create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/api/sessions.js

@@ -45,15 +45,20 @@
 // handleSessionsRepoint above.
 
 const { registerApiRoutes } = require('../api-router');
+// WP-6 (§7 ownership routing): the mirror-session lifecycle seam. Required here rather than
+// injected so the route table needs no server.js plumbing beyond the deps it already has; the
+// module resolves its own dependencies lazily and is inert until a machine is registered.
+const remoteMachineCatalog = require('../remote-machine-catalog');
 const workerAdmission = require('../worker-admission');
 const workerObservability = require('../session-create/worker-observability');
+const { createWaitWatcherReadTail, WATCH_MODES } = require('../session-create/worker-wait-watcher');
 // Caller door D-11 (delegate-followups-lead-posture-boot-truth-brain-successors-caller-door-
 // 2026-10-10.html §5): the runtime bearer the four caller-context routes require even on
 // loopback. resolveRuntimeGoalToken reads CTM_TOKEN -> WALLE_CTM_TOKEN -> CTM_API_TOKEN
 // (server.js boot sets WALLE_CTM_TOKEN to the runtime token); equalToken is the existing
 // constant-time compare -- an EMPTY token never authenticates (equalToken('','') is false).
 const { resolveRuntimeGoalToken, equalToken } = require('../runtime-goal-api');
-const { NEXT_STEPS } = require('../worker-failure-classify');
+const { NEXT_STEPS, waitNextStep } = require('../worker-failure-classify');
 const { serveNativeSubagentReview, resolveWorkerTranscriptTarget } = require('./native-subagent-review');
 const { normalizeAgentType } = require('../agent-capabilities');
 
@@ -530,7 +535,9 @@ async function handleDelegateParent(req, res, url) {
 // contents, capped at 64 KB) when the report is present -- walle_worker_status needs the
 // text itself, not just report_present, so a lead agent can read a finished worker's report
 // through the MCP tool without a second round-trip.
-const WORKER_REPORT_TEXT_CAP_BYTES = 64 * 1024;
+// D-3 (lead-cost-routing-round2-2026-10-24.html §5 D-3, §6.2): the cap has ONE definition,
+// in worker-observability, shared with the status reader that counts citations from the same text.
+const { WORKER_REPORT_TEXT_CAP_BYTES } = workerObservability;
 
 // Lifecycle WP-5 (delegated-worker-lifecycle-identity-observability-2026-09-27.html §5 D-10,
 // §9 S-13): the terminal statuses D-10's retain-then-hide clock applies to.
@@ -546,6 +553,67 @@ const _WORKER_TERMINAL_STATUSES = new Set(['report_ready', 'failed', 'exited']);
 const WORKER_WAIT_MIN_MS = 1000;
 const WORKER_WAIT_MAX_MS = 540000;
 
+// WP-2 (lead-cost-routing-round1-2026-10-21.html §5 D-5): Codex errors an MCP tool call after
+// 300 s and ignores progress notifications, so a Codex LEAD's wait is held under that ceiling --
+// 280 s leaves room for the status payload and the stdio hop. Claude leads keep
+// WORKER_WAIT_MAX_MS; a caller whose harness cannot be read is never capped, because an unknown
+// harness must not silently shorten a wait it cannot justify.
+const CODEX_LEAD_WAIT_CAP_MS = 280000;
+
+// The caller's harness: the live session's own `type` (CtmSession.type, server-state.js) first,
+// then the agent_sessions row's `provider` column through the reader this file already uses for
+// the lead (getAgentSessionByCtmId -- see delegate-worker.js's getWorkerStatus). '' means
+// unknown; callers must treat that as "no cap", never as Claude.
+function leadHarnessType(ctmSessionId) {
+  const id = String(ctmSessionId || '').trim();
+  if (!id) return '';
+  try {
+    const live = typeof _deps.getSession === 'function' ? _deps.getSession(id) : null;
+    const liveType = live && typeof live.type === 'string' ? live.type.trim() : '';
+    if (liveType) return normalizeAgentType(liveType) || liveType;
+  } catch { /* expected: an unreadable session map falls through to the agent-session row below */ }
+  try {
+    const row = typeof _deps.dbModule?.getAgentSessionByCtmId === 'function'
+      ? _deps.dbModule.getAgentSessionByCtmId(id)
+      : null;
+    const provider = row && typeof row.provider === 'string' ? row.provider.trim() : '';
+    if (provider) return normalizeAgentType(provider) || provider;
+  } catch { /* expected: an unreadable row leaves the harness unknown -- the caller is not capped */ }
+  return '';
+}
+
+// D-5: the Codex cap applied to an already-clamped wait.
+function capWaitMsForLead(waitMs, leadCtmSessionId) {
+  return leadHarnessType(leadCtmSessionId) === 'codex' ? Math.min(waitMs, CODEX_LEAD_WAIT_CAP_MS) : waitMs;
+}
+
+// WP-1 (D-3/D-4): `?watch=on|silent|off` on the two wait routes (default 'on'). Returns the
+// validated mode, or null for anything else -- the caller answers 400 watch_invalid.
+function parseWatchMode(url) {
+  const raw = url && url.searchParams ? url.searchParams.get('watch') : null;
+  if (raw === null) return 'on';
+  const value = String(raw).trim();
+  return WATCH_MODES.has(value) ? value : null;
+}
+
+// WP-1: the wait routes' watcher wiring -- the production model call (lib/background-llm.js via
+// worker-observability.js, never a provider client here), the SAME status reader the route
+// already reads through, the worker's own transcript tail, and the worker row's own pin
+// (route_alias + ':' + model; a row without one starts no watcher).
+function waitWatchWiring() {
+  const statusReader = _deps.delegateWorker.getWorkerStatusWithProgress || _deps.delegateWorker.getWorkerStatus;
+  return {
+    callModel: workerObservability.createWaitWatcherCallModel(),
+    getStatus: (id) => statusReader.call(_deps.delegateWorker, id),
+    readTail: createWaitWatcherReadTail({ dbModule: _deps.dbModule }),
+    workerRoute: (id) => {
+      const row = _deps.dbModule && typeof _deps.dbModule.getWorkerSession === 'function' ? _deps.dbModule.getWorkerSession(id) : null;
+      if (!row || !row.route_alias || !row.model) return null;
+      return { route: String(row.route_alias), model: String(row.model) };
+    },
+  };
+}
+
 // D-10b: ?wait_ms=N parks this request on the worker-change registry (no polling) and then
 // answers with the ordinary status read plus woke_on / waited_ms.
 // WP-5 (D-12, D-15): ?lead_agent_session_id=<id> makes the single-worker wait ALSO wake when a
@@ -558,6 +626,8 @@ const WORKER_WAIT_MAX_MS = 540000;
 // read without wait_ms stays exactly as today (bearer-free, loopback auto-admin).
 async function handleWorkerStatus(req, res, sessionId, url) {
   let wait = null;
+  const watchMode = parseWatchMode(url);
+  if (watchMode === null) return _deps.sendJsonResponse(res, 400, { error: 'watch_invalid' });
   const rawWait = url && url.searchParams ? url.searchParams.get('wait_ms') : null;
   if (rawWait !== null) {
     if (!requireRuntimeBearer(req, res)) return undefined;
@@ -593,22 +663,33 @@ async function handleWorkerStatus(req, res, sessionId, url) {
         return _deps.sendJsonResponse(res, 403, { error: 'worker_not_owned', next_step: NEXT_STEPS.worker_not_owned });
       }
     }
+    // WP-2 (D-5): the caller's harness is only known once the lead resolved above, so the Codex
+    // cap is applied here rather than at the clamp -- a Codex lead never parks past Codex's 300 s
+    // MCP call ceiling. No lead param (or an unreadable one) means no cap.
+    wait.waitMs = capWaitMsForLead(wait.waitMs, leadCtmSessionId);
     const handle = workerObservability.waitForWorkers({
       workerIds: [sessionId], leadId: leadCtmSessionId || null, waitMs: wait.waitMs,
       generationById: { [sessionId]: liveGeneration },
+      ...(watchMode === 'off' ? {} : { watchMode, ...waitWatchWiring() }),
     });
+    wait.decisions = [];
     let gone = false;
     res.on('close', () => { if (!res.writableEnded) { gone = true; handle.release(); } });
     try {
       const statusReader = _deps.delegateWorker.getWorkerStatusWithProgress || _deps.delegateWorker.getWorkerStatus;
       const first = await statusReader.call(_deps.delegateWorker, sessionId);
       if (gone) return undefined;
-      if (first && _WORKER_TERMINAL_STATUSES.has(first.status)) {
+      // WP-1 (session-stops-followups-2026-10-24.html D-1): a report written while the process
+      // is still alive is not terminal -- park and let the real exit wake us.
+      if (first && workerObservability.isFinalWorkerStatus(first)) {
         handle.release();
         wait.wokeOn = 'terminal';
       } else {
         if (first && first.generation != null) handle.setGeneration(sessionId, first.generation);
-        wait.wokeOn = (await handle.promise).why;
+        const wake = await handle.promise;
+        wait.wokeOn = wake.why;
+        wait.watcherReason = wake.detail && typeof wake.detail.reason === 'string' ? wake.detail.reason : null;
+        wait.decisions = wake.decisions || [];
         wait.waitedMs = Date.now() - startedAt;
         if (gone) return undefined;
       }
@@ -626,7 +707,23 @@ async function handleWorkerStatus(req, res, sessionId, url) {
 async function handleWorkerStatusRead(req, res, sessionId, url, wait) {
   try {
     const result = await workerStatusReadPayload(sessionId, url);
-    if (wait && result) { result.woke_on = wait.wokeOn; result.waited_ms = wait.waitedMs; }
+    if (wait && result) {
+      result.woke_on = wait.wokeOn;
+      result.waited_ms = wait.waitedMs;
+      // WP-1 (D-3): the watcher's own outcome rides beside woke_on -- why it woke the lead and
+      // every decision it recorded (empty when no tick ran or no watcher started).
+      result.watcher_reason = wait.watcherReason || null;
+      result.watcher_decisions = wait.decisions || [];
+      // WP-2 (session-stops-mid-job-2026-10-24.html D-9, AC-2a): a non-terminal wake names
+      // the worker that is still live and tells the lead to re-issue the wait -- this wait
+      // covered exactly one worker, so its own status is the whole answer. A terminal wake
+      // leaves nothing to wait on: null.
+      // WP-1 (session-stops-followups-2026-10-24.html D-1/D-4): a provisional report_ready is
+      // non-final, so the lead is told to keep waiting -- and the status words say why.
+      result.lead_next_step = (typeof result.status === 'string' && !workerObservability.isFinalWorkerStatus(result))
+        ? waitNextStep({ workerId: sessionId, status: waitStatusLabel(result) })
+        : null;
+    }
     return _deps.sendJsonResponse(res, 200, result);
   } catch (error) {
     const status = Number(error && error.status) || 400;
@@ -647,6 +744,8 @@ async function handleWorkerStatusRead(req, res, sessionId, url, wait) {
 async function handleWorkersWait(req, res, url) {
   // Caller door D-11: the whole-set wait requires the runtime bearer even on loopback.
   if (!requireRuntimeBearer(req, res)) return undefined;
+  const watchMode = parseWatchMode(url);
+  if (watchMode === null) return _deps.sendJsonResponse(res, 400, { error: 'watch_invalid' });
   const rawLead = url && url.searchParams ? String(url.searchParams.get('lead_agent_session_id') || '').trim() : '';
   if (!rawLead) return _deps.sendJsonResponse(res, 400, { error: 'wait_scope_unresolved' });
   if (rawLead.length > 160 || /[\x00-\x1f\x7f]/.test(rawLead)) {
@@ -657,7 +756,12 @@ async function handleWorkersWait(req, res, url) {
   if (!leadCtmSessionId) return _deps.sendJsonResponse(res, 400, { error: 'wait_scope_unresolved' });
   const rawWait = url && url.searchParams ? url.searchParams.get('wait_ms') : null;
   if (rawWait !== null && !/^\d+$/.test(rawWait)) return _deps.sendJsonResponse(res, 400, { error: 'wait_ms_invalid' });
-  const waitMs = Math.min(WORKER_WAIT_MAX_MS, Math.max(WORKER_WAIT_MIN_MS, rawWait !== null ? Number(rawWait) : 240000));
+  // WP-2 (D-5): a Codex lead's wait is held under Codex's 300 s MCP call ceiling right after the
+  // ordinary clamp; the route-scoped `?route=` wait below shares the same capped value.
+  const waitMs = capWaitMsForLead(
+    Math.min(WORKER_WAIT_MAX_MS, Math.max(WORKER_WAIT_MIN_MS, rawWait !== null ? Number(rawWait) : 240000)),
+    leadCtmSessionId,
+  );
   // D-7: an optional `route` parks on the alias's hold instead of the lead's workers.
   const rawRoute = url && url.searchParams ? url.searchParams.get('route') : null;
   if (rawRoute !== null) {
@@ -676,6 +780,8 @@ async function handleWorkersWait(req, res, url) {
       waited_ms: Date.now() - routeStartedAt,
       route: rawRoute,
       admission: workerAdmission.snapshot()[rawRoute] || null,
+      // WP-2 (D-9): a route hold covers no worker of this lead -- nothing is live to wait on.
+      lead_next_step: null,
     });
   }
   let rows = [];
@@ -694,6 +800,8 @@ async function handleWorkersWait(req, res, url) {
   const startedAt = Date.now();
   let wokeOn = 'timeout';
   let wokeWorkerId = null;
+  let watcherReason = null;
+  let watcherDecisions = [];
   if (pendingTerminal) {
     wokeOn = 'terminal';
     wokeWorkerId = pendingTerminal.ctm_session_id;
@@ -703,6 +811,7 @@ async function handleWorkersWait(req, res, url) {
     for (const row of rows) generationById[row.ctm_session_id] = _deps.getSession(row.ctm_session_id)?._workerGeneration;
     const handle = workerObservability.waitForWorkers({
       workerIds: rows.map((row) => row.ctm_session_id), leadId: leadCtmSessionId, waitMs, generationById,
+      ...(watchMode === 'off' ? {} : { watchMode, ...waitWatchWiring() }),
     });
     let gone = false;
     res.on('close', () => { if (!res.writableEnded) { gone = true; handle.release(); } });
@@ -717,7 +826,9 @@ async function handleWorkersWait(req, res, url) {
         try {
           const first = await statusReader.call(_deps.delegateWorker, row.ctm_session_id);
           if (first && first.generation != null) handle.setGeneration(row.ctm_session_id, first.generation);
-          if (first && _WORKER_TERMINAL_STATUSES.has(first.status) && !row.consumed_at && !row.acknowledged_at) {
+          // WP-1 (session-stops-followups-2026-10-24.html D-1): provisional is not terminal here
+          // either -- a live worker's report is not mail.
+          if (first && workerObservability.isFinalWorkerStatus(first) && !row.consumed_at && !row.acknowledged_at) {
             handle.release(); wokeOn = 'terminal'; wokeWorkerId = row.ctm_session_id; break;
           }
         } catch { /* expected: one unreadable worker never fails the whole-set wait */ }
@@ -726,6 +837,10 @@ async function handleWorkersWait(req, res, url) {
         const wake = await handle.promise;
         wokeOn = wake.why;
         wokeWorkerId = wake.workerId;
+        // WP-1 (D-3): the watcher's own outcome (why it woke the lead, and every decision it
+        // recorded) rides beside woke_on.
+        watcherReason = wake.detail && typeof wake.detail.reason === 'string' ? wake.detail.reason : null;
+        watcherDecisions = wake.decisions || [];
       }
     } finally {
       handle.release();
@@ -755,11 +870,40 @@ async function handleWorkersWait(req, res, url) {
   return _deps.sendJsonResponse(res, 200, {
     woke_on: wokeOn,
     waited_ms: waitedMs,
+    watcher_reason: watcherReason,
+    watcher_decisions: watcherDecisions,
     worker: workerPayload,
     workers: summary,
+    // WP-2 (D-9, AC-2a): non-null while some worker this wait covered is still live. The
+    // woken worker is named first (a wake on an advisory/generation/user_input/`watcher`
+    // leaves it working); a terminal wake names the first still-live row of the summary
+    // instead, so a lead with several workers is never told to stop waiting while one runs.
+    lead_next_step: waitLeadNextStep({ wokeWorkerId, workerPayload, summary }),
   });
 }
 
+// WP-2 (D-9): the whole-set wait's lead_next_step. The woken worker wins when its own payload
+// says it is non-terminal; otherwise the first non-terminal row of the summary is named; an
+// all-terminal wake (and a set that reads empty) is null.
+function waitLeadNextStep({ wokeWorkerId, workerPayload, summary }) {
+  const wokenStatus = workerPayload && typeof workerPayload.status === 'string' ? workerPayload.status : '';
+  // WP-1 (session-stops-followups-2026-10-24.html D-1/D-4): a provisional woken payload is
+  // still live, so it is named with the provisional label rather than read as finished.
+  if (wokeWorkerId && wokenStatus && !workerObservability.isFinalWorkerStatus(workerPayload) && !workerPayload.error) {
+    return waitNextStep({ workerId: wokeWorkerId, status: waitStatusLabel(workerPayload) });
+  }
+  const live = (Array.isArray(summary) ? summary : []).find((row) => row && row.terminal === false && row.ctm_session_id);
+  return live ? waitNextStep({ workerId: live.ctm_session_id, status: live.status }) : null;
+}
+
+// WP-1 (session-stops-followups-2026-10-24.html D-4): the status words lead_next_step names. A
+// bare "report_ready" reads as finished; the provisional case says the process is still running.
+function waitStatusLabel(payload) {
+  return payload && payload.report_provisional === true
+    ? `${payload.status} (provisional: its process is still running)`
+    : String(payload && payload.status || '');
+}
+
 // The body of the former handleWorkerStatusRead inline path, factored verbatim (WP-5 D-15:
 // "reuse that code path; do not duplicate it") so the single-id read and the whole-set
 // wait's `worker` payload run the SAME reader call, the same markAgentConsumed /
@@ -767,6 +911,8 @@ async function handleWorkersWait(req, res, url) {
 // throw propagates to the caller to map.
 async function workerStatusReadPayload(sessionId, url) {
   try {
+    // WP-2 (worker-terminal-stamp-durable 2026-10-26 D-2): a status read of a dead-but-unstamped worker repairs the row first.
+    if (typeof _deps.delegateWorker.repairExitedWorkerRow === 'function') { try { _deps.delegateWorker.repairExitedWorkerRow(sessionId); } catch { /* expected: a repair that throws must not fail the read; the next read retries */ } }
     const statusReader = _deps.delegateWorker.getWorkerStatusWithProgress || _deps.delegateWorker.getWorkerStatus;
     const result = await statusReader.call(_deps.delegateWorker, sessionId);
     if (result && typeof result.terminal_path === 'string') {
@@ -1265,10 +1411,16 @@ function register() {
       // POST /api/sessions/:id/park, /api/sessions/:id/pin, /api/sessions/:id/wake
       method: 'POST',
       regex: /^\/api\/sessions\/([^/]+)\/(park|revive|pin|wake)$/,
-      handler: (req, res, url, params) => {
+      handler: async (req, res, url, params) => {
         let sessionId = '';
         try { sessionId = decodeURIComponent(params['1'] || ''); }
         catch { return _deps.sendJsonResponse(res, 400, { ok: false, error: 'invalid_session_id' }); }
+        // WP-6 (§7 ownership routing, AC-6b): a MIRROR session's lifecycle action belongs to the
+        // BOX — the relayed frame carries the ORIGINAL id, and the box's own handler is the one
+        // that owns the PTY (D-2). A local session is untouched: the lookup misses and the existing
+        // handler below runs byte-identically. An unreachable box is a 503 machine_unreachable,
+        // never a local act on a session this hub does not have.
+        if (await remoteMachineCatalog.forwardLifecycleRequest(req, res, sessionId, params['2'])) return undefined;
         if (params['2'] === 'park') return _deps.apiSessionPark(req, res, sessionId);
         if (params['2'] === 'pin') return _deps.apiSessionPin(req, res, sessionId);
         if (params['2'] === 'wake') return _deps.apiSessionWake(req, res, sessionId);

package/template/coding-task-manager/lib/api/transcript-history.js

@@ -123,10 +123,23 @@ async function serveTranscriptHistoryV2(options) {
     // reader-seam-content-authority R-4 (WP-2): `fence` STAYS on the wire for compatibility -- an older client still reads it, and dropping a field is
     // not what this design asks for -- but a client built from that design ignores it: the seam join is proven by CONTENT (row-join.js findJoin), never
     // by paint time, so the boundary only ever places the painted DRAW start (`index`), never a proof.
-    if (!cursor && result && result.ok === true && typeof askPaintedAfter === 'function' && Number.isFinite(result.snapshot && result.snapshot.mtimeMs)) {
-      const reply = await askPaintedAfter(sessionId, result.snapshot.mtimeMs - PAINT_AFTER_WRITE_MS, result.snapshot.mtimeMs).catch(() => null /* expected: the proof is optional; no field is the honest answer */);
-      if (reply && reply.known === true && Number.isFinite(reply.epoch)) result.paintedAfter = { epoch: reply.epoch, index: Number.isFinite(reply.paintedAfter) ? reply.paintedAfter : null, ...('paintedFence' in reply ? { fence: Number.isFinite(reply.paintedFence) ? reply.paintedFence : null } : {}) };
-      if (controller.signal.aborted || res.destroyed) return;
+    if (result && result.ok === true && typeof askPaintedAfter === 'function' && Number.isFinite(result.snapshot && result.snapshot.mtimeMs)) {
+      // seam-refresh-painted-after (live incident 2026-10-25 18:55Z): the proof belongs to the WINDOW, not to the request
+      // shape. The newest window is the one whose answer reaches the transcript's tail -- `newerCursor === null` (the Claude
+      // lane sets exactly that when `reachedSnapshotTail`), whether or not the request carried a cursor. The client's D-18
+      // ladder re-asks page 0 one second later CURSORED (`refreshSeamPage`: `cursor = raw.olderCursor`, direction `newer`) --
+      // the same newest window -- and joins that answer exactly like the entry landing, so an answer that reaches the tail
+      // must carry the proof either way: without it the join falls back to the store's contiguous start and 259 un-anchored
+      // rows appear below page 0 while scrollTop stays, dropping the live terminal. A cursored answer that still has a
+      // `newerCursor` is an older window (or a `newer` page that did not reach the tail) the client never joins: no ask for
+      // it. A host that answers with no `newerCursor` field at all predates it, and there the request shape is the only tail
+      // signal there is: `!cursor`, exactly as before.
+      const windowReachesTail = 'newerCursor' in result ? result.newerCursor === null : !cursor;
+      if (windowReachesTail) {
+        const reply = await askPaintedAfter(sessionId, result.snapshot.mtimeMs - PAINT_AFTER_WRITE_MS, result.snapshot.mtimeMs).catch(() => null /* expected: the proof is optional; no field is the honest answer */);
+        if (reply && reply.known === true && Number.isFinite(reply.epoch)) result.paintedAfter = { epoch: reply.epoch, index: Number.isFinite(reply.paintedAfter) ? reply.paintedAfter : null, ...('paintedFence' in reply ? { fence: Number.isFinite(reply.paintedFence) ? reply.paintedFence : null } : {}) };
+        if (controller.signal.aborted || res.destroyed) return;
+      }
     }
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify(result));

package/template/coding-task-manager/lib/api/worktrees.js

@@ -87,9 +87,14 @@ function configure({
     invalidateWorktreeCaches,
     installRoot,
     apiListWorktrees,
-    apiCreateWorktree,
-    apiCancelWorktreeCreateJob,
-    apiGetWorktreeCreateJob,
+    // WP-4 (§6.5, §9 S-10): machine-aware by construction. The route below stays the plain
+    // dispatch shape worktree-create-job-log.test.js pins — the remote-machine decision lives in
+    // this wrapper, so a request naming a remote box creates the worktree ON the box and every
+    // other request (no `machine`, or `machine` = this instance) is the unmodified local handler.
+    apiCreateWorktree: machineRoutedCreateWorktree(apiCreateWorktree),
+    // Hub WP-5: an async create on a box returns the BOX's job id, so its poll and cancel follow it.
+    apiCancelWorktreeCreateJob: machineRouted('POST /api/worktrees/create-jobs/:id/cancel', apiCancelWorktreeCreateJob),
+    apiGetWorktreeCreateJob: machineRouted('GET /api/worktrees/create-jobs/:id', apiGetWorktreeCreateJob),
     apiSyncWorktree,
     apiSyncAllWorktrees,
     apiWorktreeInventory,
@@ -459,41 +464,37 @@ function apiFinishWorktree(req, res) {
   });
 }
 
-// WP-7 (nightly-browser-tier-green-2026-10-18 §8 WP-7, nightly rows A-9/A-10, new-session-cwd):
-// the red artifacts could not say whether the async create job ever started, which phase it
-// reached, or how long it had been running when the client gave up. The job state machine itself
-// lives in server.js (_startWorktreeCreateJob/apiGetWorktreeCreateJob); this file is dispatch-only,
-// so the phases are read off the job snapshot the handler writes back -- one line per phase change
-// and one per terminal phase. Logging only: the response is passed through untouched.
-const _worktreeJobPhases = new Map();
+// The [worktree-job] log lines moved back to their single state chokepoint
+// (server.js _recordWorktreeCreateJobProgress) in WP-4 of nightly-browser-tier-round2-2026-10-21:
+// this file's response-body observer only saw the two dispatch routes, so the GET poll route
+// and every transition it did not happen to answer went unlogged. Dispatch-only again.
 
-function _logWorktreeJobPhase(body) {
-  const id = String(body.jobId || body.id || '');
-  const phase = String(body.progress?.stage || body.stage || body.status || '');
-  if (!id || !phase) return;
-  const elapsedMs = Number(body.elapsedMs || 0) || 0;
-  const terminal = phase === 'failed' || phase === 'cancelled';
-  if (_worktreeJobPhases.get(id) === phase && !terminal) return;
-  _worktreeJobPhases.set(id, phase);
-  if (_worktreeJobPhases.size > 64) _worktreeJobPhases.delete(_worktreeJobPhases.keys().next().value);
-  const line = `[worktree-job] id=${id} phase=${phase} elapsedMs=${elapsedMs}`;
-  if (terminal) console.warn(line);
-  else console.log(line);
+// WP-4 of remote-machine-hub-sessions-2026-10-22 (§6.5, §9 S-10): remote-machine routing for
+// POST /api/worktrees/create. The decision is made BEFORE the local handler, so a request naming a
+// remote box has its worktree created ON the box (the returned path is box-local, which is exactly
+// what the caller then passes as the session cwd) — and a request with no `machine`, or one naming
+// THIS instance, falls through to the injected apiCreateWorktree unchanged.
+//
+// It wraps the DEP rather than the route on purpose: worktree-create-job-log.test.js pins the
+// dispatch shape (`handler: (req, res) => _deps.apiCreateWorktree(req, res),`) and asserts no
+// response-observer came back to this file — so the routing belongs on the handler it dispatches
+// to, not on the registration line.
+//
+// This is the only one of the four S-9/S-10 routes this file owns; the other three are answered by
+// the lead's one-line hook in server.js's apiGetProjects/apiPathStatus/apiPathSuggest (same module,
+// same contract) — so this file proves the wiring, and the integration test drives the other three
+// through lib/remote-machine-proxy.js directly.
+function machineRouted(route, localHandler) {
+  return function apiWorktreeMachineRouted(req, res) {
+    const remoteMachineProxy = require('../remote-machine-proxy');
+    if (!remoteMachineProxy.isMachineRouted(req, null)) return localHandler(req, res);
+    return remoteMachineProxy.maybeProxyMachineRequest(req, res, null, { route })
+      .then((handled) => (handled ? undefined : localHandler(req, res)));
+  };
 }
 
-function _observeWorktreeJobRoute(handler) {
-  return (req, res) => {
-    const end = res.end.bind(res);
-    res.end = (chunk, ...rest) => {
-      let parsed = null;
-      try {
-        parsed = typeof chunk === 'string' && chunk ? JSON.parse(chunk) : null;
-      } catch { parsed = null; }
-      if (parsed && typeof parsed === 'object') _logWorktreeJobPhase(parsed);
-      return end(chunk, ...rest);
-    };
-    return handler(req, res);
-  };
+function machineRoutedCreateWorktree(localHandler) {
+  return machineRouted('POST /api/worktrees/create', localHandler);
 }
 
 function register() {
@@ -511,12 +512,12 @@ function register() {
     {
       method: 'POST',
       path: '/api/worktrees/create',
-      handler: _observeWorktreeJobRoute((req, res) => _deps.apiCreateWorktree(req, res)),
+      handler: (req, res) => _deps.apiCreateWorktree(req, res),
     },
     {
       method: 'POST',
       regex: /^\/api\/worktrees\/create-jobs\/([^/]+)\/cancel$/,
-      handler: _observeWorktreeJobRoute((req, res) => _deps.apiCancelWorktreeCreateJob(req, res)),
+      handler: (req, res) => _deps.apiCancelWorktreeCreateJob(req, res),
     },
     {
       method: 'GET',

package/template/coding-task-manager/lib/approval-drift.js

@@ -54,4 +54,19 @@ function evaluateDrift({ text, providerMatched, waitingForInput } = {}) {
   };
 }
 
-module.exports = { evaluateDrift };
+// Returns the drift record when no provider recognizes `text` and evaluateDrift raises; else null.
+// This is the entry point callers use at the moment they PUNT on a live menu — so the
+// "no provider matched" decision and the drift evaluation cannot drift apart.
+// Never throws: an evaluation (or detection) error is REPORTED — a comment-only catch here
+// would hide the alarm's own failure, which is exactly the silence this module exists to break.
+function driftIfUnrecognized({ text, detectProvider } = {}) {
+  try {
+    if (detectProvider && detectProvider(text)) return null;
+    return evaluateDrift({ text, providerMatched: false, waitingForInput: true });
+  } catch (err) {
+    console.warn('[approval-drift] evaluation failed:', err && err.message ? err.message : err);
+    return null;
+  }
+}
+
+module.exports = { evaluateDrift, driftIfUnrecognized };

package/template/coding-task-manager/lib/approval-logical-frame.js

@@ -3,7 +3,11 @@
 const ANCHOR_RE = /Esc to cancel|esc to cancel|Press enter to confirm|\(esc or n\)/;
 const YES_RE = /^\s*(?:[❯›▶▸>]\s*)?\d+\.\s*(?:Yes|Allow)\b/i;
 const CURSOR_RUN_RE = /^\s*(?:[▸❯›▶→>-]+\s*)?Run\s*\(once\)\s*\(y\)/i;
-const QUESTION_RE = /Would you like to|Do you want to|Run this command\?|Allow (?:this|the)|needs? (?:your )?(?:approval|permission)/i;
+// Codex's MCP approval asks 'Allow <actor> to run tool "<tool>"?' where the
+// actor is "the <server> MCP server", "this app", or the connector's display
+// name (e.g. "Google Drive") — hence both the bare "Allow this/the" form below
+// and the "Allow … to run tool" form.
+const QUESTION_RE = /Would you like to|Do you want to|Run this command\?|Allow (?:this|the)|Allow .+ to run tool|needs? (?:your )?(?:approval|permission)/i;
 const SELECTION_RE = /[❯›▶▸→]|^\s*>\s*\d+\./;
 
 function lineStyled(line) {

package/template/coding-task-manager/lib/approval-scope.js

@@ -184,22 +184,79 @@ function kernelJoin(absPath) {
   return acc;
 }
 
+// D-5: at most this many symlink-follow restarts before the resolution is
+// declared unresolvable (Linux MAXSYMLINKS).
+const MAX_SYMLINK_RESTARTS = 40;
+
+// lstat WITHOUT following the link: `stat` is the link's own Stats (non-null
+// even for a dangling link), `stat: null` is a plain ENOENT — "not there at
+// all, keep walking upward as today" — and `error: true` is any other failure
+// (EACCES, ELOOP, ENAMETOOLONG), which the caller must fail closed on.
+function lstatNoFollow(p) {
+  try {
+    return { stat: fs.lstatSync(p) };
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return { stat: null };
+    /* expected: any other lstat failure is unresolvable — fail closed rather
+       than guess the scope of a path we could not even inspect */
+    return { error: true };
+  }
+}
+
 // `lexical` must already be an absolute, normalized path. Walks upward until
 // it finds a segment that exists, resolves THAT segment's real, canonical
 // (case-normalized) path, then rejoins the missing tail segments (their case
 // is whatever the caller/typed them — irrelevant for scope roots, and
 // protected-pattern matching is itself case-insensitive).
+//
+// D-5/D-6: a DANGLING symlink is followed (bounded by MAX_SYMLINK_RESTARTS)
+// rather than treated as a missing component — `fs.existsSync` follows the
+// link and reports false for a dangling one, so the plain upward walk would
+// strip the link NAME off into `tail` and rejoin it under the in-scope
+// parent, classifying a write that really lands in the link's target as
+// in-scope. Returns null when the path cannot be resolved (restart budget
+// exhausted, or lstat/readlink failed with anything but ENOENT); callers
+// treat null as "unresolvable ⇒ out of scope".
 function resolveDeepestExisting(lexical) {
   let cur = lexical;
-  const tail = [];
-  // Bounded by path depth; a pathological input can't loop forever since
-  // path.dirname('/') === '/' and the loop exits at the root either way.
-  for (let i = 0; i < 64 && cur !== path.sep; i += 1) {
+  let tail = [];
+  let restarts = 0;
+  // Bounded by path depth plus the restart budget; a pathological input can't
+  // loop forever since path.dirname('/') === '/' and the loop exits at the
+  // root either way.
+  const maxSteps = 64 + MAX_SYMLINK_RESTARTS;
+  for (let i = 0; i < maxSteps && cur !== path.sep; i += 1) {
     if (fs.existsSync(cur)) {
       const real = nativeRealpath(cur);
       const base = real || cur;
       return tail.length ? path.join(base, ...tail) : base;
     }
+    const lstat = lstatNoFollow(cur);
+    if (lstat.error) return null;
+    if (lstat.stat && lstat.stat.isSymbolicLink()) {
+      if (restarts >= MAX_SYMLINK_RESTARTS) return null;
+      restarts += 1;
+      let text = null;
+      try {
+        text = fs.readlinkSync(cur);
+      } catch {
+        /* expected: the link vanished or is unreadable — fail closed */
+        return null;
+      }
+      // Resolve the link text against the link's REAL parent, kernel-style
+      // (absolute text wins; relative text hangs off the parent), then re-join
+      // the already-stripped tail and re-run it through kernelJoin so no `..`
+      // inside the link text is collapsed lexically before a symlink ahead of
+      // it is followed.
+      const parent = path.dirname(cur);
+      const parentReal = nativeRealpath(parent) || parent;
+      const target = path.isAbsolute(text) ? text : `${parentReal}/${text}`;
+      // NB: the link's own NAME is NOT part of the result — the target
+      // replaces it, exactly as the kernel does.
+      cur = kernelJoin(tail.length ? `${target}/${tail.join('/')}` : target);
+      tail = [];
+      continue;
+    }
     tail.unshift(path.basename(cur));
     const parent = path.dirname(cur);
     if (parent === cur) break;
@@ -342,6 +399,11 @@ function classifyPathDetailed(p, opts = {}) {
     }
   }
 
+  // D-6: an unresolvable path (symlink loop / restart budget exhausted /
+  // lstat-readlink failure) cannot be proven in scope; it fails closed AFTER
+  // the protected check above, so a protected literal still classifies protected.
+  if (!resolved) return { scope: 'out_of_scope' };
+
   // C1: the RESOLVED path (not the lexical one) must be under an in-scope
   // root — a symlink anywhere in the chain that points outside scope must
   // not win just because the lexical spelling looked like it was under cwd.
@@ -380,6 +442,8 @@ function scopeOfRmTarget(target, ctx, recursive) {
   const lexical = path.isAbsolute(t) ? path.normalize(t) : path.resolve(ctx.cwd, t);
   if (leafIsSymlink(lexical)) return 'out_of_scope';
   const resolved = detail.resolved || resolveDeepestExisting(lexical);
+  // D-6: same fail-closed rule as classifyPathDetailed.
+  if (!resolved) return 'out_of_scope';
   if (SCRATCH_RM_RE.test(resolved) || SCRATCH_RM_RE.test(lexical)) return 'in_scope';
   const tmpdirAbs = normalizeRoot(ctx.tmpdir || os.tmpdir());
   const tmpdirReal = nativeRealpath(tmpdirAbs) || tmpdirAbs;

package/template/coding-task-manager/lib/auth-context.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
-const { ALL_SCOPES } = require('./auth-rules');
+const { ALL_SCOPES, PEER_CONTROL_SCOPE } = require('./auth-rules');
 
 const TEST_REMOTE_HEADER = 'x-ctm-test-remote';
 const resolvedEnvCredentialIdentities = new WeakMap();
@@ -195,6 +195,31 @@ function parseSyncPeerTokens(raw = '') {
 
 function resolveSyncPeerToken(token, req, env = process.env) {
   const peerId = peerIdFromRequest(req);
+  // WP-2a (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.2, D-7/D-8): the pool
+  // secret is the rev-2 replacement for the hand-copied env token. This is the FIRST branch so a
+  // `ctmpool1_` bearer never reaches the env path (and CTM_SYNC_PEER_ALLOWLIST — an env-era knob —
+  // does not apply to it). verification is SYNCHRONOUS over the loaded in-memory pool state: no I/O
+  // on the auth path. The resolved principal carries the SAME scopes as the env peer
+  // ({'sync','peer-control'}), so every existing peer-control rule row applies unchanged.
+  if (String(token || '').startsWith(require('./machine-pool').TOKEN_PREFIX)) {
+    const pool = require('./machine-pool').getMachinePool();
+    if (!pool.verify(token)) return { authenticated: false, source: 'machine-pool-invalid' };
+    const poolId = pool.poolId();
+    const authenticatedPeerId = peerId || (poolId ? `pool-${poolId}` : '');
+    return {
+      authenticated: true,
+      deviceId: `machine-pool-${authenticatedPeerId || hashTokenForLog(token)}`,
+      peerInstanceId: authenticatedPeerId,
+      peer_instance_id: authenticatedPeerId,
+      grantedPeerIds: authenticatedPeerId ? new Set([authenticatedPeerId]) : new Set(),
+      granted_peer_ids: authenticatedPeerId ? [authenticatedPeerId] : [],
+      scopes: new Set(['sync', PEER_CONTROL_SCOPE]),
+      stepUpFresh: false,
+      tokenLabel: 'machine-pool',
+      source: 'machine-pool',
+      tokenHashPrefix: hashTokenForLog(token),
+    };
+  }
   const peerTokens = parseSyncPeerTokens(env.CTM_SYNC_PEER_TOKENS || '');
   let tokenLabel = 'sync-peer';
   let authenticatedPeerId = '';
@@ -231,7 +256,12 @@ function resolveSyncPeerToken(token, req, env = process.env) {
     peer_instance_id: authenticatedPeerId,
     grantedPeerIds: authenticatedPeerId ? new Set([authenticatedPeerId]) : new Set(),
     granted_peer_ids: authenticatedPeerId ? [authenticatedPeerId] : [],
-    scopes: new Set(['sync']),
+    // WP-1 (docs/remote-machine-hub-sessions-2026-10-22.html §5 D-7, §6.2, §9 S-17): the SAME
+    // bearer (CTM_SYNC_PEER_TOKEN / CTM_SYNC_PEER_TOKENS — no new secret, no new env var) now
+    // resolves to {'sync','peer-control'}. `sync` keeps working exactly as before; the new
+    // capability is consumed only by the rule rows that declare `peerControl: true`
+    // (lib/auth-rules.js), which is the §6.2 allowlist and nothing else.
+    scopes: new Set(['sync', PEER_CONTROL_SCOPE]),
     stepUpFresh: false,
     tokenLabel,
     source: 'sync-peer-token',