create-walle 0.10.0 → 0.10.1

package/template/coding-task-manager/bin/census-codex-lead-history.js

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+'use strict';
+
+// WP-1 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §1, §7 first row, §8 WP-1):
+// the §1 census, promoted from a scratch script to the tool the report quotes.
+//
+// WHY IT EXISTS. The naive census calls the scanner's inner function and counts record TYPES, which
+// reported "no new record types" for 0.163.0 while CTM refused 265 of 505 real sessions because of
+// the KEYS inside a known type (`thread_settings_applied`). This tool calls the PRODUCTION entry
+// point instead: readCodexHistoryTransitionSnapshot = owned-rollout resolution + the native prefix
+// reader + the scanner; when the scan completes it also runs the planner (inspectTransition), so the
+// first refusal of the REAL chain is what gets reported. See §1 "The naive count is wrong".
+//
+// OQ-1 (the census harness, not production, showed 65 `canonical_history_path_unavailable`): this
+// tool derives each session's storage root from the session's OWN jsonl_path -- the directory whose
+// last `sessions` segment holds the rollout -- instead of assuming one ~/.codex home for every row.
+// The corresponding root receipt is built the same way CTM's launch path builds it
+// (lib/codex-paths.js codexSessionsRootReceipt), so what is measured here is what production reads.
+//
+// READ-ONLY. The database is opened `readonly` + `fileMustExist` and is never written; no file is
+// created anywhere; no port is contacted.
+//
+// usage:
+//   node bin/census-codex-lead-history.js [--since YYYY-MM-DD] [--limit N] [--only <ctm-session-prefix>]
+//                                         [--db <path to core.db>] [--explain <ctm-session-prefix>]
+//
+//   --since   oldest modified_at to include (default 2026-10-01, the §1 population)
+//   --limit   newest sessions to scan (default 1000: above the 505 of §1, so a full table by default)
+//   --only    only sessions whose ctm_session_id starts with this prefix
+//   --explain also print the snapshot's summary fields for the matching session(s), and for a
+//             `thread_settings_applied` refusal the lineage set vs the failing record's thread_id (OQ-3)
+//
+// exit 0 the table printed · 1 usage error · 2 the database could not be opened read-only.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const Database = require('better-sqlite3');
+
+const op = require('../lib/history-transition-read-op');
+const { readNativeHistoryPrefix } = require('../lib/codex-native-history-prefix');
+const { inspectTransition } = require('../lib/harness-history-transition');
+const codexPaths = require('../lib/codex-paths');
+const { CODEX_CONTROL_ADAPTER, CODEX_COMPACTION_SCHEMA_RECEIPT } = require('../lib/codex-harness-qualification');
+
+const DEFAULT_DB = path.join(os.homedir(), '.walle', 'data', 'core.db');
+const DEFAULT_SINCE = '2026-10-01';
+const DEFAULT_LIMIT = 1000;
+const EXAMPLES_PER_REASON = 4;
+const EXPLAIN_GENERATION = 'census-codex-lead-history';
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+// The §1 target recipe: a routed DeepSeek V4.1 Flash target (any provider id other than the
+// source's; the planner only compares them) with the
+// qualified harness version and the qualified compaction receipt. Per-session fields (approval
+// policy, sandbox policy, cyber access program) are copied from the scanned snapshot.
+const TARGET_RECIPE_BASE = Object.freeze({
+  providerId: 'census-routed-target',
+  routeId: 'census-routed-target',
+  origin: 'routed-proxy',
+  harness: 'codex-cli',
+  controlAdapterVersion: CODEX_CONTROL_ADAPTER,
+  harnessVersion: '0.163.0',
+  wireModelId: 'deepseek-v4p1-flash',
+  contextTokens: 1049000,
+  usableContextTokens: 996550,
+  nativeCompactThresholdTokens: 944100,
+  plannedRequestOutputTokens: 65536,
+  compactHash: null,
+  compactHashStatus: 'known-absent-with-native-schema-receipt',
+  compactHashSchemaReceipt: CODEX_COMPACTION_SCHEMA_RECEIPT,
+  catalogSha256: '0'.repeat(64),
+});
+
+// One row per CTM session, newest agent_sessions row first (§1: "the newest row per session").
+const SESSION_QUERY = `SELECT ctm_session_id, agent_session_id, jsonl_path, max(modified_at) AS modified_at
+  FROM agent_sessions
+  WHERE lower(provider) = 'codex' AND ctm_session_id IS NOT NULL AND ctm_session_id <> ''
+    AND jsonl_path IS NOT NULL AND modified_at > ?
+  GROUP BY ctm_session_id
+  ORDER BY modified_at DESC
+  LIMIT ?`;
+
+class UsageError extends Error {}
+
+function usage() {
+  return [
+    'usage: node bin/census-codex-lead-history.js [--since YYYY-MM-DD] [--limit N] [--only <ctm-session-prefix>] [--db <path>] [--explain <ctm-session-prefix>]',
+    '  --since <date>   oldest modified_at to include (default 2026-10-01)',
+    '  --limit <n>      newest sessions to scan (default 1000)',
+    '  --only <prefix>  only sessions whose ctm_session_id starts with this prefix',
+    '  --db <path>      core.db to read (default ~/.walle/data/core.db, opened read-only)',
+    '  --explain <prefix> print the snapshot summary (and, for a thread_settings_applied refusal,',
+    '                   the lineage set vs the failing record thread_id) for matching session(s)',
+  ].join('\n');
+}
+
+function parseArgs(argv) {
+  const parsed = { help: false, since: DEFAULT_SINCE, limit: DEFAULT_LIMIT, only: null, db: DEFAULT_DB, explain: null };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') { parsed.help = true; continue; }
+    if (['--since', '--limit', '--only', '--db', '--explain'].includes(arg)) {
+      const value = argv[index + 1];
+      if (value === undefined || value.startsWith('--')) throw new UsageError(`${arg} needs a value`);
+      index += 1;
+      if (arg === '--since') parsed.since = value;
+      else if (arg === '--limit') parsed.limit = value;
+      else if (arg === '--only') parsed.only = value;
+      else if (arg === '--explain') parsed.explain = value;
+      else parsed.db = value;
+      continue;
+    }
+    throw new UsageError(`unknown option ${arg}`);
+  }
+  if (!DATE_RE.test(parsed.since)) throw new UsageError(`--since must be YYYY-MM-DD, got ${parsed.since}`);
+  const limit = Number(parsed.limit);
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new UsageError(`--limit must be a positive integer, got ${parsed.limit}`);
+  parsed.limit = limit;
+  return parsed;
+}
+
+function openReadOnly(dbPath) {
+  if (!fs.existsSync(dbPath)) throw new Error(`${dbPath} does not exist`);
+  const stat = fs.statSync(dbPath);
+  if (!stat.isFile()) throw new Error(`${dbPath} is not a file`);
+  return new Database(dbPath, { readonly: true, fileMustExist: true });
+}
+
+// OQ-1: the storage root of THIS session, taken from its own rollout path. Codex writes
+// <codexHome>/sessions/<date>/rollout-<ts>-<uuid>.jsonl, so the codex home is the parent of the
+// `sessions` segment; the receipt is the same object the launch path captures. A jsonl_path with no
+// `sessions` segment is not a Codex rollout path this tool can speak about -- reported, not guessed.
+function storageRootForSession(jsonlPath) {
+  const segments = path.resolve(jsonlPath).split(path.sep);
+  const index = segments.lastIndexOf('sessions');
+  if (index <= 0) return { codexHome: null, sessionsDir: null, receipt: null };
+  const codexHome = segments.slice(0, index).join(path.sep) || path.sep;
+  const sessionsDir = segments.slice(0, index + 1).join(path.sep);
+  return { codexHome, sessionsDir, receipt: codexPaths.codexSessionsRootReceipt({ codexHomePath: codexHome, sessionsDir }) };
+}
+
+// The §1 methodology, one session at a time: the production read path, then the planner. Keeping
+// only the key (never the snapshot) is what lets this run over every session in the window.
+function scanSession(row) {
+  const storage = storageRootForSession(row.jsonl_path);
+  if (!storage.receipt) {
+    return { key: `scan:${storage.codexHome ? 'history_storage_root_unavailable' : 'census_jsonl_path_unexpected'}`, storage };
+  }
+  let snapshot;
+  try {
+    snapshot = op.readCodexHistoryTransitionSnapshot({
+      db: row.db,
+      ctmSessionId: row.ctm_session_id,
+      sourceThreadId: row.agent_session_id,
+      processGeneration: 0,
+      storageRootReceipt: storage.receipt,
+      maxBytes: op.MAX_SCAN_BYTES,
+    });
+  } catch (error) {
+    // expected: a rollout deleted or replaced mid-scan is reported as a throw, never as a pass
+    return { key: `scan:THROW:${String(error?.message || error).slice(0, 60)}`, storage, snapshot: null };
+  }
+  if (!snapshot.complete) return { key: `scan:${snapshot.reason}`, storage, snapshot };
+  const previousSettings = snapshot.previousSettings || {};
+  const decision = inspectTransition({
+    sourceRecipe: {
+      providerId: previousSettings.modelProvider || 'openai',
+      origin: 'native-codex',
+      harness: 'codex-cli',
+      controlAdapterVersion: CODEX_CONTROL_ADAPTER,
+      programVersion: previousSettings.programVersion,
+      cyberAccessProgram: previousSettings.cyberAccessProgram,
+      approvalPolicy: previousSettings.approvalPolicy,
+      sandboxPolicy: previousSettings.sandboxPolicy,
+      wireModelId: previousSettings.model,
+      providerThreadId: row.agent_session_id,
+    },
+    targetRecipe: {
+      ...TARGET_RECIPE_BASE,
+      approvalPolicy: previousSettings.approvalPolicy,
+      sandboxPolicy: previousSettings.sandboxPolicy,
+      cyberAccessProgram: previousSettings.cyberAccessProgram,
+    },
+    snapshot,
+  });
+  return { key: decision.action === 'unsupported' ? `plan:${decision.reason}` : `OK:${decision.action}`, storage, snapshot };
+}
+
+function prefixed(value) {
+  return String(value || '').slice(0, 8);
+}
+
+function printTable(rows, tallies, examples, { since, limit }) {
+  const lines = [];
+  lines.push(`sessions ${rows.length} (since ${since}, limit ${limit})`);  const ordered = [...tallies.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+  const width = ordered.reduce((max, [reason]) => Math.max(max, reason.length), 6);
+  for (const [reason, count] of ordered) {
+    lines.push(`${String(count).padStart(4)}  ${reason.padEnd(width)}  ${examples.get(reason).join(', ')}`);
+  }
+  if (!ordered.length) lines.push('    (no sessions matched)');
+  lines.push(`total  ${[...tallies.values()].reduce((sum, count) => sum + count, 0)}`);
+  process.stdout.write(`${lines.join('\n')}\n`);
+}
+
+// OQ-3: the refusal the scanner returns for a `thread_settings_applied` record is the generic
+// `unsupported_native_history_event`, so the failing RECORD has to be located. The scanner stops at
+// its first refusal, and summarizing a slice that ends after the last `compacted` record uses the
+// same start index as the full list -- so "does this slice refuse" is monotone there, and a binary
+// search finds the refusing index in O(log n) scans instead of one scan per record.
+function firstRefusalIndex(records, { threadId, lineageIds }) {
+  const lastCompaction = records.findLastIndex((record) => record?.type === 'compacted');
+  const startIndex = lastCompaction >= 0 ? lastCompaction : 0;
+  let low = startIndex + 1;
+  let high = records.length;
+  let found = -1;
+  while (low <= high) {
+    const mid = (low + high) >> 1;
+    const summary = op.summarizeCodexHistoryRecords(records.slice(0, mid), {
+      threadId, generation: EXPLAIN_GENERATION, lineageThreadIds: lineageIds,
+    });
+    if (summary.complete) low = mid + 1;
+    else { found = mid - 1; high = mid - 1; }
+  }
+  return found;
+}
+
+function describeRefusal(root, threadId) {
+  const lines = [];
+  const prefix = readNativeHistoryPrefix(root.jsonl_path, { expectedThreadId: threadId, storageRoots: [root.storage.receipt.canonicalPath] });
+  if (!prefix.ok) {
+    lines.push(`  raw prefix read refused: ${prefix.reason}`);
+    return lines;
+  }
+  lines.push(`  lineage ids (${prefix.lineageIds.length}): ${prefix.lineageIds.join(', ')}`);
+  const index = firstRefusalIndex(prefix.records, { threadId, lineageIds: prefix.lineageIds });
+  if (index < 0) {
+    lines.push('  no refusing record found by re-summarizing prefixes (the refusal may be outside the scanned window)');
+  } else {
+    const record = prefix.records[index];
+    const payload = record?.payload && typeof record.payload === 'object' ? record.payload : {};
+    lines.push(`  first refusing record: index ${index}, type=${record?.type}, payload.type=${payload.type}`);
+    if ('thread_id' in payload) {
+      const owned = new Set(prefix.lineageIds.map((id) => String(id).toLowerCase()));
+      lines.push(`    payload.thread_id=${payload.thread_id} in lineage=${owned.has(String(payload.thread_id).toLowerCase())}`);
+    }
+  }
+  // OQ-3 verbatim: every thread_settings_applied record's thread_id against the computed lineage,
+  // with its key set, so "the keys are in the D-1 set, so the thread_id must be outside it" is
+  // answerable from this output alone.
+  const settingsRecords = prefix.records
+    .map((record, at) => ({ record, at }))
+    .filter(({ record }) => record?.type === 'event_msg' && record.payload?.type === 'thread_settings_applied');
+  const owned = new Set(prefix.lineageIds.map((id) => String(id).toLowerCase()));
+  lines.push(`  thread_settings_applied records: ${settingsRecords.length}`);
+  for (const { record, at } of settingsRecords.slice(0, 8)) {
+    const payload = record.payload;
+    const keys = payload.thread_settings && typeof payload.thread_settings === 'object' ? Object.keys(payload.thread_settings) : [];
+    lines.push(`    index ${at}: thread_id=${payload.thread_id ?? '(absent)'} in lineage=${payload.thread_id === undefined || payload.thread_id === null ? 'n/a' : owned.has(String(payload.thread_id).toLowerCase())} settings_keys=${keys.length}`);
+  }
+  return lines;
+}
+
+function explainSessions(rows, db) {
+  for (const row of rows) {
+    process.stdout.write(`\nexplain ${row.ctm_session_id}\n`);
+    process.stdout.write(`  agent_session_id: ${row.agent_session_id}\n`);
+    process.stdout.write(`  jsonl_path: ${row.jsonl_path}\n`);
+    const storage = storageRootForSession(row.jsonl_path);
+    process.stdout.write(`  codex_home: ${storage.codexHome || '(no sessions segment)'}\n`);
+    process.stdout.write(`  storage_root: ${storage.receipt ? storage.receipt.canonicalPath : '(no receipt)'}`
+      + `${storage.receipt ? ` fingerprint=${storage.receipt.fingerprint.slice(0, 12)}` : ''}\n`);
+    const result = scanSession({ ...row, db });
+    process.stdout.write(`  verdict: ${result.key}\n`);
+    process.stdout.write(`  snapshot: ${result.snapshot ? JSON.stringify(result.snapshot, null, 2).split('\n').join('\n  ') : '(not captured: the scan never ran or threw)'}\n`);
+    if (result.key === 'scan:unsupported_native_history_event' && storage.receipt) {
+      for (const line of describeRefusal({ jsonl_path: row.jsonl_path, storage }, row.agent_session_id)) {
+        process.stdout.write(`${line}\n`);
+      }
+    }
+  }
+}
+
+function run(argv) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(`${usage()}\n`);
+    return 0;
+  }
+  const db = openReadOnly(args.db);
+  try {
+    const rows = db.prepare(SESSION_QUERY).all(args.since, args.limit)
+      .filter((row) => !args.only || String(row.ctm_session_id).startsWith(args.only));
+    const tallies = new Map();
+    const examples = new Map();
+    for (const row of rows) {
+      const result = scanSession({ ...row, db });
+      tallies.set(result.key, (tallies.get(result.key) || 0) + 1);
+      const list = examples.get(result.key) || [];
+      if (list.length < EXAMPLES_PER_REASON) list.push(prefixed(row.ctm_session_id));
+      examples.set(result.key, list);
+    }
+    printTable(rows, tallies, examples, args);
+    if (args.explain) {
+      const matching = rows.filter((row) => String(row.ctm_session_id).startsWith(args.explain));
+      if (!matching.length) process.stdout.write(`\nexplain ${args.explain}: no matching session\n`);
+      else explainSessions(matching, db);
+    }
+  } finally {
+    db.close();
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  try {
+    process.exitCode = run(process.argv.slice(2));
+  } catch (error) {
+    if (error instanceof UsageError) process.stderr.write(`census-codex-lead-history: ${error.message}\n${usage()}\n`);
+    else process.stderr.write(`census-codex-lead-history: ${error?.stack || error}\n`);
+    process.exitCode = error instanceof UsageError ? 1 : 2;
+  }
+}
+
+module.exports = { run, parseArgs, storageRootForSession, scanSession, firstRefusalIndex };

package/template/coding-task-manager/bin/seam-replay-codex.js

@@ -0,0 +1,301 @@
+#!/usr/bin/env node
+'use strict';
+
+// bin/seam-replay-codex.js -- the Codex lane of the reader seam replay harness (design
+// seam-proof-r3-codex-render-parity-2026-10-20, WP-0 / §6).
+//
+// Offline and read-only. For every Codex CTM session that still has a painted-row store, replay the
+// RECORDED live screen (a store `seal` record's `ref.rows`) against CTM's own render of the session's
+// rollouts AS THEY STOOD AT THE SEAL TIME, through the shipped join, and print COUNTS as JSON:
+//
+//   sessions   Codex sessions (core.db: ctm_sessions.provider = 'codex') with at least one rollout on
+//              disk AND a store directory, that contributed at least one taken seal.
+//   screens    seals that reached the join: the rollout rendered rows at the seal's cut, and the screen
+//              held MIN_LIVE_ROWS non-blank rows.
+//   unreplayable  seals whose render threw, produced no rows, or whose screen was too small to be one.
+//   byKind     what findJoin decided: proven / overlap / none.
+//   why        for a `none`, landingDiag's own refusal (`noknown` / `cover` / `loss` / `cut` / ...).
+//   dup3       `none` screens whose live rows repeat >= DUP3_MIN transcript-window rows (the visibly
+//              duplicated population the design measures).
+//   headerRows screens whose first live row is Codex's own `› ` prompt header (WP-3 changes what
+//              the join does with it; this counts how often it is there).
+//   hiddenTextRowsNotOnScreen  proofs whose rows [cut, end) hold an evidence row with a cut word the
+//              live screen does not show. Must be 0: it is the join's own safety claim.
+//
+// The render is the SHIPPED lib/raw-codex-history-window.js `getRawCodexHistoryWindow`, fed every
+// rollout of the session with a `fileOps` whose `fstatSync` caps `size` at the seal's cut, so the
+// window is what the rollout held at that moment. Nothing is ever written: no file is opened for
+// writing, no copy of a rollout is made, and the core.db handle is opened read-only and closed before
+// the replay starts.
+//
+// PRIVACY (hard, the same rule as bin/seam-replay.js): never prints row text, transcript lines, file
+// paths, file contents or a full session id. The report is JSON numbers, enums and the fixed key names
+// below -- nothing else.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const Database = require('better-sqlite3');
+const Raw = require('../lib/raw-codex-history-window.js');
+const RowJoin = require('../public/js/row-join.js');
+// The store's PURE reader only (`parseBuffer` verifies every line's CRC and stops at the first bad
+// one). `createPaintedRowStore` is never called from here, so nothing is written, pruned or swept.
+const { parseBuffer } = require('../lib/painted-row-store.js');
+
+const DEFAULT_PER = 40; // newest N seals per session (the same default as the Claude lane)
+const MAX_ROWS = 400; // rows the renderer may return (design §6: 400 / 1 MiB)
+const MAX_BYTES = 1 << 20;
+const SCAN_CHUNK_BYTES = 1 << 24; // 16 MiB: rollouts can be large, so the timestamp scan is chunked
+const STAMP_SCAN_BYTES = 120; // the `"timestamp"` field must be inside a line's first 120 bytes
+const MIN_LIVE_ROWS = 3; // a screen with fewer non-blank live rows is not a screen
+const DUP3_MIN = 3; // `landingDiag().dup >= 3` is the visibly-duplicated population
+const SID_PREFIX = 8; // never used for printing a full id; kept for callers that need one
+// 46 bytes, well over the 32 the cursor signer demands. Local to this script: a cursor is never
+// round-tripped here (each seal starts a fresh `older` read), so the value only has to be constant.
+const CURSOR_SECRET = 'seam-replay-codex-offline-replay-cursor-secret';
+const STRETCH_FILE_RE = /^stretch-\d+\.jsonl$/; // one stretch of a painted-row store session
+const CODEX_PROMPT_HEADER = /^› /u; // Codex's own presentation-only prompt header row
+// The Codex sessions and their rollouts. Read-only; `jsonl_path <> ''` skips a session with no file.
+const CODEX_SESSIONS_SQL = "select a.ctm_session_id sid, a.jsonl_path p from agent_sessions a "
+  + "join ctm_sessions c on c.id = a.ctm_session_id "
+  + "where c.provider = 'codex' and a.provider = 'codex' and a.jsonl_path <> '' order by a.jsonl_path";
+
+const defaultStore = () => path.join(os.homedir(), '.walle', 'data', 'painted-rows');
+const defaultCoreDb = () => path.join(os.homedir(), '.walle', 'data', 'core.db');
+
+// --- text handling ---------------------------------------------------------
+
+// The Claude lane's `strip` (bin/seam-replay.js), which is byte for byte RowJoin.stripForCompare:
+// SGR/CSI removed, U+00A0 folded to a space, trailing blanks trimmed. Delegating to the join's own
+// copy keeps one truth (and findJoin strips every row it is handed with it anyway).
+function strip(text) {
+  return RowJoin.stripForCompare(text);
+}
+
+function inc(counts, key) {
+  counts[key] = (counts[key] || 0) + 1;
+}
+
+// --- core.db (read-only) ---------------------------------------------------
+
+// Codex CTM sessions with at least one rollout still on disk: sid -> [rollout path], in path order.
+// The DB handle is opened read-only (`fileMustExist`) and closed before anything else runs; a session
+// whose rollout file has gone is dropped here rather than counted.
+function codexSessions(coreDb) {
+  const db = new Database(coreDb, { readonly: true, fileMustExist: true });
+  let pairs = [];
+  try {
+    pairs = db.prepare(CODEX_SESSIONS_SQL).all();
+  } finally {
+    db.close();
+  }
+  const bySid = new Map();
+  for (const row of pairs) {
+    const file = String(row.p == null ? '' : row.p);
+    if (!file || !fs.existsSync(file)) continue;
+    const sid = String(row.sid == null ? '' : row.sid);
+    const list = bySid.get(sid);
+    if (list) list.push(file);
+    else bySid.set(sid, [file]);
+  }
+  return bySid;
+}
+
+// --- the recorded screens --------------------------------------------------
+
+// Every `seal` record of one session directory, in file order (`stretch-*.jsonl` sorted by name, so
+// the oldest stretch first). Each line's CRC is verified by the store's own reader; a file that is
+// missing, unreadable or torn past its first bad line contributes only what it verified.
+function readSeals(dir) {
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return []; /* expected: the session directory went away between the store scan and the read */
+  }
+  const seals = [];
+  for (const name of names.filter((n) => STRETCH_FILE_RE.test(n)).sort()) {
+    let buffer;
+    try {
+      buffer = fs.readFileSync(path.join(dir, name));
+    } catch {
+      continue; /* expected: a stretch file unreadable between the listing and the read */
+    }
+    for (const object of parseBuffer(buffer).objects) {
+      if (object.op !== 'seal' || !object.ref || !Array.isArray(object.ref.rows)) continue;
+      if (typeof object.at !== 'number') continue;
+      seals.push(object);
+    }
+  }
+  return seals;
+}
+
+// The timestamp marks of one rollout: `[parsedMs, byteOffset]` for every line whose first
+// STAMP_SCAN_BYTES bytes hold a `"timestamp":"..."` field, in file order, plus the file size. Read in
+// SCAN_CHUNK_BYTES chunks with a carry, because a rollout can hold more than one chunk and the scan is
+// per line, not per chunk. Read-only: the file is opened 'r' and closed before returning.
+function timestampMarks(file) {
+  const fd = fs.openSync(file, 'r');
+  try {
+    const size = fs.fstatSync(fd).size;
+    const marks = [];
+    let carry = Buffer.alloc(0);
+    let base = 0;
+    for (let offset = 0; offset < size; offset += SCAN_CHUNK_BYTES) {
+      const chunk = Buffer.alloc(Math.min(SCAN_CHUNK_BYTES, size - offset));
+      fs.readSync(fd, chunk, 0, chunk.length, offset);
+      const buffer = carry.length ? Buffer.concat([carry, chunk]) : chunk;
+      let position = 0;
+      for (;;) {
+        const newline = buffer.indexOf(10, position);
+        if (newline < 0) break;
+        const line = buffer.subarray(position, Math.min(newline, position + STAMP_SCAN_BYTES)).toString('utf8');
+        const match = line.match(/"timestamp":"([^"]+)"/);
+        if (match) marks.push([Date.parse(match[1]), base + position]);
+        position = newline + 1;
+      }
+      carry = buffer.subarray(position);
+      base += position;
+    }
+    return { size, marks };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// The byte offset a seal's view of a rollout ends at: the offset of the FIRST line whose timestamp is
+// after the seal, else the whole file (the rollout never went further than the seal).
+function cutFor(marks, size, at) {
+  for (const [ms, offset] of marks) if (ms > at) return offset;
+  return size;
+}
+
+// Is `sid` a session the store still has a directory for? A store without one is simply not replayed.
+function hasStoreDir(store, sid) {
+  try {
+    return fs.statSync(path.join(store, sid)).isDirectory();
+  } catch {
+    return false; /* expected: no store directory for this session (or it is not a directory) */
+  }
+}
+
+// --- the join --------------------------------------------------------------
+
+// The safety count (design §7): does a proof's hidden tail hold an EVIDENCE row with a cut word the
+// live screen does not show? Rows, not words; nothing is printed.
+function hidesEvidenceRow(rows, kinds, live, cut) {
+  const liveWords = new Set();
+  for (const row of live) for (const word of RowJoin.cutWordsOf(row)) liveWords.add(word);
+  for (let i = Math.max(0, cut); i < rows.length; i += 1) {
+    if (kinds && kinds[i] !== 'text' && kinds[i] !== 'prompt') continue;
+    if (RowJoin.cutWordsOf(strip(rows[i])).some((word) => !liveWords.has(word))) return true;
+  }
+  return false;
+}
+
+// Replay ONE seal: render the session's rollouts as they stood at `seal.at`, join the recorded screen
+// against them, and tally. Mutates `report`; returns nothing. Counts and enums only, ever.
+function replaySeal(report, sid, seal, scans) {
+  const cutOf = new Map();
+  for (const scan of scans) cutOf.set(scan.file, cutFor(scan.marks, scan.size, seal.at));
+  const sources = [];
+  for (const scan of scans) {
+    const cut = cutOf.get(scan.file);
+    if (cut > 0) sources.push({ jsonl_path: scan.file, provider: 'codex', size: cut, offset: cut });
+  }
+  // No rollout held a byte at the seal time: there is no screen to replay and no join to make.
+  if (!sources.length) return;
+  // The cut is a `fstat` size cap, nothing more: the window reads the real files (read-only) and stops
+  // at the sealed size. `fd` -> path is remembered so a copied stat can be capped per source.
+  const fdPath = new Map();
+  const fileOps = {
+    ...fs,
+    openSync(file, ...args) {
+      const fd = fs.openSync(file, ...args);
+      fdPath.set(fd, String(file));
+      return fd;
+    },
+    fstatSync(fd) {
+      const stat = fs.fstatSync(fd);
+      const cut = cutOf.get(fdPath.get(fd));
+      return Object.assign(Object.create(Object.getPrototypeOf(stat)), stat, {
+        size: cut === undefined ? stat.size : Math.min(stat.size, cut),
+      });
+    },
+  };
+  let win;
+  try {
+    win = Raw.getRawCodexHistoryWindow(sources, {
+      sessionId: sid, provider: 'codex', cols: seal.ref.cols, maxRows: MAX_ROWS, maxBytes: MAX_BYTES, cursorSecret: CURSOR_SECRET,
+    }, fileOps);
+  } catch {
+    report.unreplayable += 1; /* expected: a rollout shape the renderer refuses (counted, never printed) */
+    return;
+  }
+  const items = win.items || [];
+  const rows = win.rows || items.map((item) => item.content);
+  if (!rows.length) {
+    report.unreplayable += 1; /* expected: a render that produced no rows (counted, never printed) */
+    return;
+  }
+  const kinds = items.length === rows.length ? items.map((item) => item.kind) : undefined;
+  const live = seal.ref.rows.slice(seal.ref.pinned || 0).map(strip);
+  if (live.filter((row) => row.trim()).length < MIN_LIVE_ROWS) {
+    report.unreplayable += 1; /* expected: a screen too small to be one (counted, never printed) */
+    return;
+  }
+  report.screens += 1;
+  const found = RowJoin.findJoin({ transcriptRows: rows, transcriptKinds: kinds, painted: { from: 0, rows: [] }, liveRows: live, appBelow: 0 });
+  inc(report.byKind, found.kind);
+  if (found.kind === 'none') {
+    const diag = RowJoin.landingDiag(rows, live, kinds);
+    inc(report.why, diag.why);
+    if (diag.dup >= DUP3_MIN) report.dup3 += 1;
+  }
+  if (CODEX_PROMPT_HEADER.test(live[0] || '')) report.headerRows += 1;
+  if (found.kind !== 'none' && hidesEvidenceRow(rows, kinds, live, found.cut)) report.hiddenTextRowsNotOnScreen += 1;
+}
+
+// --- the run ---------------------------------------------------------------
+
+// The whole `--codex` mode (design §6). Returns the report object; the counts are the only thing an
+// operator reads, and the caller prints it as JSON. `opts`:
+//   per      newest N seals per session (default DEFAULT_PER)
+//   until    an ISO time (or epoch ms) -- seals at or after it are not taken; null = no limit
+//   store    painted-rows root (default ~/.walle/data/painted-rows)
+//   coreDb   CTM core database (default ~/.walle/data/core.db), opened READ-ONLY
+function runCodex(opts) {
+  const options = opts || {};
+  const per = Number(options.per) > 0 ? Math.floor(Number(options.per)) : DEFAULT_PER;
+  const until = options.until === null || options.until === undefined || options.until === ''
+    ? null
+    : (typeof options.until === 'number' ? options.until : Date.parse(String(options.until)));
+  if (until !== null && !Number.isFinite(until)) throw new TypeError('--until must be an ISO time');
+  const report = {
+    mode: 'codex',
+    until: until === null ? null : new Date(until).toISOString(),
+    per,
+    sessions: 0,
+    screens: 0,
+    unreplayable: 0,
+    byKind: { proven: 0, overlap: 0, none: 0 },
+    why: {},
+    dup3: 0,
+    headerRows: 0,
+    hiddenTextRowsNotOnScreen: 0,
+  };
+  const store = options.store ? String(options.store) : defaultStore();
+  for (const [sid, paths] of codexSessions(options.coreDb ? String(options.coreDb) : defaultCoreDb())) {
+    if (!hasStoreDir(store, sid)) continue;
+    const seals = readSeals(path.join(store, sid))
+      .filter((seal) => until === null || seal.at <= until)
+      .slice(-per);
+    if (!seals.length) continue;
+    report.sessions += 1;
+    const scans = paths.map((file) => Object.assign({ file }, timestampMarks(file)));
+    for (const seal of seals) replaySeal(report, sid, seal, scans);
+  }
+  return report;
+}
+
+module.exports = { runCodex, defaultStore, defaultCoreDb, DEFAULT_PER, MAX_ROWS, MAX_BYTES, SID_PREFIX };

package/template/coding-task-manager/lib/client-diag-handler.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const os = require('node:os');
+
 // GAP-2: the throttle below used to dedupe purely by `event`, regardless of
 // which client sent it — two viewers on the same session probing within 1s
 // of each other would see one silently dropped. For terminal-authority this
@@ -47,6 +49,23 @@ const MAX_DIAG_THROTTLE_KEYS = 512;
 // 24-key cut silently dropped its trailing distPx/exitBy/provider fields.
 const MAX_GENERIC_DETAIL_KEYS = 32;
 
+// WP-B C-4: the host context AT RECEIPT of a client stall row, so a client-side frame width can be
+// read against what the machine was doing at that moment (a 35s frame during a load-40 host is not
+// the same evidence as the same frame on an idle one) without correlating a second log line. The
+// row's own client clock cannot be trusted, so `receivedAt` is the server's. Best effort: a platform
+// that refuses any of these calls records `host: null` rather than dropping the diagnostic.
+function clientDiagHostSnapshot() {
+  try {
+    const cpus = os.cpus();
+    return {
+      loadPerCore: Math.round((Number(os.loadavg()[0]) / (cpus.length || 1)) * 100) / 100,
+      freeMemPct: Math.round((os.freemem() / os.totalmem()) * 1000) / 10,
+      serverRssMB: Math.round(process.memoryUsage().rss / 1048576),
+      receivedAt: Date.now(),
+    };
+  } catch { /* expected: host sampling is advisory; its failure must not drop the client row */ return null; }
+}
+
 function createClientDiagHandler(deps = {}) {
   const getSession = deps.getSession || (() => null);
   const isSubscribed = typeof deps.isSubscribed === 'function' ? deps.isSubscribed : () => false;
@@ -129,6 +148,7 @@ function createClientDiagHandler(deps = {}) {
         entries: routed.entries,
         count: routed.entries.length,
         maxDurMs: routed.top.dur,
+        host: clientDiagHostSnapshot(),
       });
       return;
     }