create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/create/resolve-launch-params.js

@@ -456,7 +456,14 @@ function resolveCreateLaunchParams(ctx) {
   // alias because startup_tasks still stores that legacy column.
   const requestedTitle = String(msg.title || msg.label || '').replace(/^Resume:\s*/i, '').trim().slice(0, 120);
   const walleResumeRequest = msg.resumeWalle === true && !msg._isRestore;
-  const hasExplicitClientTitle = !msg._isRestore && !walleResumeRequest && !!requestedTitle;
+  // D-1: every resume sender echoes the row's own DISPLAYED title back (`label`/`title`), and
+  // an echoed label is not user intent — so a resume never yields a tier-1 (user) name.
+  // D-13/WP-5: a CTM-composed label (`Shell:`, `Folder:`, `Code Review:`, a review session, a
+  // best-of attempt, the Claude Desktop fork) declares itself with `titleIntent:'default'`, so it is
+  // written at tier 3 like any other echo. An absent titleIntent keeps today's semantics (an old
+  // client causes no regression), and the New Session modal's typed label still lands tier 1.
+  const hasExplicitClientTitle = !msg._isRestore && !walleResumeRequest && !isResumeLaunch
+    && msg.titleIntent !== 'default' && !!requestedTitle;
   let title = requestedTitle;
   if (!title) {
     const agentName = cmd.includes('claude') ? 'Claude Code'

package/template/coding-task-manager/lib/ctm-boot-lifecycle.js

@@ -91,8 +91,9 @@ function ctmLifecycleJournalPath({ env = process.env, configDir = null, instance
   return path.join(resolveEffectiveDataDir({ env, configDir }), 'logs', fileName);
 }
 
-function appendCtmBootLine({ pid = process.pid, env = process.env, configDir = null, instanceTag = null, port = null } = {}) {
+function appendCtmBootLine({ pid = process.pid, env = process.env, configDir = null, instanceTag = null, port = null, enteredAtServer = false } = {}) {
   _reportLaunchdProcessTypeOnBoot(env);
+  _reportBootEntryOnBoot(env, { enteredAtServer });
   return appendLifecycleLine(ctmLifecycleJournalPath({ env, configDir, instanceTag, port }), {
     ts: new Date().toISOString(),
     event: 'ctm-boot',
@@ -127,10 +128,25 @@ function _reportLaunchdProcessTypeOnBoot(env = process.env) {
   } catch { /* expected: a boot-time advisory must never block boot; the plist may be unreadable on a hardened install */ }
 }
 
+// WP-2 (clock-free r6 OQ-6): report-only boot check for the OTHER install drift — a launchd-managed
+// CTM whose plist still points at server.js directly, so bin/ctm-service-entry.js's conversation-storage
+// boot gate never ran. Rather than diff the plist (a second source of truth, and one that can't tell a
+// wrapper that execs the entry from a real bypass — D-2), the caller reports the RUNTIME fact
+// `require.main === module`. Warns once per boot so the drift can't stay silent for a month; never blocks
+// boot, never invokes launchctl, never reads or writes the plist. Only the real launchd-managed primary
+// is checked — a /ctm-dev instance (CTM_MANAGED_BY_LAUNCHD unset/'0') or non-darwin host has no plist.
+function _reportBootEntryOnBoot(env = process.env, { enteredAtServer = false, platform = process.platform, warn = console.warn } = {}) {
+  if (!enteredAtServer || env.CTM_MANAGED_BY_LAUNCHD !== '1' || platform !== 'darwin') return;
+  try {
+    warn('[launchd] CTM was started at server.js, so the conversation-storage boot gate did not run; re-run bin/install-service.sh or npx create-walle to enter through bin/ctm-service-entry.js');
+  } catch { /* expected: a boot-time advisory must never block boot */ }
+}
+
 module.exports = {
   resolvePrimaryDataDir,
   resolveEffectiveDataDir,
   isPrimaryInstance,
   ctmLifecycleJournalPath,
   appendCtmBootLine,
+  _reportBootEntryOnBoot,
 };

package/template/coding-task-manager/lib/db-domain-tables.js

@@ -93,6 +93,13 @@ const TABLE_DOMAINS = Object.freeze({
   // WP-3 (§6.4 S-12): where a shipped transcript landed on THIS instance. Same domain as
   // agent_sessions (the identity row it is written alongside) so one handle serves the consumer.
   sync_transcript_replicas: 'core',
+  // WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1): the hub machine registry.
+  machines: 'core',
+  // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/D-6/D-11): the machine
+  // pool's own tables, same domain as `machines` — one 'core' handle serves the whole feature.
+  host_samples: 'core',
+  machine_self: 'core',
+  machine_pairing_offers: 'core',
   // Legacy pre-v1 predecessors of ctm_sessions/agent_sessions/session_index.
   // Superseded but their CREATE TABLE IF NOT EXISTS guards remain for
   // fresh-v0 / mid-migration databases. Same domain as their successors

package/template/coding-task-manager/lib/db-domains.js

@@ -193,6 +193,26 @@ const CTM_WRITE_OPS = Object.freeze([
   'deleteChain', 'deleteCtmSession', 'deleteFolder', 'deleteHook', 'deleteImage',
   'deletePermissionRule', 'deletePrompt', 'deleteReview', 'deleteReviewComment',
   'deleteSessionAnalysis', 'deleteStaleAnalyses', 'deleteTemplate',
+  // WP-2 (docs/remote-machine-hub-sessions-2026-10-22.html §6.1/§8, deferred from WP-0): the hub
+  // machine-registry writes. `machines` is domain 'core' (lib/db-domain-tables.js), and each op's
+  // OP_META row in shared/storage/contract.js carries the same tag — Gate 2c (CTM_WRITE_OPS →
+  // OP_META kind:'write' + domain) and Gate 2c-inventory (a domain-tagged write op outside this
+  // list) are exactly the two assertions that require the pair to land together.
+  'upsertMachineRow', 'recordMachineProbe', 'deleteMachineRow',
+  // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-11): the 60 s host-sample
+  // write, on the same `core` handle as the machines rows above; its OP_META row in
+  // shared/storage/contract.js carries the matching kind:'write' + domain + tables:['host_samples'].
+  'recordHostSample',
+  // WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/P-5/P-6): the
+  // machine-owned settings write, the P-5 roster replacement (one transaction: upsert listed,
+  // delete unlisted, never self) and the leave() sweep. Each OP_META row in shared/storage/contract.js
+  // carries the matching kind:'write' + domain:'core'.
+  'setMachineSelf', 'replaceRosterMachines', 'deleteAllMachineRows',
+  // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9): the pairing-offer
+  // writes — mint, single-use redeem, and the 5-wrong-redeem burn. `machine_pairing_offers` is
+  // classified 'core' in lib/db-domain-tables.js and each op's OP_META row in
+  // shared/storage/contract.js carries the matching kind:'write' + domain + tables.
+  'insertPairingOffer', 'markPairingOfferRedeemed', 'burnLivePairingOffers',
   'deleteWorkspace', 'detachPromotedProviderChildSessions', 'duplicatePrompt',
   'enqueueSyncOutbox', 'flushSessionDiagnostics', 'flushSessionMetadataUpdates', 'heartbeatStartupTasks', 'incrementApprovalRuleMatch',
   'markStartupTaskExited', 'markStartupTaskUserPromptInput', 'markSyncOutboxDeliveredThrough', 'recordSyncOutboxServed',
@@ -205,7 +225,7 @@ const CTM_WRITE_OPS = Object.freeze([
   'supersedeHeldApprovalDecision', 'expireStaleHeldApprovalDecision', 'resolveApprovalDecision', 'claimWallePermissionResolution', 'commitWallePermissionResolution', 'expireOpenWallePermissions', 'restorePromptVersion', 'reviveStartupTask',
   'saveApprovalAiRefinementRule', 'saveApprovalRescuePattern', 'saveImage',
   'setAlwaysAsk', 'setPermRuleExceptions', 'setPromptParent',
-  'setScrollbackIdentity', 'setSessionStar', 'setSessionTitleMirror', 'setSessionTitleStatusNew',
+  'setScrollbackIdentity', 'setSessionStar', 'setSessionTitleMirror', 'setSessionTitleStatusNew', 'applyAgentTitleBackfillRows',
   'setSetting', 'startAnalysisRun', 'toggleApprovalRule', 'toggleAutoApproval',
   'toggleHook', 'trackPromptUsage', 'transferSessionOwnership', 'updateChain',
   'updateCodingSessionModel', 'updateFolder', 'updateHarvestState',
@@ -256,7 +276,6 @@ const CTM_WRITE_OPS = Object.freeze([
   'recordSyncPeerConflict', 'updateStartupTaskTitle', 'updateStartupTaskClaudeSession',
   'updateStartupTaskAttentionDismissal', 'updateStartupTaskLifecycle',
   'markStartupTaskParked', 'prepareScrollbackForSession', 'upsertAgentSessionIdentity',
-  'promoteStartupTaskTitleIfUserNamed', 'repairSessionTitlesFromStartupTasks',
   'repairCodexRolloutAgentIdentities', 'cleanupOrphanScrollbackIdentities',
 ].concat(require('../../shared/storage/ctm-domain-operation-contract').WORKSPACE_ACTIVITY_OWNER_WRITE_OPS));
 

package/template/coding-task-manager/lib/db-owner-op-registry.js

@@ -124,6 +124,13 @@ const RAW_DB_OWNER_OPS = {
   updatePromptEffectiveness: { expectedMs: 5000, resumable: false },
   applySafeRelinkRepairs: { expectedMs: 1000, resumable: false },
   recoverSessionIntegrity: { expectedMs: 1000, resumable: false },
+  // WP-3 (worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-5): one bounded,
+  // idempotent boot pass that fills agent_sessions.jsonl_path for Claude rows whose transcript is
+  // already at the derived path. `expectedMs` is a budget HINT, not a deadline: the dispatch
+  // deadline is max(interactive floor 60s, expectedMs*8) (lib/db-owner-op-deadline.js), and the op
+  // is additionally bounded by payload.limit (<=500 rows). Not resumable: the caller is a
+  // fire-and-forget boot hook with no redrive, and a redrive could only re-run a no-op.
+  linkDerivedClaudeTranscripts: { expectedMs: 2000, resumable: false },
   backfillSessionMessagesAsync: { expectedMs: 500, resumable: false },
   runContentRowsBackfillSweep: { expectedMs: 500, resumable: false },
   deleteStaleSessionAnalysesFromArtifact: {

package/template/coding-task-manager/lib/db-owner-worker-client.js

@@ -937,12 +937,34 @@ class CtmDbOwnerWorkerClient {
     }).catch(() => {});
   }
 
+  // WP-A P-2 (freeze-probes): the up-to-`limit` OLDEST client requests still outstanding on this
+  // worker, each { op, ageMs, started } -- what a memory step should be read against. One pass over
+  // the Map with a bounded insert (never a sort of the whole pending set: this runs on the sampler path).
+  _oldestPendingOps(limit = 5) {
+    const now = Date.now();
+    const oldest = [];
+    for (const pending of this._pending.values()) {
+      const entry = {
+        op: String(pending?.op || 'unknown'),
+        ageMs: Math.max(0, now - (Number(pending?.enqueuedAt) || now)),
+        started: Number(pending?.startedAt) > 0,
+      };
+      let at = oldest.length;
+      while (at > 0 && oldest[at - 1].ageMs < entry.ageMs) at -= 1;
+      if (at >= limit) continue;
+      oldest.splice(at, 0, entry);
+      if (oldest.length > limit) oldest.pop();
+    }
+    return oldest;
+  }
+
   getStatus() {
     const s = {
       ...this._status,
       ready: this._ready,
       closed: this._closed,
       pendingClientRequests: this._pending.size,
+      pendingOps: this._oldestPendingOps(),
       degraded: this.isDegraded(),
       degradedUntil: this._degradedUntil,
       consecutiveTimeouts: this._consecutiveTimeouts,

package/template/coding-task-manager/lib/db-schema-source-files.js

@@ -39,6 +39,7 @@ const SCHEMA_SOURCE_FILES = Object.freeze([
   'lib/migrations/v52-coding-session-launch-generations.js',
   'lib/migrations/v53-session-model-intent.js',
   'lib/migrations/v54-session-lead-model.js',
+  'lib/migrations/v56-host-samples-and-machine-pool.js',
   'lib/migrations/v29-usage-accounting.js', 'lib/migrations/v30-usage-reporting.js', 'lib/migrations/v36-conversation-projection-deletes.js',
   '../shared/usage-store.js', '../shared/usage-reporting-schema.js',
   'lib/delete-ctm-session-saga.js',

package/template/coding-task-manager/lib/feature-manifest.js

@@ -612,8 +612,6 @@ const FEATURES = [
   { id: "ctm_ctm_fp_memo", env: "CTM_FP_MEMO", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
   // !== '0' comparison found; 1 site(s); first: lib/ws/state-sync.js:470
   { id: "ctm_ctm_frame_nack", env: "CTM_FRAME_NACK", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
-  // !== '0' comparison found; 1 site(s); first: server.js:36110
-  { id: "ctm_ctm_freeze_park_giant", env: "CTM_FREEZE_PARK_GIANT", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
   // numeric-tunable suffix/read shape; 1 site(s); first: lib/perf-tracker.js:829
   { id: "ctm_ctm_freeze_probe_ms", env: "CTM_FREEZE_PROBE_MS", owner: "ctm-core-team", stage: "ops", tunable: true, default: 0, since: "2026-08-24", expires: null, note: "numeric tunable" },
   // !== '0' comparison found; 1 site(s); first: server.js:445
@@ -1559,7 +1557,7 @@ const FEATURES = [
   // no polarity/tunable/config pattern matched; 1 site(s); first: db.js:4416
   { id: "ctm_ctm_sqlite_synchronous", env: "CTM_SQLITE_SYNCHRONOUS", owner: "ctm-core-team", stage: "ops", defaultOn: true, since: "2026-08-24", expires: null, note: "unclassified raw read; needs manual triage" },
   // numeric-tunable suffix/read shape; 1 site(s); first: db.js:4373
-  { id: "ctm_ctm_sqlite_write_lock_stale_ms", env: "CTM_SQLITE_WRITE_LOCK_STALE_MS", owner: "ctm-core-team", stage: "ops", tunable: true, default: 0, since: "2026-08-24", expires: null, note: "numeric tunable" },
+  { id: "ctm_ctm_sqlite_write_lock_stale_ms", env: "CTM_SQLITE_WRITE_LOCK_STALE_MS", owner: "ctm-core-team", stage: "removed", defaultOn: false, since: "2026-08-24", expires: null, note: "retired 2026-10-23 (fsevents-churn WP-1, docs/fsevents-churn-kernel-write-lock-2026-10-23.html D-4): the SQLite write lock is a kernel lock on a .mutex lock DB released by the OS when its holder dies, so stale-claim recovery and its age knob were deleted; no read of this name survives." },
   // !== '0' comparison found; 1 site(s); first: server.js:448
   { id: "ctm_ctm_stale_grid_embargo", env: "CTM_STALE_GRID_EMBARGO", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
   // !== '0' comparison found; 1 site(s); first: server.js:19764

package/template/coding-task-manager/lib/fs-watcher.js

@@ -4,6 +4,7 @@ const path = require('path');
 const EventEmitter = require('events');
 const { namedInterval, runSync, wrap } = require('./perf-tracker');
 const envFlags = require('./env-flags');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 // Design doc mainloop-composer-freeze-2026-08-20.html §5 D-1, §6, §9 S-1/S-4. The 60s
 // scan tick and the attach/reattach directory walk ran completely unwrapped, so the
@@ -103,7 +104,7 @@ function resolveRoot(root) {
       result.refusalCode = 'wrong-owner';
       return result;
     }
-    if ((Number(targetStat.mode) & 0o022) !== 0) {
+    if (!isWritableOnlyByOwner(targetStat)) {
       result.validationStatus = 'refused';
       result.refusalCode = 'unsafe-permissions';
       return result;
@@ -159,7 +160,7 @@ async function resolveRootAsync(root) {
       result.refusalCode = 'wrong-owner';
       return result;
     }
-    if ((Number(targetStat.mode) & 0o022) !== 0) {
+    if (!isWritableOnlyByOwner(targetStat)) {
       result.validationStatus = 'refused';
       result.refusalCode = 'unsafe-permissions';
       return result;

package/template/coding-task-manager/lib/harness-history-transition.js

@@ -4,8 +4,14 @@ const NATIVE_ORIGINS = new Set(['native-codex', 'native-claude', 'native-opencod
 const KNOWN_ORIGINS = new Set([...NATIVE_ORIGINS, 'routed-proxy', 'portable-transcript']);
 // S-3: the adapter/schema ids and the version membership test come from the one qualified table.
 const { CODEX_CONTROL_ADAPTER, CODEX_COMPACTION_SCHEMA_RECEIPT, CODEX_PRE_TURN_COMPACTION_SCHEMA,
-  isQualifiedCodexVersion } = require('./codex-harness-qualification');
-const PORTABLE_HISTORY_KINDS = new Set(['text', 'tool-pair', 'native-world-state', 'native-lifecycle']);
+  isQualifiedCodexVersion, isNonElevatedCyberAccessProgram } = require('./codex-harness-qualification');
+// S-4: the ONE portable-kind set. `native-media` is a message whose only non-text content parts are
+// input_image parts (D-2); it is portable only to a Codex target, which is the planner's job below.
+const PORTABLE_HISTORY_KINDS = new Set(['text', 'tool-pair', 'native-world-state', 'native-lifecycle', 'native-media']);
+// D-5/D-6 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §6.2): the plaintext handoff
+// the source model writes is injected into the forked target, so it consumes target context that the
+// source estimate does not count. 32 KiB of summary text is 8_192 tokens at four characters each.
+const HANDOFF_TOKEN_RESERVE = 8_192;
 
 function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}) {
   if (signal?.aborted) return refuse('transition_cancelled');
@@ -17,9 +23,11 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
   const targetProviderId = nonempty(targetRecipe.providerId);
   const origin = nonempty(sourceRecipe.origin);
   const codexHistorySource = origin === 'native-codex' || sourceRecipe.harness === 'codex-cli';
+  // D-3: qualification is per record (D-1) plus the installed binary that performs the fork. The
+  // rollout's CREATOR version (session_meta.cli_version, written once at creation) is not the writer
+  // of its later records, so it is not a gate here.
   const qualifiedCodexHistorySource = codexHistorySource
-    && sourceRecipe.controlAdapterVersion === CODEX_CONTROL_ADAPTER
-    && isQualifiedCodexVersion(sourceRecipe.programVersion);
+    && sourceRecipe.controlAdapterVersion === CODEX_CONTROL_ADAPTER;
   if (!origin) return refuse('source_origin_unknown');
   if (!KNOWN_ORIGINS.has(origin)) return refuse('source_origin_unsupported');
   if (!sourceProviderId || !targetProviderId) return refuse('provider_identity_unknown');
@@ -31,7 +39,7 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
   if (nativeSource && sourceProviderId === targetProviderId) {
     return {
       action: 'reuse', reason: 'same_provider_native_history', sourceCheckpoint,
-      estimateTokens, targetBudgetTokens: null, evidenceKind,
+      estimateTokens, targetBudgetTokens: null, evidenceKind, handoff: null,
     };
   }
 
@@ -40,12 +48,8 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
   if (!sourceCheckpoint) return refuse('source_checkpoint_unknown');
   if (codexHistorySource && sourceProviderId !== targetProviderId
       && (!qualifiedCodexHistorySource
-        || !isQualifiedCodexVersion(sourceRecipe.programVersion)
-        || sourceRecipe.cyberAccessProgram !== null
-        || snapshot.previousSettings?.cyberAccessProgram !== null
-        || (snapshot.previousSettings?.programVersion !== undefined
-          && snapshot.previousSettings?.programVersion !== null
-          && !isQualifiedCodexVersion(snapshot.previousSettings.programVersion))
+        || !isNonElevatedCyberAccessProgram(sourceRecipe.cyberAccessProgram)
+        || !isNonElevatedCyberAccessProgram(snapshot.previousSettings?.cyberAccessProgram)
         || targetRecipe.harness !== 'codex-cli' || !isQualifiedCodexVersion(targetRecipe.harnessVersion))) {
     return refuse('native_fork_adapter_unqualified', { sourceCheckpoint });
   }
@@ -71,7 +75,27 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
     }
   }
   if (snapshot.opaque === true || has(snapshot.historyKinds, 'opaque')) return refuse('opaque_history_not_portable', { sourceCheckpoint });
-  if (snapshot.compacted === true) return refuse('compacted_source_fork_unqualified', { sourceCheckpoint });
+  // D-2: native media is portable exactly when the target is Codex, which strips images the target
+  // cannot accept (core/src/context_manager/normalize.rs:346 @ rust-v0.163.0). A non-Codex target
+  // gets a plain refusal instead of a silent rewrite of the source history.
+  if (has(snapshot.historyKinds, 'native-media') && targetRecipe.harness !== 'codex-cli') {
+    return refuse('history_media_not_portable', { sourceCheckpoint });
+  }
+  // D-5/D-6: a sealed `compaction` item is carried by a plaintext handoff the SOURCE model writes
+  // before the switch. Exactly one sealed digest can be covered, and only the native openai source
+  // (whose own model can be asked to write it) can produce one; everything else keeps a named refusal.
+  const sealed = (Array.isArray(snapshot.encryptedCompactions) ? snapshot.encryptedCompactions : [])
+    .filter((sha) => typeof sha === 'string' && /^[a-f0-9]{64}$/.test(sha));
+  if (sealed.length > 1) return refuse('encrypted_compaction_multiple', { sourceCheckpoint });
+  const handoff = sealed.length === 1 && snapshot.handoffCovers !== true
+    ? (qualifiedCodexHistorySource && origin === 'native-codex' && sourceProviderId === 'openai'
+      ? { required: true, compactionSha256: sealed[0] } : null)
+    : null;
+  if (sealed.length === 1 && snapshot.handoffCovers !== true && !handoff) {
+    return refuse('encrypted_compaction_handoff_unavailable', { sourceCheckpoint });
+  }
+  // D-4: a plaintext compaction is portable. Codex fork rebuilds the window from
+  // replacement_history, and no test, doc or incident ever justified the blanket refusal.
   if (snapshot.encrypted === true || has(snapshot.historyKinds, 'encrypted')) return refuse('encrypted_history_not_portable', { sourceCheckpoint });
   if (!Array.isArray(snapshot.historyKinds) || snapshot.historyKinds.length === 0
       || snapshot.historyKinds.some((kind) => !PORTABLE_HISTORY_KINDS.has(kind))) {
@@ -126,7 +150,10 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
     : null;
   const evidence = { sourceCheckpoint, estimateTokens, targetBudgetTokens, evidenceKind,
     ...(preTurnCompaction ? { preTurnCompaction } : {}) };
-  if (estimateTokens <= targetBudgetTokens) return { action: 'reuse', reason: 'history_fits_target', ...evidence };
+  // The injected handoff is target context the source estimate cannot see, so the comparison
+  // reserves it while every reported evidence field keeps the measured source value.
+  const budgetTokens = handoff?.required ? estimateTokens + HANDOFF_TOKEN_RESERVE : estimateTokens;
+  if (budgetTokens <= targetBudgetTokens) return { action: 'reuse', reason: 'history_fits_target', ...evidence, handoff };
 
   // Phase A has no qualified source-owned compact adapter. Native API acknowledgements alone
   // are not durable checkpoint receipts, so a recipe flag cannot authorize mutation here.
@@ -191,4 +218,4 @@ function refuse(reason, details = {}) {
   return { action: 'unsupported', reason, ...details };
 }
 
-module.exports = { inspectTransition, computeTargetBudget };
+module.exports = { inspectTransition, computeTargetBudget, PORTABLE_HISTORY_KINDS, HANDOFF_TOKEN_RESERVE };

package/template/coding-task-manager/lib/headless-inflight-ops.js

@@ -0,0 +1,203 @@
+'use strict';
+
+// WP-0 (stale-pty-host-evacuation-2026-10-24.html, D-6 §5/§6, S-12): the ONE
+// shared op-stamp slot pair in headless-term-service.js could only ever name
+// whichever op had stamped last, and any op finishing zeroed it unconditionally.
+// This module keeps a PER-SESSION in-flight op table instead, so a wedged op
+// names its own session (and the depth of work queued behind it) even while
+// another session is happily churning.
+//
+// Report-only by construction: nothing here can reject, time out, retry or
+// reorder an op (AC-0e). Every entry is a plain value; `now` is injected so
+// tests can grow an age without a wall clock.
+
+// An op that has been in flight this long is worth a one-shot
+// `headless-op-overdue` diagnostic (D-6 §6): long enough that a healthy host
+// never trips it, short enough to name the wedge inside the watchdog's own
+// minute-scale reporting.
+const HEADLESS_OP_OVERDUE_MS = 30_000;
+// How many entries a threadpool frame may carry (D-6 §6: the five oldest).
+const HEADLESS_OP_FRAME_MAX = 5;
+
+function _sidOf(value) {
+  return value == null ? '' : String(value);
+}
+
+// createInFlightOps({ now }) -> { begin, end, noteQueued, list, oldest }.
+//
+// `queued` is the number of ops enqueued for that session and not yet started,
+// i.e. the depth waiting behind the running one. It is tracked in `waiting` (a
+// session -> count map) rather than on the entry, so two ops enqueued
+// synchronously -- before the chain's first microtask stamps either of them --
+// still count correctly: enqueue bumps `waiting`, a start decrements it, and
+// list()/begin() report the remainder.
+function createInFlightOps({ now = Date.now } = {}) {
+  const entries = new Map(); // sessionId -> { sessionId, opType, startedAt, seq, queued }
+  const waiting = new Map(); // sessionId -> ops enqueued but not yet started
+  let seqCounter = 0;
+
+  const waitingFor = (sid) => waiting.get(sid) || 0;
+
+  function _setWaiting(sid, count) {
+    if (count > 0) waiting.set(sid, count);
+    else waiting.delete(sid);
+  }
+
+  // Called when an op actually starts (the stamp site of the per-session chain,
+  // and ONLY that chain -- an op dispatched outside it, e.g. a direct
+  // getViewportText, must not register here: `entries` holds one row per session,
+  // so it would overwrite a wedged chain op and its end() would then delete the
+  // wedge). Returns its seq, which the caller passes back to end() so a stale
+  // finisher cannot delete a newer op.
+  function begin(sessionId, opType) {
+    const sid = _sidOf(sessionId);
+    const behind = Math.max(0, waitingFor(sid) - 1);
+    _setWaiting(sid, behind);
+    const seq = (seqCounter += 1);
+    entries.set(sid, {
+      sessionId: sid,
+      opType: opType == null || opType === '' ? 'none' : String(opType),
+      startedAt: now(),
+      seq,
+      queued: behind,
+    });
+    return seq;
+  }
+
+  // Compare-and-clear: deletes the entry only if this seq is still the current
+  // one for the session. A late finisher from an earlier op is a no-op.
+  function end(sessionId, seq) {
+    const sid = _sidOf(sessionId);
+    const current = entries.get(sid);
+    if (!current || current.seq !== seq) return false;
+    entries.delete(sid);
+    return true;
+  }
+
+  // Called at enqueue time, before the op starts.
+  function noteQueued(sessionId, delta = 1) {
+    const sid = _sidOf(sessionId);
+    const next = Math.max(0, waitingFor(sid) + (Number(delta) || 0));
+    _setWaiting(sid, next);
+    const current = entries.get(sid);
+    if (current) current.queued = next;
+    return next;
+  }
+
+  function list() {
+    const out = [];
+    for (const entry of entries.values()) {
+      out.push({ ...entry, queued: waitingFor(entry.sessionId) });
+    }
+    return out;
+  }
+
+  // The n oldest in-flight ops, oldest first: { sid8, op, ageMs, queued, seq }.
+  // `at` defaults to now() so a test can assert a growing age on a frozen clock.
+  function oldest(n, at = now()) {
+    const limit = Number.isFinite(Number(n)) ? Math.max(0, Math.trunc(Number(n))) : 0;
+    const rows = [];
+    for (const entry of list()) {
+      rows.push({
+        sid8: entry.sessionId.slice(0, 8),
+        op: entry.opType,
+        startedAt: entry.startedAt,
+        seq: entry.seq,
+        ageMs: Math.max(0, at - entry.startedAt),
+        queued: entry.queued,
+      });
+    }
+    rows.sort((a, b) => (a.startedAt - b.startedAt) || (a.seq - b.seq));
+    return rows.slice(0, limit);
+  }
+
+  return { begin, end, noteQueued, list, oldest };
+}
+
+// Frame-side sanitizer: the manager keeps only strings/numbers it can trust in
+// the stored snapshot, capped at `max` entries, oldest first. Sorting by age
+// here (not just at the producer) is what makes "≤5, oldest first" a property
+// of the stored snapshot rather than of the transport. Anything unparseable is
+// normalised rather than thrown away.
+function sanitizeSessionOps(entries, max = HEADLESS_OP_FRAME_MAX) {
+  const limit = Number.isFinite(Number(max)) ? Math.max(0, Math.trunc(Number(max))) : HEADLESS_OP_FRAME_MAX;
+  const rows = [];
+  for (const raw of Array.isArray(entries) ? entries : []) {
+    const sid8 = _sidOf(raw?.sid8).slice(0, 8);
+    if (!sid8) continue;
+    const ageMs = Number(raw?.ageMs);
+    const queued = Number(raw?.queued);
+    const seq = Number(raw?.seq);
+    rows.push({
+      sid8,
+      op: raw?.op == null || raw.op === '' ? 'none' : String(raw.op),
+      ageMs: Number.isFinite(ageMs) ? ageMs : 0,
+      queued: Number.isFinite(queued) ? queued : 0,
+      seq: Number.isFinite(seq) ? seq : 0,
+    });
+  }
+  rows.sort((a, b) => b.ageMs - a.ageMs); // stable: equal ages keep producer order
+  return rows.slice(0, limit);
+}
+
+// Edge trigger for the report-only `headless-op-overdue` row (D-6 §6): at most
+// one hit per (hostId, sid8, seq) at or above thresholdMs. Each host's dedupe
+// set is re-derived from ITS OWN latest frame, so it can never grow past the ops
+// actually present in that frame -- and a seq that leaves the frame and later
+// returns is a NEW seq, so it reports again.
+function createOverdueEdgeTrigger({ thresholdMs = HEADLESS_OP_OVERDUE_MS } = {}) {
+  // hostId -> Set<'sid8|seq'>. The set is PER HOST: one shared set pruned against
+  // whichever host framed last would drop another host's keys, and that host's
+  // next frame would then re-report an op it had already reported.
+  const reportedByHost = new Map();
+  const keyOf = (entry) => `${entry.sid8}|${entry.seq}`;
+
+  function next(frameEntries, hostId, resolveSessionId) {
+    const entries = Array.isArray(frameEntries) ? frameEntries : [];
+    const host = String(hostId);
+    const present = new Set();
+    for (const entry of entries) present.add(keyOf(entry));
+    if (!reportedByHost.has(host)) reportedByHost.set(host, new Set());
+    const reported = reportedByHost.get(host);
+    for (const key of reported) {
+      if (!present.has(key)) reported.delete(key);
+    }
+    if (reported.size === 0) reportedByHost.delete(host);
+    const hits = [];
+    for (const entry of entries) {
+      if (!(Number(entry.ageMs) >= thresholdMs)) continue;
+      const key = keyOf(entry);
+      let seen = reportedByHost.get(host);
+      if (!seen) { seen = new Set(); reportedByHost.set(host, seen); }
+      if (seen.has(key)) continue;
+      seen.add(key);
+      hits.push({
+        sessionId: typeof resolveSessionId === 'function' ? resolveSessionId(entry.sid8) : entry.sid8,
+        details: {
+          hostId: host,
+          op: String(entry.op),
+          ageMs: Number(entry.ageMs),
+          queued: Number(entry.queued) || 0,
+          seq: Number(entry.seq) || 0,
+        },
+      });
+    }
+    return hits;
+  }
+
+  function size() {
+    let total = 0;
+    for (const set of reportedByHost.values()) total += set.size;
+    return total;
+  }
+
+  return { next, size };
+}
+
+module.exports = {
+  createInFlightOps,
+  createOverdueEdgeTrigger,
+  sanitizeSessionOps,
+  HEADLESS_OP_OVERDUE_MS,
+  HEADLESS_OP_FRAME_MAX,
+};

package/template/coding-task-manager/lib/headless-missing-reply.js

@@ -29,6 +29,48 @@ function headlessMissingReplies(message) {
   switch (msg.type) {
     case 'serialize':
       return [{ type: 'serialized', ...base, data: '', cols: 0, rows: 0, fp: '', missing: true }];
+    // WP-1 (stale-pty-host-evacuation-2026-10-24.html §5 D-5, §6 missing-reply case, §9 S-11):
+    // 'serialize-bootstrap' shares its body with 'serialize' in handleMessage
+    // (lib/headless-term-service.js:1796-1804), so it must share the REPLY TYPE too. The bootstrap
+    // gate listens only for `type === 'serialized'` with its own requestId (server.js:40730) and
+    // clears the moment `bootstrap` is absent (server.js:40746-40749, reason 'serialize-invalid').
+    // The generic default answer below produced 'serialize-bootstrap-result', which the gate ignored
+    // -- an honest "missing" was indistinguishable from a hung host, and the cold client waited out
+    // the 3 s deadline (reason 'deadline', phase 'serializing').
+    case 'serialize-bootstrap':
+      return [{ type: 'serialized', ...base, data: '', cols: 0, rows: 0, fp: '', bootstrap: null, missing: true }];
+    // 'recheck' is answered with 'feed-result' on BOTH normal branches (lib/headless-term-service.js:1506-1510
+    // for a session with no mirror, :1532-1544 for a live one) -- server.js keys the pending approval
+    // entry on that type, so the generic 'recheck-result' left the caller waiting for a reply it never got.
+    case 'recheck':
+      return [{
+        type: 'feed-result', ...base, hasApproval: false, providerId: null, text: null,
+        rawDetected: false, rawText: null, debugLines: [], missing: true,
+      }];
+    // The bootstrap handshake's two post-serialize ops answer 'terminal-bootstrap-activated' /
+    // 'terminal-bootstrap-flushed', keyed by clientId + socketGeneration + requestId
+    // (lib/headless-term-service.js:1956-1960, :1969-1973). server.js clears its gate only when it can
+    // find the client by those three fields, and an `accepted: false` is what turns "there is no host
+    // state to activate/flush" into an immediate failure instead of the gate's phase deadline
+    // (server.js:31247-31260 activated, :31300-31346 flushed).
+    case 'terminal-bootstrap-ack':
+      return [{
+        type: 'terminal-bootstrap-activated', ...base,
+        clientId: String(msg.clientId || ''), socketGeneration: Number(msg.socketGeneration || 0),
+        accepted: false, missing: true,
+      }];
+    case 'terminal-bootstrap-flush':
+      return [{
+        type: 'terminal-bootstrap-flushed', ...base,
+        clientId: String(msg.clientId || ''), socketGeneration: Number(msg.socketGeneration || 0),
+        accepted: false, throughSeq: 0, missing: true,
+      }];
+    // The archive-quiesce barrier and the painted-row drop both always post their own reply type
+    // (lib/headless-term-service.js:2173, :2180) -- the caller matches on (type, sessionId, requestId).
+    case 'flush-archive':
+      return [{ type: 'archive-flushed', ...base, missing: true }];
+    case 'drop-painted':
+      return [{ type: 'painted-dropped', ...base, missing: true }];
     case 'getViewportText':
       return [{ type: 'viewport-text', ...base, text: '', missing: true, cols: 0, rows: 0 }];
     case 'getText':