create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/launch-plan-worker.js

@@ -16,10 +16,11 @@ const {
 } = require('./lifecycle-wake-experiment');
 const projectConfig = require('./project-config');
 const { resolveResumeCwdFallback } = require('./resume-cwd');
-const { validateResumeTarget, withTrashLocation } = require('./resume-preflight');
+const { validateResumeTarget, withTrashLocation, findClaudeResumeTranscript, transcriptHasConversation } = require('./resume-preflight');
 const { findTrashedTranscript } = require('./session-transcript-trash');
 const sessionHistory = require('./session-history');
 const { extractResumeTarget, getCodexThreadResumeCwdInfo, locateCodexRollout } = sessionHistory;
+const { ensureClaudeResumeTarget } = require('./launch-model-override');
 const walleMcpAutoConfig = require('./walle-mcp-auto-config');
 const { ensureWalleMcpForAgentSession } = walleMcpAutoConfig;
 const {
@@ -228,7 +229,15 @@ async function prepareLaunchPlan(spec = {}, progressPort = parentPort) {
   cwd = fallback.cwd || cwd;
 
   let agentType = agentTypeForCommand(cmd);
-  let resumeResolution = resolveResumeAlias(agentType, args, metadata);
+  // WP-0 D-2: for the PRIVATE Claude model-target operation below, the recorded source argv must reach
+  // the native-history classification UNTOUCHED. resolveResumeAlias is a naive
+  // `indexOf('--resume')` + metadata rewrite, and an argument that merely SPELLS `--resume` while being
+  // another option's operand (e.g. `--append-system-prompt --resume`) would be rewritten before the
+  // canonical normalizer ever sees it. Ordinary create/restore callers and Codex keep today's order.
+  const defersClaudeResumeAlias = agentType === 'claude' && spec.claudeResumeThreadId !== undefined;
+  let resumeResolution = defersClaudeResumeAlias
+    ? { args, resume: extractResumeTarget(agentType, args) }
+    : resolveResumeAlias(agentType, args, metadata);
   args = resumeResolution.args;
   let resume = resumeResolution.resume;
 
@@ -283,6 +292,54 @@ async function prepareLaunchPlan(spec = {}, progressPort = parentPort) {
   const cliResolution = resolvePublishedCliCommand(cmd, spec, env);
   cmd = cliResolution.cmd;
   agentType = agentTypeForCommand(cmd);
+  // WP-0 D-2 (same-harness, early): the project config above may have just rewritten this launch to a
+  // DIFFERENT harness, and the Codex-specific MCP/profile rewrites and prepareCodexLaunch() run long
+  // before a plan is returned. The private Claude model-target field names a Claude thread, so a launch
+  // that resolved to another harness is refused HERE -- before any of that preparation -- instead of
+  // executing Codex preparation and only then refusing the produced plan.
+  // Ordinary callers never set the private field, and Codex callers never set it either, so their
+  // behavior is unchanged. The planner's post-plan same-harness guard remains as the outer defence.
+  if (spec.claudeResumeThreadId !== undefined && agentType !== 'claude') {
+    const error = new TypeError('spec.claudeResumeThreadId names a Claude thread but the launch resolved to another harness');
+    error.code = 'launch_claude_target_harness_changed';
+    throw error;
+  }
+  // WP-0 (docs/claude-routed-native-history-resume-2026-10-24.html §5 D-2, §6): a Claude
+  // MODEL-TARGET preparation names the canonical source thread through the PRIVATE spec field
+  // `claudeResumeThreadId`, which only the lead-transition target planner sets after its canonical
+  // source proof. Claude keeps its own native transcript, so the launch must RESUME that exact
+  // thread instead of starting the recorded `--session-id` again (which would collide with the
+  // conversation already on disk). The classification below is the EXISTING native preflight --
+  // findClaudeResumeTranscript + transcriptHasConversation -- never a second reader, and nothing is
+  // written, moved, deleted or materialized here.
+  //
+  // A source with no recorded conversation is left EXACTLY as it is (today's fresh-launch
+  // behavior): forcing `--resume` onto a metadata-only stub is what the CLI answers with
+  // "No conversation found". The field is private to this worker spec, so an ordinary
+  // create/restore caller -- which never sets it -- cannot reach this block at all.
+  if (agentType === 'claude' && spec.claudeResumeThreadId !== undefined) {
+    const canonicalThreadId = String(spec.claudeResumeThreadId || '').trim();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(canonicalThreadId)) {
+      const error = new TypeError('spec.claudeResumeThreadId must be the canonical Claude thread id');
+      error.code = 'launch_claude_resume_target_invalid';
+      throw error;
+    }
+    const canonicalTranscript = findClaudeResumeTranscript({
+      resumeId: canonicalThreadId,
+      jsonlPath: metadata.resumeAgent?.jsonl_path || metadata.resolved?.jsonl_path || '',
+      homeDir,
+      claudeConfigDir: env.CLAUDE_CONFIG_DIR || spec.claudeConfigDir,
+    });
+    if (canonicalTranscript && transcriptHasConversation(canonicalTranscript.path)) {
+      const normalized = ensureClaudeResumeTarget(args, canonicalThreadId);
+      if (!normalized.ok) {
+        const error = new TypeError(`the recorded Claude launch arguments cannot name the canonical thread: ${normalized.reason}`);
+        error.code = normalized.reason;
+        throw error;
+      }
+      args = normalized.args;
+    }
+  }
   resumeResolution = resolveResumeAlias(agentType, args, metadata);
   args = resumeResolution.args;
   resume = resumeResolution.resume;

package/template/coding-task-manager/lib/lead-model-observer.js

@@ -172,15 +172,30 @@ function wrapResolver(inner) {
     const results = await inner(outgoing);
     if (current && wanted.size && Array.isArray(results)) {
       const itemsById = new Map(list.map((it) => [String(it.id), it]));
+      const answered = new Set();
       for (const result of results) {
         const id = String(result && result.id);
         if (!wanted.has(id)) continue;
+        answered.add(id);
         const obs = turnObservationFrom(itemsById.get(id), result);
+        // A pending switch settles only on this observation; every drop point is otherwise silent.
+        const trace = (verdict) => console.warn(`[lead-model-observer] ${id.slice(0, 8)} ${JSON.stringify({
+          partial: result?.partial ?? null, coverage: result?.scanCoverage ?? result?.modelScanCheckpoint?.coverage ?? null,
+          turnContext: result?.turnContext ? { model: result.turnContext.model, outcome: result.turnContext.outcome ?? null } : null,
+          observations: Array.isArray(result?.observations) ? result.observations.map((o) => `${o?.kind}:${o?.source}`) : null,
+          obs: obs ? { model: obs.model, outcome: obs.outcome ?? null, turnId: obs.turnId ?? null,
+            processGeneration: obs.processGeneration ?? null, providerThreadId: obs.providerThreadId ?? null,
+            routeId: obs.routeId ?? null, hasProfile: Object.hasOwn(obs, 'profileFingerprint'),
+            hasFacts: Object.hasOwn(obs, 'factsRevision') } : null,
+          verdict })}`);
         if (obs) {
           const report = (error) => console.warn(`[lead-model-observer] observe failed for ${id.slice(0, 8)}: ${error && error.message || error}`);
-          try { Promise.resolve(current.observe(id, obs)).catch(report); } // REPORT: an observer failure must never break model sync
+          try { Promise.resolve(current.observe(id, obs)).then((verdict) => trace(verdict), report); } // REPORT: an observer failure must never break model sync
           catch (error) { report(error); }
-        }
+        } else trace({ settled: false, ignored: 'no_turn_observation' });
+      }
+      for (const id of wanted) {
+        if (!answered.has(id)) console.warn(`[lead-model-observer] ${id.slice(0, 8)} {"verdict":"no_result"}`);
       }
     }
     return results;

package/template/coding-task-manager/lib/lead-model-switch-runtime.js

@@ -217,6 +217,13 @@ function createLeadTransitionTargetPlanner(deps = {}) {
     const cwd = task.cwd || session.cwd || '';
     const agentType = detectAgentType(cmd);
     const resume = extractResumeTarget(agentType, args);
+    // D-2 (docs/claude-routed-native-history-resume-2026-10-24.html §5 D-2, §6): a Claude target
+    // launch must name the canonical SOURCE thread -- never an old startup/parent selector still
+    // sitting in the recorded argv -- so the canonical owner's own provider thread is what the
+    // metadata read is keyed by, and the private spec field below is what the launch-plan worker
+    // classifies/normalizes against. Both are derived ONLY here, after the canonical source proof
+    // below; no client/API caller and no ordinary create/restore caller sets either.
+    const canonicalThreadId = String(source?.providerThreadId || '');
     // The canonical SOURCE proof: the injected model runtime's owner must name THIS session, agent and
     // provider thread at exactly the submitted generation — generation 0 included. A missing owner is
     // refused here, BEFORE any reservation, metadata read or plan.
@@ -241,12 +248,19 @@ function createLeadTransitionTargetPlanner(deps = {}) {
     const generation = reserved.generation;
     const launchMetadata = await runReadPoolOp('readLaunchMetadata', {
       dbPath: dbModule.getDbPath(), baseDbPath: dbModule.getDbPath(), sessionId,
-      resumeId: resume?.sessionId || '', telemetryReason: 'lead-transition-target-preflight',
+      resumeId: agentType === 'claude' ? canonicalThreadId : (resume?.sessionId || ''),
+      telemetryReason: 'lead-transition-target-preflight',
     }, { timeoutMs: 10_000, signal });
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     cacheSessionOwnershipProjection(sessionId, launchMetadata?.resolved || launchMetadata || null);
     const mcpProfile = sessionMcpProfileSetting(task);
-    const warmPlanInputs = await launchPlanWarmInputs({ agentType, cwd, launchMetadata, mcpProfile });
+    // Only Codex gathers warm-plan inputs. A Claude model-target preparation opts out of that cache
+    // entirely, because its key (transcript freshness, cwd, codex config, CLI stamp) cannot describe
+    // the same-thread resume operation below -- and a value that is computed only to be discarded
+    // would still cost the read.
+    const warmPlanInputs = agentType === 'codex'
+      ? await launchPlanWarmInputs({ agentType, cwd, launchMetadata, mcpProfile })
+      : null;
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     const capturedLaunch = session._modelTransitionLaunchContext || {};
     const launchHomeDir = session._launchEnvOverrides?.HOME || capturedLaunch.homeDir || serverConfig.HOME;
@@ -262,11 +276,36 @@ function createLeadTransitionTargetPlanner(deps = {}) {
       env: targetPlanEnv,
       homeDir: launchHomeDir, cliCacheFile: agentCliCacheFile, codexHome: launchCodexHome,
       codexTransportGuard: serverConfig.CTM_CODEX_MCP_TRANSPORT_GUARD !== '0', wallePort,
-      isRestore: true, launchMetadata, mcpProfile, warmPlanInputs, lane: 'interactive',
+      isRestore: true, launchMetadata, mcpProfile,
+      warmPlanInputs,
+      lane: 'interactive',
       transcriptTrashRoot: sessionTranscriptTrashRoot,
+      // PRIVATE internal argument (never persisted, never published, never accepted from a client):
+      // the canonical source thread the produced plan must resume. Only this planner sets it.
+      ...(agentType === 'claude' ? { claudeResumeThreadId: canonicalThreadId } : {}),
     });
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     if (!result?.plan || Number(result.plan.generation) !== generation) return { ok: false, reason: 'lead_target_plan_unavailable' };
+    // D-2/D-3: the produced plan must still name the canonical thread in its argv AND in its resume
+    // metadata, and the two must AGREE about whether there is a resume target at all.
+    // `resolveResumeAlias` may re-resolve a Claude resume id out of the metadata row, so a plan that
+    // ends up on ANOTHER thread is refused here -- before the controller ever parks the source. Both
+    // absent is the legitimate native no-history fresh launch; exactly one absent is an inconsistent
+    // plan (an argv the launcher will act on that the metadata denies, or the reverse).
+    if (agentType === 'claude') {
+      // Same-harness guard: project config's applyToSpec may substitute the live Claude `cmd`, so a
+      // plan for ANOTHER harness (or a plan that does not name its harness at all) is refused here
+      // rather than being accepted as this planner's fresh/both-absent result.
+      if (result.plan.agentType !== 'claude') return { ok: false, reason: 'lead_target_harness_changed' };
+      const planArgs = Array.isArray(result.plan.args) ? result.plan.args : [];
+      const argvResume = extractResumeTarget('claude', planArgs);
+      const argvId = argvResume ? String(argvResume.sessionId || '') : '';
+      const metadataId = String(result.plan.resume?.sessionId || '');
+      if (!!argvId !== !!metadataId) return { ok: false, reason: 'lead_target_resume_inconsistent' };
+      if (argvId && (argvId !== canonicalThreadId || metadataId !== canonicalThreadId)) {
+        return { ok: false, reason: 'lead_target_resume_changed' };
+      }
+    }
     noteLaunchPlanReadinessGeneration(result.plan);
     return { ok: true, generation, launchPlan: result.plan, sourceGeneration };
   };
@@ -670,7 +709,10 @@ function createLeadModelSwitchRuntime(host) {
       const targetRecipe = {
         id: targetRecipeId, sessionId, providerThreadId: source.providerThreadId, harness,
         providerId: target.routeId || 'unknown', origin: target.routeId ? 'routed-proxy' : 'unknown',
-        controlAdapterVersion: target.routeId ? CODEX_CONTROL_ADAPTER : null,
+        // The marker names the Codex app-server conversion adapter. A Claude target -- routed or
+        // native -- has no conversion adapter at all, so recording the Codex one there would claim a
+        // conversion this operation never performs (same-harness native resume).
+        controlAdapterVersion: harness === 'codex-cli' && target.routeId ? CODEX_CONTROL_ADAPTER : null,
         programVersion: null, cyberAccessProgram: null,
         routeId: target.routeId || null,
         wireModelId: target.routeId ? (target.modelId || null) : null, processGeneration: targetPlan.generation,
@@ -758,6 +800,17 @@ function createLeadModelSwitchRuntime(host) {
         const rebound = require('./launch-model-override').ensureCodexResumeTarget(recoveryArgs, source.providerThreadId);
         if (!rebound.ok) return { ok: false, reason: rebound.reason };
         recoveryArgs = rebound.args;
+      } else if (source.agent === 'claude') {
+        // The SAME normalization for a native Claude source. A captured Claude argv may select its
+        // thread through `--resume` OR through an explicit `--session-id` (a fresh identity CTM
+        // injected at startup), and it may still carry that launch's own initial positional prompt.
+        // The existing pure normalizer produces exactly one canonical `--resume <source thread>`
+        // prefix: every permission/settings operand survives, while the selector that named the
+        // thread and the one-shot startup prompt do not -- so a rollback resumes the SAME
+        // conversation instead of replaying the original task as a new turn.
+        const rebound = require('./launch-model-override').ensureClaudeResumeTarget(recoveryArgs, source.providerThreadId);
+        if (!rebound.ok) return { ok: false, reason: rebound.reason };
+        recoveryArgs = rebound.args;
       }
       const selectedSourceThread = extractResumeTarget(source.agent, recoveryArgs)?.sessionId || '';
       if (selectedSourceThread !== sourceThreadId) return { ok: false, reason: 'source_launch_context_unavailable' };

package/template/coding-task-manager/lib/lead-model-switch.js

@@ -393,6 +393,7 @@ function createLeadModelSwitch(deps) {
       entry.recovered = !!result?.ok;
       if (!entry.recovered) {
         entry.req.recovery_reason = 'source_recovery_failed';
+        diagnostic(entry.req.ctm_session_id, 'lead-transition-source-recovery-failed', { reason: String(result?.reason || 'unknown').slice(0, 120) });
         const cause = entry.failureOutcome?.detail || 'The requested target was not applied.';
         entry.req.detail = `${cause} The captured source provider could not be restored.`;
       } else {
@@ -480,7 +481,7 @@ function createLeadModelSwitch(deps) {
       return refuse(409, 'client_request_conflict');
     }
     if (existing?.confirmationPromise) return refuse(409, 'lead_transition_committing', { request: publicRequest(existing.req) });
-    if (existing?.handoffStarted && !existing.recovered && ['cancelled', 'failed'].includes(existing.req.state)) {
+    if (existing?.handoffStarted && (existing.sourceParked || existing.targetStarted) && !existing.recovered && ['cancelled', 'failed'].includes(existing.req.state)) {
       return refuse(409, 'lead_switch_recovery_in_flight', { request: publicRequest(existing.req) });
     }
     if (existing?.req.state === 'awaiting_turn' && existing.handoffStarted && !existing.recovered) {
@@ -767,7 +768,7 @@ function createLeadModelSwitch(deps) {
         return refuse(500, 'lead_transition_persist_failed', { message: String(error?.message || error).slice(0, 200) });
       }
     }
-    if (providerTransition) {
+    if (providerTransition && info.agent !== 'claude') {
       if (!entry.transition) { requestControllers.delete(id); fail(entry, 'lead_transition_owner_unavailable', 'The transition owner is not available.'); return refuse(409, 'lead_transition_owner_unavailable'); }
       try {
         historyPreparation = await prepareHistory({
@@ -783,6 +784,14 @@ function createLeadModelSwitch(deps) {
           targetRecipe: entry.transition.targetRecipe,
           preparedProfile: routed?.preparedProfile || targetPlan?.preparedProfile || null,
           signal: controller.signal,
+          // D-5/R-1: the source model is writing the handoff summary, which spends a GPT turn and
+          // can take minutes. The journal records the phase (preparing -> compacting -> verified)
+          // and the public request carries the bounded detail line the client already renders.
+          onPhase: async (phase, detail) => {
+            if (phase !== 'compacting' || !ownsRequest()) return;
+            await advanceJournal(entry, 'compacting');
+            transition(entry, 'preparing', { phase: 'compacting', detail: String(detail).slice(0, 200) });
+          },
         });
       } catch (error) { historyPreparation = { ok: false, reason: error?.code || 'history_preparation_failed' }; }
       if (!ownsRequest()) return superseded();

package/template/coding-task-manager/lib/lead-model-transition-runtime.js

@@ -4,11 +4,13 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { inspectTransition } = require('./harness-history-transition');
-const { createCodexNativeHistoryControl } = require('./native-history-control');
+const { createCodexNativeHistoryControl, handoffMessage } = require('./native-history-control');
+const { writeSourceHandoff } = require('./codex-source-handoff');
 const { effectiveOutputCap } = require('./model-proxy/output-cap');
 const { workerCapabilityForModel } = require('./model-proxy/routes');
 const { rebindCodexForkLaunchPlan } = require('./launch-model-override');
 const codexPaths = require('./codex-paths');
+const { _probeVersion } = require('./harness-model-profile');
 // S-6: the receipt id and the default control-adapter id are qualified-table constants.
 const { CODEX_COMPACTION_SCHEMA_RECEIPT, CODEX_CONTROL_ADAPTER, isQualifiedCodexVersion } =
   require('./codex-harness-qualification');
@@ -71,6 +73,9 @@ function createLeadModelTransitionRuntime(host = {}) {
     // The GENUINE native-config receipt checker. Existing callers omit it and keep the real behavior;
     // a test may inject a wrapper that delegates to it (never an always-true verifier).
     configReceiptMatches = codexConfigReceiptMatches,
+    // The measured `--version` of the source executable the fork runs. A test whose executable is
+    // not a Codex binary injects the version that binary would report.
+    probeSourceProgramVersion = _probeVersion,
     transitionControlAdapterVersion = CODEX_CONTROL_ADAPTER } = host;
   if (typeof getSession !== 'function' || typeof runReadPoolOp !== 'function'
       || typeof dbModule?.getDbPath !== 'function') throw new TypeError('lead history runtime requires session, read-pool, and DB-owner access');
@@ -218,6 +223,13 @@ function createLeadModelTransitionRuntime(host = {}) {
     )) ? { ok: true } : { ok: false, reason: 'source_config_policy_unqualified' };
     try { sourceLaunch.executablePath = await fs.promises.realpath(sourceLaunch.executablePath); }
     catch { return refuse('source_binary_unavailable'); }
+    // The fork and the handoff run THIS binary, so its measured version is what the adapter
+    // qualifies. The rollout's session_meta cli_version names the binary that CREATED the thread
+    // (resumes append none), e.g. 0.147.0 for a thread still resumed today by 0.163.0.
+    let sourceProgramVersion;
+    try { sourceProgramVersion = await probeSourceProgramVersion(sourceLaunch.executablePath, signal); }
+    catch { return refuse('source_binary_unavailable'); }
+    effectiveSource.programVersion = sourceProgramVersion;
     let policyOverrides;
     try {
       const argvPolicyOverrides = extractCodexPolicyOverrides(captured.args, {
@@ -242,17 +254,35 @@ function createLeadModelTransitionRuntime(host = {}) {
     try {
       nativeControl = createCodexNativeHistoryControl({
         sourceRecipe: { controlAdapterVersion: transitionControlAdapterVersion,
-          programVersion: snapshot.previousSettings.programVersion,
+          programVersion: sourceProgramVersion,
           cyberAccessProgram: snapshot.previousSettings.cyberAccessProgram,
           approvalPolicy: snapshot.previousSettings.approvalPolicy,
           sandboxPolicy: snapshot.previousSettings.sandboxPolicy, ...sourceLaunch },
         targetRecipe: targetControlRecipe,
       });
     } catch (error) { return refuse(error?.code || 'native_adapter_unqualified'); }
+    // D-5/D-6: the source model writes the plaintext handoff that will cover its sealed compaction.
+    // It runs here -- after the source launch context and config receipt were validated and before
+    // anything is parked or staged -- so a refusal costs one GPT turn and no state change.
+    let handoff = null;
+    if (decision.handoff?.required) {
+      const sourceModel = nonempty(snapshot.previousSettings?.model) || nonempty(source.modelId);
+      if (!sourceModel) return refuse('source_model_changed');
+      await input.onPhase?.('compacting', `Writing a handoff summary with ${sourceModel}`);
+      const written = await writeSourceHandoff(sourceLaunch, { sourceThreadId: source.providerThreadId,
+        lastTurnId: snapshot.checkpoint.id }, { signal });
+      if (!sourceIdentityHolds()) return refuse('lead_source_changed');
+      if (!written.ok) return refuse(written.reason);
+      const message = handoffMessage({ compactionSha256: decision.handoff.compactionSha256,
+        text: written.text, sourceModel });
+      handoff = { compactionSha256: decision.handoff.compactionSha256, text: written.text,
+        textSha256: crypto.createHash('sha256').update(message.content[0].text).digest('hex'),
+        sourceModel };
+    }
     return { ok: true, action: 'fork', planAction: decision.action, reason: decision.reason, decision, snapshot,
       sourceRecipe: effectiveSource, targetRecipe: effectiveTarget,
       nativeControl, sourceLaunch, targetControlRecipe, revalidateTargetProfile, revalidateSourceConfig,
-      storageRootReceipt,
+      storageRootReceipt, handoff,
       controlPolicy: { approvalPolicy: snapshot.previousSettings.approvalPolicy,
         sandboxPolicy: snapshot.previousSettings.sandboxPolicy,
         cyberAccessProgram: snapshot.previousSettings.cyberAccessProgram } };
@@ -306,7 +336,8 @@ function createLeadModelTransitionRuntime(host = {}) {
     try {
       nativeReceipt = await historyPreparation.nativeControl.forkCheckpoint({ sourceThreadId: source.providerThreadId,
         lastTurnId: historyPreparation.snapshot.checkpoint.id,
-        sourceGeneration: historyPreparation.snapshot.generation }, { signal, targetAuthToken: token });
+        sourceGeneration: historyPreparation.snapshot.generation },
+      { signal, targetAuthToken: token, handoff: historyPreparation.handoff || undefined });
     } catch (error) { return refuse(error?.code || 'native_history_control_failed'); }
     if (signal?.aborted) return refuse('transition_cancelled');
     if (parkedGone(getSession(sessionId))) return refuse('source_owner_changed_after_read');
@@ -317,6 +348,12 @@ function createLeadModelTransitionRuntime(host = {}) {
       targetGeneration: transition.targetGeneration, sourceCheckpointId: historyPreparation.snapshot.checkpoint.id,
       sourceContentDigest: historyPreparation.snapshot.contentDigest, targetThreadId: nativeReceipt.targetThreadId,
       storageRootReceipt: historyPreparation.storageRootReceipt,
+      // D-8: the readback must prove the EXACT handoff that was injected, so the controller hands
+      // the reader the two digests it wrote instead of trusting the inject call's own result.
+      expectedHandoff: historyPreparation.handoff
+        ? { compactionSha256: historyPreparation.handoff.compactionSha256,
+          textSha256: historyPreparation.handoff.textSha256 }
+        : null,
     }, { timeoutMs: 30_000, signal });
     if (signal?.aborted) return refuse('transition_cancelled');
     if (parkedGone(getSession(sessionId))) return refuse('source_owner_changed_after_read');
@@ -385,6 +422,7 @@ function createLeadModelTransitionRuntime(host = {}) {
 }
 
 function refuse(reason) { return { ok: false, reason }; }
+function nonempty(value) { return typeof value === 'string' && value.trim() ? value.trim() : ''; }
 
 function extractCodexPolicyOverrides(argv, expected = {}) {
   if (!Array.isArray(argv)) throw Object.assign(new Error('source launch args unavailable'), { code: 'source_policy_override_unqualified' });

package/template/coding-task-manager/lib/lead-model-transition-store.js

@@ -261,11 +261,41 @@ function createLeadModelTransitionStore({
   const getActiveForSession = (ctmSessionId) => {
     const sessionId = String(ctmSessionId || '').trim();
     if (!sessionId || sessionId.length > 128) return null;
-    const row = getCoreDb().prepare(`SELECT transition_id FROM coding_model_transitions
+    const db = getCoreDb();
+    // An explicit CTM_DB_DOMAIN_SPLIT=0 boot never stamps v18, so the v49 journal is never
+    // created there. A journal that does not exist holds no active transition: answer that
+    // truthfully instead of throwing, which made every deferred restore on such a boot refuse
+    // with lead-transition-reconciliation-unavailable.
+    if (!db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type='table' AND name='coding_model_transitions'").get()) return null;
+    const row = db.prepare(`SELECT transition_id FROM coding_model_transitions
       WHERE ctm_session_id=? AND state IN ('queued','preparing','compacting','verified','handing_off','awaiting_turn')
       ORDER BY updated_at DESC, transition_id DESC LIMIT 1`).get(sessionId);
     return row ? get(row.transition_id) : null;
   };
+  // WP-1 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-3, §9 S-6): the journal
+  // reader the launch-time route reconciliation needs. `getActiveForSession` excludes terminal
+  // states, but the repair must find the fork a transition ACTUALLY launched even after it failed, so
+  // this reads ANY state, newest revision first, with the parsed target recipe beside the row
+  // identity. Read-only and bounded; a malformed recipe JSON is skipped, never surfaced.
+  const listForThread = (ctmSessionId, providerThreadId) => {
+    const sessionId = String(ctmSessionId || '').trim();
+    const threadId = String(providerThreadId || '').trim();
+    if (!sessionId || sessionId.length > 128 || !threadId || threadId.length > 512) return [];
+    const rows = getCoreDb().prepare(`SELECT transition_id, revision, state, target_recipe_json
+      FROM coding_model_transitions WHERE ctm_session_id = ? ORDER BY revision DESC, updated_at DESC, transition_id DESC`)
+      .all(sessionId);
+    const out = [];
+    for (const row of rows) {
+      let targetRecipe;
+      try { targetRecipe = JSON.parse(row.target_recipe_json); } catch { continue; /* expected: a corrupt recipe is not a route source */ }
+      out.push({
+        transition_id: row.transition_id, revision: Number(row.revision), state: row.state, target_recipe: targetRecipe,
+        provider_thread_id: targetRecipe?.providerThreadId || null, route_id: targetRecipe?.routeId || null,
+        model: targetRecipe?.wireModelId || null, harness: targetRecipe?.harness || null,
+      });
+    }
+    return out;
+  };
   function saveProfile(profile = {}) {
     const allowed = new Set(['fingerprint', 'harness', 'cliVersion', 'adapterVersion', 'deployment', 'artifactPath', 'evidenceReceipt']);
     if (Object.keys(profile).some((key) => !allowed.has(key))) throw new TypeError('profile contains an unapproved field');
@@ -690,11 +720,39 @@ function createLeadModelTransitionStore({
     if (!row) return null;
     try { return { ...row, bindings: JSON.parse(row.bindings_json) }; } catch { return null; }
   }
-  return { get, getActiveForSession, getStagedToken, saveProfile, begin, advance, commit, stageToken, recordFork, clearStagedToken };
+  return { get, getActiveForSession, listForThread, getStagedToken, saveProfile, begin, advance, commit, stageToken, recordFork, clearStagedToken };
 }
 
 // `validateRecipe` is exported so the approved-intent store can reuse the ONE complete bounded
 // journal recipe validation instead of keeping a parallel whitelist that silently drops (or refuses)
 // the real producer's provider/context metadata. This module imports only the PURE intent contract,
 // so the store importing this export introduces no construction cycle.
-module.exports = { ACTIVE_STATES, createLeadModelTransitionStore, validateRecipe };
+// The provider thread of a FORK the session's active transition is still trying, or null. Until
+// commit() moves the startup pointer, that thread is a candidate: the startup row keeps the source so
+// a cold start before the first confirmed target turn resumes the source. Every startup-pointer writer
+// (db.js updateStartupTaskAgentSession) asks this on the same handle, inside its own transaction.
+function activeCandidateForkThread(db, ctmSessionId) {
+  // A core schema without the journal (pre-migration fixtures) has no transitions, so no candidate.
+  if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='coding_model_transitions'").get()) return null;
+  const row = db.prepare(`SELECT source_recipe_json, target_recipe_json FROM coding_model_transitions
+    WHERE ctm_session_id=? AND state IN (${[...ACTIVE_STATES].map(() => '?').join(',')})
+    ORDER BY updated_at DESC, transition_id DESC LIMIT 1`).get(String(ctmSessionId || ''), ...ACTIVE_STATES);
+  if (!row) return null;
+  let source, target;
+  try { source = JSON.parse(row.source_recipe_json); target = JSON.parse(row.target_recipe_json); }
+  catch { return null; } // expected: a malformed journal row is refused by every transition reader; it names no candidate
+  const thread = String(target?.providerThreadId || '');
+  return thread && thread !== String(source?.providerThreadId || '') ? thread : null;
+}
+
+// The startup-pointer writers' guard (db.js updateStartupTaskAgentSession). Live: a fork relaunch wrote
+// `resume <target>` and the commit then refused "startup task does not point at the captured source
+// provider thread".
+function resumesCandidateFork(db, ctmSessionId, resumeArgs) {
+  const candidate = Array.isArray(resumeArgs) ? activeCandidateForkThread(db, ctmSessionId) : null;
+  if (!candidate || !resumeArgs.some((arg) => String(arg) === candidate)) return false;
+  console.warn(`[startup-task] kept the source pointer for ${String(ctmSessionId).slice(0, 8)}: ${candidate.slice(0, 8)} is an uncommitted fork`);
+  return true;
+}
+
+module.exports = { ACTIVE_STATES, createLeadModelTransitionStore, validateRecipe, activeCandidateForkThread, resumesCandidateFork };

package/template/coding-task-manager/lib/legacy-draft-cancellation-recovery.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const path = require('node:path');
+const { createMediaJournalControlReader } = require('./media-journal-control-reader');
+
+function unavailable(cause) {
+  return Object.assign(new Error('Pending image cancellation recovery is unavailable', { cause }), {
+    code: 'CTM_MEDIA_JOURNAL_UNAVAILABLE',
+  });
+}
+
+// One recovery scope per logical DB handle and journal directory. No new SQL owner: the caller
+// supplies the same worker projector used by the write-behind store. Neither journal nor cursor
+// is advanced, because unrelated content must remain available to its ordinary replay owner.
+function createLegacyDraftCancellationRecovery({ getDirectory, getContext, projectEntry }) {
+  for (const callback of [getDirectory, getContext, projectEntry]) {
+    if (typeof callback !== 'function') throw new TypeError('Cancellation recovery requires callbacks');
+  }
+  let scope = null;
+  let operation = null;
+  let retired = false;
+  let closing = null;
+
+  function binding() {
+    const context = getContext();
+    const directory = getDirectory();
+    if (!context || !directory) throw new Error('Cancellation recovery has no open storage context');
+    return { context, directory: path.resolve(directory) };
+  }
+
+  function assertCurrent(owner) {
+    if (retired || owner !== scope) throw new Error('Cancellation recovery scope is retired');
+    const current = binding();
+    if (current.context !== owner.context || current.directory !== owner.directory) {
+      throw new Error('Cancellation recovery storage context changed');
+    }
+  }
+
+  async function closeReader(owner) {
+    if (!owner?.reader) return;
+    await owner.reader.close();
+    owner.reader = null; // Retain an unconfirmed resource owner on failure, not just its descriptor.
+  }
+
+  async function recover(current) {
+    await closeReader(scope);
+    const owner = scope = { ...current, reader: null, ready: false };
+    assertCurrent(owner);
+    const reader = owner.reader = createMediaJournalControlReader({
+      directory: owner.directory, assertCurrent: () => assertCurrent(owner),
+    });
+    let records;
+    let failed = false;
+    let failure;
+    try { records = await reader.read(); }
+    catch (error) { failed = true; failure = error; }
+    try { await closeReader(owner); }
+    catch (error) {
+      throw failed
+        ? new AggregateError([failure, error], 'Cancellation recovery and reader cleanup failed', { cause: failure })
+        : error;
+    }
+    if (failed) throw failure;
+    // Close every read handle BEFORE the first SQL projection. A partial projection remains
+    // idempotently retryable through applyMediaJournalEntry; it is never a completed recovery.
+    for (const { entry } of records) {
+      assertCurrent(owner);
+      const result = await projectEntry(entry, { urgent: true });
+      assertCurrent(owner);
+      if (typeof result?.cancelled !== 'boolean' || typeof result?.sessionEnded !== 'boolean'
+          || result.cancelled === result.sessionEnded) {
+        throw new TypeError('Cancellation projection did not confirm a durable cancellation or ended session');
+      }
+    }
+    assertCurrent(owner);
+    owner.ready = true;
+  }
+
+  function prepare() {
+    try {
+      if (retired) throw new Error('Cancellation recovery is closed');
+      const current = binding();
+      if (operation) return operation;
+      if (scope?.ready && scope.context === current.context && scope.directory === current.directory) {
+        return Promise.resolve();
+      }
+      operation = recover(current).catch(error => { throw unavailable(error); })
+        .finally(() => { operation = null; });
+      return operation;
+    } catch (error) {
+      return Promise.reject(unavailable(error));
+    }
+  }
+
+  function close() {
+    retired = true;
+    if (closing) return closing;
+    closing = (async () => {
+      // Already delivered operational errors are not shutdown failures. Unconfirmed handles
+      // remain owned and closeReader must still report them. No race against a timeout here.
+      if (operation) await operation.catch(() => { /* expected: admitted caller receives the failure */ });
+      await closeReader(scope);
+      scope = null;
+    })().finally(() => { closing = null; });
+    return closing;
+  }
+
+  return { prepare, close };
+}
+
+module.exports = { createLegacyDraftCancellationRecovery };

package/template/coding-task-manager/lib/login-tripwire.js

@@ -13,6 +13,20 @@
 //   claude-not-logged-in    transcript 95d10514 (16 Oct 23:31 -> 17 Oct 22:06): 37 results.
 //   github-device-login     ~/.claude/plugins/cache/doordash-agentskills/core/5.3.67/bin/_run_cli.py
 //                           url_patterns:62 -- the wrapper's `gh auth login --web` URL shape.
+//   codex-login-picker      strings /opt/homebrew/Caskroom/codex/0.163.0/bin/codex (measured
+//                           2026-10-20) holds the literal "Sign in with Device Code" -- the
+//                           picker's second label, D-2.
+//   codex-browser-login     the same binary holds "Finish signing in via your browser", the banner
+//                           the default (browser) flow prints while it waits.
+//   codex-device-login      the same binary holds "Enter this one-time code" and the path fragment
+//                           "/codex/device" (the full URL is composed at runtime, D-2); the device
+//                           URL https://auth.openai.com/codex/device is cited in
+//                           https://developers.openai.com/codex/cli/reference.
+//
+// NOT matched on purpose: the bare literal "Sign in with ChatGPT". The same 0.163.0 binary prints
+// it in status lines such as "Sign in with ChatGPT to use /usage." and "Sign in with ChatGPT and
+// retry", which are not a login screen -- matching them would kill an authenticated session. Only
+// the picker's device-code label, the browser-flow banner and the device URL/code are matched.
 //
 // The window is a rolling tail of ANSI-stripped output so a pattern split across two
 // chunks (or wrapped in colour codes) still matches. Correctness only needs
@@ -28,6 +42,9 @@ const LOGIN_PATTERNS = Object.freeze([
   { id: 'claude-oauth-url', re: /claude\.(?:com\/cai|ai)\/oauth/ },
   { id: 'claude-not-logged-in', re: /Not logged in\s*·\s*Please run \/login/ },
   { id: 'github-device-login', re: /github\.com\/login(?:\/device|\/oauth)/ },
+  { id: 'codex-login-picker', re: /Sign in with Device Code/ },
+  { id: 'codex-browser-login', re: /Finish signing in via your browser/ },
+  { id: 'codex-device-login', re: /auth\.openai\.com\/codex\/device|Enter this one-time code/ },
 ]);
 
 const WINDOW_CHARS = 4096;
@@ -170,6 +187,7 @@ function armSessionLoginTripwire({ proc, env, onBlocked } = {}) {
 module.exports = {
   LOGIN_PATTERNS,
   WINDOW_CHARS,
+  stripAnsi,
   createLoginTripwire,
   attachToPty,
   armSessionLoginTripwire,