create-walle 0.10.0 → 0.10.1

package/template/coding-task-manager/lib/server-memory-sampler-runtime.js

@@ -46,6 +46,13 @@ function startServerMemorySamplerRuntime(options = {}) {
     // WP-0b (§5 D-2): () => [{ owner, memory }] over the read-pool / db-owner worker clients.
     // Forwarded verbatim; absent -> the sampler's own () => [] default keeps workers[] empty.
     workersSource,
+    // WP-A P-2 (freeze-probes): () => the work in flight at sample time (read-pool ops, db-owner
+    // pending ops, recent main-loop spans). Forwarded verbatim; absent -> the sampler's () => null
+    // default keeps the row's `inFlight` null.
+    inFlightSource,
+    // WP-A P-3 (freeze-probes): { sampleFootprintRegions(pid) } for the main pid -- the categorized
+    // `/usr/bin/footprint` read. Forwarded verbatim; absent -> main.regions stays null.
+    regionSampler,
     samplerOptions,
   } = options;
   // WP-4 (design doc §5 D-5, §8 WP-4): reuse the SAME 'mirrors-report' IPC round trip
@@ -62,6 +69,9 @@ function startServerMemorySamplerRuntime(options = {}) {
     mirrorsSampler,
     // Explicit workersSource wins; otherwise a workersSource carried in samplerOptions (test seam).
     workersSource: typeof workersSource === 'function' ? workersSource : samplerOptions?.workersSource,
+    // WP-A P-2/P-3: forwarded the same way, so server.js's one call site wires all three probes.
+    inFlightSource: typeof inFlightSource === 'function' ? inFlightSource : samplerOptions?.inFlightSource,
+    regionSampler: regionSampler || samplerOptions?.regionSampler || null,
     listProcesses: () => serverProcessList({ sessionHostManager, desktopIndex, errorSink }),
     buildLedgerInput: () => ({
       processMemory: process.memoryUsage(),

package/template/coding-task-manager/lib/server-memory-sampler.js

@@ -135,6 +135,15 @@ function createServerMemorySampler(options = {}) {
     // liveDecoders } }] in raw bytes -- read from the read-pool/db-owner worker clients. Omitted ->
     // workers[] is empty and workersTotal sums are 0 (never fabricated from nothing).
     workersSource = () => [],
+    // WP-A P-2 (freeze-probes): () => any JSON-safe value describing the work in flight when the row
+    // was taken (read-pool ops, db-owner pending ops, recent main-loop spans). Stored verbatim on the
+    // row as `inFlight`; a throw or an absent source yields null ("unknown"), never a lost row.
+    inFlightSource = () => null,
+    // WP-A P-3 (freeze-probes): optional { sampleFootprintRegions(pid): Promise<{ totalMB, top }|null> }
+    // -- the CATEGORIZED `/usr/bin/footprint` read (lib/session-resource-sampler.js), a fresh spawn per
+    // call rather than the TTL-cached sampleFootprints() summary, so the region that just grew is
+    // named. Omitted -> main.regions stays null, never fabricated.
+    regionSampler = null,
     now = () => Date.now(),
     // Injectable so a test isn't forced to monkey-patch the process-global console (which
     // would race other concurrently-running tests in the same file).
@@ -199,6 +208,17 @@ function createServerMemorySampler(options = {}) {
     };
   }
 
+  // WP-A P-2: the in-flight snapshot for this row. A broken/absent source reports null rather than
+  // failing the tick (same disposition as readWorkerMemory above).
+  function readInFlight() {
+    try {
+      return (typeof inFlightSource === 'function' ? inFlightSource() : null) ?? null;
+    } catch {
+      /* expected: the read-pool/db-owner clients can be mid-restart; "unknown in flight" beats a lost row */
+      return null;
+    }
+  }
+
   async function sampleProcessesRss(pids) {
     if (!pids.length) return new Map();
     const psCommand = platform === 'darwin' ? '/bin/ps' : 'ps';
@@ -261,6 +281,18 @@ function createServerMemorySampler(options = {}) {
     const mu = process.memoryUsage();
     const mainProc = procs.find((p) => p.role === 'main') || null;
     const poolProc = procs.find((p) => p.role === 'session-host-pool') || null;
+    // WP-A P-3: the MAIN process' categorized footprint regions -- the only read that can NAME the
+    // category behind a step (the 4<->9 GB swing is entirely "Malloc Large"). `null` (never
+    // fabricated) when unwired, when the main pid is unknown, or when the read failed.
+    let regions = null;
+    if (regionSampler && typeof regionSampler.sampleFootprintRegions === 'function' && mainProc && mainProc.pid) {
+      try {
+        regions = (await regionSampler.sampleFootprintRegions(mainProc.pid)) ?? null;
+      } catch {
+        /* expected: /usr/bin/footprint can be missing, denied or killed; the row must still record */
+        regions = null;
+      }
+    }
     const main = {
       heapUsedMB: roundMB(mu.heapUsed),
       externalMB: roundMB(mu.external),
@@ -273,6 +305,8 @@ function createServerMemorySampler(options = {}) {
       footprintMB: mainProc ? mainProc.physFootprintMB : null,
       // WP-0b (§5 D-2): main-thread's OWN live zstd contexts (workers report theirs separately).
       liveDecoders: liveDecoderCount(),
+      // WP-A P-3: categorized footprint regions of this same pid (null when unwired/unsampled).
+      regions,
     };
     // WP-0b (§5 D-2, §9 S-9): per-worker heap/external/arrayBuffers + live decoder count, summed
     // into workersTotal so the row explains what the main isolate's process.memoryUsage() cannot.
@@ -338,7 +372,10 @@ function createServerMemorySampler(options = {}) {
     }
     const ledger = compactLedgerSubset(fullLedger);
 
-    const sample = { schemaVersion: SCHEMA_VERSION, reason, procs, main, poolHost, ledger, workers, workersTotal };
+    // WP-A P-2: the work in flight at sample time, so a step in rss/footprint can be read against
+    // what was running when it happened (`null` = unknown/not wired).
+    const inFlight = readInFlight();
+    const sample = { schemaVersion: SCHEMA_VERSION, reason, procs, main, poolHost, ledger, workers, workersTotal, inFlight };
     if (typeof record === 'function') {
       try { record('server-memory', sample); } catch { /* expected: a broken diagnostic sink must not break the sampler loop itself */ }
     }
@@ -363,13 +400,15 @@ function createServerMemorySampler(options = {}) {
   // WP-0b (§5 D-2, §9 S-9): run an extra sample whenever main RSS stepped >= minStepMB since the
   // last recorded row. Never throws; returns the sample or null when skipped (no prior sample,
   // caller rss unavailable, below threshold, an unrepresentable prior rss, or a sample in flight).
+  // WP-A P-3: the default threshold is 768 MB, not 2048 -- the live 2026-10-21 measurement showed the
+  // server's real steps are ~970 MB of "Malloc Large", which the old 2048 default silently skipped.
   async function sampleIfStep(options = {}) {
     try {
       const opts = options && typeof options === 'object' ? options : {};
       const target = Number(opts.rssMB);
       if (!Number.isFinite(target)) return null;
       if (!_lastMain || !Number.isFinite(Number(_lastMain.rssMB))) return null;
-      const threshold = Number.isFinite(Number(opts.minStepMB)) ? Number(opts.minStepMB) : 2048;
+      const threshold = Number.isFinite(Number(opts.minStepMB)) ? Number(opts.minStepMB) : 768;
       if (Math.abs(target - Number(_lastMain.rssMB)) < threshold) return null;
       return await sampleOnce({ reason: 'rss-step', rssMB: target });
     } catch {

package/template/coding-task-manager/lib/session-create/provider-process.js

@@ -76,7 +76,7 @@ function applyModelExecutionRecipeToSpawnEnv(env, recipe, expected = {}) {
 }
 
 function modelExecutionRecipeForSpawn({ sessionId, processGeneration, agent, launchPlan, leadRoute, transition,
-  sourceEnvironmentReference, providerThreadId: explicitProviderThreadId }) {
+  sourceEnvironmentReference, providerThreadId: explicitProviderThreadId, nativeConfigReceipt }) {
   const routeId = leadRoute ? String(leadRoute.routeId || leadRoute.alias || '') : null;
   const profile = leadRoute?.profile || leadRoute?.preparedPlan?.profile || null;
   const ownership = leadRoute?.ownership || leadRoute?.preparedPlan?.ownership || null;
@@ -93,6 +93,8 @@ function modelExecutionRecipeForSpawn({ sessionId, processGeneration, agent, lau
     factsRevision: routeId ? (profile.factsRevision || ownership?.factsRevision || null) : null,
     transitionId: transition?.transitionId || leadRoute?.transitionId || ownership?.transitionId || null,
     ...(sourceEnvironmentReference ? { sourceEnvironmentReference } : {}),
+    ...(nativeConfigReceipt && ['present', 'missing'].includes(nativeConfigReceipt.state)
+      ? { nativeConfigReceipt: { state: nativeConfigReceipt.state, sha256: nativeConfigReceipt.sha256 ?? null } } : {}),
   };
 }
 
@@ -890,7 +892,7 @@ function createProviderSession(state) {
     const modelProcessGeneration = capturedModelProcessGeneration;
     const executionRecipe = modelExecutionRecipeForSpawn({ sessionId: id, processGeneration: modelProcessGeneration,
       agent: createAgentType, launchPlan: preparedLaunchPlan, leadRoute, transition: msg._leadModelTransition || null,
-      sourceEnvironmentReference, providerThreadId: launchProviderThreadId({ agent: createAgentType,
+      sourceEnvironmentReference, nativeConfigReceipt, providerThreadId: launchProviderThreadId({ agent: createAgentType,
         launchPlan: preparedLaunchPlan, claudeResumeId, injectedSessionId: _injectedSessionId, args: launchArgs }) });
     let spawnEnv = { ...applyModelExecutionRecipeToSpawnEnv(leadApplied.spawnEnv, executionRecipe,
       { sessionId: id, processGeneration: modelProcessGeneration }), CTM_MODEL_PROCESS_GENERATION: String(modelProcessGeneration) };

package/template/coding-task-manager/lib/session-lifecycle.js

@@ -128,9 +128,6 @@ function lifecycleConfigFromEnv(env = process.env) {
     prewarm: envBool(env, 'CTM_PREWARM', false),
     prewarmTtlMs: envInt(env, 'CTM_PREWARM_TTL_MS', 60_000, 1_000),
     prewarmTopK: envInt(env, 'CTM_PREWARM_TOP_K', 1, 1),
-    freezeTier: idlePark && envBool(env, 'CTM_FREEZE_TIER', false),
-    freezeAfterMs: envInt(env, 'CTM_FREEZE_AFTER_MS', 15 * 60_000, 1_000),
-    freezeParkAfterMs: 2 * 60 * 60_000,
     // WP-3: default is derived from host RAM (see defaultSessionRssBudgetMB), so the
     // MemoryBudgetController is live out of the box. `CTM_SESSION_RSS_BUDGET_MB=0`
     // remains the explicit disable — a 0 budget makes observe() inert again.
@@ -147,11 +144,7 @@ function lifecycleConfigFromEnv(env = process.env) {
 
 function automaticParkSweepPolicy(config, options = {}) {
   const pressure = ['warn', 'critical'].includes(options.pressure) ? options.pressure : 'normal';
-  const freezeTier = options.freezeTier === true;
-  const configuredThresholdMs = Math.max(0, Number(config?.idleParkAfterMs) || 0);
-  const idleParkAfterMs = freezeTier
-    ? Math.max(configuredThresholdMs, Number(config?.freezeParkAfterMs) || 0)
-    : configuredThresholdMs;
+  const idleParkAfterMs = Math.max(0, Number(config?.idleParkAfterMs) || 0);
   const disconnectCollapseMs = Math.max(
     idleParkAfterMs,
     Number(config?.disconnectCollapseMs) || 0,
@@ -223,7 +216,7 @@ function normalizeClientKind(value) {
 function evaluatePark(session, host, config) {
   const now = Number(host?.now) || Date.now();
   const protections = [];
-  if (!session || !['live', 'frozen'].includes(session.state)) protections.push('not-live');
+  if (!session || session.state !== 'live') protections.push('not-live');
   if (session?.resumable === false) protections.push('not-resumable'); if (session?.parkable === false) protections.push('not-parkable-class');
   if (session?.liveStatus === 'running' || session?.liveStatus === 'generating' || session?.liveStatus === 'working') protections.push('running');
   if (session?.liveStatus === 'waiting_input' || session?.liveStatus === 'resuming') protections.push('waiting-input');
@@ -490,37 +483,6 @@ function describePressureCause(signals = {}, thresholds = {}, effectiveLevel = '
     || { kind: 'recovering', level, value: null };
 }
 
-function evaluateFreeze(session, host, config) {
-  if (config?.freezeTier !== true) {
-    return { eligible: false, protections: ['disabled'], idleMs: 0, thresholdMs: Number(config?.freezeAfterMs) || 0 };
-  }
-  if (!session || session.state !== 'live') {
-    return { eligible: false, protections: ['not-live'], idleMs: 0, thresholdMs: Number(config?.freezeAfterMs) || 0 };
-  }
-  return evaluatePark(session, host, {
-    ...config,
-    idleParkAfterMs: Number(config.freezeAfterMs) || 15 * 60_000,
-    disconnectCollapseMs: Number(config.freezeAfterMs) || 15 * 60_000,
-  });
-}
-
-function selectFreezeVictim(sessions, host, config) {
-  const eligible = [];
-  for (const session of sessions || []) {
-    const result = evaluateFreeze(session, host, config);
-    if (result.eligible) eligible.push({ session, result });
-  }
-  eligible.sort((a, b) => {
-    const activityDelta = (Number(a.session.lastMeaningfulActivityAt) || 0)
-      - (Number(b.session.lastMeaningfulActivityAt) || 0);
-    if (activityDelta !== 0) return activityDelta;
-    const rssDelta = sessionMemoryMB(b.session) - sessionMemoryMB(a.session);
-    if (rssDelta !== 0) return rssDelta;
-    return String(a.session.id).localeCompare(String(b.session.id));
-  });
-  return eligible[0]?.session || null;
-}
-
 class PressureController {
   constructor() {
     this.level = 'normal';
@@ -773,7 +735,6 @@ class LifecycleDiagnostics {
     this.activationByClient = {};
     this.parkByReason = {};
     this.prewarmByOutcome = {};
-    this.freezeByAction = {};
     this.shadow = { candidates: 0, falsePositives: 0, projectedReclaimMB: 0 };
     this.pressureTransitions = 0;
     this.events = [];
@@ -813,12 +774,6 @@ class LifecycleDiagnostics {
     this._event({ type: 'prewarm', id, outcome: normalized, reason: String(reason || '').slice(0, 48) });
   }
 
-  recordFreeze({ id, action, idleMs = 0, reason = '' }) {
-    const normalized = String(action || 'unknown').slice(0, 32);
-    this._count(this.freezeByAction, normalized);
-    this._event({ type: 'freeze', id, action: normalized, idleMs: Math.max(0, idleMs), reason: String(reason || '').slice(0, 48) });
-  }
-
   recordShadow({ id, action = 'candidate', rssMB = 0, activityAfterMs = 0, reason = '', signals = {} }) {
     if (action === 'candidate') {
       this.shadow.candidates += 1;
@@ -876,7 +831,6 @@ class LifecycleDiagnostics {
       activationByClient: { ...this.activationByClient },
       parkByReason: { ...this.parkByReason },
       prewarmByOutcome: { ...this.prewarmByOutcome },
-      freezeByAction: { ...this.freezeByAction },
       shadow: { ...this.shadow },
       pressureTransitions: this.pressureTransitions,
       wakeOutcomes: { ...this.wakeOutcomes },
@@ -901,11 +855,9 @@ module.exports = {
   classifyWakeOutcome,
   derivePressure,
   describePressureCause,
-  evaluateFreeze,
   evaluateManualPark,
   evaluatePark,
   summarizeParkEligibility,
-  selectFreezeVictim,
   selectParkVictim,
   sessionMemoryMB,
 };

package/template/coding-task-manager/lib/session-model-action-preconditions.js

@@ -72,6 +72,28 @@ function parkRefusalDetail(protections) {
   return 'The session could not be restarted right now. Try again in a moment.';
 }
 
+// WP-0 D-10: a refusal code with no hand-written sentence still gets a family sentence that NAMES
+// the code, so no refusal can reach the person as a generic line. Checked after the explicit map and
+// before any caller-supplied message.
+const HISTORY_REFUSAL_FAMILIES = Object.freeze([
+  [/^unsupported_native_/, 'This history carries a record type that has not been qualified for transfer.'],
+  [/^native_world_state_/, 'The native Codex world state could not be replayed safely.'],
+  [/^native_history_/, 'The native Codex history could not be prepared for transfer.'],
+  [/^tool_call_/, 'This history has an incomplete tool exchange, so it cannot be transferred safely.'],
+  [/^history_/, 'The source history could not be verified for this provider change.'],
+  [/^source_/, 'The source session could not be verified for this provider change.'],
+  [/^target_/, 'The target session could not be verified for this provider change.'],
+  [/^fork_/, 'The native fork could not be verified in Codex history.'],
+  [/^native_(?:rpc|process|fork|adapter|readback|initialize)_/, 'The native Codex process could not complete the handoff.'],
+]);
+
+function historyRefusalFamilyMessage(reason, tail) {
+  for (const [pattern, sentence] of HISTORY_REFUSAL_FAMILIES) {
+    if (pattern.test(reason)) return `${sentence} (code: ${reason}) ${tail}`;
+  }
+  return '';
+}
+
 // History checks run before the source is parked. Keep their bounded reason codes useful to the
 // person making the change without exposing scanner records, paths, or provider credentials.
 function historyPreparationMessage(reason, suppliedMessage = '', { postPark = false } = {}) {
@@ -83,10 +105,13 @@ function historyPreparationMessage(reason, suppliedMessage = '', { postPark = fa
       source_checkpoint_changed_after_park: `The source checkpoint changed during handoff verification. ${recovery}`,
       source_config_policy_unqualified: `The captured Codex configuration changed during handoff verification. ${recovery}`,
       native_history_control_failed: `Codex could not create the native history checkpoint. ${recovery}`,
+      native_handoff_inject_failed: `The handoff summary could not be written into the new Codex thread. ${recovery}`,
+      fork_target_handoff_missing: `The new Codex thread does not prove it received the handoff summary for its encrypted history. ${recovery}`,
       fork_readback_unverified: `The native fork could not be verified in Codex history. ${recovery}`,
       fork_journal_owner_changed: `The transition owner changed during handoff. ${recovery}`,
     };
-    return messages[reason] || `The target handoff could not be verified. ${recovery}`;
+    return messages[reason] || historyRefusalFamilyMessage(reason, recovery)
+      || `The target handoff could not be verified. ${recovery}`;
   }
   const messages = {
     native_target_profile_unavailable: 'The native Codex model does not publish the context limits needed to verify this history move. The current session is still running unchanged.',
@@ -100,7 +125,6 @@ function historyPreparationMessage(reason, suppliedMessage = '', { postPark = fa
     // WP-2 (docs/codex-encrypted-history-lead-switch-2026-10-17.html §5/§8): the name stays; the copy
     // now says what the user actually has (an encrypted summary) and what did NOT happen to them.
     encrypted_history_not_portable: 'Earlier history exists only as an encrypted summary that the target model cannot read, so it cannot be carried over. The current session is still running unchanged.',
-    compacted_source_fork_unqualified: 'This source history was compacted, and its active checkpoint cannot yet be verified across providers. The current session is still running unchanged.',
     source_compaction_unqualified: 'The source history is too large for the target, and safely compacting it is not supported yet. The current session is still running unchanged.',
     history_estimate_unknown: 'The source history size could not be verified safely. The current session is still running unchanged.',
     target_compaction_hash_unknown: 'The target profile cannot verify the source history compaction settings. The current session is still running unchanged.',
@@ -109,9 +133,41 @@ function historyPreparationMessage(reason, suppliedMessage = '', { postPark = fa
     unpaired_tool_history: 'This history has an incomplete tool exchange, so it cannot be transferred safely. The current session is still running unchanged.',
     source_origin_unknown: 'The source provider could not be verified. The current session is still running unchanged.',
     source_origin_unsupported: 'This source provider has no qualified history handoff yet. The current session is still running unchanged.',
+    transition_cancelled: 'The history check was cancelled before it finished. The current session is still running unchanged.',
+    history_scan_incomplete: 'The source history scan did not finish, so nothing was moved. The current session is still running unchanged.',
+    source_checkpoint_unknown: 'The source history has no verified checkpoint to carry over. The current session is still running unchanged.',
+    source_previous_model_mismatch: 'The model recorded on the source history does not match the captured source model. The current session is still running unchanged.',
+    source_model_changed: 'The source model changed while the history was being prepared. The current session is still running unchanged.',
+    lead_source_changed: 'The source session this switch started from is no longer the live one. The current session is still running unchanged.',
+    provider_identity_unknown: 'The source or target provider for this history move could not be identified. The current session is still running unchanged.',
+    target_budget_unknown: 'The target model does not publish the context budget needed to carry this history over. The current session is still running unchanged.',
+    history_estimate_evidence_unknown: 'The source history size was measured, but not in a way that can be verified for this move. The current session is still running unchanged.',
+    compaction_hash_mismatch: 'The source and target history compaction settings disagree, so the move cannot be verified safely. The current session is still running unchanged.',
+    native_transition_policy_unknown: 'The Codex permission policy for the source or the target could not be read. The current session is still running unchanged.',
+    native_transition_policy_mismatch: 'The Codex permission policy on the target differs from the source, so the history cannot be moved safely. The current session is still running unchanged.',
+    native_fork_adapter_unqualified: 'This Codex installation or adapter is not qualified to carry this history over. The current session is still running unchanged.',
+    native_policy_override_unqualified: 'This source session uses a Codex policy override that cannot yet be reproduced safely for history transfer. The current session is still running unchanged.',
+    native_token_usage_record_invalid: 'The Codex usage record for this session could not be verified, so the history size cannot be trusted. The current session is still running unchanged.',
+    history_media_not_portable: 'This history contains an image, and the target model cannot receive images. The current session is still running unchanged.',
+    // WP-2 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §5 D-5/D-6, §6.5): the
+    // encrypted-compaction path. The source model writes a plaintext handoff before the switch, and
+    // each way that handoff can fail says which one it was.
+    encrypted_compaction_multiple: 'This history holds more than one encrypted compaction, and only one of them can be replaced by a handoff summary. The current session is still running unchanged.',
+    encrypted_compaction_handoff_unavailable: 'This history exists only as an encrypted summary, and the model that wrote it cannot be asked to write a plaintext handoff for this provider change. The current session is still running unchanged.',
+    handoff_fork_failed: 'The handoff summary could not be started from this session\'s history. The current session is still running unchanged.',
+    handoff_turn_failed: 'The source model did not finish writing the handoff summary. The current session is still running unchanged.',
+    handoff_empty: 'The source model returned a handoff summary that is too short to carry this history over. The current session is still running unchanged.',
+    handoff_too_long: 'The source model returned a handoff summary that is too long to carry this history over. The current session is still running unchanged.',
+    handoff_marker_in_text: 'The handoff summary contains text reserved for this move, so it cannot be trusted. The current session is still running unchanged.',
+    handoff_timeout: 'The source model did not finish writing the handoff summary in time. The current session is still running unchanged.',
+    // Raised while the forked target is being written, but the code is enumerated from its own
+    // source file, so it carries a sentence on both paths rather than falling back to the generic one.
+    native_handoff_inject_failed: 'The handoff summary could not be written into the new Codex thread. The current session is still running unchanged.',
   };
   const safe = typeof suppliedMessage === 'string' ? suppliedMessage.trim().slice(0, 240) : '';
-  return messages[reason] || safe || 'History could not be verified for this provider change. The current session is still running unchanged.';
+  return messages[reason]
+    || historyRefusalFamilyMessage(reason, 'The current session is still running unchanged.')
+    || safe || 'History could not be verified for this provider change. The current session is still running unchanged.';
 }
 
 function refusal(status, code, extra) {

package/template/coding-task-manager/lib/session-resource-sampler.js

@@ -126,6 +126,33 @@ function parseFootprintJson(text) {
   return results;
 }
 
+// WP-A P-1 (freeze-probes): the CATEGORIZED `footprint -j` document (no `--noCategories`) --
+// { unit, 'bytes per unit', processes: [{ pid, footprint, categories: { name: { dirty, swapped, ... } } }] }.
+// The 4<->9 GB server swing measured 2026-10-21 lives entirely in the "Malloc Large" category, which
+// the --noCategories summary above cannot name. Pure; returns { totalMB, top: [{name,dirtyMB,swappedMB}] }
+// for the FIRST process, null for unparseable input or a non-byte unit (same rules as parseFootprintJson).
+function parseFootprintRegions(text) {
+  let doc;
+  try { doc = JSON.parse(String(text ?? '')); } catch { return null; } // not JSON at all (empty stdout on a failed run)
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return null;
+  if (doc.unit !== 'byte') return null;
+  const bytesPerUnit = Number(doc['bytes per unit']) || 1;
+  const proc = (Array.isArray(doc.processes) ? doc.processes : []).find(entry => entry && typeof entry === 'object');
+  if (!proc) return null;
+  const mb = (bytes) => Math.round((bytes / 1048576) * 10) / 10;
+  const rows = Object.entries(proc.categories && typeof proc.categories === 'object' ? proc.categories : {})
+    .map(([name, region]) => {
+      const dirty = (Number(region?.dirty) || 0) * bytesPerUnit;
+      const swapped = (Number(region?.swapped) || 0) * bytesPerUnit;
+      return { name: String(name).slice(0, 40), dirtyMB: mb(dirty), swappedMB: mb(swapped), total: dirty + swapped };
+    })
+    .sort((a, b) => b.total - a.total);
+  return {
+    totalMB: Number.isFinite(proc.footprint) ? mb(proc.footprint * bytesPerUnit) : null,
+    top: rows.slice(0, 6).map(({ name, dirtyMB, swappedMB }) => ({ name, dirtyMB, swappedMB })),
+  };
+}
+
 // Cleanup never turns an already-decided sample (number or D-3 null) into a rejected sweep.
 function removeTempFileQuietly(file) {
   return fs.promises.rm(file, { force: true }).then(() => true, () => false);
@@ -540,6 +567,26 @@ class SessionResourceSampler {
     return results;
   }
 
+  // WP-A P-1: ONE fresh categorized `/usr/bin/footprint -j <tmp> <pid>` for the MAIN pid, every call.
+  // Deliberately NOT the TTL-cached sampleFootprints() path: a stale cache entry cannot name the region
+  // that just grew. Same gate/tmp/limits/cleanup mechanics as _sampleFootprintBatch, minus the cache.
+  // Never rejects: null on non-darwin, on the primary-only gate, or on any failure. Categorized
+  // `footprint` does not suspend its target (measured 2026-10-21), unlike vmmap/sample/leaks.
+  async sampleFootprintRegions(pid) {
+    const key = Number(pid);
+    if (this.platform !== 'darwin' || !(key > 0)) return null;
+    if (this.exec === execFileAsync && !hostIdentityAccessAllowed({ env: this.env })) return null;
+    const tmp = path.join(os.tmpdir(), `ctm-footprint-regions-${process.pid}-${crypto.randomUUID()}.json`);
+    try {
+      await this.exec(FOOTPRINT_BIN, ['-j', tmp, String(key)], { timeout: 10_000, maxBuffer: 4 * 1024 * 1024 });
+      return parseFootprintRegions(await fs.promises.readFile(tmp, 'utf8'));
+    } catch {
+      return null; // footprint missing/denied or temp file unreadable (D-3: null, never a throw)
+    } finally {
+      await removeTempFileQuietly(tmp);
+    }
+  }
+
   // D-1: sweep counterpart to sampleFootprints() (same batch and TTL cache), resolving to
   // `{ footprintMB, sampledAt }` per pid so a consumer can tell how fresh an entry is.
   async sampleFootprintSnapshots({ pids, now } = {}) {
@@ -558,6 +605,7 @@ module.exports = {
   FOOTPRINT_SAMPLE_TTL_MS,
   hostMemoryFromVmStat,
   parseFootprintJson,
+  parseFootprintRegions,
   parseMemoryPressure,
   parsePageouts,
   parseProcessTable,

package/template/coding-task-manager/lib/session-status.js

@@ -11,7 +11,7 @@ const RESUMING_RESUME_PHASES = new Set(['preparing', 'spawning', 'loading', 'str
 // projectSessionStatus(session) is a pure reducer over the fields server.js already writes
 // today (`_lifecycleState`, `_resumeAttemptState.phase`, `_resumeBlocked`, `_pendingApproval`,
 // `_pressureShed`) — see server.js's RESUME_PHASE enum (lib/resume-attempt-state.js) and the
-// `_lifecycleState` values ('frozen'/'live'/'parking'/'parked'/'deferred'/'waking'/'degraded'/
+// `_lifecycleState` values ('live'/'parking'/'parked'/'deferred'/'waking'/'degraded'/
 // 'exited') for the source vocabulary this projects from.
 //
 // requestTransition(sessionId, to, cause) is the ONE gate for changing the FSM's *phase*.
@@ -48,7 +48,7 @@ function projectSessionStatus(session) {
   else if (lifecycleState === 'parked' || lifecycleState === 'parking') phase = 'parked';
   else if (lifecycleState === 'degraded' || resumePhase === 'blocked') phase = 'degraded';
   else if (resumeBlocked || RESUMING_RESUME_PHASES.has(resumePhase)) phase = 'resuming';
-  else if (lifecycleState === 'waking' || lifecycleState === 'deferred' || lifecycleState === 'frozen') phase = 'attaching';
+  else if (lifecycleState === 'waking' || lifecycleState === 'deferred') phase = 'attaching';
   else if (lifecycleState === 'live' || (lifecycleState === '' && (resumePhase === 'ready' || resumePhase === ''))) phase = 'live';
   else phase = 'detached';
 

package/template/coding-task-manager/lib/typing-interaction-trace.js

@@ -1,5 +1,12 @@
 'use strict';
 
+// WP-3 (composer-freeze-followups-load-sigstop-attribution-2026-10-20.html §5 D-C1/D-C2):
+// READ THE STAGE NAMES HONESTLY. Every stage after `pty-written` EXCEPT `echo-bytes`/`echo-cell`
+// is stamped on the session's whole pending id set by the FIRST output/feed/frame after the key
+// -- "first X after the key", which is approximate, not causal (D-C1; the pty-output leg lands
+// 0-3 ms after pty-written in 14 of 18 retained slow rows, which no agent CLI can do).
+// `echo-bytes`/`echo-cell` are the only per-key matches today, and they are shadow-only
+// instrumentation for WP-4/WP-5's decision (D-C2) -- nothing reads them as truth yet.
 const STAGES = Object.freeze([
   'browser-keydown',
   'server-received',
@@ -11,6 +18,11 @@ const STAGES = Object.freeze([
   'host-posted',
   'pty-written',
   'pty-output',
+  // WP-3 D-C2: the two shadow, per-key echo matchers -- VS Code typeahead's byte rule and
+  // mosh's cell rule (see lib/typing-worker-stages.js, which runs them in the mirror). Both are
+  // OPTIONAL (OPTIONAL_STAGES below), so neither can move lastCompletedBoundary.
+  'echo-bytes',
+  'echo-cell',
   // WP-0 (composer-freeze-stop-and-wait-emitter-2026-09-16.html §5 D-1, §6 API specs, §8 WP-0):
   // four stages stamped INSIDE the worker/pool-host, between `pty-output` and `mirror-revision`
   // -- the 16.1 s gap the census found with zero instrumentation coverage (§1.5). All four are
@@ -52,7 +64,11 @@ const STAGE_INDEX = new Map(STAGES.map((stage, index) => [stage, index]));
 // D-1: stages that may be absent from an otherwise-complete row without that absence meaning
 // "the interaction stalled here" -- the sequential boundary walk in note() skips these rather
 // than treating a miss as the end of the row's progress (see the walk below).
-const OPTIONAL_STAGES = new Set(['pty-output', 'worker-received', 'mirror-written', 'emit-offered', 'emit-refused']);
+// WP-3 D-C2: 'echo-bytes'/'echo-cell' join them -- they are shadow stamps most keys never get.
+const OPTIONAL_STAGES = new Set([
+  'pty-output', 'worker-received', 'mirror-written', 'emit-offered', 'emit-refused',
+  'echo-bytes', 'echo-cell',
+]);
 const WORKLOAD_FIELDS = Object.freeze([
   'rawBatchClass', 'synchronizedFrameCount', 'mirrorChangedRows', 'frameKind',
   'frameBytes', 'queuedBytes', 'queueDepth', 'codexRepairActions',
@@ -99,6 +115,23 @@ function stageMsFromKeydown(row, stage) {
   return stageDelta(row, stage, 'browser-keydown');
 }
 
+// WP-3 D-C3: an expired row must not report an OPTIONAL stage as "where it got to" -- the
+// reverse scan it used to do picked `pty-output` over `pty-written` for a key that stalled
+// after a stray output chunk (I-6 / R9). `lastObservedStage` is therefore the last observed
+// REQUIRED stage (fallback `browser-keydown`), and the last observed OPTIONAL stage is reported
+// separately as `lastOptionalStage` ('' when there is none) so the shadow echo stamps stay
+// readable without ever being mistaken for progress.
+function observedStageSplit(row) {
+  let lastObservedStage = 'browser-keydown';
+  let lastOptionalStage = '';
+  for (const stage of STAGES) {
+    if (!row.stages[stage]) continue;
+    if (OPTIONAL_STAGES.has(stage)) lastOptionalStage = stage;
+    else lastObservedStage = stage;
+  }
+  return { lastObservedStage, lastOptionalStage };
+}
+
 // D-7/S-14: builds the flat, ≤24-key `typing-interaction-slow` payload from the SAME stage
 // vector `note()`/`begin()` already maintain -- no second clock, no parallel bookkeeping.
 // `lastStage` is passed explicitly by the two callers below rather than read from
@@ -118,6 +151,10 @@ function buildSlowInteractionRow(row, ktpMs, lastStage) {
     printable: row.printable === true,
     ktpMs: Math.max(0, finite(ktpMs, 0)),
     lastStage: lastStage || row.lastCompletedBoundary || 'browser-keydown',
+    // WP-3 D-C3: the last OPTIONAL stage observed for this row ('' when none) -- carried on
+    // every slow/worst vector so `lastStage` can stay required-only without losing the shadow
+    // echo stamps.
+    lastOptionalStage: observedStageSplit(row).lastOptionalStage,
     dropReason: dropped ? boundedText(dropped.reason, 64) : '',
     gate: refused ? refused.gate : '',
     gateTop: refused ? refused.gate : '',
@@ -131,6 +168,9 @@ function buildSlowInteractionRow(row, ktpMs, lastStage) {
     serverReceivedMs: stageMsFromKeydown(row, 'server-received'),
     ptyWrittenMs: stageMsFromKeydown(row, 'pty-written'),
     ptyOutputMs: stageMsFromKeydown(row, 'pty-output'),
+    // WP-3 D-C2: the shadow per-key matchers' legs, same keydown rule as ptyOutputMs above.
+    echoBytesMs: stageMsFromKeydown(row, 'echo-bytes'),
+    echoCellMs: stageMsFromKeydown(row, 'echo-cell'),
     mirrorRevisionMs: stageMsFromKeydown(row, 'mirror-revision'),
     frameSentMs: stageMsFromKeydown(row, 'frame-sent'),
     socketReceivedMs: stageMsFromKeydown(row, 'socket-received'),
@@ -302,12 +342,14 @@ function createTypingInteractionTraceStore(options = {}) {
 
   function captureExpiredInteraction(row, at) {
     if (row.stages.painted) return;
-    const lastObservedStage = STAGES.slice().reverse().find(stage => row.stages[stage]) || 'browser-keydown';
+    // WP-3 D-C3: required-only `lastObservedStage` + a separate `lastOptionalStage` (I-6/R9).
+    const { lastObservedStage, lastOptionalStage } = observedStageSplit(row);
     const ageMs = Math.max(0, at - row.startedAt);
     pushBounded(pendingExpired, rollupGroupKey(row.sessionId, row.agentType), {
       ageMs,
       clientId: row.clientId,
       lastObservedStage,
+      lastOptionalStage,
     });
     windowExpiredHistory.push({ at });
     if (windowExpiredHistory.length > WINDOW_HISTORY_CAP) windowExpiredHistory.shift();