R(e,n){const t=e[n];return typeof t=="string"&&t.trim()!==""?t:void 0}i(R,"optionalColumn");function K(e,n,t,o){return W(`crtr node message send --to ${f(e)} --tier ${f(n)}`,t,`CRTR_MIGRATED_${o.replace(/[^A-Za-z0-9]/g,"_")}`)}i(K,"migratedMessageCommand");function he(e,n){return`printf '%s\\n' "$CRTR_GATE_STDOUT" | crtr node message send --to ${f(e)} --tier ${f(n)}`}i(he,"migratedGateStdoutMessageCommand");function we(e,n){const t=[`crtr node new --kind ${f(L(e,"kind",n))}`],o=[["mode","mode"],["cwd","cwd"],["name","name"],["parent","parent"],["worktreeBase","worktree"],["forkFrom","fork-from"],["model","model"],["profile","profile"],["situationalContext","situational-context"]];for(const[T,r]of o){const E=U(e,T);E!==void 0&&t.push(`--${r} ${f(E)}`)}e.root===!0&&t.push("--root");const s=L(e,"prompt",n);return W(t.join(" "),s,`CRTR_MIGRATED_${n.replace(/[^A-Za-z0-9]/g,"_")}`)}i(we,"migratedSpawnCommand");const q="migration.v22.skipped";function xe(e){const n=e.prepare("SELECT cwd FROM nodes WHERE parent IS NULL ORDER BY created LIMIT 1").get();return(n!==void 0?R(n,"cwd"):void 0)??process.cwd()}i(xe,"ambientMigrationCwd");function ve(e){let n;try{n=e.prepare("SELECT eval_pid FROM triggers WHERE eval_state = 'running' AND eval_pid IS NOT NULL").all()}catch{return}for(const t of n){const o=t.eval_pid;if(!(typeof o!="number"||!Number.isInteger(o)||o<=1))try{process.kill(-o,"SIGTERM")}catch{}}}i(ve,"reapRunningPredicateEvaluations");function Fe(e){const n=[],t=e.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'triggers'").get()!==void 0;t&&ve(e);let o=[];if(t)try{o=e.prepare("SELECT * FROM triggers ORDER BY created, trigger_id").all()}catch(r){n.push({trigger_id:"<unreadable table>",reason:`triggers table could not be read: ${r instanceof Error?r.message:String(r)}`})}const s=xe(e),T=e.prepare(`
 INSERT OR REPLACE INTO crons (
   cron_id, name, created_by, command, fire_at, recur, tz, expires_at,
   anchor_node, cancel_on_wake, cwd, env_json, profile, scope,
   run_timeout_s, overlap, on_output, sink, tier, created, updated
-) VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, NULL, ?, 'profile', ?, 'skip', 'on-failure', '{}', ?, ?, ?)`);
-    for (const row of rows) {
-        const triggerId = optionalColumn(row, 'trigger_id');
-        if (triggerId === undefined) {
-            skipped.push({ trigger_id: '<unidentified row>', reason: 'row carries no trigger_id' });
-            continue;
-        }
-        try {
-            convertTriggerRow(db, insert, row, triggerId, fallbackCwd);
-        }
-        catch (err) {
-            skipped.push({ trigger_id: triggerId, reason: err instanceof Error ? err.message : String(err) });
-        }
-    }
-    if (skipped.length > 0) {
-        db.prepare('INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(V22_SKIPPED_META_KEY, JSON.stringify(skipped));
-        console.warn(`[canvas migration v22] ${skipped.length} retired schedule(s) could not be converted to crons and were dropped; ` +
-            `see canvas_meta['${V22_SKIPPED_META_KEY}']: ` +
-            skipped.map((entry) => `${entry.trigger_id} (${entry.reason})`).join('; '));
-    }
-    db.exec(`
+) VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, NULL, ?, 'profile', ?, 'skip', 'on-failure', '{}', ?, ?, ?)`);for(const r of o){const E=R(r,"trigger_id");if(E===void 0){n.push({trigger_id:"<unidentified row>",reason:"row carries no trigger_id"});continue}try{ye(e,T,r,E,s)}catch(d){n.push({trigger_id:E,reason:d instanceof Error?d.message:String(d)})}}n.length>0&&(e.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(q,JSON.stringify(n)),console.warn(`[canvas migration v22] ${n.length} retired schedule(s) could not be converted to crons and were dropped; see canvas_meta['${q}']: `+n.map(r=>`${r.trigger_id} (${r.reason})`).join("; "))),e.exec(`
 DROP INDEX IF EXISTS idx_triggers_fire;
 DROP INDEX IF EXISTS idx_triggers_node;
 DROP INDEX IF EXISTS idx_triggers_owner;
 DROP INDEX IF EXISTS idx_triggers_eval;
 DROP INDEX IF EXISTS idx_triggers_deadline;
 DROP TABLE IF EXISTS triggers;
-`);
-}
-/** Convert ONE retired schedule row into a cron row. Throws only when the row
- *  cannot be expressed as a cron at all; the caller turns that into a recorded
- *  skip so the schema still advances. */
-function convertTriggerRow(db, insert, row, triggerId, fallbackCwd) {
-    const ownerId = requiredString(row, 'owner_id', triggerId);
-    // A pruned armer is expected, not corrupt (no FK on `owner_id`, by design):
-    // keep the schedule and snapshot the ambient root cwd instead of its armer's.
-    const owner = db.prepare('SELECT cwd, profile_id FROM nodes WHERE node_id = ?').get(ownerId);
-    const cwd = (owner === undefined ? undefined : optionalColumn(owner, 'cwd')) ?? fallbackCwd;
-    const profile = owner === undefined ? null : optionalColumn(owner, 'profile_id') ?? null;
-    const nodeId = optionalColumn(row, 'node_id') ?? null;
-    const action = requiredString(row, 'action', triggerId);
-    const actionMode = requiredString(row, 'action_mode', triggerId);
-    const triggerType = requiredString(row, 'trigger_type', triggerId);
-    const payload = migrationPayload(row['payload']);
-    const created = optionalColumn(row, 'created') ?? new Date().toISOString();
-    const tier = actionMode === 'deadline_message' ? 'urgent' : optionalString(payload, 'tier') ?? 'normal';
-    const label = optionalString(payload, 'label');
-    let command;
-    let name;
-    // A `--when` schedule could legally omit its body: the retired daemon filled
-    // it from the gate's stdout at fire time. Such a row pipes the captured gate
-    // output into the send instead of carrying a heredoc.
-    let bodyFromGate = false;
-    if (action === 'msg' && (actionMode === 'inbox_message' || actionMode === 'deadline_message')) {
-        if (nodeId === null)
-            throw new Error('has no message target');
-        const body = optionalString(payload, 'body');
-        if (body !== undefined) {
-            command = migratedMessageCommand(nodeId, tier, body, triggerId);
-        }
-        else if (triggerType === 'when') {
-            bodyFromGate = true;
-            command = migratedGateStdoutMessageCommand(nodeId, tier);
-        }
-        else {
-            // Not expressible from a gate: synthesize the most informative body the
-            // row still holds rather than losing the enactment.
-            command = migratedMessageCommand(nodeId, tier, label ?? 'Scheduled message (no body was recorded when this schedule was armed).', triggerId);
-        }
-        name = label ?? (actionMode === 'deadline_message' ? 'deadline' : 'scheduled message');
-    }
-    else if (action === 'msg' && actionMode === 'fresh_revive') {
-        if (nodeId === null)
-            throw new Error('has no revive target');
-        command = `crtr node lifecycle revive ${shellSingleQuote(nodeId)} --fresh`;
-        name = label ?? 'scheduled fresh revive';
-    }
-    else if (action === 'new' && actionMode === 'node_birth') {
-        command = migratedSpawnCommand(payload, triggerId);
-        name = optionalString(payload, 'name') ?? `scheduled ${requiredString(payload, 'kind', triggerId)} node`;
-    }
-    else {
-        throw new Error(`has unsupported action ${action}/${actionMode}`);
-    }
-    let fireAt;
-    let recur;
-    let expiresAt = null;
-    if (triggerType === 'when') {
-        fireAt = requiredString(row, 'next_eval_at', triggerId);
-        // A when-row with no evaluation cadence would silently become a ONE-SHOT
-        // gate that evaporates on its first unsatisfied check; skip-and-record it.
-        recur = requiredString(row, 'eval_every', triggerId);
-        expiresAt = optionalColumn(row, 'timeout_at') ?? null;
-        const gate = requiredString(row, 'when_script', triggerId);
-        const open = bodyFromGate ? `if ! CRTR_GATE_STDOUT="$(\n${gate}\n)"; then` : `if ! (\n${gate}\n); then`;
-        // `&&`, not a newline: the run's exit status must be the ACTION's, so a
-        // failed enactment escalates through the cron's on-failure path and leaves
-        // the cron armed instead of silently self-cancelling on a lost message.
-        // The action is BRACE-GROUPED because it may be heredoc-shaped: a `&&`
-        // appended straight onto it would land on the heredoc's closing delimiter
-        // line, which then never terminates the document.
-        command = `${open}\n  exit 0\nfi\n{\n${command}\n} && crtr cron cancel "$CRTR_CRON_ID"`;
-    }
-    else if (triggerType === 'at' || triggerType === 'every' || triggerType === 'until') {
-        fireAt = requiredString(row, 'fire_at', triggerId);
-        recur = triggerType === 'every' ? requiredString(row, 'recur', triggerId) : null;
-    }
-    else {
-        throw new Error(`has unknown timing type ${triggerType}`);
-    }
-    // `INSERT OR REPLACE` (the re-run convergence for a repeated `cron_id`) would
-    // ALSO silently evict a conflicting row on the ≤1-deadline-per-node partial
-    // index. Only drifted data can produce that shape, and it must be recorded,
-    // not resolved in silence: keep the earlier deadline, skip this one.
-    if (actionMode === 'deadline_message' && nodeId !== null) {
-        const rival = db
-            .prepare('SELECT cron_id FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1 AND cron_id <> ?')
-            .get(nodeId, triggerId);
-        if (rival !== undefined) {
-            throw new Error(`node ${nodeId} already has a migrated deadline (${String(rival['cron_id'])}); only one is allowed`);
-        }
-    }
-    insert.run(triggerId, name, ownerId, command, fireAt, recur, expiresAt, nodeId, actionMode === 'deadline_message' ? 1 : 0, cwd, profile, 300, 
-    // `tier` and `sink` are INERT for migrated rows: the delivery lives entirely
-    // inside `command` (which carries its own `--tier`), and `sink = '{}'`
-    // parses to "no sink armed". `tier` is preserved only as provenance of what
-    // the retired schedule would have sent.
-    tier, created, created);
-}
-/** v23 — pid-REUSE guard for the cron run lease: `crons.run_pid_identity` holds
- * the `capturePidIdentities` fingerprint of the run's process, captured at lease
- * acquisition beside `run_pid`. Every kill site (stale-lease recovery,
- * `cancelCron`, `cancelCronsOnWake`, deadline displacement) re-captures the
- * identity of the recorded pid and refuses to signal unless it MATCHES.
- *
- * Without it, a bare pid recorded by a daemon life that ended (SIGKILL, host
- * reboot) is compared only with `isPidAlive` — after a reboot the pid comes
- * from a dead kernel's pid space, a low pid is likely recycled, and the run's
- * own timeout is trivially exceeded, so recovery SIGTERMs an unrelated user
- * process group. Rows written before this column exist have NULL identity and
- * therefore fall to the fail-closed path (release the lease, never signal). */
-function addCronRunPidIdentityColumn(db) {
-    const columns = tableColumns(db, 'crons');
-    // A metadata-only harness db may have no `crons` table at all (PRAGMA returns
-    // no rows); there is nothing to alter and the version must still advance.
-    if (columns.size === 0 || columns.has('run_pid_identity'))
-        return;
-    db.exec('ALTER TABLE crons ADD COLUMN run_pid_identity TEXT;');
-}
-/** v24 — mark an OUT-OF-BAND run lease, and drop the never-implemented
- * `crons.queued` column.
- *
- * `run_out_of_band` is set by `acquireCronRunLease` when the run is a `cron run`
- * (the manual verify verb) rather than a scheduled fire. The overlap pass
- * selects on `run_state = 'running'` alone, so without this marker a manual run
- * that happens to straddle a real occurrence gets that occurrence advanced past
- * (`overlap=skip` — a scheduled fire silently lost to a verification) or gets
- * itself SIGTERMed (`overlap=replace`). The overlap pass now excludes it.
- *
- * `queued` was written by nothing and read by nothing: `overlap='queue'` is
- * implemented purely by LEAVING `fire_at` past-due, so the depth is structural
- * (one occurrence per row) and needs no counter. A column documenting a policy
- * it does not implement misleads the next reader, so it goes. */
-function addCronOutOfBandColumn(db) {
-    const columns = tableColumns(db, 'crons');
-    // A metadata-only harness db may have no `crons` table at all (PRAGMA returns
-    // no rows); there is nothing to alter and the version must still advance.
-    if (columns.size === 0)
-        return;
-    if (!columns.has('run_out_of_band')) {
-        db.exec('ALTER TABLE crons ADD COLUMN run_out_of_band INTEGER NOT NULL DEFAULT 0;');
-    }
-    if (columns.has('queued'))
-        db.exec('ALTER TABLE crons DROP COLUMN queued;');
-}
-/** v25 — the `warm_pool` table: the spare-node pool behind `prefer_warm`.
- *
- *  A spare IS a real canvas node (its broker is already booted against a real
- *  node dir); the row here is the marker that it has not been handed to anyone
- *  yet. Membership in this table is what hides a node from every listing
- *  (`listNodes`/`rosterNodes`/`listResumableRoots`) — an unclaimed spare must
- *  never surface as a phantom empty conversation in a user's sidebar. Claiming
- *  is exactly the DELETE of this row, taken under the canvas write-lock, so two
- *  concurrent creates can never be handed the same spare.
- *
- *  `recipe_key` is the frozen-tuple digest a claim must match exactly (see
- *  `runtime/warm-pool.ts`); the FK cascade reaps the marker when the node row
- *  goes away. */
-function addWarmPoolTable(db) {
-    db.exec(`
+`)}i(Fe,"migrateTriggersToCrons");function ye(e,n,t,o,s){const T=L(t,"owner_id",o),r=e.prepare("SELECT cwd, profile_id FROM nodes WHERE node_id = ?").get(T),E=(r===void 0?void 0:R(r,"cwd"))??s,d=r===void 0?null:R(r,"profile_id")??null,_=R(t,"node_id")??null,c=L(t,"action",o),N=L(t,"action_mode",o),u=L(t,"trigger_type",o),m=De(t.payload),M=R(t,"created")??new Date().toISOString(),C=N==="deadline_message"?"urgent":U(m,"tier")??"normal",x=U(m,"label");let p,D,G=!1;if(c==="msg"&&(N==="inbox_message"||N==="deadline_message")){if(_===null)throw new Error("has no message target");const O=U(m,"body");O!==void 0?p=K(_,C,O,o):u==="when"?(G=!0,p=he(_,C)):p=K(_,C,x??"Scheduled message (no body was recorded when this schedule was armed).",o),D=x??(N==="deadline_message"?"deadline":"scheduled message")}else if(c==="msg"&&N==="fresh_revive"){if(_===null)throw new Error("has no revive target");p=`crtr node lifecycle revive ${f(_)} --fresh`,D=x??"scheduled fresh revive"}else if(c==="new"&&N==="node_birth")p=we(m,o),D=U(m,"name")??`scheduled ${L(m,"kind",o)} node`;else throw new Error(`has unsupported action ${c}/${N}`);let v,F,B=null;if(u==="when"){v=L(t,"next_eval_at",o),F=L(t,"eval_every",o),B=R(t,"timeout_at")??null;const O=L(t,"when_script",o);p=`${G?`if ! CRTR_GATE_STDOUT="$(
+${O}
+)"; then`:`if ! (
+${O}
+); then`}
+  exit 0
+fi
+{
+${p}
+} && crtr cron cancel "$CRTR_CRON_ID"`}else if(u==="at"||u==="every"||u==="until")v=L(t,"fire_at",o),F=u==="every"?L(t,"recur",o):null;else throw new Error(`has unknown timing type ${u}`);if(N==="deadline_message"&&_!==null){const O=e.prepare("SELECT cron_id FROM crons WHERE anchor_node = ? AND cancel_on_wake = 1 AND cron_id <> ?").get(_,o);if(O!==void 0)throw new Error(`node ${_} already has a migrated deadline (${String(O.cron_id)}); only one is allowed`)}n.run(o,D,T,p,v,F,B,_,N==="deadline_message"?1:0,E,d,300,C,M,M)}i(ye,"convertTriggerRow");function ke(e){const n=w(e,"crons");n.size===0||n.has("run_pid_identity")||e.exec("ALTER TABLE crons ADD COLUMN run_pid_identity TEXT;")}i(ke,"addCronRunPidIdentityColumn");function Me(e){const n=w(e,"crons");n.size!==0&&(n.has("run_out_of_band")||e.exec("ALTER TABLE crons ADD COLUMN run_out_of_band INTEGER NOT NULL DEFAULT 0;"),n.has("queued")&&e.exec("ALTER TABLE crons DROP COLUMN queued;"))}i(Me,"addCronOutOfBandColumn");function Ge(e){e.exec(`
 CREATE TABLE IF NOT EXISTS warm_pool (
   node_id    TEXT PRIMARY KEY REFERENCES nodes(node_id) ON DELETE CASCADE,
   recipe_key TEXT NOT NULL,   -- frozen launch tuple this spare was minted for
   created    TEXT NOT NULL    -- ISO 8601, mint time (oldest spare claimed first)
 );
 CREATE INDEX IF NOT EXISTS idx_warm_pool_recipe ON warm_pool(recipe_key, created);
-`);
-}
-/** v26 — narrow `consult_outbox` for the humanloop absorption into
- *  `src/core/human/` (absorb-humanloop
- *  design, "The human-work receipt table"; Landing 2 Part E task E2). The
- *  five-column trust binding (`handler_command`, `handler_args_json`,
- *  `claim_token`, `generation_id`, `interaction_snapshot`) existed only to let
- *  crtrd re-verify that a Visual event arrived through crouter's own
- *  registered handler argv — that registry is deleted in this landing, so
- *  there is nothing left to bind. `dir`/`root` collapse into `ticket_node_id`,
- *  the bridge node id stored as `basename(dir)` in the input rows.
- *
- *  THIS IS A TABLE REBUILD, NOT `ALTER TABLE … DROP COLUMN`: six of the nine
- *  existing indexes are on `dir` (`idx_consult_outbox_dir`,
- *  `idx_consult_outbox_dir_request_status`, `idx_consult_outbox_dir_status`
- *  from v18; `idx_consult_outbox_human_work_dir_status`,
- *  `idx_consult_outbox_human_work_request_status`, and the partial-unique
- *  `idx_consult_outbox_visual_request` from v19), and SQLite refuses
- *  `DROP COLUMN` on any indexed column. `ticket_node_id` cannot be a SQL
- *  DEFAULT either — SQLite has no `basename()` — so it is computed per row in
- *  JS: read every existing row through a prepared SELECT, insert each into a
- *  freshly created `consult_outbox_new` with `ticket_node_id = basename(dir)`,
- *  drop the old table (dropping its indexes with it), rename the new table
- *  into place, and recreate exactly five indexes on the narrowed shape. Every
- *  row is carried, including terminal ones, EXCEPT a row whose legacy `dir` is
- *  not a canonical direct child of its recorded `root`, or whose basename is
- *  not a safe node id — either would create an unaddressable or aliased ticket
- *  id once `root` is discarded. A warning names how many are dropped.
- *
- *  THERE IS NO ROLLBACK. A sealed older runtime generation still running
- *  against this canvas.db fails on the Visual lane (`INSERT INTO
- *  consult_outbox (… dir, root, handler_command …)`) once this has run —
- *  acceptable because this migration lands WITH a generation roll
- *  (`npm run build && npm run install-runtime && crtr sys daemon restart`),
- *  never alongside one. Not self-transactional: like every ordinary migration
- *  it runs inside `migrate()`'s per-step `BEGIN IMMEDIATE`, so an interrupted
- *  run leaves `consult_outbox` exactly as it was (SQLite DDL is transactional)
- *  and a re-open resumes cleanly at the same step. */
-function narrowHumanWorkOutbox(db) {
-    const rows = db
-        .prepare('SELECT node_id, dir, root, request_id, work_kind, status, final_report, updated_at FROM consult_outbox')
-        .all();
-    db.exec(`
+`)}i(Ge,"addWarmPoolTable");function Be(e){const n=e.prepare("SELECT node_id, dir, root, request_id, work_kind, status, final_report, updated_at FROM consult_outbox").all();e.exec(`
 CREATE TABLE consult_outbox_new (
   node_id        TEXT PRIMARY KEY,
   ticket_node_id TEXT NOT NULL,
@@ -1019,24 +254,9 @@ CREATE TABLE consult_outbox_new (
   final_report   TEXT,
   updated_at     TEXT NOT NULL
 );
-`);
-    const insert = db.prepare(`
+`);const t=e.prepare(`
 INSERT INTO consult_outbox_new (node_id, ticket_node_id, request_id, work_kind, status, final_report, updated_at)
-VALUES (?, ?, ?, ?, ?, ?, ?)`);
-    let dropped = 0;
-    for (const row of rows) {
-        const ticketNodeId = basename(row.dir);
-        const directChild = row.root === resolve(row.root) && row.dir === join(row.root, ticketNodeId);
-        if (!directChild || !isSafeNodeId(ticketNodeId)) {
-            dropped += 1;
-            continue;
-        }
-        insert.run(row.node_id, ticketNodeId, row.request_id, row.work_kind, row.status, row.final_report, row.updated_at);
-    }
-    if (dropped > 0) {
-        console.warn(`[canvas migration v26] dropped ${dropped} consult_outbox row(s) whose legacy ticket path cannot safely map to a ticket node id`);
-    }
-    db.exec(`
+VALUES (?, ?, ?, ?, ?, ?, ?)`);let o=0;for(const s of n){const T=te(s.dir);if(!(s.root===H(s.root)&&s.dir===y(s.root,T))||!ie(T)){o+=1;continue}t.run(s.node_id,T,s.request_id,s.work_kind,s.status,s.final_report,s.updated_at)}o>0&&console.warn(`[canvas migration v26] dropped ${o} consult_outbox row(s) whose legacy ticket path cannot safely map to a ticket node id`),e.exec(`
 DROP TABLE consult_outbox;
 ALTER TABLE consult_outbox_new RENAME TO consult_outbox;
 
@@ -1045,11 +265,7 @@ CREATE INDEX IF NOT EXISTS idx_consult_outbox_human_work_status ON consult_outbo
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_ticket_status ON consult_outbox(ticket_node_id, work_kind, status);
 CREATE INDEX IF NOT EXISTS idx_consult_outbox_ticket_request_status ON consult_outbox(ticket_node_id, request_id, work_kind, status);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_consult_outbox_visual_request ON consult_outbox(ticket_node_id, request_id, work_kind) WHERE work_kind = 'visual';
-`);
-}
-/** v27 — the canonical daemon-owned review record. */
-function addReviewsTable(db) {
-    db.exec(`
+`)}i(Be,"narrowHumanWorkOutbox");function He(e){e.exec(`
 CREATE TABLE IF NOT EXISTS reviews (
   review_id            TEXT PRIMARY KEY,
   idempotency_key      TEXT NOT NULL UNIQUE,
@@ -1093,11 +309,7 @@ CREATE INDEX IF NOT EXISTS idx_reviews_state ON reviews(state);
 CREATE INDEX IF NOT EXISTS idx_reviews_origin ON reviews(origin_node_id);
 CREATE INDEX IF NOT EXISTS idx_reviews_file ON reviews(file);
 CREATE INDEX IF NOT EXISTS idx_reviews_bridge ON reviews(bridge_node_id);
-`);
-}
-/** v28 — current review-comment projection and append-only comment audit. */
-function addReviewCommentTables(db) {
-    db.exec(`
+`)}i(He,"addReviewsTable");function Pe(e){e.exec(`
 CREATE TABLE IF NOT EXISTS review_comments (
   comment_id          TEXT PRIMARY KEY,
   review_id           TEXT NOT NULL,
@@ -1142,43 +354,13 @@ CREATE INDEX IF NOT EXISTS idx_review_comment_events_review_seq
   ON review_comment_events(review_id, seq);
 CREATE INDEX IF NOT EXISTS idx_review_comment_events_comment_seq
   ON review_comment_events(comment_id, seq);
-`);
-}
-/** v29 — durable review-comment anchor disposition. v28 is already released, so this corrects both fresh and migrated databases without rewriting its historical schema. */
-function addReviewCommentAnchorState(db) {
-    db.exec(`
+`)}i(Pe,"addReviewCommentTables");function be(e){e.exec(`
 ALTER TABLE review_comments
   ADD COLUMN anchor_state TEXT NOT NULL DEFAULT 'live' CHECK (anchor_state IN ('live', 'detached'));
-`);
-}
-/** v30 — remove the retired human-work receipt table after every runtime reader is gone. */
-function dropConsultOutbox(db) {
-    db.exec('DROP TABLE IF EXISTS consult_outbox');
-}
-/** v31 — a human's submit intent recorded on a still-open review, so the
- *  approval can wait for the companion to stop working. Deliberately a column
- *  and not a new `state` value: through the wait the review IS open — comments
- *  still land, ranges still remap, and cancellation still applies. */
-function addReviewSubmitRequested(db) {
-    db.exec('ALTER TABLE reviews ADD COLUMN submit_requested_at TEXT');
-}
-/** v32 — held crons (the exit-75 owed-gate disposition). `held` marks a row
- *  whose last scheduled run exited 75 ("owed but not currently eligible"):
- *  the occurrence was not spent and the row waits for an eligibility poke or
- *  its natural backstop slot. `last_poke_at` records the most recent
- *  `POST /v1/crons/poke` receipt on EVERY row, closing the race where a poke
- *  lands while a gate check is in flight (the settling run compares its start
- *  against it and re-dues instead of parking). Deliberately not part of the
- *  due query: a held row is non-due by `fire_at`, never by a new predicate. */
-function addCronHeldColumns(db) {
-    db.exec(`
+`)}i(be,"addReviewCommentAnchorState");function Ye(e){e.exec("DROP TABLE IF EXISTS consult_outbox")}i(Ye,"dropConsultOutbox");function $e(e){e.exec("ALTER TABLE reviews ADD COLUMN submit_requested_at TEXT")}i($e,"addReviewSubmitRequested");function We(e){e.exec(`
 ALTER TABLE crons ADD COLUMN held INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE crons ADD COLUMN last_poke_at TEXT;
-`);
-}
-/** v33 — durable, daemon-owned attempts to deliver settled human completions. */
-function addHumanActionDeliveries(db) {
-    db.exec(`
+`)}i(We,"addCronHeldColumns");function Ke(e){e.exec(`
 CREATE TABLE human_action_deliveries (
   request_id           TEXT PRIMARY KEY,
   state                TEXT NOT NULL,
@@ -1196,128 +378,18 @@ CREATE TABLE human_action_deliveries (
   updated_at           INTEGER NOT NULL
 );
 CREATE INDEX idx_human_action_deliveries_due ON human_action_deliveries(state, next_attempt_at);
-`);
-}
-/** v34 — index the exact Pi session file coordinate used to recover fork
- * exposure provenance without hydrating every node meta. Meta remains authoritative;
- * normal identity upserts keep this projection current after the one-time backfill. */
-function addNodeSessionFileIndex(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'pi_session_file', 'ALTER TABLE nodes ADD COLUMN pi_session_file TEXT;');
-    for (const entry of readdirSync(nodesRoot(), { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
-        try {
-            const meta = JSON.parse(readFileSync(nodeMetaPath(entry.name), 'utf8'));
-            if (typeof meta.pi_session_file === 'string') {
-                db.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?').run(meta.pi_session_file, entry.name);
-            }
-        }
-        catch {
-            // Corrupt node metadata is ignored by the ordinary canvas rebuild too.
-        }
-    }
-    db.exec('CREATE INDEX IF NOT EXISTS idx_nodes_pi_session_file ON nodes(pi_session_file);');
-}
-/** Reproject the derived session-file index from authoritative node metadata.
- * v36 may resolve duplicate authoritative claimants because it runs before the
- * first UNIQUE index exists. v37 must retain every surviving meta claim: a
- * conflict at that later boundary is irreconcilable and fails instead. */
-function reconcileNodeSessionFileOwners(db, clearDuplicateMetaClaimants) {
-    const canonical = (sessionFile) => {
-        const absolute = resolve(sessionFile);
-        return existsSync(absolute) ? realpathSync(absolute) : absolute;
-    };
-    const setFile = db.prepare('UPDATE nodes SET pi_session_file = ? WHERE node_id = ?');
-    db.exec('DROP INDEX IF EXISTS idx_nodes_pi_session_file;');
-    const rows = db.prepare('SELECT node_id FROM nodes ORDER BY created ASC, node_id ASC').all();
-    for (const { node_id } of rows) {
-        const metaPath = nodeMetaPath(node_id);
-        // Missing or unreadable metadata has no authoritative coordinate. Avoid
-        // taking a file lock there: old rows can outlive a removed node directory.
-        if (readMetaObject(metaPath) === null) {
-            setFile.run(null, node_id);
-            continue;
-        }
-        const sessionFile = withMetaLock(metaPath, () => {
-            const meta = readMetaObject(metaPath);
-            if (meta === null)
-                throw new Error(`node ${node_id} session metadata changed during ownership migration`);
-            if (typeof meta['pi_session_file'] !== 'string')
-                return null;
-            const storedSessionFile = meta['pi_session_file'];
-            const normalizedSessionFile = canonical(storedSessionFile);
-            if (normalizedSessionFile !== storedSessionFile) {
-                meta['pi_session_file'] = normalizedSessionFile;
-                writeMetaObjectLocked(metaPath, meta);
-            }
-            return normalizedSessionFile;
-        });
-        // meta.json is authoritative: a crash after its write can leave this row
-        // claiming another node's old session coordinate.
-        setFile.run(sessionFile, node_id);
-    }
-    const duplicates = db.prepare(`
+`)}i(Ke,"addHumanActionDeliveries");function qe(e){const n=l(e);a(e,n,"pi_session_file","ALTER TABLE nodes ADD COLUMN pi_session_file TEXT;");for(const t of X(S(),{withFileTypes:!0}))if(t.isDirectory())try{const o=JSON.parse(h(I(t.name),"utf8"));typeof o.pi_session_file=="string"&&e.prepare("UPDATE nodes SET pi_session_file = ? WHERE node_id = ?").run(o.pi_session_file,t.name)}catch{}e.exec("CREATE INDEX IF NOT EXISTS idx_nodes_pi_session_file ON nodes(pi_session_file);")}i(qe,"addNodeSessionFileIndex");function j(e,n){const t=i(E=>{const d=H(E);return A(d)?ne(d):d},"canonical"),o=e.prepare("UPDATE nodes SET pi_session_file = ? WHERE node_id = ?");e.exec("DROP INDEX IF EXISTS idx_nodes_pi_session_file;");const s=e.prepare("SELECT node_id FROM nodes ORDER BY created ASC, node_id ASC").all();for(const{node_id:E}of s){const d=I(E);if(P(d)===null){o.run(null,E);continue}const _=Te(d,()=>{const c=P(d);if(c===null)throw new Error(`node ${E} session metadata changed during ownership migration`);if(typeof c.pi_session_file!="string")return null;const N=c.pi_session_file,u=t(N);return u!==N&&(c.pi_session_file=u,Ee(d,c)),u});o.run(_,E)}const T=e.prepare(`
 SELECT pi_session_file
 FROM nodes
 WHERE pi_session_file IS NOT NULL
 GROUP BY pi_session_file
 HAVING COUNT(*) > 1
-`).all();
-    if (!clearDuplicateMetaClaimants && duplicates.length > 0) {
-        const coordinates = duplicates.map(({ pi_session_file }) => pi_session_file).join(', ');
-        throw new Error(`cannot restore unique Pi session ownership: authoritative metadata has concurrent claimants for ${coordinates}`);
-    }
-    const clearRow = db.prepare('UPDATE nodes SET pi_session_file = NULL WHERE node_id = ?');
-    for (const { pi_session_file } of duplicates) {
-        const owners = db.prepare(`
+`).all();if(!n&&T.length>0){const E=T.map(({pi_session_file:d})=>d).join(", ");throw new Error(`cannot restore unique Pi session ownership: authoritative metadata has concurrent claimants for ${E}`)}const r=e.prepare("UPDATE nodes SET pi_session_file = NULL WHERE node_id = ?");for(const{pi_session_file:E}of T){const d=e.prepare(`
 SELECT node_id
 FROM nodes
 WHERE pi_session_file = ?
 ORDER BY created ASC, node_id ASC
-`).all(pi_session_file);
-        for (const { node_id } of owners.slice(1)) {
-            // Clear both durable coordinates so a later reindex cannot restore the
-            // duplicate projection. The checked write fails rather than erasing a
-            // concurrent metadata change.
-            const cleared = updateJsonFileDurably(nodeMetaPath(node_id), (meta) => {
-                const currentSessionFile = meta['pi_session_file'];
-                if (typeof currentSessionFile !== 'string' || canonical(currentSessionFile) !== pi_session_file) {
-                    throw new Error(`node ${node_id} session metadata changed during ownership migration`);
-                }
-                meta['pi_session_id'] = null;
-                meta['pi_session_file'] = null;
-                return true;
-            });
-            if (!cleared)
-                throw new Error(`node ${node_id} session metadata changed during ownership migration`);
-            clearRow.run(node_id);
-        }
-    }
-    db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_nodes_pi_session_file ON nodes(pi_session_file);');
-}
-/** v36 — one Pi transcript may have exactly one node owner. This is the narrow
- * corrective body for clients below v36; it reprojects metadata before choosing
- * the earliest created duplicate claimant (node_id breaks equal timestamps). */
-function makeNodeSessionFileUnique(db) {
-    reconcileNodeSessionFileOwners(db, true);
-}
-/** v37 — repair v0.3.250's already-applied v36 projection without inventing
- * coordinates v36 already cleared. Surviving authoritative metadata wins over
- * stale rows; concurrent surviving claims fail loudly rather than clearing one. */
-function repairNodeSessionFileUniqueIndex(db) {
-    reconcileNodeSessionFileOwners(db, false);
-}
-/** v35 — durable node lifecycle execution state and terminal cause. */
-function addNodeLifecycleColumns(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'frozen_at', 'ALTER TABLE nodes ADD COLUMN frozen_at TEXT;');
-    addNodeColumnIfMissing(db, columns, 'respawn_failures', 'ALTER TABLE nodes ADD COLUMN respawn_failures INTEGER NOT NULL DEFAULT 0;');
-    addNodeColumnIfMissing(db, columns, 'respawn_not_before', 'ALTER TABLE nodes ADD COLUMN respawn_not_before TEXT;');
-    addNodeColumnIfMissing(db, columns, 'launched_at', 'ALTER TABLE nodes ADD COLUMN launched_at TEXT;');
-    addNodeColumnIfMissing(db, columns, 'last_settled_at', 'ALTER TABLE nodes ADD COLUMN last_settled_at TEXT;');
-    addNodeColumnIfMissing(db, columns, 'terminal_reason', 'ALTER TABLE nodes ADD COLUMN terminal_reason TEXT;');
-    db.exec(`
+`).all(E);for(const{node_id:_}of d.slice(1)){if(!b(I(_),N=>{const u=N.pi_session_file;if(typeof u!="string"||t(u)!==E)throw new Error(`node ${_} session metadata changed during ownership migration`);return N.pi_session_id=null,N.pi_session_file=null,!0}))throw new Error(`node ${_} session metadata changed during ownership migration`);r.run(_)}}e.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_nodes_pi_session_file ON nodes(pi_session_file);")}i(j,"reconcileNodeSessionFileOwners");function je(e){j(e,!0)}i(je,"makeNodeSessionFileUnique");function ze(e){j(e,!1)}i(ze,"repairNodeSessionFileUniqueIndex");function Je(e){const n=l(e);a(e,n,"frozen_at","ALTER TABLE nodes ADD COLUMN frozen_at TEXT;"),a(e,n,"respawn_failures","ALTER TABLE nodes ADD COLUMN respawn_failures INTEGER NOT NULL DEFAULT 0;"),a(e,n,"respawn_not_before","ALTER TABLE nodes ADD COLUMN respawn_not_before TEXT;"),a(e,n,"launched_at","ALTER TABLE nodes ADD COLUMN launched_at TEXT;"),a(e,n,"last_settled_at","ALTER TABLE nodes ADD COLUMN last_settled_at TEXT;"),a(e,n,"terminal_reason","ALTER TABLE nodes ADD COLUMN terminal_reason TEXT;"),e.exec(`
 UPDATE nodes SET terminal_reason = CASE
   WHEN status = 'done' AND final_report IS NOT NULL THEN 'finalized'
   WHEN status = 'done' AND intent = 'parked'        THEN 'parked'
@@ -1326,51 +398,7 @@ UPDATE nodes SET terminal_reason = CASE
   WHEN status = 'dead'                              THEN 'crashed'
 END
 WHERE status IN ('done','canceled','dead') AND terminal_reason IS NULL;
-`);
-}
-/** v38 — mirror the two display-identity fields (`description`, `cycles`) that
- *  lived ONLY in meta.json onto the row, completing the identity projection the
- *  row index already is. Before this, every roster read that wanted a node's full
- *  label had to open and parse each node's meta.json (a per-node disk read on a
- *  path that already had all the other columns in one query). The backfill reads
- *  each meta once; from here `upsertRow`/`seedRow` maintain them like any other
- *  identity column, and `rebuildIndex` re-derives them. */
-function addNodeLabelColumns(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'description', 'ALTER TABLE nodes ADD COLUMN description TEXT;');
-    addNodeColumnIfMissing(db, columns, 'cycles', 'ALTER TABLE nodes ADD COLUMN cycles INTEGER;');
-    const root = nodesRoot();
-    if (!existsSync(root))
-        return;
-    const upd = db.prepare('UPDATE nodes SET description = ?, cycles = ? WHERE node_id = ?');
-    for (const id of readdirSync(root)) {
-        const p = nodeMetaPath(id);
-        if (!existsSync(p))
-            continue;
-        let meta;
-        try {
-            meta = JSON.parse(readFileSync(p, 'utf8'));
-        }
-        catch {
-            continue; // a single unreadable meta never aborts the migration
-        }
-        const description = typeof meta['description'] === 'string' ? meta['description'] : null;
-        const cycles = typeof meta['cycles'] === 'number' ? meta['cycles'] : null;
-        upd.run(description, cycles, id);
-    }
-}
-/** v39 — durable terminal outcomes, spawn deadlines, and externally-owned
- * outcome-delivery attempts. The outcome columns live on `nodes` so the same
- * conditional terminal-status UPDATE can latch them atomically. */
-function addNodeOutcomeAndDeadline(db) {
-    const columns = nodeColumns(db);
-    addNodeColumnIfMissing(db, columns, 'outcome_kind', 'ALTER TABLE nodes ADD COLUMN outcome_kind TEXT;');
-    addNodeColumnIfMissing(db, columns, 'outcome_reason', 'ALTER TABLE nodes ADD COLUMN outcome_reason TEXT;');
-    addNodeColumnIfMissing(db, columns, 'outcome_at', 'ALTER TABLE nodes ADD COLUMN outcome_at TEXT;');
-    addNodeColumnIfMissing(db, columns, 'outcome_revision', 'ALTER TABLE nodes ADD COLUMN outcome_revision INTEGER NOT NULL DEFAULT 0;');
-    addNodeColumnIfMissing(db, columns, 'outcome_detail_json', 'ALTER TABLE nodes ADD COLUMN outcome_detail_json TEXT;');
-    addNodeColumnIfMissing(db, columns, 'deadline_at', 'ALTER TABLE nodes ADD COLUMN deadline_at TEXT;');
-    db.exec(`
+`)}i(Je,"addNodeLifecycleColumns");function Qe(e){const n=l(e);a(e,n,"description","ALTER TABLE nodes ADD COLUMN description TEXT;"),a(e,n,"cycles","ALTER TABLE nodes ADD COLUMN cycles INTEGER;");const t=S();if(!A(t))return;const o=e.prepare("UPDATE nodes SET description = ?, cycles = ? WHERE node_id = ?");for(const s of X(t)){const T=I(s);if(!A(T))continue;let r;try{r=JSON.parse(h(T,"utf8"))}catch{continue}const E=typeof r.description=="string"?r.description:null,d=typeof r.cycles=="number"?r.cycles:null;o.run(E,d,s)}}i(Qe,"addNodeLabelColumns");function Ve(e){const n=l(e);a(e,n,"outcome_kind","ALTER TABLE nodes ADD COLUMN outcome_kind TEXT;"),a(e,n,"outcome_reason","ALTER TABLE nodes ADD COLUMN outcome_reason TEXT;"),a(e,n,"outcome_at","ALTER TABLE nodes ADD COLUMN outcome_at TEXT;"),a(e,n,"outcome_revision","ALTER TABLE nodes ADD COLUMN outcome_revision INTEGER NOT NULL DEFAULT 0;"),a(e,n,"outcome_detail_json","ALTER TABLE nodes ADD COLUMN outcome_detail_json TEXT;"),a(e,n,"deadline_at","ALTER TABLE nodes ADD COLUMN deadline_at TEXT;"),e.exec(`
 CREATE TABLE IF NOT EXISTS node_outcome_deliveries (
   node_id              TEXT PRIMARY KEY,
   state                TEXT NOT NULL,
@@ -1403,141 +431,4 @@ UPDATE nodes SET outcome_kind='failure',
        outcome_reason=COALESCE(terminal_reason,'crashed'),
        outcome_at=COALESCE(finalized_at, created), outcome_revision=1
  WHERE final_report IS NULL AND status IN ('done','dead','canceled') AND outcome_at IS NULL;
-`);
-}
-/** The journaled lane of the state-migration registry, adapted to this chain's
- *  step shape. Registry order is preserved, so these versions stay stable as
- *  long as the registry is append-only (same contract as the local list). */
-const JOURNALED_STATE_MIGRATIONS = STATE_MIGRATIONS
-    .filter((m) => m.lane === 'journaled')
-    .map((m) => (db) => m.apply(db, crtrHome()));
-/** The ordered migration list. Index `i` is migration version `i + 1`; the db's
- *  `user_version` tracks how many have been applied. Append only. Journaled
- *  entries from `src/migrations/registry.ts` follow the local steps, so a new
- *  registry migration lands as the next version. */
-export const MIGRATIONS = [
-    /* v1 */ baselineSchema,
-    /* v2 */ addRuntimeColumns,
-    /* v3 */ backfillRuntime,
-    /* v4 */ edgesForeignKeyCascade,
-    /* v5 */ addPaneColumn,
-    /* v6 */ addFocusesTable,
-    /* v7 */ appendWakeupsTable,
-    /* v8 */ addHostKindColumn,
-    /* v9 */ migrateWakeupsToTriggers,
-    /* v10 */ addCanvasMetaTable,
-    /* v11 */ addProfileIdColumn,
-    /* v12 */ addPidIdentityColumn,
-    /* v13 */ addMessageWaitColumn,
-    /* v14 */ addCanonicalFinalColumns,
-    /* v15 */ normalizePersistedLaunchExtensions,
-    // Repair databases that reached v15 through the concurrent launch-metadata
-    // migration before canonical finalization joined the ordered mainline.
-    /* v16 */ addCanonicalFinalColumns,
-    /* v17 */ addMessageWaitGenerationColumn,
-    /* v18 */ addHumanWorkOutboxTable,
-    /* v19 */ addHumanWorkColumns,
-    /* v20 */ addNodeParentCreatedIndexes,
-    /* v21 */ addCronsTables,
-    /* v22 */ migrateTriggersToCrons,
-    /* v23 */ addCronRunPidIdentityColumn,
-    /* v24 */ addCronOutOfBandColumn,
-    /* v25 */ addWarmPoolTable,
-    /* v26 */ narrowHumanWorkOutbox,
-    /* v27 */ addReviewsTable,
-    /* v28 */ addReviewCommentTables,
-    /* v29 */ addReviewCommentAnchorState,
-    /* v30 */ dropConsultOutbox,
-    /* v31 */ addReviewSubmitRequested,
-    /* v32 */ addCronHeldColumns,
-    /* v33 */ addHumanActionDeliveries,
-    /* v34 */ addNodeSessionFileIndex,
-    /* v35 */ addNodeLifecycleColumns,
-    /* v36 */ makeNodeSessionFileUnique,
-    /* v37 */ repairNodeSessionFileUniqueIndex,
-    /* v38 */ addNodeLabelColumns,
-    /* v39 */ addNodeOutcomeAndDeadline,
-    ...JOURNALED_STATE_MIGRATIONS,
-    (db) => {
-        importNodeSqlAuthority(db);
-        migrateRecoveryWitnesses(db);
-        migrateMessagingState(db);
-        migrateHumanRequestsState(db);
-    },
-];
-/** Migration indexes that manage their OWN transaction and therefore must not
- *  be wrapped by `migrate()` — `node:sqlite` rejects a nested BEGIN. Index 3
- *  (v4, the edges FK rebuild) both BEGINs internally and toggles
- *  `PRAGMA foreign_keys`, which is a no-op inside a transaction. Its docblock
- *  documents its own crash-safety: a partial rebuild rolls back and a re-run
- *  over an already-rebuilt table is idempotent. (Entering `migrate()` from
- *  INSIDE a caller's transaction with `user_version` still at 3 would make that
- *  internal BEGIN nest and throw; daemon startup calls it in autocommit.) */
-const SELF_TRANSACTIONAL_MIGRATIONS = new Set([3]);
-function currentUserVersion(db) {
-    return db.prepare('PRAGMA user_version').get().user_version;
-}
-function applyMigration(db, v) {
-    MIGRATIONS[v](db);
-    // `user_version` takes no bound parameters; v is a controlled integer.
-    db.exec(`PRAGMA user_version = ${v + 1}`);
-}
-/** Bring `db` up to the latest schema version. Reads `user_version`, runs each
- *  pending migration in order, and bumps `user_version` after each so the work
- *  is gated and idempotent: re-running is a no-op once `user_version` reaches
- *  `MIGRATIONS.length`. Forward-only.
- *
- *  ATOMIC AND RESTARTABLE: each step AND its `user_version` bump run inside one
- *  `BEGIN IMMEDIATE`/`COMMIT` (SQLite journals `user_version` with the
- *  transaction, so a rollback restores it too). An interrupted or failing step
- *  therefore leaves the db exactly at the previous version with none of its
- *  writes committed — a half-applied step can never wedge every later open. The
- *  write lock also serializes concurrent openers; the version is re-read after
- *  acquiring it so a step another process just applied is skipped rather than
- *  re-run. */
-export function migrate(db) {
-    const version = currentUserVersion(db);
-    if (version > MIGRATIONS.length) {
-        throw new Error(`unsupported canvas schema version ${version} (latest supported ${MIGRATIONS.length})`);
-    }
-    if (version === MIGRATIONS.length)
-        return;
-    // Pending work: a step now holds the write lock for its whole duration, and
-    // the fs-heavy legacy steps (v3/v14/v15) can outlast the ordinary 5s busy
-    // timeout. Let concurrent openers WAIT for the migration rather than fail.
-    const priorTimeout = db.prepare('PRAGMA busy_timeout').get().timeout;
-    db.exec('PRAGMA busy_timeout = 60000;');
-    try {
-        runPendingMigrations(db);
-    }
-    finally {
-        db.exec(`PRAGMA busy_timeout = ${priorTimeout};`);
-    }
-}
-function runPendingMigrations(db) {
-    for (;;) {
-        const v = currentUserVersion(db);
-        if (v >= MIGRATIONS.length)
-            return;
-        // Already inside a caller's transaction (or a self-transactional step):
-        // run bare rather than nesting a BEGIN node:sqlite would reject.
-        if (db.isTransaction || SELF_TRANSACTIONAL_MIGRATIONS.has(v)) {
-            applyMigration(db, v);
-            continue;
-        }
-        db.exec('BEGIN IMMEDIATE');
-        try {
-            // Another process may have applied this step while we waited on the lock.
-            if (currentUserVersion(db) === v)
-                applyMigration(db, v);
-            db.exec('COMMIT');
-        }
-        catch (err) {
-            try {
-                db.exec('ROLLBACK');
-            }
-            catch { /* transaction was already closed */ }
-            throw err;
-        }
-    }
-}
+`)}i(Ve,"addNodeOutcomeAndDeadline");const Ze=re.filter(e=>e.lane==="journaled").map(e=>n=>e.apply(n,oe())),g=[ae,de,_e,ce,Ne,ue,le,pe,Le,Oe,Ae,fe,Re,$,me,$,Ie,Xe,Se,Ue,ge,Fe,ke,Me,Ge,Be,He,Pe,be,Ye,$e,We,Ke,qe,Je,je,ze,Qe,Ve,...Ze,e=>{Q(e),V(e),Z(e),ee(e)}],en=new Set([3]);function k(e){return e.prepare("PRAGMA user_version").get().user_version}i(k,"currentUserVersion");function z(e,n){g[n](e),e.exec(`PRAGMA user_version = ${n+1}`)}i(z,"applyMigration");function ln(e){const n=k(e);if(n>g.length)throw new Error(`unsupported canvas schema version ${n} (latest supported ${g.length})`);if(n===g.length)return;const t=e.prepare("PRAGMA busy_timeout").get().timeout;e.exec("PRAGMA busy_timeout = 60000;");try{nn(e)}finally{e.exec(`PRAGMA busy_timeout = ${t};`)}}i(ln,"migrate");function nn(e){for(;;){const n=k(e);if(n>=g.length)return;if(e.isTransaction||en.has(n)){z(e,n);continue}e.exec("BEGIN IMMEDIATE");try{k(e)===n&&z(e,n),e.exec("COMMIT")}catch(t){try{e.exec("ROLLBACK")}catch{}throw t}}}i(nn,"runPendingMigrations");export{g as MIGRATIONS,ln as migrate};