create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/headless-term-service.js

@@ -76,6 +76,7 @@ const { createErrorSink } = require('./error-sink');
 const { createPendingClientRegistry } = require('./state-sync/pending-client-registry');
 const { createApprovalTrailingRecheck } = require('./approval-trailing-recheck');
 const { composeTerminalBootstrapResult, truncateBootstrapAnsi } = require('./terminal-bootstrap');
+const { createInFlightOps } = require('./headless-inflight-ops'); // WP-0 (D-6): per-session in-flight op table
 
 let postMessage = () => {};
 const errorSink = createErrorSink({ name: 'worker:headless-terminal' });
@@ -87,6 +88,8 @@ const errorSink = createErrorSink({ name: 'worker:headless-terminal' });
 // is a complete no-op, so behaviour is unchanged everywhere else.
 let _opStampBuffer = null;
 let _opTable = null;
+// WP-0 (D-6): the per-session truth the single SAB slot pair above can never hold.
+const _inFlightOps = createInFlightOps();
 
 function setOpStampBuffer(shared, opTable) {
   _opStampBuffer = shared ? new BigInt64Array(shared) : null;
@@ -106,18 +109,31 @@ function _sid32(sessionId) {
   return Number.isFinite(n) ? BigInt(n >>> 0) : 0n;
 }
 
+// Returns the packed (sid32<<32)|opCode this call wrote (or null with no buffer)
+// so the op's own finisher can compare-and-clear exactly its own stamp.
+// asIntN(64, ...) is NOT cosmetic: a BigInt64Array wraps on store, so the value
+// read back (and hence what compareExchange must be given) is the signed 64-bit
+// one -- the unwrapped positive BigInt would never match and the clear would
+// silently become a no-op.
 function _stampOp(sessionId, opType) {
-  if (!_opStampBuffer) return;
+  if (!_opStampBuffer) return null;
   const sid32 = _sid32(sessionId);
   const opCode = BigInt(_opCode(opType));
+  const packed = BigInt.asIntN(64, (sid32 << 32n) | opCode);
   Atomics.store(_opStampBuffer, 2, BigInt(Date.now()));
-  Atomics.store(_opStampBuffer, 3, (sid32 << 32n) | opCode);
-}
-
-function _clearOp() {
-  if (!_opStampBuffer) return;
-  Atomics.store(_opStampBuffer, 2, 0n);
-  Atomics.store(_opStampBuffer, 3, 0n);
+  Atomics.store(_opStampBuffer, 3, packed);
+  return packed;
+}
+
+// WP-0 (D-6, S-12): compare-and-clear. Slots [2]/[3] are ONE shared pair per
+// process, so an unconditional zero would erase a DIFFERENT session's op that
+// stamped after this one. Clear [2] only when slot [3] still holds this op's
+// own packed value.
+function _clearOp(packed) {
+  if (!_opStampBuffer || packed == null) return;
+  if (Atomics.compareExchange(_opStampBuffer, 3, packed, 0n) === packed) {
+    Atomics.store(_opStampBuffer, 2, 0n);
+  }
 }
 
 function postTransport(message) {
@@ -730,20 +746,21 @@ function _stateSyncOnMirrorWrite(sessionId, bytes, opts) {
       _stateSyncEmitter.setFlooding(sessionId, _stateSyncIsFlooding(flood, _stateSyncClock.now(), {}));
       const clearScrollback = _stateSyncPendingClearScrollback.delete(sessionId);
       const currentEntry = terminals.get(sessionId);
-      _noteWorkerTypingStagePending(sessionId, currentEntry, 'emit-offered');
+      const offeredEchoSeq = Number(currentEntry?.state?.echoedThroughInputSeq || 0);
+      _noteWorkerTypingStagePending(sessionId, currentEntry, 'emit-offered', { offeredEchoSeq });
       const sent = _stateSyncEmitter.onMirrorUpdated(sessionId, {
         bypassRate: true,
         clearScrollback,
-        echoedThroughSeq: Number(currentEntry?.state?.echoedThroughInputSeq || 0),
+        echoedThroughSeq: offeredEchoSeq,
         synchronizedOutputOpen: _stateSyncSynchronizedOutputOpen(sessionId),
       });
       if (sent && currentEntry?.state) {
         currentEntry.state.lastStateSyncEmittedInputSeq = Number(
           currentEntry.state.echoedThroughInputSeq || 0
         );
-        // A frame actually shipped for these interactions -- clear the pending set so a LATER
-        // refusal (a different write's gate) never double-attributes to an already-delivered one.
-        currentEntry.state.pendingTypingInteractionIds = [];
+        // A frame actually shipped for these interactions -- clear only the ids whose echo it
+        // covers (WP-4 R-7); a LATER refusal (a different write's gate) never double-attributes.
+        currentEntry.state.pendingTypingInteractionIds = _typingWorkerStages.noteFramePostedForEchoed(postTransport, sessionId, currentEntry, offeredEchoSeq);
       }
     }
   };
@@ -1265,12 +1282,14 @@ const opQueues = new Map(); // sessionId -> Promise chain for feed/serialize/des
 
 function enqueueSessionOp(sessionId, fn, opType) {
   const prev = opQueues.get(sessionId) || Promise.resolve();
+  _inFlightOps.noteQueued(sessionId, 1); // WP-0: depth behind the running op
   let next;
   next = prev
     .catch(() => {})
     .then(() => {
-      _stampOp(sessionId, opType);
-      return Promise.resolve().then(fn).finally(_clearOp);
+      const seq = _inFlightOps.begin(sessionId, opType);
+      const packed = _stampOp(sessionId, opType);
+      return Promise.resolve().then(fn).finally(() => { _clearOp(packed); _inFlightOps.end(sessionId, seq); });
     })
     .catch((err) => {
       postTransport({
@@ -1320,6 +1339,18 @@ async function handleMessage(msg) {
         if (feedEntry.state.typingIdsAwaitingFeed && feedEntry.state.pendingTypingInteractionIds.length) {
           feedEntry.state.typingIdsAwaitingFeed = false;
           _noteWorkerTypingStage(msg.sessionId, feedEntry.state.pendingTypingInteractionIds, 'worker-received');
+          // WP-4 (clock-free-tests-followups-r4-2026-10-24.html §5 R-9, §6.5): the SAME ids, in
+          // the same call pattern, gain a second stamp at the instant the host's mirror-feed
+          // coalescer took the batch in (`hostReceivedAt`, carried from the deliver callback) --
+          // 'worker-received' above is the parse leg, this one is the host's receipt leg, and the
+          // delta between them is what R-9 exists to measure. Only a finite host time stamps
+          // anything: a sender that predates the field leaves the stage absent, never at 0.
+          if (Number.isFinite(msg.hostReceivedAt)) {
+            _noteWorkerTypingStage(
+              msg.sessionId, feedEntry.state.pendingTypingInteractionIds, 'host-pty-data',
+              { at: msg.hostReceivedAt },
+            );
+          }
         }
       }
       const byteCount = Buffer.byteLength(String(msg.data || ''));
@@ -1345,6 +1376,8 @@ async function handleMessage(msg) {
           // WP-0b (§6): the xterm write callback for THIS feed -- exactly where the brief says
           // `mirror-written` belongs.
           _noteWorkerTypingStagePending(msg.sessionId, entry, 'mirror-written');
+          // WP-3 (D-C2): per-key shadow echo matchers -- see lib/typing-worker-stages.js.
+          _typingWorkerStages.matchEchoPredictions(postTransport, msg.sessionId, entry, msg.data);
           entry.state.liveOutputSeq += 1;
           entry.state.liveBytesSinceSeed += byteCount;
           if (entry.state.pendingInputSeq > entry.state.echoedThroughInputSeq) {
@@ -1470,12 +1503,9 @@ async function handleMessage(msg) {
       // every keystroke (HeadlessTerminalRouter.postMessage, lib/session-host-manager.js
       // :1815-1834, forwards by sessionId to the pool host when one owns the session, else the
       // legacy worker thread) -- carry the pending typing-interaction ids here, not on 'feed'.
-      if (Array.isArray(msg.interactionIds) && msg.interactionIds.length) {
-        entry.state.pendingTypingInteractionIds = _typingWorkerStages.mergePendingInteractionIds(
-          entry.state.pendingTypingInteractionIds, msg.interactionIds,
-        );
-        entry.state.typingIdsAwaitingFeed = true;
-      }
+      // WP-3 (D-C2): the pending-id merge above moved into armEchoPrediction, which also arms
+      // this keystroke's shadow echo prediction when the message carries one.
+      _typingWorkerStages.armEchoPrediction(entry, msg);
       break;
     }
 
@@ -2368,8 +2398,12 @@ async function handleMessage(msg) {
 function dispatchHeadlessMessage(msg) {
   const sessionId = msg && msg.sessionId;
   if (sessionId && msg.type === 'getViewportText') {
-    _stampOp(sessionId, msg.type);
-    return handleMessage(msg).finally(_clearOp);
+    // WP-0: SAB stamp only. This op is outside the per-session chain and cannot wedge it,
+    // and the in-flight table holds ONE row per session -- registering here would overwrite
+    // (and its end() would then delete) a wedged chain op for the same session, hiding the
+    // very wedge WP-0 exists to name.
+    const packed = _stampOp(sessionId, msg.type);
+    return handleMessage(msg).finally(() => _clearOp(packed));
   }
   if (!sessionId) {
     return handleMessage(msg).catch((err) => {
@@ -2392,6 +2426,9 @@ function bindHeadlessTerminalService(options = {}) {
   return {
     handleMessage: dispatchHeadlessMessage,
     hasTerminal,
+    // WP-0 (D-6): report-only views of the per-session in-flight op table.
+    getInFlightOps: () => _inFlightOps.list(),
+    oldestInFlightOps: (n) => _inFlightOps.oldest(n),
     getStats() {
       const pendingStats = pendingStateSyncClients.snapshot();
       const warningStats = _stalledSessionWarnings.snapshot();

package/template/coding-task-manager/lib/history-transition-read-op.js

@@ -7,17 +7,23 @@ const transcriptSource = require('./transcript-source');
 const sessionHistory = require('./session-history');
 const codexPaths = require('./codex-paths');
 const { readNativeHistoryPrefix, findCanonicalRolloutsByFilenameId } = require('./codex-native-history-prefix');
+// S-4: one definition of the portable history kinds, in the planner. This module only reads it.
+const { PORTABLE_HISTORY_KINDS } = require('./harness-history-transition');
 
 const DEFAULT_SCAN_BYTES = 64 * 1024 * 1024;
 const MAX_SCAN_BYTES = 64 * 1024 * 1024;
 const MAX_RECORDS = 200_000;
 const THREAD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// D-5/D-8 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §6.1): the plaintext
+// handoff a source GPT model writes before the switch, exactly as lib/native-history-control.js
+// injects it. Only the marker sha is parsed here; the summary text itself never leaves the digest.
+const HANDOFF_MARKER = /^<ctm_handoff compaction_sha256="([0-9a-f]{64})"/;
+const COMPACTION_ITEM_KEYS = Object.freeze(['replacement_history', 'replacementHistory', 'summary']);
 const TOOL_PAIRS = Object.freeze({
   function_call: 'function_call_output', custom_tool_call: 'custom_tool_call_output',
   computer_call: 'computer_call_output', local_shell_call: 'local_shell_call_output',
 });
 const TOOL_OUTPUTS = new Set(Object.values(TOOL_PAIRS));
-const PORTABLE_HISTORY_KINDS = new Set(['text', 'tool-pair', 'native-world-state', 'native-lifecycle']);
 const SAFE_EVENT_TYPES = new Set([
   'task_started', 'task_complete', 'turn_aborted', 'token_count', 'user_message',
   'agent_message_delta', 'agent_reasoning_delta', 'agent_reasoning_section_break', 'item_completed',
@@ -70,7 +76,12 @@ function summarizeCodexHistoryRecords(records, { threadId, generation, lineageTh
       active.kinds.add('text');
       collectHashes(record, active.hashes);
       if (containsFlag(payload, /^opaque$/i)) active.opaque = true;
-      if (containsFlag(payload, /^(encrypted|ciphertext|encrypted_content)$/i)) active.encrypted = true;
+      // S-9/D-5: a `compaction` item inside the replacement history is the ONLY ciphertext that a
+      // source-written plaintext handoff can cover, so it is tracked by digest instead of being
+      // collapsed into the blanket `encrypted` flag. The record-level flag is evaluated on a copy
+      // with those items removed, so every OTHER ciphertext still marks the window non-portable.
+      const withoutSealed = withoutSealedCompactionItems(payload);
+      if (containsFlag(withoutSealed, /^(encrypted|ciphertext|encrypted_content)$/i)) active.encrypted = true;
       const replacement = payload.replacement_history ?? payload.replacementHistory ?? payload.summary;
       if (replacement !== undefined) {
         const status = classifyReplacement(replacement, active);
@@ -189,12 +200,25 @@ function summarizeCodexHistoryRecords(records, { threadId, generation, lineageTh
         }
         if (pairKind === 'output') active.estimateValid = false;
       } else if (itemType === 'message' || itemType === 'agent_message' || itemType === 'reasoning') {
-        if (itemType !== 'reasoning' && !portableTextOnly(payload)) return unsupported('unsupported_native_history_item_content');
-        active.kinds.add('text');
+        // D-2: a `message` whose only non-text content parts are input_image parts is native media,
+        // not a refusal -- Codex strips an image the target cannot accept
+        // (core/src/context_manager/normalize.rs:346 @ rust-v0.163.0) and CTM declares
+        // input_modalities:['text'] for routed models (lib/harness-model-profile.js:85). Any other
+        // modality (input_audio, file, ...) and an agent_message carrying media still refuse.
+        if (itemType !== 'reasoning' && !portableTextOnly(payload)) {
+          if (itemType !== 'message' || !imageOnlyNonText(payload)) return unsupported('unsupported_native_history_item_content');
+          active.kinds.add('native-media');
+        } else {
+          active.kinds.add('text');
+        }
         if (itemType === 'agent_message') active.estimateValid = false;
         if (payload.role === 'user' || payload.role === 'developer' || payload.role === 'system') active.estimateValid = false;
       }
       if (itemType === 'reasoning' && ownsTopLevelFlag(payload, 'encrypted_content')) active.droppableReasoningCount += 1;
+      // D-8: the covering proof for a sealed compaction is a developer message the source model wrote
+      // after it. Only its digests are recorded; the summary text stays out of this object.
+      const marker = handoffMarkerOf(payload);
+      if (marker) active.handoffMarkers.push(marker);
       // D-1: a reasoning item's own ciphertext is droppable (the issuer omits incompatible reasoning
       // itself); nested ciphertext in its content/summary parts still marks the window non-portable.
       const ciphertextScope = itemType === 'reasoning' ? withoutTopLevelFlag(payload, 'encrypted_content') : payload;
@@ -261,6 +285,11 @@ function summarizeCodexHistoryRecords(records, { threadId, generation, lineageTh
   const nativeCurrentPolicyStatus = !active.currentThreadSettings ? 'not-present'
     : !completedContext?.nativePolicyFingerprint || !active.currentThreadSettings.policyFingerprint ? 'unknown'
       : completedContext.nativePolicyFingerprint === active.currentThreadSettings.policyFingerprint ? 'match' : 'mismatch';
+  // D-8: coverage is proven from the readback itself -- every sealed compaction digest must have a
+  // marker at or after it, and the marker covering the first one identifies the exact text.
+  const encryptedCompactions = [...new Set(active.encryptedCompactions)];
+  const coveredShas = new Set(active.handoffMarkers.map((marker) => marker.sha));
+  const coveringMarker = active.handoffMarkers.find((marker) => marker.sha === encryptedCompactions[0]) || null;
   return {
     complete: true, sourceThreadId: threadId, generation,
     compacted: sawCompaction,
@@ -270,6 +299,9 @@ function summarizeCodexHistoryRecords(records, { threadId, generation, lineageTh
     historyKinds: [...active.kinds].sort().length ? [...active.kinds].sort() : [sawCompaction ? 'text' : 'unknown'],
     toolPairsValid: active.calls.size === active.outputs.size && [...active.calls].every((id) => active.outputs.has(id)),
     opaque: active.opaque, encrypted: active.encrypted,
+    encryptedCompactions,
+    handoffCovers: encryptedCompactions.every((sha) => coveredShas.has(sha)),
+    handoffTextSha256: coveringMarker ? coveringMarker.textSha256 : null,
     droppableReasoningCount: active.droppableReasoningCount, compactionHashes: hashSet,
     previousSettings, nativePolicyControl: completedContext?.nativePolicyControl || null,
     nativeCurrentPolicyStatus, currentThreadSettingsModel: active.currentThreadSettings?.model || null,
@@ -278,6 +310,59 @@ function summarizeCodexHistoryRecords(records, { threadId, generation, lineageTh
   };
 }
 
+// D-5: the digest of a `compaction` replacement item's ciphertext, or '' when the item is not one.
+// `type` is read the same way classifyReplacement reads it, so the two can never disagree.
+function sealedCompactionSha(item) {
+  if (!isRecord(item) || nonempty(item.type || item.kind) !== 'compaction') return '';
+  const content = item.encrypted_content;
+  return typeof content === 'string' && content.length > 0 ? digest(content) : '';
+}
+
+// A copy of a `compacted` payload without the ciphertext this scanner already accounts for, so the
+// record-level probe sees every OTHER encrypted value:
+//  - a sealed `compaction` replacement item, which a source-written handoff can cover (D-5);
+//  - a `reasoning` item's own top-level encrypted_content, droppable exactly as for a top-level
+//    reasoning response_item (D-1). Codex >= 0.163 checkpoints the auto-reviewer's transcript as
+//    `guardian_history` (core/src/session/guardian_checkpoint.rs @ rust-v0.163.0), and its
+//    reasoning items carry their own ciphertext; nested ciphertext inside them still counts.
+const CHECKPOINT_ITEM_KEYS = Object.freeze([...COMPACTION_ITEM_KEYS, 'guardian_history']);
+
+function withoutSealedCompactionItems(payload) {
+  if (typeof payload !== 'object' || payload === null) return payload;
+  let copy = null;
+  for (const key of CHECKPOINT_ITEM_KEYS) {
+    const value = payload[key];
+    if (!Array.isArray(value)) continue;
+    let changed = false;
+    const kept = [];
+    for (const item of value) {
+      if (sealedCompactionSha(item)) { changed = true; continue; }
+      if (isRecord(item) && item.type === 'reasoning' && ownsTopLevelFlag(item, 'encrypted_content')) {
+        changed = true;
+        kept.push(withoutTopLevelFlag(item, 'encrypted_content'));
+        continue;
+      }
+      kept.push(item);
+    }
+    if (!changed) continue;
+    if (!copy) copy = { ...payload };
+    copy[key] = kept;
+  }
+  return copy || payload;
+}
+
+// The covering proof: a developer message whose first content part is input_text starting at the
+// handoff marker. Returns digests only -- never the summary text.
+function handoffMarkerOf(payload) {
+  if (!isRecord(payload) || payload.type !== 'message' || payload.role !== 'developer') return null;
+  const content = payload.content;
+  if (!Array.isArray(content) || content.length === 0) return null;
+  const first = content[0];
+  if (!isRecord(first) || first.type !== 'input_text' || typeof first.text !== 'string') return null;
+  const match = HANDOFF_MARKER.exec(first.text);
+  return match ? { sha: match[1], textSha256: digest(first.text) } : null;
+}
+
 function readCodexHistoryTransitionSnapshot({ db, ctmSessionId, sourceThreadId, processGeneration, signal, assertLive,
   maxBytes = DEFAULT_SCAN_BYTES, storageRootReceipt } = {}) {
   if (cancelled(signal)) return unsupported('transition_cancelled');
@@ -311,7 +396,7 @@ function readCodexHistoryTransitionSnapshot({ db, ctmSessionId, sourceThreadId,
 
 function verifyCodexTransitionFork({ db, transitionId, expectedRevision, sessionId, sourceThreadId,
   sourceGeneration, targetGeneration, sourceCheckpointId, sourceContentDigest, targetThreadId,
-  signal, assertLive, storageRootReceipt } = {}) {
+  expectedHandoff, signal, assertLive, storageRootReceipt } = {}) {
   if (cancelled(signal)) return unsupported('transition_cancelled');
   assertLive?.();
   if (!db || !nonempty(transitionId) || !nonempty(sessionId) || !THREAD_ID.test(String(sourceThreadId || ''))
@@ -355,6 +440,18 @@ function verifyCodexTransitionFork({ db, transitionId, expectedRevision, session
   if (!target.complete || target.sourceThreadId !== targetThreadId || target.checkpoint?.id !== sourceCheckpointId) {
     return unsupported('fork_target_checkpoint_mismatch');
   }
+  // S-10/D-8: a sealed compaction in the FORKED history is accepted only when the readback itself
+  // proves the exact plaintext handoff that covers it. Trusting the inject call would accept a lost
+  // or partial inject, so the coverage digests are compared against what the controller wrote.
+  const sealedTarget = Array.isArray(target.encryptedCompactions) ? target.encryptedCompactions : [];
+  if (sealedTarget.length && (target.handoffCovers !== true
+      || !isRecord(expectedHandoff)
+      || !/^[a-f0-9]{64}$/.test(String(expectedHandoff.compactionSha256 || ''))
+      || !/^[a-f0-9]{64}$/.test(String(expectedHandoff.textSha256 || ''))
+      || sealedTarget[0] !== expectedHandoff.compactionSha256
+      || target.handoffTextSha256 !== expectedHandoff.textSha256)) {
+    return unsupported('fork_target_handoff_missing');
+  }
   if (target.opaque || target.encrypted || target.toolPairsValid !== true
       || !Array.isArray(target.historyKinds) || target.historyKinds.length === 0
       || target.historyKinds.some((kind) => !PORTABLE_HISTORY_KINDS.has(kind))) return unsupported('fork_target_history_unsafe');
@@ -416,12 +513,20 @@ function classifyReplacement(value, active) {
     else if (type === 'compaction') {
       // Codex 0.162.1 keeps the pre-window digest in a `compaction` item. It is a known shape,
       // but its ciphertext is the only record of earlier context, so it is never droppable.
+      // D-5: the SOURCE model can write a plaintext handoff covering exactly this ciphertext, so
+      // the item is tracked by digest; the coverage decision belongs to the planner.
       active.kinds.add('text');
-      if (nonempty(item.encrypted_content)) active.encrypted = true;
+      const sealed = sealedCompactionSha(item);
+      if (sealed) {
+        if (!active.encryptedCompactions.includes(sealed)) active.encryptedCompactions.push(sealed);
+        continue;
+      }
     }
     else if (type === 'message') {
-      if (!portableTextOnly(item)) return 'compaction_replacement_unknown';
-      active.kinds.add('text');
+      // D-2 applies inside a compaction replacement too: an image-only message is native media.
+      if (portableTextOnly(item)) active.kinds.add('text');
+      else if (imageOnlyNonText(item)) active.kinds.add('native-media');
+      else return 'compaction_replacement_unknown';
     }
     else if (type === 'function_call' || type === 'custom_tool_call' || type === 'computer_call' || type === 'local_shell_call') {
       const id = nonempty(item.call_id || item.id);
@@ -544,17 +649,30 @@ function inspectCompletedItemEvent(payload, lineage) {
   return { ok: inspection.ok, opaque: inspection.opaque, encrypted: inspection.encrypted };
 }
 
+// D-1: exactly the field set of Codex ThreadSettingsSnapshot
+// (codex-rs/protocol/src/protocol.rs:2335-2362 @ rust-v0.163.0). The fields below are the ones the
+// struct requires; the rest carry a serde default (runtime_workspace_roots, disabled_plugin_ids,
+// active_permission_profile) or are Option. The payload's own thread_id is Option<ThreadId>
+// (protocol.rs:2329), so it is optional but must be in the lineage when present.
+const THREAD_SETTINGS_REQUIRED = Object.freeze(['model', 'model_provider_id', 'approval_policy',
+  'approvals_reviewer', 'permission_profile', 'cwd', 'collaboration_mode']);
+const THREAD_SETTINGS_OPTIONAL = Object.freeze(['service_tier', 'active_permission_profile',
+  'runtime_workspace_roots', 'reasoning_effort', 'reasoning_summary', 'personality', 'disabled_plugin_ids']);
+const THREAD_SETTINGS_KEYS = new Set([...THREAD_SETTINGS_REQUIRED, ...THREAD_SETTINGS_OPTIONAL]);
+const THREAD_SETTINGS_PAYLOAD_KEYS = new Set(['type', 'thread_id', 'thread_settings']);
+
 function inspectThreadSettingsApplied(payload, lineage) {
   const settings = payload.thread_settings;
-  const keys = new Set(['model', 'model_provider_id', 'approval_policy', 'approvals_reviewer',
-    'permission_profile', 'cwd', 'runtime_workspace_roots', 'collaboration_mode', 'disabled_plugin_ids']);
   const invalid = () => ({ ok: false, opaque: false, encrypted: false });
-  if (!hasOnlyKeys(payload, new Set(['type', 'thread_id', 'thread_settings']))
+  if (!hasOnlyKeys(payload, THREAD_SETTINGS_PAYLOAD_KEYS)
       || payload.type !== 'thread_settings_applied'
-      || !lineage.has(String(payload.thread_id || '').toLowerCase())
-      || !isRecord(settings) || Object.keys(settings).some((key) => !keys.has(key))) return invalid();
+      || (payload.thread_id !== undefined && payload.thread_id !== null
+        && !lineage.has(String(payload.thread_id).toLowerCase()))
+      || !isRecord(settings) || Object.keys(settings).some((key) => !THREAD_SETTINGS_KEYS.has(key))) return invalid();
   const boundedString = (value, max, pattern = null) => typeof value === 'string' && value.length > 0
     && value.length <= max && (!pattern || pattern.test(value));
+  const optionalBoundedString = (value, max, pattern) => value === undefined || value === null
+    || boundedString(value, max, pattern);
   const collaboration = settings.collaboration_mode;
   const collaborationSettings = collaboration?.settings;
   const permissionKeys = settings.permission_profile && isRecord(settings.permission_profile)
@@ -566,14 +684,25 @@ function inspectThreadSettingsApplied(payload, lineage) {
     : profileType === 'external'
       ? permissionKeys.length === 2 && permissionKeys.includes('network') && ['enabled', 'restricted'].includes(settings.permission_profile.network)
       : profileType === 'disabled' && permissionKeys.length === 1;
+  // A serde-defaulted Vec is absent in real records with an empty list; the two are the same value.
+  const disabledPluginIds = settings.disabled_plugin_ids ?? [];
+  const runtimeWorkspaceRoots = settings.runtime_workspace_roots;
+  const activePermissionProfile = settings.active_permission_profile;
   if (!boundedString(settings.model, 256, /^[A-Za-z0-9@][A-Za-z0-9@._:/+-]*$/)
       || !boundedString(settings.model_provider_id, 128, /^[A-Za-z0-9][A-Za-z0-9._-]*$/)
       || !['never', 'on-request', 'on-failure', 'untrusted'].includes(settings.approval_policy)
       || !['user', 'auto_review', 'guardian_subagent'].includes(settings.approvals_reviewer)
       || !validPermissionProfile
       || !boundedString(settings.cwd, 4096) || !path.isAbsolute(settings.cwd)
-      || !Array.isArray(settings.runtime_workspace_roots) || settings.runtime_workspace_roots.length > 256
-      || settings.runtime_workspace_roots.some((value) => !boundedString(value, 4096) || !path.isAbsolute(value))
+      || !optionalBoundedString(settings.service_tier, 64, /^[a-z0-9_-]{1,64}$/)
+      || !optionalBoundedString(settings.reasoning_effort, 32, /^[a-z]{1,32}$/)
+      || !optionalBoundedString(settings.reasoning_summary, 32, /^[a-z]{1,32}$/)
+      || !optionalBoundedString(settings.personality, 64, /^[a-z0-9_-]{1,64}$/)
+      || (activePermissionProfile !== undefined && activePermissionProfile !== null
+        && !isRecord(activePermissionProfile))
+      || (runtimeWorkspaceRoots !== undefined && runtimeWorkspaceRoots !== null
+        && (!Array.isArray(runtimeWorkspaceRoots) || runtimeWorkspaceRoots.length > 256
+          || runtimeWorkspaceRoots.some((value) => !boundedString(value, 4096) || !path.isAbsolute(value))))
       || !isRecord(collaboration) || Object.keys(collaboration).some((key) => !['mode', 'settings'].includes(key))
       || !['default', 'plan'].includes(collaboration.mode)
       || !isRecord(collaborationSettings)
@@ -583,25 +712,30 @@ function inspectThreadSettingsApplied(payload, lineage) {
         || boundedString(collaborationSettings.reasoning_effort, 128, /^[A-Za-z0-9._-]+$/))
       || !(collaborationSettings.developer_instructions === undefined || collaborationSettings.developer_instructions === null
         || boundedString(collaborationSettings.developer_instructions, 64 * 1024))
-      || !Array.isArray(settings.disabled_plugin_ids) || settings.disabled_plugin_ids.length > 256
-      || settings.disabled_plugin_ids.some((value) => !boundedString(value, 256, /^[A-Za-z0-9][A-Za-z0-9._:-]*$/))) return invalid();
+      || !Array.isArray(disabledPluginIds) || disabledPluginIds.length > 256
+      || disabledPluginIds.some((value) => !boundedString(value, 256, /^[A-Za-z0-9][A-Za-z0-9._:-]*$/))) return invalid();
   const permission = inspectNativeState(settings.permission_profile);
   const collaborationInspection = inspectNativeState(collaboration);
-  if (!permission.ok || !collaborationInspection.ok) return invalid();
+  const activeInspection = activePermissionProfile === undefined || activePermissionProfile === null
+    ? { ok: true, opaque: false, encrypted: false } : inspectNativeState(activePermissionProfile);
+  if (!permission.ok || !collaborationInspection.ok || !activeInspection.ok) return invalid();
   return { ok: true, model: settings.model, policyFingerprint: nativePolicyFingerprint(settings),
-    opaque: permission.opaque || collaborationInspection.opaque,
-    encrypted: permission.encrypted || collaborationInspection.encrypted };
+    opaque: permission.opaque || collaborationInspection.opaque || activeInspection.opaque,
+    encrypted: permission.encrypted || collaborationInspection.encrypted || activeInspection.encrypted };
 }
 
 function nativePolicyFingerprint(value) {
+  // An absent (serde-default) disabled_plugin_ids is the same policy as an explicit empty list.
+  const disabledPluginIds = value?.disabled_plugin_ids === undefined || value?.disabled_plugin_ids === null
+    ? [] : (Array.isArray(value.disabled_plugin_ids) ? value.disabled_plugin_ids : null);
   if (!isRecord(value) || !isRecord(value.permission_profile) || !nonempty(value.cwd)
       || !nonempty(value.approval_policy) || !nonempty(value.approvals_reviewer)
-      || !isRecord(value.collaboration_mode) || !Array.isArray(value.disabled_plugin_ids)) return null;
+      || !isRecord(value.collaboration_mode) || disabledPluginIds === null) return null;
   return digest(JSON.stringify({ permissionProfile: stableValue(value.permission_profile), cwd: value.cwd,
     approvalPolicy: value.approval_policy, approvalsReviewer: value.approvals_reviewer,
     collaborationMode: { mode: value.collaboration_mode.mode,
       developerInstructions: value.collaboration_mode.settings?.developer_instructions ?? null },
-    disabledPluginIds: [...value.disabled_plugin_ids].sort() }));
+    disabledPluginIds: [...disabledPluginIds].sort() }));
 }
 
 function stableValue(value) {
@@ -678,13 +812,14 @@ function optionalSafeInteger(value) { return value === undefined || value === nu
 
 function freshActive() {
   return { kinds: new Set(), calls: new Set(), outputs: new Set(), hashes: [], opaque: false, encrypted: false,
-    droppableReasoningCount: 0,
+    droppableReasoningCount: 0, encryptedCompactions: [], handoffMarkers: [],
     latestContext: null, lastCompletedContext: null, currentThreadSettings: null, compactTurnId: '', estimatedTokens: null, estimateValid: false, programVersion: '', modelProvider: '' };
 }
 
 function resetActive(active) {
   active.kinds.clear(); active.calls.clear(); active.outputs.clear(); active.hashes.length = 0;
   active.opaque = false; active.encrypted = false; active.droppableReasoningCount = 0;
+  active.encryptedCompactions.length = 0; active.handoffMarkers.length = 0;
   active.latestContext = null; active.lastCompletedContext = null;
   active.currentThreadSettings = null;
   active.compactTurnId = ''; active.estimatedTokens = null; active.estimateValid = false;
@@ -750,6 +885,27 @@ function portableTextOnly(value) {
   return visit(value);
 }
 
+// D-2: a `message` item whose content carries at least one Codex InputImage part and no other
+// non-text modality. A part is an image part only when its key set is exactly type/image_url/detail;
+// anything else (input_audio, file, nested media, extra keys) falls back to portableTextOnly and
+// therefore refuses, exactly as before.
+function imageOnlyNonText(value) {
+  if (!isRecord(value) || !Array.isArray(value.content) || value.content.length === 0) return false;
+  let images = 0;
+  for (const part of value.content) {
+    if (isInputImagePart(part)) { images += 1; continue; }
+    if (!portableTextOnly(part)) return false;
+  }
+  return images > 0;
+}
+
+function isInputImagePart(part) {
+  return isRecord(part) && part.type === 'input_image'
+    && typeof part.image_url === 'string' && part.image_url.length > 0
+    && Object.keys(part).every((key) => ['type', 'image_url', 'detail'].includes(key))
+    && (part.detail === undefined || part.detail === null || typeof part.detail === 'string');
+}
+
 function tableExists(db, name) {
   try { return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name); } catch { return false; }
 }