create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/host-control-dial.js

@@ -0,0 +1,167 @@
+'use strict';
+
+// The session-host control-socket dial, extracted from lib/session-host-manager.js
+// (session-stops-mid-job-2026-10-24.html WP-3 freed the manager's file-size budget this way).
+// Behaviour is unchanged; tests/host-dial-stall-clock.test.js pins it from this file.
+
+const fs = require('node:fs');
+const net = require('node:net');
+const { CONTROL_CONNECTION_ROLE, encodeFrame, createFrameDecoder, PROTOCOL_VERSION, FLOOR_VERSION } = require('./host-control-protocol');
+const { hostRuntimeCompatibilityDecision } = require('./host-runtime-compatibility');
+const { hashClosureFiles } = require('./host-closure-hash');
+const { resolveDialRetryDeadline, DIAL_MAX_STALL_EXTENSION_RATIO } = require('./host-dial-stall-clock');
+
+// Dial a host control socket within a stall-aware deadline. The first state frame
+// is judged by hostRuntimeCompatibilityDecision (a differing closure hash is adoptable); later frames
+// route to onFrame, while onState exposes adoptable session metadata.
+function dialControlSocketWithRetry(socketPath, {
+  serverBootId, onFrame, onState, timeoutMs = 5000, retryDelayMs = 200,
+  protocolVersion = PROTOCOL_VERSION,
+} = {}) {
+  return new Promise((resolve, reject) => {
+    const budgetMs = Math.max(0, Number(timeoutMs) || 5000);
+    // Stall-aware, not fixed wall clock: see lib/host-dial-stall-clock.js for the incident where
+    // this deadline drained during the server's OWN boot freeze and a healthy pooled host was
+    // SIGTERM'd (taking its live sessions with it). `deadline` is reassigned as stall is credited
+    // back; `_stallExtendedMs` is the running total and is capped, so a permanently stalled
+    // server still times out rather than waiting forever.
+    let deadline = Date.now() + budgetMs;
+    let _stallExtendedMs = 0;
+    const maxStallExtensionMs = budgetMs * DIAL_MAX_STALL_EXTENSION_RATIO;
+    let settled = false;
+    let retryTimer = null, deadlineTimer = null, activeConn = null;
+    function finishOk(conn) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadlineTimer);
+      resolve(conn);
+    }
+    function finishFail(err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(retryTimer); clearTimeout(deadlineTimer);
+      try { activeConn?.destroy(); } catch { /* expected: connection may already be gone */ }
+      reject(err || new Error('control socket dial failed'));
+    }
+    function armDeadlineWatchdog(scheduledAt = Date.now()) {
+      const delayMs = Math.max(1, deadline - scheduledAt);
+      deadlineTimer = setTimeout(() => {
+        const firedAt = Date.now();
+        const credited = resolveDialRetryDeadline({ deadline, scheduledAt, firedAt, retryDelayMs: delayMs,
+          extendedMs: _stallExtendedMs, maxExtensionMs: maxStallExtensionMs });
+        deadline = credited.deadline; _stallExtendedMs = credited.extendedMs;
+        if (firedAt < deadline) armDeadlineWatchdog(firedAt); else finishFail(new Error(`control socket handshake timed out after ${timeoutMs}ms`));
+      }, delayMs);
+      deadlineTimer.unref?.();
+    }
+    function scheduleRetry() {
+      if (settled) return;
+      if (Date.now() >= deadline) {
+        finishFail(new Error(
+          `control socket dial timed out after ${timeoutMs}ms`
+          + (_stallExtendedMs > 0 ? ` (+${_stallExtendedMs}ms credited for main-loop stall)` : ''),
+        ));
+        return;
+      }
+      const scheduledAt = Date.now();
+      retryTimer = setTimeout(() => {
+        // A retry that fires far later than it was armed for means OUR event loop was starved --
+        // that time is not evidence about the child, so give it back before re-testing the
+        // deadline above. Bounded by maxStallExtensionMs.
+        const credited = resolveDialRetryDeadline({
+          deadline,
+          scheduledAt,
+          firedAt: Date.now(),
+          retryDelayMs,
+          extendedMs: _stallExtendedMs,
+          maxExtensionMs: maxStallExtensionMs,
+        });
+        deadline = credited.deadline;
+        _stallExtendedMs = credited.extendedMs;
+        attempt();
+      }, retryDelayMs);
+      retryTimer.unref?.();
+    }
+    function attempt() {
+      if (settled) return;
+      // Do NOT dial before the host has created its socket. A connect to a missing unix socket
+      // makes node build an ExceptionWithHostPort and capture its stack, and this loop runs every
+      // retryDelayMs across every concurrent dial (pool + per-session + registry probes). Measured
+      // 2026-08-23 with the server's own auto-CPU-profiler, during a boot where a pooled host was
+      // being started:
+      //   top self-time frames: ExceptionWithHostPort (errors:765) 3290ms
+      //                       | defaultPrepareStackTrace (errors:95) 3256ms
+      //                       | (garbage collector) 752ms | checkError (destroy:33) 512ms
+      //                       | scheduleRetry (session-host-manager.js:89) 192ms
+      // i.e. ~6.5s of main-loop CPU spent building the retry loop's OWN connection errors. That
+      // block (`[perf-lag] Event loop blocked 6102ms`) is what then starved the very handshake it
+      // was polling for, until the dial "timed out" and the manager SIGTERM'd a healthy pooled
+      // host, killing its live sessions. A self-inflicted starvation loop.
+      //
+      // fs.access (async -- never sync I/O on the main loop) is a cheap stat that produces no
+      // exception object. This is a fast-path skip only: once the socket exists the dial below is
+      // byte-identical to before, and a socket that appears between this check and the connect
+      // still takes the ordinary error path.
+      fs.access(socketPath, fs.constants.F_OK, (missing) => {
+        if (settled) return;
+        if (missing) { scheduleRetry(); return; }
+        _connect();
+      });
+    }
+    function _connect() {
+      if (settled) return;
+      let conn;
+      let helloAcked = false;
+      try {
+        conn = net.createConnection(socketPath);
+        activeConn = conn;
+      } catch {
+        scheduleRetry();
+        return;
+      }
+      const decoder = createFrameDecoder({
+        onFrame: (msg) => {
+          if (!helloAcked) {
+            if (msg && msg.type === 'state') {
+              const diskClosureHash = hashClosureFiles(Array.isArray(msg.closureFiles) ? msg.closureFiles : []), hostClosureHash = String(msg.closureHash || '');
+              const compatibility = { ...hostRuntimeCompatibilityDecision({
+                expectedProtocol: protocolVersion, actualProtocol: msg.protocolVersion,
+                expectedFloor: FLOOR_VERSION, actualFloor: msg.floorVersion, diskClosureHash, hostClosureHash,
+              }), hostClosureHash, diskClosureHash };
+              if (!compatibility.compatible) {
+                helloAcked = true;
+                try { conn.destroy(); } catch { /* expected: already gone */ }
+                finishFail(Object.assign(
+                  new Error(`control socket host compatibility mismatch (${compatibility.reason})`),
+                  { code: 'HOST_INCOMPATIBLE', compatibilityReason: compatibility.reason },
+                ));
+                return;
+              }
+              helloAcked = true;
+              try { onState?.(msg, compatibility); } catch { /* expected: caller's onState must not wedge the dial */ }
+              finishOk(conn);
+            }
+            return;
+          }
+          if (typeof onFrame === 'function') onFrame(msg);
+        },
+        onError: () => { try { conn.destroy(); } catch { /* expected: already gone */ } },
+      });
+      conn.on('data', (chunk) => decoder.push(chunk));
+      conn.on('connect', () => {
+        try {
+          conn.write(encodeFrame({ type: 'hello', serverBootId, connectionRole: CONTROL_CONNECTION_ROLE.CONTROLLER, lastSeq: 0, protocolVersion, floorVersion: FLOOR_VERSION }));
+        } catch {
+          try { conn.destroy(); } catch { /* expected: already gone */ }
+        }
+      });
+      conn.on('error', () => { /* expected: close follows error and owns the sole retry */ });
+      conn.on('close', () => { if (!helloAcked) scheduleRetry(); });
+    }
+
+    attempt();
+    armDeadlineWatchdog();
+  });
+}
+
+module.exports = { dialControlSocketWithRetry };

package/template/coding-task-manager/lib/host-handoff-orchestrator.js

@@ -173,10 +173,17 @@ async function probeSuccessor(ch, spawned, hostId, deadlineAt) {
 }
 
 // One handoff attempt. Resolves { ok:true, ... } or { ok:false, reason, attempted }; never rejects.
+//
+// WP-3 (D-3/S-3): opts.reason is 'upgrade' (default) or 'evacuate-threadpool'.
+// An evacuation is not an upgrade -- the host is being replaced because its
+// libuv pool is dead, so it does not need an 'upgrade-pending' compat entry to
+// be eligible (any entry, or none, passes). The recovery-protected check stays
+// first for both reasons, and 'upgrade' keeps today's check byte-for-byte.
 async function handoffHost(manager, hostId, opts = {}) {
+  const reason = opts.reason === 'evacuate-threadpool' ? 'evacuate-threadpool' : 'upgrade';
   if (manager.isRecoveryProtectedHost?.(hostId)) return { ok: false, attempted: false, reason: 'owner-recovery-pending' };
   const compat = manager.hostCompatibility.get(hostId);
-  if (!compat || compat.reason !== 'upgrade-pending') return { ok: false, attempted: false, reason: 'not-upgrade-pending' };
+  if (reason === 'upgrade' && (!compat || compat.reason !== 'upgrade-pending')) return { ok: false, attempted: false, reason: 'not-upgrade-pending' };
   const adapters = liveAdapters(manager, hostId);
   const first = adapters.values().next().value;
   const conn = first && first._socketConn && !first._socketConn.destroyed ? first._socketConn : null;
@@ -331,11 +338,18 @@ async function handoffHostWithRetry(manager, hostId, opts = {}) {
 }
 
 // Restore-loop tail (server.js): upgrade every upgrade-pending host, serially. Never throws.
-async function runUpgradePendingHandoffs({ manager, log = console.log, ...opts } = {}) {
+// WP-3 (S-4): skipHostIds names hosts the boot-time stall escalation (D-4) has
+// ALREADY decided to evacuate -- they are logged and left alone here, so no
+// rollup/stale flag/10-minute retry can be armed against a stalled host.
+async function runUpgradePendingHandoffs({ manager, skipHostIds = new Set(), log = console.log, ...opts } = {}) {
   const results = [];
   try {
     const hostIds = [...manager.hostCompatibility].filter(([, c]) => c && c.reason === 'upgrade-pending').map(([id]) => id);
     for (const hostId of hostIds) {
+      if (skipHostIds.has(hostId)) {
+        log(`[host-handoff] ${hostId} skipped: evacuating`);
+        continue;
+      }
       const result = await handoffHostWithRetry(manager, hostId, { ...opts, log });
       results.push(result);
       if (!result.attempted) {

package/template/coding-task-manager/lib/host-handoff.js

@@ -33,6 +33,22 @@ function modelProcessGenerationMetadata(value) {
   return validModelProcessGeneration(value) ? { modelProcessGeneration: value } : {};
 }
 const MODEL_STORAGE_ROOT_KEYS = Object.freeze(['HOME', 'CODEX_HOME', 'CTM_CODEX_SESSIONS_DIR', 'CLAUDE_CONFIG_DIR', 'GEMINI_CLI_HOME', 'OPENCODE_DATA_DIR', 'XDG_DATA_HOME']);
+// The keys a lead-model switch re-projects into the launch context (lib/lead-model-restore-reconciliation.js
+// projectDeferredRestoreLaunch: HOME / CODEX_HOME from the launch context, TMPDIR alongside them). They are
+// PROJECTED launch context, not per-session private overrides: a spawn still receives them, but their presence
+// must never turn an otherwise empty override set into a private environment that only a surviving owner can
+// reproduce. Anything else in the env is private and is captured by value.
+const PROJECTED_LAUNCH_CONTEXT_KEYS = Object.freeze(['HOME', 'CODEX_HOME', 'TMPDIR']);
+// Returns a NEW object holding only the non-projected entries of `env`; never mutates its input and maps a
+// non-object to `{}`.
+function privateOverridesFromEnv(env) {
+  if (!env || typeof env !== 'object' || Array.isArray(env)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!PROJECTED_LAUNCH_CONTEXT_KEYS.includes(key)) out[key] = value;
+  }
+  return out;
+}
 function modelStorageRootsFromEnv(env) {
   const roots = {};
   for (const key of MODEL_STORAGE_ROOT_KEYS) {
@@ -111,6 +127,10 @@ function isAlive(pid) {
 // listSessions() -> [{ sessionId, ptyProcess, ptyClosed, cols, rows, seq, cmd, cwd, name, outputEpoch,
 //   workerDisplayContext, suppressPtyHeadlessUntilInput, mirrorFeed }]; serialize(sessionId) -> {data,cols,rows}|null.
 const REPAINT_NUDGE_MS = 80;
+// D-1: the old host's painted-seal await is bounded. A seal runs on its session's own op chain; a wedged chain
+// (a dead libuv pool) never comes back, and no deadline is long enough to wait it out. Losing the race costs a
+// restart break in that session's painted rows (an unsealed stretch cannot be joined), never the whole handoff.
+const HANDOFF_SEAL_TIMEOUT_MS = 1000;
 
 function createHandoff({ hostId, workerPath, controlSocketPath, listSessions, serialize, mirrorStatus, headless, send, log = () => {}, setTimer = setTimeout, spawnSuccessor = spawnSuccessorHost }) {
   let active = null;
@@ -140,6 +160,26 @@ function createHandoff({ hostId, workerPath, controlSocketPath, listSessions, se
     (reply || send)({ type: 'handoff-aborted', handoffId: cur.handoffId, reason });
   }
 
+  // One session's painted-seal, raced against HANDOFF_SEAL_TIMEOUT_MS: resolves when the seal completes (its
+  // timer then cleared) or when the bound expires, in which case the handoff proceeds and the loss is reported.
+  // A rejecting seal still rejects (the begin() catch aborts the handoff, unchanged).
+  function raceSeal(sessionId) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const timer = setTimer(() => {
+        if (settled) return;
+        settled = true;
+        diagnostic(sessionId, 'host-handoff-seal-timeout', { timeoutMs: HANDOFF_SEAL_TIMEOUT_MS, oldHostId: hostId });
+        resolve();
+      }, HANDOFF_SEAL_TIMEOUT_MS);
+      timer?.unref?.();
+      Promise.resolve(headless.handleMessage({ type: 'painted-seal', sessionId })).then(
+        () => { if (settled) return; settled = true; clearTimeout(timer); resolve(); },
+        (err) => { if (settled) return; settled = true; clearTimeout(timer); reject(err); },
+      );
+    });
+  }
+
   async function begin(msg, reply) {
     const handoffId = String(msg.handoffId || '');
     if (active) { reply({ type: 'handoff-aborted', handoffId, reason: 'already-in-progress' }); return; }
@@ -153,11 +193,11 @@ function createHandoff({ hostId, workerPath, controlSocketPath, listSessions, se
         s.ptyProcess.pause();
         cur.paused.push(s);
       }
-      const seeds = new Map();
-      for (const s of cur.paused) {
+      // D-1: every seed is issued concurrently -- each `serialize` keeps its own 2 000 ms cap, so N sessions cost
+      // one cap, not N. The mirrorFeed flush still lands immediately before its own session's serialize.
+      const seeds = new Map(await Promise.all(cur.paused.map(async (s) => {
         s.mirrorFeed?.flush?.({ force: true });
         const snap = await serialize(s.sessionId);
-        seeds.set(s.sessionId, snap);
         // Probe (observe only): what the seed carries vs what the mirror believed at the same instant.
         const seedData = String((snap && snap.data) || '');
         diagnostic(s.sessionId, 'host-handoff-mirror-seed', {
@@ -168,18 +208,16 @@ function createHandoff({ hostId, workerPath, controlSocketPath, listSessions, se
           seedBytes: Buffer.byteLength(seedData),
           oldHostId: hostId,
         });
-      }
+        return [s.sessionId, snap];
+      })));
       if (active !== cur) return; // aborted (deadline) while serializing
       // This host exits without its headless close(): seal each painted-row stretch (with its last screen) and flush the
       // log now, before the successor exists to load it -- an unsealed stretch cannot be joined (a restart break).
-      // Each id is listed BEFORE its seal is queued, so an abort that lands mid-seal still reopens it (the per-session op
-      // queue runs that reopen after the seal).
-      cur.sealed = [];
-      for (const s of cur.paused) {
-        if (active !== cur) return; // aborted (deadline) while sealing
-        cur.sealed.push(s.sessionId);
-        await headless.handleMessage({ type: 'painted-seal', sessionId: s.sessionId });
-      }
+      // D-1: every id is listed BEFORE any seal is queued (so an abort that lands mid-seal still reopens all of them,
+      // the per-session op queue running each reopen after its seal), and every seal is raced against
+      // HANDOFF_SEAL_TIMEOUT_MS, so one wedged op chain cannot hold the handoff past its bound.
+      cur.sealed = cur.paused.map((s) => s.sessionId);
+      await Promise.all(cur.paused.map((s) => raceSeal(s.sessionId)));
       if (active !== cur) return; // aborted (deadline) while sealing
       const running = cur.paused.filter((s) => !s.ptyClosed);
       const entries = running.map((s, i) => {
@@ -306,4 +344,4 @@ function createHandoff({ hostId, workerPath, controlSocketPath, listSessions, se
   return { intercept, restore, resumeRestored, isActive: () => !!active };
 }
 
-module.exports = { handoffManifestFromArgv, writeHandoffManifest, readHandoffManifest, spawnSuccessorHost, createHandoff, validModelProcessGeneration, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata };
+module.exports = { HANDOFF_SEAL_TIMEOUT_MS, handoffManifestFromArgv, writeHandoffManifest, readHandoffManifest, spawnSuccessorHost, createHandoff, validModelProcessGeneration, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata, PROJECTED_LAUNCH_CONTEXT_KEYS, privateOverridesFromEnv };

package/template/coding-task-manager/lib/host-health-ledger.js

@@ -11,6 +11,12 @@
 // module's), no further RPCs go to that host; markCapped freezes the verdict
 // until forgetHost. Pure/in-memory except the injectable readStall hook.
 //
+// WP-3 (session-stops-mid-job-2026-10-24.html, D-10..D-12): a hard serialize
+// miss on a host that sent ANY frame after that request was issued (the
+// injectable lastFrameAt hook) is readiness, not liveness -- it latches
+// 'degraded' (reported once, cleared by a reply, never a kill). Only a silent
+// host still reaches 'unresponsive'; the stall-file shortcut is unchanged.
+//
 // No deps beyond node:fs/node:path for the default readStall -- kept free of
 // process globals (server.js binds dataDir into the readStall it injects).
 
@@ -31,23 +37,77 @@ function readStallFromDataDir(dataDir, hostId) {
   }
 }
 
+// WP-3 (stale-pty-host-evacuation design doc, D-2, §6): the evacuation deadline
+// for a continuously stalled libuv threadpool. Value provenance (§4 D-2): every
+// recovered stall in the log evidence lasted <= 1.7 s, all 6 unrecovered ones
+// longer; 30 s equals the existing hard-miss floor below (line 69).
+const THREADPOOL_EVACUATE_MS = 30000;
+
 function createHostHealthLedger({
   missThreshold = 2,
   stallThresholdMs = 30000,
   readStall = null,
+  // WP-3 (D-10): lastFrameAt(hostId) -> number, the manager's per-host frame
+  // clock ("the host sent any frame", any transport). Optional: without it the
+  // ledger behaves exactly as it did before WP-3.
+  lastFrameAt = null,
   now = Date.now,
+  // WP-3 (D-2): the stall-evacuation episode's clock/timers/action seam. All
+  // three default to the real thing, so every existing caller is unaffected.
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+  onEvacuate = null,
+  log = console.warn,
 } = {}) {
-  const hosts = new Map(); // hostId -> { misses, lastMissAt, lastReplyAt, verdict }
+  // hostId -> { misses, lastMissAt, lastReplyAt, verdict, degraded, ...threadpool episode }
+  const hosts = new Map();
 
   function entryFor(hostId) {
     let entry = hosts.get(hostId);
     if (!entry) {
-      entry = { misses: 0, lastMissAt: 0, lastReplyAt: 0, verdict: 'ok', cappedUntil: 0 };
+      entry = {
+        misses: 0, lastMissAt: 0, lastReplyAt: 0, verdict: 'ok', cappedUntil: 0, degraded: false,
+        // D-2 (WP-3) per-host stall episode: 0 = no episode in progress.
+        threadpoolStalledSince: 0, threadpoolOldestPendingMs: 0, evacuateFired: false, threadpoolTimer: null,
+      };
       hosts.set(hostId, entry);
     }
     return entry;
   }
 
+  function _cancelThreadpoolTimer(entry) {
+    if (!entry || !entry.threadpoolTimer) return;
+    clearTimer(entry.threadpoolTimer);
+    entry.threadpoolTimer = null;
+  }
+
+  function _threadpoolResult(entry, id) {
+    return {
+      action: 'evacuate',
+      hostId: id,
+      oldestPendingMs: Number(entry.threadpoolOldestPendingMs) || 0,
+      stalledForMs: now() - entry.threadpoolStalledSince,
+    };
+  }
+
+  // Fires an episode exactly once: marks it fired BEFORE calling out, so a
+  // re-entrant recordThreadpool from onEvacuate cannot double-fire.
+  function _markFired(entry, id) {
+    entry.evacuateFired = true;
+    entry.threadpoolTimer = null;
+    return _threadpoolResult(entry, id);
+  }
+
+  // The armed-timer path is the ONLY one that calls out: an immediate verdict is
+  // returned to the caller of recordThreadpool instead (§6 -- one action per
+  // episode, never both).
+  function _fireEvacuate(entry, id) {
+    const result = _markFired(entry, id);
+    if (typeof onEvacuate !== 'function') return; // no action bound -- the episode is still marked fired
+    try { onEvacuate(result); }
+    catch (err) { log(`[host-health] host=${id} onEvacuate threw: ${err?.message || err}`); } // REPORT: a timer callback must never throw into the event loop
+  }
+
   // Final-review fix C4: 'unresponsive-capped' used to be permanent -- markCapped
   // set it forever and recordMiss short-circuited on any non-'ok' verdict, so
   // EVERY snapshot for EVERY session on that host was answered timedOut for the
@@ -63,7 +123,7 @@ function createHostHealthLedger({
     entry.cappedUntil = 0;
   }
 
-  function recordMiss(hostId, { sessionId, kind, deadlineMs } = {}) {
+  function recordMiss(hostId, { sessionId, kind, deadlineMs, issuedAt } = {}) {
     const id = String(hostId || '');
     if (!id) return null;
     // Soft (short-deadline, or explicitly non-'hard') misses never count -- D-2
@@ -74,14 +134,37 @@ function createHostHealthLedger({
     // Once a host already carries a verdict, further misses are idempotent --
     // no state change, verdict() keeps reporting it until forgetHost.
     if (entry.verdict !== 'ok') return null;
-    entry.misses += 1;
-    entry.lastMissAt = now();
     let stall = null;
     if (typeof readStall === 'function') {
       try { stall = readStall(id); } catch { stall = null; }
     }
-    const stalled = stall && Number(stall.durationMs) >= stallThresholdMs;
-    if (stalled || entry.misses >= missThreshold) {
+    // D-2(b), unchanged: the host's own stall report is proof it is wedged, and
+    // it still wins over any frame (a stalled host can relay PTY bytes).
+    if (stall && Number(stall.durationMs) >= stallThresholdMs) {
+      entry.misses += 1;
+      entry.lastMissAt = now();
+      entry.verdict = 'unresponsive';
+      return { verdict: 'unresponsive', misses: entry.misses, stall };
+    }
+    // D-11 (WP-3): the host sent a frame at or after this request was issued --
+    // a deadlined request family timing out on a TALKING host is readiness, not
+    // liveness. Report 'degraded' once per host since the last reply; never
+    // count it toward the miss threshold, never verdict the host unresponsive.
+    if (typeof lastFrameAt === 'function' && Number.isFinite(issuedAt)) {
+      const frameAt = Number(lastFrameAt(id));
+      if (Number.isFinite(frameAt) && frameAt >= issuedAt) {
+        if (entry.degraded !== true) {
+          entry.degraded = true;
+          return { verdict: 'degraded', misses: entry.misses, lastFrameAgoMs: now() - frameAt };
+        }
+        return null;
+      }
+    }
+    // D-12: no frame of any kind since the first missed request was issued --
+    // today's path. Two such misses (missThreshold) is a silent host.
+    entry.misses += 1;
+    entry.lastMissAt = now();
+    if (entry.misses >= missThreshold) {
       entry.verdict = 'unresponsive';
       return { verdict: 'unresponsive', misses: entry.misses, stall: stall || null };
     }
@@ -94,6 +177,9 @@ function createHostHealthLedger({
     const entry = entryFor(id);
     entry.misses = 0;
     entry.lastReplyAt = now();
+    // D-11: the host answered, so whatever readiness conclusion was latched is
+    // stale evidence -- the next talking miss reports once again.
+    entry.degraded = false;
     // C4: the host answered -- whatever the cap concluded is stale evidence.
     if (entry.verdict === 'unresponsive-capped') {
       entry.verdict = 'ok';
@@ -116,17 +202,78 @@ function createHostHealthLedger({
     entry.cappedUntil = now() + CRASH_CAP_WINDOW_MS;
   }
 
+  // WP-3 (D-2, §6): the host's own threadpool snapshot as a verdict, not a
+  // banner. Returns { action:'evacuate', hostId, oldestPendingMs, stalledForMs }
+  // exactly ONCE per stall episode, and only for a host whose pool is either
+  // reported stalled with an already-overdue op (oldestPendingMs >= 30 s) or
+  // has been continuously stalled for >= 30 s with no 'ok' frame in between.
+  function recordThreadpool(hostId, snapshot) {
+    const id = String(hostId || '');
+    const state = snapshot && snapshot.state;
+    if (!id || (state !== 'ok' && state !== 'stalled')) return null; // unknown shape -- no state change
+    if (state === 'ok') {
+      const entry = hosts.get(id);
+      if (!entry) return null; // nothing was in progress -- no entry to create
+      _cancelThreadpoolTimer(entry);
+      entry.threadpoolStalledSince = 0;
+      entry.threadpoolOldestPendingMs = 0;
+      entry.evacuateFired = false;
+      return null;
+    }
+    const entry = entryFor(id);
+    if (!entry.threadpoolStalledSince) entry.threadpoolStalledSince = now(); // first stalled frame starts the episode
+    if (entry.evacuateFired) return null; // already acted on this episode
+    entry.threadpoolOldestPendingMs = Number(snapshot.oldestPendingMs) || 0;
+    const stalledForMs = now() - entry.threadpoolStalledSince;
+    if (entry.threadpoolOldestPendingMs >= THREADPOOL_EVACUATE_MS || stalledForMs >= THREADPOOL_EVACUATE_MS) {
+      _cancelThreadpoolTimer(entry);
+      return _markFired(entry, id);
+    }
+    // Not yet due: arm ONE timer for the remainder of the window (never stack --
+    // an existing timer already targets the same deadline and its own `hosts.get`
+    // liveness check keeps it honest across forget/move).
+    if (!entry.threadpoolTimer) {
+      const timer = setTimer(() => {
+        if (hosts.get(id) !== entry || entry.threadpoolStalledSince <= 0 || entry.evacuateFired) return;
+        _fireEvacuate(entry, id);
+      }, Math.max(1, THREADPOOL_EVACUATE_MS - stalledForMs));
+      timer?.unref?.();
+      entry.threadpoolTimer = timer || null;
+    }
+    return null;
+  }
+
+  // WP-3: re-arm RE-EVALUATION without forgetting the episode (used when an
+  // evacuation was deferred -- owner recovery pending): the next stalled frame
+  // re-decides immediately, keeping the episode's original stalledSince.
+  function resetThreadpoolEpisode(hostId) {
+    const entry = hosts.get(String(hostId || ''));
+    if (!entry) return;
+    _cancelThreadpoolTimer(entry);
+    entry.evacuateFired = false;
+  }
+
   function forgetHost(hostId) {
-    hosts.delete(String(hostId || ''));
+    const id = String(hostId || '');
+    _cancelThreadpoolTimer(hosts.get(id));
+    hosts.delete(id);
   }
 
-  // WP-4: a handoff replaces the host process, not its health history -- carry the entry over.
+  // WP-4: a handoff replaces the host process, not its health history -- carry
+  // the entry over. WP-3 (D-2): the successor is a fresh process with a fresh
+  // libuv pool, so its stall episode is dropped -- its own frames decide.
   function moveHost(fromId, toId) {
     const from = String(fromId || ''); const to = String(toId || '');
     if (!from || !to || from === to) return;
     const entry = hosts.get(from);
     hosts.delete(from);
-    if (entry) hosts.set(to, entry);
+    if (!entry) return;
+    _cancelThreadpoolTimer(entry);
+    entry.threadpoolStalledSince = 0;
+    entry.threadpoolOldestPendingMs = 0;
+    entry.evacuateFired = false;
+    _cancelThreadpoolTimer(hosts.get(to)); // a superseded entry's armed timer must never fire for its successor
+    hosts.set(to, entry);
   }
 
   function snapshot() {
@@ -138,12 +285,17 @@ function createHostHealthLedger({
         lastReplyAt: entry.lastReplyAt,
         verdict: entry.verdict,
         cappedUntil: entry.cappedUntil || 0,
+        threadpoolStalledSince: entry.threadpoolStalledSince || 0,
+        evacuateFired: entry.evacuateFired === true,
+        // D-11 (WP-3): a talking host that missed a hard deadline since its last
+        // reply -- readiness, reported once, never a kill.
+        degraded: entry.degraded === true,
       };
     }
     return { hosts: out };
   }
 
-  return { recordMiss, recordReply, verdict, markCapped, forgetHost, moveHost, snapshot };
+  return { recordMiss, recordReply, recordThreadpool, verdict, markCapped, forgetHost, moveHost, resetThreadpoolEpisode, snapshot };
 }
 
-module.exports = { createHostHealthLedger, readStallFromDataDir };
+module.exports = { createHostHealthLedger, readStallFromDataDir, THREADPOOL_EVACUATE_MS };

package/template/coding-task-manager/lib/host-self-truth-watchdog.js

@@ -34,6 +34,10 @@ const HOST_WATCHDOG_OP_TABLE = [
   'getViewportText', 'composer-probe', 'getRows', 'reset', 'flush-archive',
   'mirror-status', 'mirrors-report', 'trim-mirrors', 'flush-tail', 'destroy',
   'painted-read', 'drop-painted',
+  // WP-0 (D-6/S-13): appended ONLY -- an entry's index IS its opCode, so
+  // reordering or removing any of the rows above would relabel every stamp a
+  // still-running host writes. These three were missing and stamped as 'none'.
+  'serialize-bootstrap', 'painted-seal', 'painted-reopen',
 ];
 
 function _hostCpuUsageMs() {