create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/root-prompt-flow.js

@@ -10,7 +10,8 @@ const {
   createRootDeliveryRuntime, getRootDeliveryJobLifetime, isRootDeliveryJobLifetimeCurrent,
 } = require('./root-delivery-runtime');
 const { ROOT_PROMPT_ACTION } = require('./remote-command-purpose');
-const { selectRootDeliveryAttempt } = require('./root-delivery-selection');
+const { selectRootDeliveryAttempt, selectRootDeliveryRecovery } = require('./root-delivery-selection');
+const promptAdmissionTrace = require('./prompt-admission-trace');
 
 const TERMINAL_STATUSES = new Set([
   'sent', 'accepted_by_terminal', 'durable_user_message_seen', 'response_started', 'queued_by_agent',
@@ -18,6 +19,49 @@ const TERMINAL_STATUSES = new Set([
 const PREFLIGHT_RETRYABLE = new Set([
   'session_input_in_flight', 'session_resume_not_ready', 'command_deferred_until_idle',
 ]);
+const PREFLIGHT_USER_ACTION = new Set(['session_not_live', 'session_waiting_for_approval']);
+// WP-0 (queue-delivery-recovery): one wording per recovery action, so the persisted
+// row, the broadcast frame and the direct reply cannot describe the same verdict
+// differently. Both describe the preserved prompt and the action the user owns;
+// neither claims the prompt was not sent while its effect is unknown.
+const RESEND_MESSAGE = 'Your prompt is saved and was not sent. Choose Resend to try again.';
+const REVIEW_MESSAGE = 'CTM could not safely confirm this desktop delivery. Review the submission before resending.';
+const SAFE_DIAGNOSTIC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+
+function safeDiagnosticId(value) {
+  return typeof value === 'string' && SAFE_DIAGNOSTIC_ID_RE.test(value) ? value : '';
+}
+
+// WP-0: what a cached (restart-surviving) parent row plus its scoped delivery
+// receipts prove about the prompt, and the exact action the user owns. Delegates
+// the proof rules to root-delivery-selection so read evidence and classification
+// cannot drift; anything uncertified stays `unknown`/`review`.
+function classifyReplayRecovery(snapshot) {
+  const verdict = selectRootDeliveryRecovery(snapshot);
+  if (verdict.deliveryState === 'sent') {
+    const recorded = String(snapshot?.parent?.status || '');
+    return Object.freeze({
+      recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+      reason: '', // Canonical Root confirmation stores 'sent' for provider_transcript_match.
+      terminalStatus: recorded === 'sent' ? 'durable_user_message_seen' : recorded,
+    });
+  }
+  if (verdict.recoveryAction === 'resend') {
+    // The certified no-effect proof names the exact earlier blocker; keep that
+    // specific reason instead of flattening it to the generic refusal code.
+    const blocker = snapshot?.latest?.result?.result?.delivery_evidence?.blocker;
+    const specific = typeof blocker === 'string'
+      && (PREFLIGHT_RETRYABLE.has(blocker) || PREFLIGHT_USER_ACTION.has(blocker)) ? blocker : '';
+    return Object.freeze({
+      recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+      reason: specific, terminalStatus: '',
+    });
+  }
+  return Object.freeze({
+    recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+    reason: '', terminalStatus: '',
+  });
+}
 const SAFE_DIAGNOSTIC_ERROR_KINDS = new Set(['ReferenceError', 'TypeError', 'RangeError', 'SqliteError', 'Error']);
 const SAFE_DIAGNOSTIC_SOURCE_FILES = new Set([
   'root-prompt-admission.js', 'remote-relay-store.js', 'server.js', 'main-db-census.js',
@@ -49,6 +93,7 @@ function safeResult(response, publicId, sessionId, fallbackSource = 'unknown') {
       reason: mapped.reason,
       source: mapped.source,
       retryable: mapped.retryable,
+      recoveryAction: mapped.recoveryAction,
       ...(mapped.message ? { message: mapped.message } : {}),
       ...(detail.duplicate === true || response?.duplicate === true ? { duplicate: true } : {}),
       ...(detail.retrying === true || response?.retrying === true ? { retrying: true } : {}),
@@ -68,6 +113,7 @@ function safeResult(response, publicId, sessionId, fallbackSource = 'unknown') {
     reason: mapped.reason,
     source: mapped.source,
     retryable: mapped.retryable,
+    recoveryAction: mapped.recoveryAction,
     ...(mapped.message ? { message: mapped.message } : {}),
     ...(Number.isInteger(httpStatus) && httpStatus >= 400 && httpStatus <= 599 ? { httpStatus } : {}),
   };
@@ -94,6 +140,11 @@ function createRootPromptFlow(deps = {}) {
   const observerLifetimes = new WeakMap();
   const sessionDrains = new WeakMap();
   const httpRequestScopes = new WeakMap();
+  // WP-0: the normalized session/client-message correlation for the operation
+  // currently running on a captured scope, so every diagnostic that scope emits
+  // (admission, driver, delivery stage, replay recovery) can be joined to the one
+  // user-visible submission. Both values are bounded ids, never receipt ids.
+  const scopeCorrelation = new WeakMap();
 
   function registryFor(db) {
     let registry = registries.get(db);
@@ -120,6 +171,9 @@ function createRootPromptFlow(deps = {}) {
   function reportFailure(scope, phase, code, details = {}) {
     if (!scope?.isCurrent()) return;
     const event = { category: 'root-prompt-flow', phase, code };
+    const correlation = scopeCorrelation.get(scope);
+    if (correlation?.sessionId) event.sessionId = correlation.sessionId;
+    if (correlation?.clientMessageId) event.clientMessageId = correlation.clientMessageId;
     for (const key of ['returnedRecordConfirmed', 'canonicalRecordConfirmed', 'recordFieldsMatch']) {
       if (typeof details[key] === 'boolean') event[key] = details[key];
     }
@@ -182,6 +236,11 @@ function createRootPromptFlow(deps = {}) {
       },
       isDeliveryCurrent: (_handle, metadata) => scope.isCurrent() === true && now() < metadata.expiresAt,
       now,
+      // WP-0 criterion 6: the driver reports the exact rejected handoff stage
+      // (delivery_snapshot / delivery_text / delivery_selection / delivery_dispatch /
+      // admission_metadata) with a static code. reportFailure bounds the event and
+      // swallows a throwing sink, so diagnostics can never change an outcome.
+      reportDiagnostic: (event) => reportFailure(scope, event?.phase, event?.code, {}),
     });
   }
 
@@ -230,14 +289,18 @@ function createRootPromptFlow(deps = {}) {
       {
         retire(registry, job);
         if (job.scope.isCurrent()) {
+          // WP-0 criterion 7: the certificate is gone without a completion proof,
+          // so the effect of this prompt is UNKNOWN. Say so, and keep the
+          // conservative review action rather than claiming nothing was sent.
+          const expired = code === 'root_delivery_expired';
           try {
             await storeStatus(job.sessionId, job.receiptId, 'needs_attention', {
-              reason: code === 'root_delivery_expired'
-                ? code : 'root_job_unresolved',
+              reason: expired ? code : 'root_job_unresolved',
               retryable: false,
-              message: code === 'root_delivery_expired'
-                ? 'The desktop delivery permission expired. Resend this prompt to try again.'
-                : 'CTM could not safely confirm this desktop delivery. Review the submission and resend if needed.',
+              recoveryAction: 'review',
+              message: expired
+                ? 'The desktop delivery permission expired before CTM could confirm this delivery. Review the submission before resending.'
+                : REVIEW_MESSAGE,
               source: job.source,
             });
           } catch { reportFailure(job.scope, 'publish_unresolved', 'status_write_failed'); }
@@ -321,6 +384,11 @@ function createRootPromptFlow(deps = {}) {
     const scope = operationScope || commandRuntime.captureRootPromptCoordinator();
     if (!scope || !requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
     const publicId = agentSessionKernel.normalizeClientMessageId(options.clientMessageId);
+    // WP-0: correlate every diagnostic this operation emits with its normalized
+    // session/client-message identity (bounded ids only -- never a receipt id).
+    scopeCorrelation.set(scope, {
+      sessionId: safeDiagnosticId(sessionId), clientMessageId: safeDiagnosticId(publicId),
+    });
     const authState = { auth: null, namespace: null };
     const freshContext = transportKind === 'ws'
       ? (socket, namespace) => commandRuntime.freshRootPromptContext(socket, namespace)
@@ -351,7 +419,7 @@ function createRootPromptFlow(deps = {}) {
     const admission = makeAdmission({ scope, current, freshContext, authState, sessionId, text, options });
     let admitted;
     try {
-      admitted = await admission.submit(client, sessionId, text, options);
+      admitted = await promptAdmissionTrace.time('admission', () => admission.submit(client, sessionId, text, options));
     } catch {
       admitted = { response: denial('remote_command_unresolved'), admission: null };
     }
@@ -383,6 +451,15 @@ function createRootPromptFlow(deps = {}) {
             driver, writeActive: true, autoPending: true, inFlight: false, lastResult: null,
           };
           registry.set(receiptId, job);
+        } else {
+          // WP-0 criterion 4: a committed admission whose delivery facade cannot be
+          // registered is a typed handoff failure, never a silent acceptance. The
+          // committed historical record is left exactly as it is.
+          reportFailure(scope, 'driver_registration', 'root_driver_registration_unavailable');
+          admitted = { ...admitted, response: { ...denial('root_driver_registration_unavailable', 503),
+            recoveryAction: 'resend',
+            message: 'CTM saved your prompt but could not start delivery. Resend to try again.',
+          } };
         }
       }
       if (job) {
@@ -392,37 +469,86 @@ function createRootPromptFlow(deps = {}) {
         void firstDrive.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
       }
     } else if (admitted?.response?.ok === true) {
-      // A cached parent is not a process-local write marker. Never adopt it after restart.
+      // A cached parent is not a process-local write marker. Never adopt it after
+      // restart, and never answer with its cached acceptance: a reply is truthful
+      // only when this process holds the job, or when a scoped read proves what
+      // actually happened to the prompt.
       let context = null;
+      let contextFailed = false;
       try { context = await freshContext(client, null); }
-      catch { reportFailure(scope, 'drive', 'unexpected_failure'); }
-      if (context?.ok && requestCurrent(scope, current)) {
-        const receiptId = remoteCommandStore.remoteCommandReceiptId(context.namespace.namespaceHash, publicId);
-        const resident = registry.get(receiptId);
-        let requestedIntentHash = '';
+      catch { contextFailed = true; }
+      if (!contextFailed && (!context?.ok || !requestCurrent(scope, current))) contextFailed = true;
+      if (contextFailed) {
+        // WP-0 criterion 4: no current authority and no proof -- refuse, never
+        // fall through to the cached `received`/`accepted` response.
+        reportFailure(scope, 'replay_recovery', 'root_replay_context_unavailable');
+        return denial(context?.code || 'remote_command_auth_unavailable', context?.status || 503);
+      }
+      const receiptId = remoteCommandStore.remoteCommandReceiptId(context.namespace.namespaceHash, publicId);
+      const resident = registry.get(receiptId);
+      let requestedIntentHash = '';
+      try {
+        const intentHandle = rootPromptIntent.captureRootPromptIntent({
+          sessionId, text, source: options.source, attachments: options.attachments,
+        }, { maxPromptBytes });
+        requestedIntentHash = intentHandle.body.intent_hash;
+      } catch { requestedIntentHash = ''; reportFailure(scope, 'replay_recovery', 'root_replay_intent_unavailable'); }
+      const residentProof = resident && getCommittedRootAdmission(resident.admissionHandle);
+      if (resident?.writeActive && now() < resident.expiresAt && resident.scope.isCurrent()
+          && residentProof?.selector?.sessionId === sessionId
+          && residentProof.selector.namespaceHash === context.namespace.namespaceHash
+          && residentProof.selector.intentHash === requestedIntentHash) {
+        // A same-id manual retry with a live local job keeps the existing child
+        // selection semantics; no read evidence is consulted for it.
+        job = resident;
+        const retry = driveJob(registry, resident, false);
+        void retry.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
+      } else {
+        // WP-0 criterion 3: the delivery permission is gone (restart, lost
+        // registry). Ask the scoped store what the prompt's own receipts prove --
+        // authenticated namespace + session + command id + a freshly captured
+        // intent hash -- and recheck the request scope after every await.
+        let snapshot = null;
+        let readFailed = false;
         try {
-          const intentHandle = rootPromptIntent.captureRootPromptIntent({
-            sessionId, text, source: options.source, attachments: options.attachments,
-          }, { maxPromptBytes });
-          requestedIntentHash = intentHandle.body.intent_hash;
-        } catch { requestedIntentHash = ''; reportFailure(scope, 'drive', 'unexpected_failure'); }
-        const residentProof = resident && getCommittedRootAdmission(resident.admissionHandle);
-        if (resident?.writeActive && now() < resident.expiresAt && resident.scope.isCurrent()
-            && residentProof?.selector?.sessionId === sessionId
-            && residentProof.selector.namespaceHash === context.namespace.namespaceHash
-            && residentProof.selector.intentHash === requestedIntentHash) {
-          job = resident;
-          const retry = driveJob(registry, resident, false);
-          void retry.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
+          snapshot = await runReadPoolOp('getLatestRootJobDeliveryReceipt', {
+            dbPath: scope.dbPath,
+            selector: {
+              namespaceHash: context.namespace.namespaceHash, commandId: publicId,
+              instanceId: scope.instanceId, sessionId, intentHash: requestedIntentHash,
+            },
+          }, { telemetryReason: 'root-prompt-replay-recovery' });
+        } catch { readFailed = true; }
+        if (!requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
+        if (readFailed) reportFailure(scope, 'replay_recovery', 'root_delivery_replay_unavailable');
+        const proof = classifyReplayRecovery(readFailed ? null : snapshot);
+        if (proof.deliveryState === 'sent') {
+          // Read evidence proves the prompt was already delivered: report the
+          // recorded sent signal as a duplicate. No new delivery, no new
+          // authority, and the preserved row is not downgraded.
+          admitted = { ...admitted, response: {
+            ok: true, status: proof.terminalStatus, duplicate: true,
+            source: options.source || 'web',
+          } };
         } else {
+          const action = proof.recoveryAction === 'resend' ? 'resend' : 'review';
+          const status = action === 'resend' ? 'needs_attention' : 'blocked';
+          const details = {
+            reason: proof.reason || 'root_job_unresolved', retryable: false,
+            recoveryAction: action,
+            message: action === 'resend' ? RESEND_MESSAGE : REVIEW_MESSAGE,
+            source: options.source || 'web',
+          };
+          reportFailure(scope, 'replay_recovery', 'root_job_unresolved');
           try {
-            await storeStatus(sessionId, receiptId, 'needs_attention', {
-              reason: 'root_job_unresolved', retryable: false,
-              message: 'The original desktop delivery permission is unavailable. Resend this prompt to try again.',
-              source: options.source || 'web',
-            });
+            await storeStatus(sessionId, receiptId, status, details);
           } catch { reportFailure(scope, 'proof_loss_status', 'status_write_failed'); }
-          admitted = { ...admitted, response: denial('root_job_unresolved', 409) };
+          if (!requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
+          admitted = { ...admitted, response: {
+            ok: false, status, code: 'root_job_unresolved', httpStatus: 409,
+            reason: details.reason, message: details.message, retryable: false,
+            recoveryAction: action, source: details.source,
+          } };
         }
       }
     }
@@ -445,6 +571,7 @@ function createRootPromptFlow(deps = {}) {
           type: 'submit-prompt-status', id: sessionId, clientMessageId: publicId,
           status: safe.status, signal: safe.signal, reason: safe.reason, source: safe.source,
           code: safe.code || '', retryable: safe.retryable === true,
+          recoveryAction: safe.recoveryAction || 'none',
           ...(safe.message ? { message: safe.message } : {}),
         };
         try { sendWsJson(client, frame); } catch { reportFailure(scope, 'status_reply', 'socket_write_failed'); }
@@ -456,8 +583,9 @@ function createRootPromptFlow(deps = {}) {
   function submitWs(ws, sessionId, text, options = {}) {
     const authReference = ws?.auth;
     const current = () => ws?.readyState === 1 && ws?.auth === authReference;
-    return submit({ client: ws, sessionId, text, options, transportKind: 'ws',
-      current, req: null, url: null });
+    return promptAdmissionTrace.run({ sessionId, source: options.source, transport: 'ws', receivedAt: options.wsReceivedAt },
+      () => submit({ client: ws, sessionId, text, options, transportKind: 'ws',
+        current, req: null, url: null }));
   }
 
   function submitHttp(req, url, sessionId, options = {}) {
@@ -470,8 +598,9 @@ function createRootPromptFlow(deps = {}) {
         || url?.pathname !== state.url.pathname || url?.search !== state.url.search) {
       return Promise.resolve(denial('invalid_request', 400));
     }
-    return submit({ client: req, sessionId, text: options.text, options,
-      transportKind: 'http', req, url: state.url, current: state.current, operationScope: state.scope });
+    return promptAdmissionTrace.run({ sessionId, source: options.source, transport: 'http' },
+      () => submit({ client: req, sessionId, text: options.text, options,
+        transportKind: 'http', req, url: state.url, current: state.current, operationScope: state.scope }));
   }
 
   function captureHttpScope(req, url, response) {
@@ -503,6 +632,7 @@ function createRootPromptFlow(deps = {}) {
     const scope = capturedScope || commandRuntime.captureRootPromptCoordinator();
     if (!scope || (databaseHandle && scope.databaseHandle !== databaseHandle)
         || (instanceId && scope.instanceId !== instanceId) || !scope.isCurrent()) return 0;
+    scopeCorrelation.set(scope, { sessionId: safeDiagnosticId(sessionId) });
     let rows;
     try { rows = remoteRelayStore.listRemoteSubmissions(scope.databaseHandle, { sessionId, limit: 200 }); }
     catch { return 0; }
@@ -524,7 +654,12 @@ function createRootPromptFlow(deps = {}) {
       if (!scope.isCurrent()) break;
       const details = {
         reason: 'root_job_unresolved', retryable: false,
-        message: 'The original desktop delivery permission is unavailable. Resend this prompt to try again.',
+        // WP-0 criterion 7: a missing process-local marker is not proof that the
+        // prompt was never sent (a restart can lose the marker after delivery).
+        // Only a scoped no-effect certificate would justify "resend"; none is
+        // reachable from a bare durable row, so the action is review.
+        recoveryAction: 'review',
+        message: REVIEW_MESSAGE,
         source: row.result?.source || 'web',
       };
       try {
@@ -548,6 +683,7 @@ function createRootPromptFlow(deps = {}) {
     if (!id) return { driven: 0, escalated: 0 };
     const scope = commandRuntime.captureRootPromptCoordinator();
     if (!scope || !scope.isCurrent()) return { driven: 0, escalated: 0 };
+    scopeCorrelation.set(scope, { sessionId: safeDiagnosticId(id) });
     const registry = registryFor(scope.databaseHandle);
     const inFlight = sessionDrains.get(scope.databaseHandle) || new Set();
     if (!sessionDrains.has(scope.databaseHandle)) sessionDrains.set(scope.databaseHandle, inFlight);
@@ -566,7 +702,8 @@ function createRootPromptFlow(deps = {}) {
           try {
             await storeStatus(job.sessionId, job.receiptId, 'needs_attention', {
               reason: 'root_delivery_expired', retryable: false,
-              message: 'The desktop delivery permission expired. Resend this prompt to try again.',
+              recoveryAction: 'review',
+              message: 'The desktop delivery permission expired before CTM could confirm this delivery. Review the submission before resending.',
             });
           } catch { reportFailure(job.scope, 'expiry_status', 'status_write_failed'); }
           continue;

package/template/coding-task-manager/lib/scrollback-archive-store.js

@@ -103,6 +103,8 @@ function createScrollbackArchive(options = {}) {
   const flushMs = options.flushMs !== undefined && Number.isFinite(Number(options.flushMs))
     ? Number(options.flushMs)
     : ARCHIVE_FLUSH_MS;
+  // Test seam, like `now`: a test drives ticks itself instead of waiting on the wall clock.
+  const scheduleInterval = typeof options.setInterval === 'function' ? options.setInterval : setInterval;
   const pendingMaxRows = Math.max(1, Number(options.pendingMaxRows) || ARCHIVE_PENDING_MAX_ROWS);
   const pendingMaxBytes = Math.max(1, Number(options.pendingMaxBytes) || ARCHIVE_PENDING_MAX_BYTES);
   const blockBytes = Math.max(1, Number(options.blockBytes) || DEFAULT_BLOCK_BYTES);
@@ -525,12 +527,12 @@ function createScrollbackArchive(options = {}) {
 
   function _scheduleTimer() {
     if (timer || flushMs <= 0) return;
-    timer = setInterval(() => {
+    const tick = () => {
       // A slow async tick skips re-entry; the next tick resumes round-robin order.
-      if (tickInFlight) return;
+      if (tickInFlight) return null;
       tickInFlight = true;
       const ids = Array.from(sessions.keys());
-      (async () => {
+      return (async () => {
         // 1) Write buffered appends for every session -- cheap, one appendFile
         //    per session's active bucket, no gzip involved.
         for (const id of ids) {
@@ -561,7 +563,8 @@ function createScrollbackArchive(options = {}) {
       })()
         .catch(() => { /* expected: the background timer tick itself must never throw -- every step inside already catches its own failures; this is the final backstop */ })
         .finally(() => { tickInFlight = false; });
-    }, flushMs);
+    };
+    timer = scheduleInterval(tick, flushMs);
     if (typeof timer.unref === 'function') timer.unref();
   }
 

package/template/coding-task-manager/lib/server-memory-sampler-runtime.js

@@ -46,6 +46,13 @@ function startServerMemorySamplerRuntime(options = {}) {
     // WP-0b (§5 D-2): () => [{ owner, memory }] over the read-pool / db-owner worker clients.
     // Forwarded verbatim; absent -> the sampler's own () => [] default keeps workers[] empty.
     workersSource,
+    // WP-A P-2 (freeze-probes): () => the work in flight at sample time (read-pool ops, db-owner
+    // pending ops, recent main-loop spans). Forwarded verbatim; absent -> the sampler's () => null
+    // default keeps the row's `inFlight` null.
+    inFlightSource,
+    // WP-A P-3 (freeze-probes): { sampleFootprintRegions(pid) } for the main pid -- the categorized
+    // `/usr/bin/footprint` read. Forwarded verbatim; absent -> main.regions stays null.
+    regionSampler,
     samplerOptions,
   } = options;
   // WP-4 (design doc §5 D-5, §8 WP-4): reuse the SAME 'mirrors-report' IPC round trip
@@ -62,6 +69,9 @@ function startServerMemorySamplerRuntime(options = {}) {
     mirrorsSampler,
     // Explicit workersSource wins; otherwise a workersSource carried in samplerOptions (test seam).
     workersSource: typeof workersSource === 'function' ? workersSource : samplerOptions?.workersSource,
+    // WP-A P-2/P-3: forwarded the same way, so server.js's one call site wires all three probes.
+    inFlightSource: typeof inFlightSource === 'function' ? inFlightSource : samplerOptions?.inFlightSource,
+    regionSampler: regionSampler || samplerOptions?.regionSampler || null,
     listProcesses: () => serverProcessList({ sessionHostManager, desktopIndex, errorSink }),
     buildLedgerInput: () => ({
       processMemory: process.memoryUsage(),

package/template/coding-task-manager/lib/server-memory-sampler.js

@@ -135,6 +135,15 @@ function createServerMemorySampler(options = {}) {
     // liveDecoders } }] in raw bytes -- read from the read-pool/db-owner worker clients. Omitted ->
     // workers[] is empty and workersTotal sums are 0 (never fabricated from nothing).
     workersSource = () => [],
+    // WP-A P-2 (freeze-probes): () => any JSON-safe value describing the work in flight when the row
+    // was taken (read-pool ops, db-owner pending ops, recent main-loop spans). Stored verbatim on the
+    // row as `inFlight`; a throw or an absent source yields null ("unknown"), never a lost row.
+    inFlightSource = () => null,
+    // WP-A P-3 (freeze-probes): optional { sampleFootprintRegions(pid): Promise<{ totalMB, top }|null> }
+    // -- the CATEGORIZED `/usr/bin/footprint` read (lib/session-resource-sampler.js), a fresh spawn per
+    // call rather than the TTL-cached sampleFootprints() summary, so the region that just grew is
+    // named. Omitted -> main.regions stays null, never fabricated.
+    regionSampler = null,
     now = () => Date.now(),
     // Injectable so a test isn't forced to monkey-patch the process-global console (which
     // would race other concurrently-running tests in the same file).
@@ -199,6 +208,17 @@ function createServerMemorySampler(options = {}) {
     };
   }
 
+  // WP-A P-2: the in-flight snapshot for this row. A broken/absent source reports null rather than
+  // failing the tick (same disposition as readWorkerMemory above).
+  function readInFlight() {
+    try {
+      return (typeof inFlightSource === 'function' ? inFlightSource() : null) ?? null;
+    } catch {
+      /* expected: the read-pool/db-owner clients can be mid-restart; "unknown in flight" beats a lost row */
+      return null;
+    }
+  }
+
   async function sampleProcessesRss(pids) {
     if (!pids.length) return new Map();
     const psCommand = platform === 'darwin' ? '/bin/ps' : 'ps';
@@ -261,6 +281,18 @@ function createServerMemorySampler(options = {}) {
     const mu = process.memoryUsage();
     const mainProc = procs.find((p) => p.role === 'main') || null;
     const poolProc = procs.find((p) => p.role === 'session-host-pool') || null;
+    // WP-A P-3: the MAIN process' categorized footprint regions -- the only read that can NAME the
+    // category behind a step (the 4<->9 GB swing is entirely "Malloc Large"). `null` (never
+    // fabricated) when unwired, when the main pid is unknown, or when the read failed.
+    let regions = null;
+    if (regionSampler && typeof regionSampler.sampleFootprintRegions === 'function' && mainProc && mainProc.pid) {
+      try {
+        regions = (await regionSampler.sampleFootprintRegions(mainProc.pid)) ?? null;
+      } catch {
+        /* expected: /usr/bin/footprint can be missing, denied or killed; the row must still record */
+        regions = null;
+      }
+    }
     const main = {
       heapUsedMB: roundMB(mu.heapUsed),
       externalMB: roundMB(mu.external),
@@ -273,6 +305,8 @@ function createServerMemorySampler(options = {}) {
       footprintMB: mainProc ? mainProc.physFootprintMB : null,
       // WP-0b (§5 D-2): main-thread's OWN live zstd contexts (workers report theirs separately).
       liveDecoders: liveDecoderCount(),
+      // WP-A P-3: categorized footprint regions of this same pid (null when unwired/unsampled).
+      regions,
     };
     // WP-0b (§5 D-2, §9 S-9): per-worker heap/external/arrayBuffers + live decoder count, summed
     // into workersTotal so the row explains what the main isolate's process.memoryUsage() cannot.
@@ -338,7 +372,10 @@ function createServerMemorySampler(options = {}) {
     }
     const ledger = compactLedgerSubset(fullLedger);
 
-    const sample = { schemaVersion: SCHEMA_VERSION, reason, procs, main, poolHost, ledger, workers, workersTotal };
+    // WP-A P-2: the work in flight at sample time, so a step in rss/footprint can be read against
+    // what was running when it happened (`null` = unknown/not wired).
+    const inFlight = readInFlight();
+    const sample = { schemaVersion: SCHEMA_VERSION, reason, procs, main, poolHost, ledger, workers, workersTotal, inFlight };
     if (typeof record === 'function') {
       try { record('server-memory', sample); } catch { /* expected: a broken diagnostic sink must not break the sampler loop itself */ }
     }
@@ -363,13 +400,15 @@ function createServerMemorySampler(options = {}) {
   // WP-0b (§5 D-2, §9 S-9): run an extra sample whenever main RSS stepped >= minStepMB since the
   // last recorded row. Never throws; returns the sample or null when skipped (no prior sample,
   // caller rss unavailable, below threshold, an unrepresentable prior rss, or a sample in flight).
+  // WP-A P-3: the default threshold is 768 MB, not 2048 -- the live 2026-10-21 measurement showed the
+  // server's real steps are ~970 MB of "Malloc Large", which the old 2048 default silently skipped.
   async function sampleIfStep(options = {}) {
     try {
       const opts = options && typeof options === 'object' ? options : {};
       const target = Number(opts.rssMB);
       if (!Number.isFinite(target)) return null;
       if (!_lastMain || !Number.isFinite(Number(_lastMain.rssMB))) return null;
-      const threshold = Number.isFinite(Number(opts.minStepMB)) ? Number(opts.minStepMB) : 2048;
+      const threshold = Number.isFinite(Number(opts.minStepMB)) ? Number(opts.minStepMB) : 768;
       if (Math.abs(target - Number(_lastMain.rssMB)) < threshold) return null;
       return await sampleOnce({ reason: 'rss-step', rssMB: target });
     } catch {

package/template/coding-task-manager/lib/session-analysis-memory.js

@@ -322,6 +322,8 @@ function loadCodingJournalOutcomes(sessionIds, options = {}) {
                  archived_at, consolidated_at, extraction_status
             FROM memories INDEXED BY idx_memories_session_summary
            WHERE archived_at IS NULL
+             AND source IN ('walle-coding', 'walle-diary')
+             AND memory_type IN ('coding_journal', 'coding_journal_segment', 'agent_diary')
              AND source = 'walle-coding'
              AND memory_type = 'coding_journal'
              AND subject IN (${placeholders})