create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/session-create/provider-launch-context.js

@@ -0,0 +1,77 @@
+'use strict';
+
+// native-same-thread-model-switch / §6.5: the PRIVATE launch capture a rollback recovery replays.
+// It is recorded for EVERY native harness whose `recoverSource` can resume the same canonical
+// thread -- Codex AND Claude -- because this capture is the only proof of THIS spawn's
+// executable/argv/cwd/home/generation. It is taken from the prepared launch plan at the REAL
+// spawn (never synthesized later from mutable session fields), and every field is a copy: the
+// argv array is cloned, so a later `session.args` rewrite cannot edit the receipt.
+// WP-0b: extracted verbatim from provider-process.js (same spawn point) so that file stays under
+// the file-size ceiling; behavior is unchanged. The existing Codex receipt dependency is called
+// once as before; this adds no reader, state, or credential copy.
+
+const path = require('node:path');
+const { strFlag } = require('../env-flags');
+
+// Explicit launch inputs (never the whole process env): the prepared plan, the caller's argv/cwd,
+// the ACTUAL spawn env, the recipe/generation the launch was prepared with, the Codex config
+// receipt already read for this spawn, and the existing codex-paths dependency (no extra read).
+// Returns `null` for a harness with no same-canonical-thread rollout to resume.
+function buildModelTransitionLaunchContext({ agentType, preparedLaunchPlan, cmd, args, cwd, spawnEnv,
+  serverHome, executionRecipe, processGeneration, nativeConfigReceipt = null, codexPaths = null }) {
+  if (agentType !== 'codex' && agentType !== 'claude') return null;
+  const capturedHome = spawnEnv.HOME || serverHome || null;
+  const capturedTmpDir = typeof spawnEnv.TMPDIR === 'string' && path.isAbsolute(spawnEnv.TMPDIR)
+    ? spawnEnv.TMPDIR : null;
+  if (agentType === 'claude') {
+    // A native Claude launch claims NO Codex receipt/config: `codexHome`, `nativeStorageRootReceipt`
+    // and `nativeConfigReceipt` (read from the Codex `config.toml`) are explicitly null, so a
+    // rollback can never mistake this capture for a Codex one. The configured storage root is the
+    // Claude `projects/` dir under the ACTUAL `CLAUDE_CONFIG_DIR` (else `HOME/.claude`) and stays
+    // null when neither is known. The canonical thread is this launch's OWN recipe thread --
+    // computed by `launchProviderThreadId` from the resume plan, an injected/explicit
+    // `--session-id` and the caller's argv -- never inferred from the CTM session id, and left
+    // null (a fail-closed refusal in `recoverSource`) when the identity is unknown.
+    // A blank child CLAUDE_CONFIG_DIR falls back to that child's HOME/.claude, never the parent's
+    // config root. Codex keeps its CTM_CODEX_SESSIONS_DIR fallback below, unchanged.
+    const claudeConfigDir = spawnEnv.CLAUDE_CONFIG_DIR
+      || (capturedHome ? path.join(capturedHome, '.claude') : null);
+    return {
+      executablePath: preparedLaunchPlan?.cmd || cmd,
+      args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
+      workingDirectory: preparedLaunchPlan?.cwd || cwd,
+      providerThreadId: executionRecipe?.providerThreadId || null,
+      processGeneration,
+      homeDir: capturedHome,
+      codexHome: null,
+      nativeStorageRootConfiguredPath: claudeConfigDir ? path.join(claudeConfigDir, 'projects') : null,
+      nativeStorageRootReceipt: null,
+      tmpDir: capturedTmpDir,
+      nativeConfigReceipt: null,
+    };
+  }
+  const sessionsDir = spawnEnv.CTM_CODEX_SESSIONS_DIR || strFlag('CTM_CODEX_SESSIONS_DIR', '');
+  return {
+    executablePath: preparedLaunchPlan?.cmd || cmd,
+    args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
+    workingDirectory: preparedLaunchPlan?.cwd || cwd,
+    providerThreadId: preparedLaunchPlan?.resume?.providerResumeId || preparedLaunchPlan?.resume?.sessionId
+      || preparedLaunchPlan?.resume?.agentSessionId || null,
+    processGeneration,
+    homeDir: capturedHome,
+    codexHome: spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
+    nativeStorageRootConfiguredPath: spawnEnv.CTM_CODEX_SESSIONS_DIR
+      || sessionsDir
+      || ((spawnEnv.CODEX_HOME || capturedHome)
+        ? path.join(spawnEnv.CODEX_HOME || path.join(capturedHome, '.codex'), 'sessions') : null),
+    nativeStorageRootReceipt: codexPaths?.codexSessionsRootReceipt?.({
+      homeDir: capturedHome,
+      codexHomePath: spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
+      sessionsDir: sessionsDir || undefined,
+    }) || null,
+    tmpDir: capturedTmpDir,
+    nativeConfigReceipt: nativeConfigReceipt || { state: 'unknown' },
+  };
+}
+
+module.exports = { buildModelTransitionLaunchContext };

package/template/coding-task-manager/lib/session-create/provider-process.js

@@ -20,8 +20,11 @@ const { RECIPE_ENV_KEY, MAX_RECIPE_BYTES, modelExecutionRecipeMetadata } = requi
 const { validateDeferredRestoreAttempt } = require('../deferred-restore-attempt');
 const { getPrivateSourceRecoveryEnvironment, capturePrivateSourceEnvironment,
   hasCapturedEmptySourceEnvironmentRestore } = require('../lead-model-restore-reconciliation');
-const { modelStorageRootsFromEnv } = require('../host-handoff');
-const { strFlag } = require('../env-flags');
+const { modelStorageRootsFromEnv, privateOverridesFromEnv } = require('../host-handoff');
+// WP-0b: the rollback launch capture (moved out of this file, same spawn point) -- see
+// lib/session-create/provider-launch-context.js for the field-by-field contract.
+const { buildModelTransitionLaunchContext } = require('./provider-launch-context');
+const codexNativeProviderGate = require('./codex-native-provider-gate');
 const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 
 async function readCodexConfigReceipt(codexHome, onCleanupError = () => {}) {
@@ -76,7 +79,7 @@ function applyModelExecutionRecipeToSpawnEnv(env, recipe, expected = {}) {
 }
 
 function modelExecutionRecipeForSpawn({ sessionId, processGeneration, agent, launchPlan, leadRoute, transition,
-  sourceEnvironmentReference, providerThreadId: explicitProviderThreadId }) {
+  sourceEnvironmentReference, providerThreadId: explicitProviderThreadId, nativeConfigReceipt }) {
   const routeId = leadRoute ? String(leadRoute.routeId || leadRoute.alias || '') : null;
   const profile = leadRoute?.profile || leadRoute?.preparedPlan?.profile || null;
   const ownership = leadRoute?.ownership || leadRoute?.preparedPlan?.ownership || null;
@@ -93,6 +96,8 @@ function modelExecutionRecipeForSpawn({ sessionId, processGeneration, agent, lau
     factsRevision: routeId ? (profile.factsRevision || ownership?.factsRevision || null) : null,
     transitionId: transition?.transitionId || leadRoute?.transitionId || ownership?.transitionId || null,
     ...(sourceEnvironmentReference ? { sourceEnvironmentReference } : {}),
+    ...(nativeConfigReceipt && ['present', 'missing'].includes(nativeConfigReceipt.state)
+      ? { nativeConfigReceipt: { state: nativeConfigReceipt.state, sha256: nativeConfigReceipt.sha256 ?? null } } : {}),
   };
 }
 
@@ -193,6 +198,7 @@ async function prepareProviderSession(state) {
     _wsSend,
     recordSessionDiagnostic,
     harnessModelProfileLoader,
+    markSessionResumeBlocked, // WP-1: the deterministic refusal hook (server.js)
   } = _getDeps();
   const { args, cmd, createAgentType, cwd, env, id, msg, preparedLaunchPlan, restoreSeedSnapshot, ws, signal,
     claudeResumeId, _injectedSessionId } = state;
@@ -322,6 +328,14 @@ async function prepareProviderSession(state) {
         if (typeof recordSessionDiagnostic === 'function') recordSessionDiagnostic(id, 'lead-route-read-failed', { message: String(error && error.message || error).slice(0, 200) });
       }
     }
+    // WP-1 (codex-routed-fork-cold-restore-guard §5 D-2..D-4): a native `codex resume T` loads the provider
+    // STORED IN T; the gate refuses (D-4) or repairs the route from the journal (D-3) before any spawn.
+    if (!target && !readFailed && createAgentType === 'codex' && resolvedProviderThreadId) {
+      const gated = await codexNativeProviderGate.gateNativeCodexLaunch({ sessionId: id, threadId: resolvedProviderThreadId,
+        env, preparedLaunchPlan, dbModule, recordSessionDiagnostic, markSessionResumeBlocked, ws, wsSend: _wsSend });
+      if (gated.refused) { if (runtime) await runtime.close(); return { handled: true, providerState: null }; }
+      if (gated.target) target = gated.target;
+    }
     if (target && !readFailed) {
       let lr;
       if (target.preparedPlan) {
@@ -861,13 +875,17 @@ function createProviderSession(state) {
     const leadApplied = _applyLeadRouteToSpawn({ launchArgs, env, leadRoute });
     launchArgs = leadApplied.launchArgs;
     // The host receipt carries only whether the original per-session overrides were empty or
-    // require a surviving private owner. Storage roots projected for this restore remain in the
-    // launch context and do not turn an otherwise empty override set into a private environment.
+    // require a surviving private owner. Storage roots and TMPDIR projected into the launch context
+    // (`launchEnvironmentOverrides`) are launch context, not private overrides: for EVERY spawn, not
+    // only a host restore, they are dropped before the receipt is computed, so a projected HOME/TMPDIR
+    // never turns an otherwise empty override set into a private environment. The spawned child still
+    // receives them (`launchEnvOverrides` below).
     const trustedCapturedEmptySourceEnvironment = msg._isRestore === true
       && hasCapturedEmptySourceEnvironmentRestore(msg);
     const sourceOverrideCapture = capturePrivateSourceEnvironment(sourceRecoveryEnvironment
-      ? sourceRecoveryEnvironment.environment : trustedCapturedEmptySourceEnvironment ? {}
-        : (msg.env && typeof msg.env === 'object' ? msg.env : {}));
+      ? privateOverridesFromEnv(sourceRecoveryEnvironment.environment)
+      : trustedCapturedEmptySourceEnvironment ? {}
+        : privateOverridesFromEnv(msg.env && typeof msg.env === 'object' ? msg.env : {}));
     const sourceEnvironmentReference = trustedCapturedEmptySourceEnvironment ? 'captured-empty'
       : sourceOverrideCapture.state === 'captured'
         ? (Object.keys(sourceOverrideCapture.values || {}).length === 0 ? 'captured-empty' : 'private-owner-required')
@@ -890,7 +908,7 @@ function createProviderSession(state) {
     const modelProcessGeneration = capturedModelProcessGeneration;
     const executionRecipe = modelExecutionRecipeForSpawn({ sessionId: id, processGeneration: modelProcessGeneration,
       agent: createAgentType, launchPlan: preparedLaunchPlan, leadRoute, transition: msg._leadModelTransition || null,
-      sourceEnvironmentReference, providerThreadId: launchProviderThreadId({ agent: createAgentType,
+      sourceEnvironmentReference, nativeConfigReceipt, providerThreadId: launchProviderThreadId({ agent: createAgentType,
         launchPlan: preparedLaunchPlan, claudeResumeId, injectedSessionId: _injectedSessionId, args: launchArgs }) });
     let spawnEnv = { ...applyModelExecutionRecipeToSpawnEnv(leadApplied.spawnEnv, executionRecipe,
       { sessionId: id, processGeneration: modelProcessGeneration }), CTM_MODEL_PROCESS_GENERATION: String(modelProcessGeneration) };
@@ -1063,32 +1081,14 @@ function createProviderSession(state) {
       _modelProcessGeneration: modelProcessGeneration,
       _modelExecutionRecipe: modelExecutionRecipeMetadata(executionRecipe,
         { sessionId: id, processGeneration: modelProcessGeneration }).modelExecutionRecipe || null,
-      ...(createAgentType === 'codex' ? { _modelTransitionLaunchContext: (() => {
-        const capturedHome = leadApplied.spawnEnv.HOME || serverConfig.HOME || null;
-        const sessionsDir = leadApplied.spawnEnv.CTM_CODEX_SESSIONS_DIR || strFlag('CTM_CODEX_SESSIONS_DIR', '');
-        return {
-          executablePath: preparedLaunchPlan?.cmd || cmd,
-          args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
-          workingDirectory: preparedLaunchPlan?.cwd || cwd,
-          providerThreadId: preparedLaunchPlan?.resume?.providerResumeId || preparedLaunchPlan?.resume?.sessionId
-            || preparedLaunchPlan?.resume?.agentSessionId || null,
-          processGeneration: modelProcessGeneration,
-          homeDir: capturedHome,
-          codexHome: leadApplied.spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
-          nativeStorageRootConfiguredPath: leadApplied.spawnEnv.CTM_CODEX_SESSIONS_DIR
-            || sessionsDir
-            || ((leadApplied.spawnEnv.CODEX_HOME || capturedHome)
-              ? path.join(leadApplied.spawnEnv.CODEX_HOME || path.join(capturedHome, '.codex'), 'sessions') : null),
-          nativeStorageRootReceipt: codexPaths?.codexSessionsRootReceipt?.({
-            homeDir: capturedHome,
-            codexHomePath: leadApplied.spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
-            sessionsDir: sessionsDir || undefined,
-          }) || null,
-          tmpDir: typeof leadApplied.spawnEnv.TMPDIR === 'string' && path.isAbsolute(leadApplied.spawnEnv.TMPDIR)
-            ? leadApplied.spawnEnv.TMPDIR : null,
-          nativeConfigReceipt: nativeConfigReceipt || { state: 'unknown' },
-        };
-      })() } : {}),
+      // native-same-thread-model-switch / §6.5, WP-0b: the PRIVATE launch capture a rollback recovery
+      // replays, built at THIS REAL spawn point by the sibling module (see
+      // lib/session-create/provider-launch-context.js for the field-by-field contract).
+      ...((createAgentType === 'codex' || createAgentType === 'claude') ? { _modelTransitionLaunchContext: buildModelTransitionLaunchContext({
+        agentType: createAgentType, preparedLaunchPlan, cmd, args, cwd,
+        spawnEnv: leadApplied.spawnEnv, serverHome: serverConfig.HOME,
+        executionRecipe, processGeneration: modelProcessGeneration, nativeConfigReceipt, codexPaths,
+      }) } : {}),
       clients: sessionClients,
       _primaryWs: null,
       // scrollback removed — headless terminal is source of truth (Phase 3D)
@@ -1453,11 +1453,10 @@ function createProviderSession(state) {
           provider: sessionAgentType,
           providerResumeId: sessionAgentType === 'codex' ? (claudeResumeId || '') : '',
           cwd,
-          title: session.title || session.label,
-          userRenamed: !!session.userRenamed,
-          titleSource: session.userRenamed ? 'user' : '',
-          titleStatus: session.userRenamed ? 'user_named' : '',
-          titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+          // D-2 (session-name design 2026-10-23): a resume of a titled row keeps its title + provenance (upsertSession keeps omitted keys).
+          ...(isResumeLaunch && existingTitle?.title ? {} : { title: session.title || session.label, userRenamed: !!session.userRenamed,
+            titleSource: session.userRenamed ? 'user' : '', titleStatus: session.userRenamed ? 'user_named' : '',
+            titleStatusReason: session.userRenamed ? 'new_session_title' : '' }),
           projectEntry: sessionAgentType === 'claude' ? encodeClaudeProjectEntry(cwd) : encodeProjectEntry(cwd),
           projectPath: cwd,
         },

package/template/coding-task-manager/lib/session-create/response.js

@@ -9,6 +9,12 @@ const { releaseAdmissionOnExit, retireWorkerOnExit, scheduleWorkerObservation }
 // whole frame is built by the SAME bounded pure transport leaf (it copies the fixed typed whitelist out
 // of the payload `_sessionPayload` already produced).
 const { buildCreatedSessionPayload } = require('../coding-session-model-public');
+// WP-2 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-5): the module carries the
+// rationale — a Codex config-load failure is a precondition failure, never a restart-budget consumer.
+const { classifyCodexResumeExit } = require('./codex-resume-exit-classify');
+const { codexProviderMissingMessage } = require('./codex-native-provider-gate'); // WP-1 owns the one block sentence
+// WP-1 (D-1/D-2, S-11): the pure chooser for the block a deferred exit carries (a direct require, like the two leaves above: the injected `runtime` is built in server.js, which this WP does not own).
+const { deferBlockForExit } = require('../resume-blocked-wire');
 
 // D-9 (delegated-worker-lifecycle-identity-observability-2026-09-27.html §5 D-9, §9 S-15):
 // best-effort proxy-token revoke for a worker session exiting on the CREATE path (never
@@ -887,7 +893,7 @@ function installResponseRuntime(runtime) {
   // classification BEFORE this handler is installed; the handler then passes its FULL event through it.
   const leadRouteCleanup = runtime.session.agentRole === 'worker' ? null : require('./lead-route-launch').createLeadRouteLifetimeCleanup({ sessionId: runtime.session.id, ownership: runtime.session._leadRouteTokenOwnership, hosted: _useSessionHostProcessForPty() === true });
   const onPtyExit = async (exitEvent) => {
-      const { exitCode, signal } = exitEvent || {};
+      const { exitCode, signal, exitSource } = exitEvent || {};
       runtime.sessionInputAuthority.observeProvider({ sessionId: runtime.id, status: 'exited' });
       runtime.session._ptyExitLifecycle = {
         stage: 'capturing-viewport',
@@ -1064,6 +1070,20 @@ function installResponseRuntime(runtime) {
       // retry path as an exit 1 rather than being mistaken for a completed terminal lifecycle.
       const maxAutoRestarts = 3;
       const restartCount = runtime.session._autoRestartCount || 0;
+      // WP-2 (§5 D-5, §9 S-9/S-10): classify THIS attempt's buffer — never scrollback — before the
+      // auto-restart decision, and block a Codex config-load failure instead of spending the budget.
+      const codexProviderMissingExit = (agentType === 'codex' && exitedBeforeResumeReady) ? classifyCodexResumeExit(runtime.session._resumeAttemptOutput || '') : null;
+      if (codexProviderMissingExit) {
+        runtime.recordSessionDiagnostic(runtime.id, 'codex-provider-missing-exit', { provider: codexProviderMissingExit.provider, exitCode });
+        // Marked ONCE. This is what makes the auto-restart decision below false
+        // (`resumeBlocked: isSessionResumeBlocked(runtime.id)`), so `handleCreatePrepared` is never
+        // scheduled for this exit; the flow then falls through to the ordinary exit-persistence path,
+        // which sees the session already blocked and keeps the placeholder + startup recipe as is.
+        markSessionResumeBlocked(runtime.id, {
+          code: 'codex_provider_missing', detail: codexProviderMissingExit.line, agentType: 'codex', deterministic: true,
+          message: codexProviderMissingMessage(codexProviderMissingExit.provider),
+        }, 'codex-provider-exit');
+      }
       // A worker continuation does launch `-p --resume` / `exec resume`, but its exit is terminal and
       // never an interactive auto-restart (that would relaunch it as a TUI under the worker's identity,
       // stuck at worker-status 'starting'). lib/session-class.js declares that: relaunchFromRestore=false.
@@ -1208,25 +1228,22 @@ function installResponseRuntime(runtime) {
       const exitPersistence = sessionExitPersistenceDecision({
         intentionalKill: !!runtime.session._intentionalKill,
         exitCode,
-        signal,
+        signal, exitSource,
         isResumable,
         resumeContext: resumeExitContext(runtime.session), deferOnAbnormalExit: sessionPolicy(runtime.session).deferOnAbnormalExit,
       });
       runtime.session._ptyExitLifecycle.stage = `persistence-${String(exitPersistence.action || 'unknown')}`;
       if (exitPersistence.action === 'defer') {
         const latestResumeExit = resumeExitContext(runtime.session);
-        if (!isSessionResumeBlocked(runtime.id)) {
-          const label = getAgentCapabilities(agentType).label || 'The agent';
+        const label = getAgentCapabilities(agentType).label || 'The agent';
+        // WP-1 (D-1/D-2): the block comes from the exit EVIDENCE -- an unknown exit yields null (defer with no block: exited, and the next input resumes it).
+        const block = deferBlockForExit({ exitPersistence, latestResumeExit, exitCode, signal, autoRestartCount: runtime.session._autoRestartCount || 0, label });
+        if (block && !isSessionResumeBlocked(runtime.id)) {
           markSessionResumeBlocked(runtime.id, {
-            code: latestResumeExit.failedBeforeReady
-              ? (latestResumeExit.code || 'resume_failed')
-              : 'session_crash_loop',
-            message: latestResumeExit.failedBeforeReady
-              ? `${label} did not become ready while resuming.`
-              : `${label} exited unexpectedly and automatic recovery was exhausted.`,
+            ...block,
             detail: resumeFailureDetail(agentType, runtime.session._resumeAttemptOutput || ''),
             agentType,
-          });
+          }, 'response-defer');
         }
         // Keep the CTM identity and startup recipe as a deferred placeholder. Retiring the startup
         // task here would make retry impossible. Failed resume mirrors also stay provisional so they
@@ -1243,7 +1260,8 @@ function installResponseRuntime(runtime) {
           runtime.session._restoreStarting = false;
           runtime.session._lifecycleState = 'deferred';
           runtime._markServerSessionTurnClosed(runtime.session, Date.now(), 'session-exit'); // R-15: PROCESS_EXIT, never a dead wait
-          runtime.session._resumeBlocked = true;
+          // WP-1 (D-1): read the flag, never assert it -- a defer with no block is "exited, resumes on input", not "resuming".
+          runtime.session._resumeBlocked = isSessionResumeBlocked(runtime.id);
           runtime.session._exitPersistenceReason = exitPersistence.reason;
           runtime.session._restoreTask = {
             session_id: runtime.id,

package/template/coding-task-manager/lib/session-create/transcript.js

@@ -120,12 +120,21 @@ async function createWalleSession(state) {
   if (createResult) deps.recordWalleTranscriptAppend(session, createResult);
   for (const record of seeded.records) deps.recordWalleTranscriptAppend(session, record);
   try {
+    // WP-0 (session-name-agent-title-precedence-2026-10-23.html §5 D-2): reusing an existing
+    // Wall-E transcript must not rewrite the row's title or its provenance — the client echoes
+    // the displayed name back (D-1), and upsertSession keeps the stored value for any omitted
+    // title key (or empty titleSource/titleStatus/titleStatusReason), so omit them on a resume
+    // of a row that already has a title.
+    const preserveTitleProvenance = !msg._isRestore
+      && (launch.walleResumeRequest || launch.isResumeLaunch) && !!existingTitle?.title;
     void deps.detachOwnerMutation('walle-session-created', () => deps.dbModule.upsertSession(id, {
       agentSessionId: chatSessionId, provider: 'walle', cwd, projectPath: cwd,
-      title: session.title, userRenamed: !!session.userRenamed,
-      titleSource: session.userRenamed ? 'user' : '',
-      titleStatus: session.userRenamed ? 'user_named' : '',
-      titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+      ...(preserveTitleProvenance ? {} : {
+        title: session.title, userRenamed: !!session.userRenamed,
+        titleSource: session.userRenamed ? 'user' : '',
+        titleStatus: session.userRenamed ? 'user_named' : '',
+        titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+      }),
       jsonlPath, fileSize: 0, modifiedAt: '', model: modelId || '', hostname: deps.hostname,
     }));
   } catch (error) {

package/template/coding-task-manager/lib/session-create/worker-continuation.js

@@ -7,6 +7,12 @@ const admissionDefault = require('../worker-admission');
 const { restoreSucceeded } = require('../resume-rung-enrich');
 const transcriptRetention = require('../transcript-retention-check');
 const transcriptSource = require('../transcript-source');
+// WP-2 (D-4/D-7): the derived-transcript-path helper and its verifier (see the preflight at the
+// transcript link below). serverConfig is the same live-read env seam production uses for the
+// Claude config dir (server.js:6743 getClaudeConfigDir).
+const serverConfig = require('../server-config');
+const { deriveClaudeTranscriptPath } = require('../resume-cwd');
+const { verifyClaudeTranscriptAt } = require('../transcript-link');
 const { isColdDeferredSession, notifyWorkerGeneration } = require('./worker-observability');
 const { budgetSentence } = require('./worker-brief');
 const { attachProgressGuard } = require('./worker-progress-guard');
@@ -533,7 +539,43 @@ function createWorkerContinuation({ getDeps, admission = admissionDefault, helpe
     catch {
       return failReceipt('worker_transcript_unavailable', 'The provider transcript link could not be read.', { retryable: true });
     }
-    const transcriptPath = String(agentRow && agentRow.jsonl_path || '').trim();
+    // WP-2 (D-4, worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-4/D-7): an
+    // empty jsonl_path is "we never recorded the link", not "the transcript is gone". Claude Code
+    // writes a session's transcript at a path derivable from (cwd, session id) alone, so derive
+    // it, VERIFY it through the one transcript reader (lib/transcript-link.js -- the file's own
+    // first line must name this session), link it, and continue. A derived path that verifies
+    // false, or a row with no cwd to derive from, refuses exactly as before -- now naming what
+    // was checked. Codex rows never enter this branch (their resume identity is the rollout
+    // thread, and a missing link there is a different failure).
+    let transcriptPath = String(agentRow && agentRow.jsonl_path || '').trim();
+    if (!transcriptPath && agentRow && recipe.agent === 'claude') {
+      const cwd = String(recipe.cwd || agentRow.project_path || agentRow.cwd || '').trim();
+      const providerSessionId = String(agentRow.agent_session_id || id);
+      let derived = '';
+      try {
+        derived = deriveClaudeTranscriptPath({
+          cwd,
+          agentSessionId: providerSessionId,
+          // The house coercion for this dep (lib/session-create/worker-mcp-servers.js:45): production's
+          // deps carries no `homedir` at all, and the test corpus injects both a getter and a string.
+          homeDir: typeof deps.homedir === 'function' ? deps.homedir() : deps.homedir,
+          claudeConfigDir: deps.claudeConfigDir || serverConfig.CLAUDE_CONFIG_DIR || '',
+        });
+      } catch { /* expected: a row with no cwd (or no agent_session_id) has nothing to derive -- fall through to the unchanged refusal */ }
+      if (derived) {
+        const verified = await verifyClaudeTranscriptAt(derived, providerSessionId, {
+          ...(typeof deps.resolveTranscriptSource === 'function' ? { resolveTranscriptSource: deps.resolveTranscriptSource } : {}),
+          ...(typeof deps.readTranscriptHead === 'function' ? { readTranscriptHead: deps.readTranscriptHead } : {}),
+        });
+        if (!verified.ok) {
+          return failReceipt('worker_transcript_missing', 'The provider transcript is not linked to this worker.', {
+            extra: { derived_path: derived, derived_state: verified.state },
+          });
+        }
+        if (typeof db.updateAgentSessionTranscriptLink === 'function') db.updateAgentSessionTranscriptLink(providerSessionId, derived);
+        transcriptPath = derived;
+      }
+    }
     if (!transcriptPath) return failReceipt('worker_transcript_missing', 'The provider transcript is not linked to this worker.');
 
     let providerId = '';

package/template/coding-task-manager/lib/session-create/worker-notices.js

@@ -1,9 +1,12 @@
 'use strict';
 
 // A lead hears that its delegated worker stopped through its next PostToolUse / UserPromptSubmit
-// hook (lib/api/ingress.js -> bin/claude-hook.js). The queue lives here; the durable truth is the
-// terminal receipt's `delivered_at_ms` in worker_sessions.runtime_json, so a CTM restart rebuilds
-// the undelivered notices once per parent. Never types into the lead's terminal.
+// hook, and -- RC-1, docs/session-stops-mid-job-2026-10-24.html D-1..D-3 -- through its Stop hook
+// too, which is answered synchronously by CTM with the drained notices plus, when the lead still
+// owns a live worker and nothing pending will wake it, a nudge naming walle_worker_wait /
+// walle_stop_worker. The queue lives here; the durable truth is the terminal receipt's
+// `delivered_at_ms` in worker_sessions.runtime_json, so a CTM restart rebuilds the undelivered
+// notices once per parent. Never types into the lead's terminal (D-5).
 
 const mainDbCensus = require('../main-db-census');
 const { nextStepFor } = require('../worker-failure-classify');
@@ -13,6 +16,88 @@ const MAX_TEXT = 400;
 
 const _queues = new Map(); // parent ctm id -> [{ receipt_id, worker_id, parent, text, at_ms }]
 
+// WP-0 (D-2/D-7): the live-worker index, maintained from the receipts CTM already publishes.
+// Memory only -- the hook path touches no DB, and a CTM restart retires every live worker, so the
+// index starts empty and needs no rebuild.
+const _live = new Map(); // parent ctm id -> Map(worker id -> { generation, at_ms })
+
+// WP-1 (D-4): one nudge per tool epoch. `nudgedAtEpoch` starts at `null` so the first Stop
+// (toolEpoch 0) nudges; a second Stop with no PostToolUse between sees toolEpoch === nudgedAtEpoch.
+const _epochs = new Map(); // parent ctm id -> { toolEpoch, nudgedAtEpoch }
+
+function _epochFor(parent) {
+  let epoch = _epochs.get(parent);
+  if (!epoch) { epoch = { toolEpoch: 0, nudgedAtEpoch: null }; _epochs.set(parent, epoch); }
+  return epoch;
+}
+
+// D-2: a `started` receipt says this worker is live for its parent until a terminal receipt for the
+// same or a newer generation arrives. No parent or no worker id -> nothing to index.
+function markWorkerLive(receipt) {
+  if (!receipt || receipt.kind !== 'started') return null;
+  const parent = String(receipt.parent_ctm_session_id || '');
+  const workerId = String(receipt.worker_id || '');
+  if (!parent || !workerId) return null;
+  const generation = Number(receipt.generation) || 1;
+  const atMs = Number(receipt.at_ms) || Date.now();
+  const map = _live.get(parent) || new Map();
+  map.set(workerId, { generation, at_ms: atMs });
+  _live.set(parent, map);
+  return { worker_id: workerId, generation, at_ms: atMs };
+}
+
+// The terminal receipt retires the worker, but an OLDER generation's terminal must never erase a
+// newer generation's `started` (AC-0c): the remove happens only while stored generation <= receipt
+// generation.
+function markWorkerGone(receipt) {
+  const parent = String(receipt?.parent_ctm_session_id || '');
+  const workerId = String(receipt?.worker_id || '');
+  if (!parent || !workerId) return false;
+  const map = _live.get(parent);
+  if (!map) return false;
+  const entry = map.get(workerId);
+  if (entry && Number(entry.generation) > (Number(receipt.generation) || 1)) return false;
+  map.delete(workerId);
+  if (!map.size) _live.delete(parent);
+  return true;
+}
+
+function liveWorkers(parentCtmSessionId) {
+  const parent = String(parentCtmSessionId || '');
+  const map = _live.get(parent);
+  if (!map || !map.size) return [];
+  return [...map.entries()]
+    .map(([worker_id, entry]) => ({ worker_id, generation: entry.generation, at_ms: entry.at_ms }))
+    .sort((a, b) => a.at_ms - b.at_ms);
+}
+
+function noteLeadToolUse(parentCtmSessionId) {
+  const parent = String(parentCtmSessionId || '');
+  if (!parent) return null;
+  const epoch = _epochFor(parent);
+  epoch.toolEpoch += 1;
+  return epoch.toolEpoch;
+}
+
+// D-3/D-4: the Stop nudge. Returns null when no worker is live, when a pending background task or
+// session cron will wake the lead anyway, when the field is absent (Claude did not send it --
+// unknown state fails open, never a nudge), or when this tool epoch was already nudged.
+function stopNudge(parentCtmSessionId, { backgroundTasks = null, sessionCrons = null } = {}) {
+  const parent = String(parentCtmSessionId || '');
+  if (!parent) return null;
+  const workers = liveWorkers(parent);
+  if (!workers.length) return null;
+  if (Array.isArray(backgroundTasks) && backgroundTasks.some((task) => task && task.status === 'running')) return null;
+  if (Array.isArray(sessionCrons) && sessionCrons.length) return null;
+  if (!Array.isArray(backgroundTasks)) return null;
+  const epoch = _epochFor(parent);
+  if (epoch.toolEpoch === epoch.nudgedAtEpoch) return null;
+  epoch.nudgedAtEpoch = epoch.toolEpoch;
+  const firstId = workers[0].worker_id;
+  const text = `Delegated worker ${firstId} is still working (${workers.length} live) and nothing pending will wake you when it finishes. Call walle_worker_wait to keep waiting, or walle_stop_worker if you no longer need it. If you are deliberately handing back to your user with the worker still running, say so and end your turn again.`;
+  return { text, workers: workers.map((worker) => worker.worker_id) };
+}
+
 // D-25: the notice ends with the failure's next_step. The evidence carries it when the
 // publisher stamped it; a receipt stored before that (or filtered by the evidence
 // whitelist) still names the code/class/reason, so the SAME table derives the identical
@@ -51,6 +136,7 @@ function noticeText(receipt) {
 function enqueueNotice(receipt) {
   const parent = String(receipt?.parent_ctm_session_id || '');
   if (!parent || receipt.kind !== 'terminal' || !receipt.receipt_id) return null;
+  markWorkerGone(receipt);
   const notice = { receipt_id: receipt.receipt_id, worker_id: String(receipt.worker_id || ''), parent, text: noticeText(receipt), at_ms: Number(receipt.at_ms) || Date.now() };
   const queue = _queues.get(parent) || [];
   if (!queue.some((n) => n.receipt_id === notice.receipt_id)) queue.push(notice);
@@ -132,6 +218,9 @@ function drainNotices(parentCtmSessionId, { now = Date.now(), dbModule = null, d
   };
 }
 
-function _resetForTest() { _queues.clear(); }
+function _resetForTest() { _queues.clear(); _live.clear(); _epochs.clear(); }
 
-module.exports = { enqueueNotice, rebuildFromDb, drainNotices, noticeText, _resetForTest };
+module.exports = {
+  enqueueNotice, rebuildFromDb, drainNotices, noticeText,
+  markWorkerLive, liveWorkers, noteLeadToolUse, stopNudge, _resetForTest,
+};