create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/session-status-runtime.js

@@ -34,6 +34,7 @@ const UNKNOWN_IDLE_BACKOFF_MS = 60000;
 const OPEN_TURN_IDLE_PROBE_AFTER_MS = 15000;
 // D-6: a session tree's CPU-time delta is process evidence at or above this floor AND at or above 5 % of one core
 // over the sample interval (the park predicate's cpuPct >= 5); the rate keeps a 60 s sample from firing on 0.8 %.
+const BG_OUTPUT_UNREADABLE_DIAG_MS = 10 * 60 * 1000;
 const CPU_ACTIVE_MIN_DELTA_MS = 500;
 const CPU_ACTIVE_MIN_CORE_FRACTION = 0.05;
 // The fast tick fires on a 10 s timer whose jitter must not skip a due sample.
@@ -886,6 +887,17 @@ function createBindings(d) {
       shape.zeros = 0; // a newer snapshot (or no shell to check) restarts the count
       shape.observedAt = ledger.backgroundObservedAt;
     }
+    // D-2: a descendant CPU-time delta is silent-activity evidence; the baseline is independent of snapshots.
+    const cpuNow = Number(sample.descendantCpuTimeMs);
+    if (Number.isFinite(cpuNow)) {
+      if (Number.isFinite(shape.cpuTimeMs)) {
+        const delta = cpuNow - shape.cpuTimeMs;
+        const intervalMs = Number(sample.intervalMs) > 0 ? Number(sample.intervalMs) : (sampledAt - (Number(shape.cpuSampledAt) || 0));
+        if (delta >= Math.max(CPU_ACTIVE_MIN_DELTA_MS, CPU_ACTIVE_MIN_CORE_FRACTION * intervalMs)) ledger.markBackgroundActive(isHookShell, sampledAt);
+      }
+      shape.cpuTimeMs = cpuNow;
+      shape.cpuSampledAt = sampledAt;
+    }
     const leaders = Number(sample.descendantGroupLeaderCount);
     if (leaders > 0 && sampledAt > ledger.backgroundObservedAt && [...ledger.background.values()].some(isHookShell)) {
       const renewed = ledger.renewBackground(isHookShell, sampledAt); // D-1
@@ -915,6 +927,29 @@ function createBindings(d) {
     d.markHeartbeatDirty(session);
   }
 
+  // D-3: the output file of each live hook shell is a second silent-activity signal. Never throws.
+  async function observeTaskOutputs(session, sampledAt) {
+    try {
+      const ledger = session && session._statusLedger;
+      if (!ledger || !d.fsp) return;
+      const entries = [...ledger.background.values()].filter((e) => e.type === 'shell' && e.source === 'hook');
+      for (const e of entries) {
+        const p = typeof d.taskOutputPathFor === 'function' ? d.taskOutputPathFor(session, e.id) : '';
+        if (!p) continue;
+        try {
+          const st = await d.fsp.stat(p);
+          ledger.observeBackgroundOutput(e.id, { size: st.size, mtimeMs: st.mtimeMs }, sampledAt);
+        } catch (err) {
+          const at = Number(sampledAt) || Date.now();
+          if (!(at - (Number(ledger._bgOutputUnreadableAt) || 0) < BG_OUTPUT_UNREADABLE_DIAG_MS)) {
+            ledger._bgOutputUnreadableAt = at;
+            d.recordDiagnostic(session.id, 'status-background-output-unreadable', { id: e.id, code: (err && err.code) || '' });
+          }
+        }
+      }
+    } catch { /* expected: evidence-only observer must never throw into the sampler */ }
+  }
+
   // D-6 cadence: 60 s baseline is the lifecycle sweep's own ps; while any ledger is probable/unknown/near-stall
   // (or a session was just CPU-active) this tick takes ONE cheap ps at STATUS_FAST_SAMPLE_MS. At baseline it is a no-op.
   let cpuTickRunning = false;
@@ -979,7 +1014,7 @@ function createBindings(d) {
     }
   }
 
-  return { timeDrivenTick, inputWaitIsIdle, markHookObserved, ledgerFor, verdictFor, recordEvidence, recordWaitCleared, syncWaitFields, composerMayClose, composerRetryMs, keepBlockingWait, cardGoneTwice, cardSeenTwice, cardKeyFor, scheduleWaitEvaluation, cancelWaitEvaluations, recordPtyChunk, fireStallBackstop, observeTranscriptBoundary, observeTranscriptGrowth, observeCodexRollout, liveStatus, tick, applyCpuSample, applyProcessShape, processSampleTick };
+  return { timeDrivenTick, inputWaitIsIdle, markHookObserved, ledgerFor, verdictFor, recordEvidence, recordWaitCleared, syncWaitFields, composerMayClose, composerRetryMs, keepBlockingWait, cardGoneTwice, cardSeenTwice, cardKeyFor, scheduleWaitEvaluation, cancelWaitEvaluations, recordPtyChunk, fireStallBackstop, observeTranscriptBoundary, observeTranscriptGrowth, observeCodexRollout, liveStatus, tick, applyCpuSample, applyProcessShape, observeTaskOutputs, processSampleTick };
 }
 
 // W-1: under host load shedding the wait-state sweep still owes the sessions whose status truth is at stake: wait fields set,
@@ -998,6 +1033,14 @@ function shedSweepIds(sessionMap, approverBuffers, cap = 4, now = Date.now()) {
   return due.slice(0, cap).map(({ id, s }) => { s._reconcileVisitedAt = now; return id; });
 }
 
+// D-3: Claude Code's background-shell output file. Pure; the server passes uid and its canonical project-entry encoder.
+function claudeTaskOutputPathFor(session, taskId, { uid, encodeClaudeProjectEntry } = {}) {
+  const sid = String((session && session.agentSessionId) || '').trim();
+  const cwd = String((session && session.cwd) || '');
+  if (!sid || !cwd || !/^[\w.-]{1,80}$/.test(String(taskId)) || String(taskId) === '..' || String(taskId) === '.') return '';
+  return require('path').join('/tmp', 'claude-' + uid, encodeClaudeProjectEntry(cwd), sid, 'tasks', taskId + '.output');
+}
+
 // R-10: the constant-size empty keepalive frame, built on the main thread (never behind a read-pool op that can time out).
 function keepaliveFrame(now) {
   return JSON.stringify({ type: 'session-activity', sessions: [], keepalive: true, statusTimestamp: Number(now) || 0, serverNow: Number(now) || 0 });
@@ -1015,6 +1058,7 @@ function rowFields(v, reason) {
 
 module.exports = {
   createBindings,
+  claudeTaskOutputPathFor,
   movingCardKey,
   shedSweepIds,
   keepaliveFrame,

package/template/coding-task-manager/lib/session-status.js

@@ -11,7 +11,7 @@ const RESUMING_RESUME_PHASES = new Set(['preparing', 'spawning', 'loading', 'str
 // projectSessionStatus(session) is a pure reducer over the fields server.js already writes
 // today (`_lifecycleState`, `_resumeAttemptState.phase`, `_resumeBlocked`, `_pendingApproval`,
 // `_pressureShed`) — see server.js's RESUME_PHASE enum (lib/resume-attempt-state.js) and the
-// `_lifecycleState` values ('frozen'/'live'/'parking'/'parked'/'deferred'/'waking'/'degraded'/
+// `_lifecycleState` values ('live'/'parking'/'parked'/'deferred'/'waking'/'degraded'/
 // 'exited') for the source vocabulary this projects from.
 //
 // requestTransition(sessionId, to, cause) is the ONE gate for changing the FSM's *phase*.
@@ -48,7 +48,7 @@ function projectSessionStatus(session) {
   else if (lifecycleState === 'parked' || lifecycleState === 'parking') phase = 'parked';
   else if (lifecycleState === 'degraded' || resumePhase === 'blocked') phase = 'degraded';
   else if (resumeBlocked || RESUMING_RESUME_PHASES.has(resumePhase)) phase = 'resuming';
-  else if (lifecycleState === 'waking' || lifecycleState === 'deferred' || lifecycleState === 'frozen') phase = 'attaching';
+  else if (lifecycleState === 'waking' || lifecycleState === 'deferred') phase = 'attaching';
   else if (lifecycleState === 'live' || (lifecycleState === '' && (resumePhase === 'ready' || resumePhase === ''))) phase = 'live';
   else phase = 'detached';
 

package/template/coding-task-manager/lib/session-title-mirror.js

@@ -76,14 +76,14 @@ async function _mirrorSessionTitleAttempt(o) {
     const message = (error && error.message) || String(error);
     try {
       if (db && typeof db.setSessionTitleMirror === 'function') {
-        db.setSessionTitleMirror(sessionId, { state: 'failed', error: message, value: '' });
+        db.setSessionTitleMirror(sessionId, { state: 'failed', reason: 'exception', error: message, value: '' });
       }
     } catch (persistError) {
       // expected: a persist failure on this catch-all path must not turn a resolved
       // outcome into a throw either.
       void persistError;
     }
-    return { state: 'failed', reason: '', error: message };
+    return { state: 'failed', reason: 'exception', error: message };
   }
 }
 
@@ -91,7 +91,10 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
   const logger = typeof log === 'function' ? log : () => {};
   const persist = (state, reason, error, value) => {
     try {
-      db.setSessionTitleMirror(sessionId, { state, error: error || '', value: value || '' });
+      // D-12: the REASON travels with the outcome — db.setSessionTitleMirror composes
+      // title_mirror_error = reason + (error ? ': ' + error : ''), so an `unsupported` row can no
+      // longer sit there with an empty error and no recorded cause (S-24).
+      db.setSessionTitleMirror(sessionId, { state, reason: reason || '', error: error || '', value: value || '' });
     } catch (persistError) {
       // expected: a persist failure must not turn a resolved outcome into a throw —
       // the caller still gets the real state/reason/error, just unrecorded in the DB.
@@ -147,10 +150,11 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
     outcome = { state: 'unsupported', reason: 'unknown_title_spec_kind', error: '' };
   }
 
-  // Step 7: persist + return.
+  // Step 7: persist + return. D-12: a failure that reports no reason of its own still gets one, so
+  // `failed`/`unsupported` never lands with an empty reason to compose from.
   return persist(
     outcome.state,
-    outcome.reason || '',
+    outcome.reason || (outcome.state === 'failed' ? 'adapter_failed' : ''),
     outcome.error || '',
     outcome.state === 'mirrored' ? name : row.value
   );
@@ -166,6 +170,14 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
 // Synchronous by design (setSessionTitleNew is a plain DB write, not provider I/O) — callers on
 // a live-session sync tick (lib/coding-agent-models.js, workers/db-owner-worker.js) never await
 // this; a rejection would have nothing to propagate to, so it's log-and-drop and retried next tick.
+// D-9/AC-4c: the LAST agent name a re-assert was fired for, per CTM session. The observed name is
+// re-read on every sync tick (D-10) while the agent's own name only changes when the AGENT renames
+// itself, so a plain per-session memo is what turns "observed on every tick" into "mirrored once per
+// observed name". Convergence clears the entry (the agent's name equals the CTM title again), so a
+// later drift fires again. In-memory by design: it is a coalescing memo for a live process, never a
+// durable state machine — a restart simply re-observes.
+const _lastReassertedName = new Map();
+
 function applyProviderTitle(o = {}) {
   const { db, sessionId, provider, mirror = mirrorSessionTitle } = o;
   const agentName = normalizeSessionTitle(o.agentName);
@@ -175,13 +187,20 @@ function applyProviderTitle(o = {}) {
     if (agentName && agentName !== normalizeSessionTitle(row.title)) {
       // Fire-and-forget re-assert: the agent has drifted from the user's CTM name: push the
       // CTM name back out. NEVER write the agent's name over a user rename.
+      const key = String(sessionId || '');
+      if (_lastReassertedName.get(key) === agentName) return { applied: 'none', reason: 'already_reasserted' };
+      _lastReassertedName.set(key, agentName);
       void mirror({ db, sessionId });
       return { applied: 'reasserted' };
     }
+    if (agentName) _lastReassertedName.delete(String(sessionId || ''));
     return { applied: 'none' };
   }
 
   if (agentName) {
+    // No write churn: a row already carrying this exact name (tier 2 or a tier-3 title that
+    // happens to match) is left alone — no setSessionTitleNew, no updated_at bump.
+    if (row && normalizeSessionTitle(row.title) === agentName) return { applied: 'none', reason: 'unchanged' };
     try {
       // Explicitly detached: the write is best-effort off a live-session sync tick and this
       // function is synchronous, so a rejection has no caller to propagate to — the next tick
@@ -202,57 +221,6 @@ function applyProviderTitle(o = {}) {
   return { applied: 'none' };
 }
 
-// WP-3 (session-rename-mirror §5 D-1, D-4; AC-3d/AC-3e): resolves the Claude agent's OWN
-// session name for feeding applyProviderTitle, on demand for ONE session — never call this from
-// a full-catalog scan loop (see AC-3f's "no process spawn" sibling concern for Codex; this one's
-// hazard is the SDK round-trip, not a spawn). Guarded by getTitleSpec('claude')?.readsUserName:
-// an absent/false spec (the kill switch is `titleSpec: null`) falls straight back to the
-// caller-supplied parser result (parsedTitle, e.g. parseSessionFile's tail/head-scan title)
-// WITHOUT ever touching the SDK adapter (AC-3e). `customTitle` (info.userName) outranks the
-// derived `aiTitle` (info.summary when it differs from the first prompt) — same precedence
-// lib/claude-session-title.js's readClaudeSessionTitle already encodes into its own return shape.
-async function resolveClaudeAgentName(o = {}) {
-  const { sessionId, dir, sdk, parsedTitle = '', getTitleSpec = defaultGetTitleSpec, adapter } = o;
-  const spec = getTitleSpec('claude');
-  if (!spec || !spec.readsUserName) return normalizeSessionTitle(parsedTitle);
-  const claude = adapter || _defaultClaudeAdapter();
-  const info = await claude.readClaudeSessionTitle({ sessionId, dir, sdk });
-  if (!info) return normalizeSessionTitle(parsedTitle);
-  const name = info.userName || info.aiTitle || '';
-  return normalizeSessionTitle(name || parsedTitle);
-}
-
-// Fix round 1 (Finding 1): production wiring for resolveClaudeAgentName — one call per Claude
-// session becoming known/linked to CTM (never a scan/batch loop; the SDK round-trip is the
-// per-session hazard, matching AC-3f's spawn concern for Codex's sibling). Callers use
-// `void fillClaudeAgentTitle(...)` — async, fire-and-forget, never awaited on a hot sync path.
-// Cheap guard BEFORE the SDK read: a tier-1 (user_renamed) row never triggers the round-trip.
-// Never throws into the caller — any error (a throwing db read, a rejecting resolve/apply) is
-// reported via recordSessionDiagnostic (HANDLE) and swallowed; `unsupported`/`sdk_absent` from
-// resolveClaudeAgentName is a normal, silent `{applied:'none'}`, not an error.
-async function fillClaudeAgentTitle(o = {}) {
-  const { db, sessionId, provider = 'claude', claudeSessionId, dir, sdk, getTitleSpec, adapter, recordSessionDiagnostic, log } = o;
-  try {
-    const row = db.getSessionTitleMirror(sessionId);
-    if (row && row.userRenamed && row.title) return { applied: 'none' };
-    const agentName = await resolveClaudeAgentName({ sessionId: claudeSessionId, dir, sdk, getTitleSpec, adapter });
-    if (!agentName) return { applied: 'none' };
-    return applyProviderTitle({ db, sessionId, provider, agentName });
-  } catch (error) {
-    const message = (error && error.message) || String(error);
-    try {
-      if (typeof recordSessionDiagnostic === 'function') {
-        recordSessionDiagnostic(sessionId, 'claude-agent-title-fill-error', { error: message });
-      }
-    } catch (diagError) {
-      // expected: diagnostics must never turn a swallowed error into a throw.
-      void diagError;
-    }
-    if (typeof log === 'function') log('fillClaudeAgentTitle failed', message);
-    return { applied: 'none' };
-  }
-}
-
 // F1 (final review, AC-3g): shared guard for the tier-3 "live label" writer — the ONLY
 // question this answers is "does `existing` already carry a tier that a tier-3 write must
 // never clobber", NEVER a db access itself (pure, so both an on-thread caller with a
@@ -269,4 +237,4 @@ function canWriteTier3Title(existing) {
   return true;
 }
 
-module.exports = { mirrorSessionTitle, isUuidLike, applyProviderTitle, resolveClaudeAgentName, fillClaudeAgentTitle, canWriteTier3Title };
+module.exports = { mirrorSessionTitle, isUuidLike, applyProviderTitle, canWriteTier3Title };

package/template/coding-task-manager/lib/session-transcript-trash.js

@@ -196,7 +196,14 @@ async function findTrashedTranscript({ trashRoot, fileName, fs: fsImpl = fsPromi
     } catch { continue; /* expected: missing/corrupt manifest in this trash dir */ }
     for (const entry of manifest.entries || []) {
       if (path.basename(entry.originalPath) === fileName) {
-        return { trashPath: entry.trashPath, originalPath: entry.originalPath, trashedAt: manifest.trashedAt };
+        // WP-3 (D-13): the manifest already carries WHY it was trashed and when; the card's "why"
+        // sentence is built from these two facts alone, so they travel with the lookup result.
+        return {
+          trashPath: entry.trashPath,
+          originalPath: entry.originalPath,
+          trashedAt: manifest.trashedAt,
+          reason: String(manifest.reason || ''),
+        };
       }
     }
   }

package/template/coding-task-manager/lib/startup-pointer-write.js

@@ -0,0 +1,57 @@
+'use strict';
+// WP-3 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §9 S-11, §10 AC-3a/3b): the
+// startup pointer is written ONLY through db.updateStartupTaskAgentSession, whose
+// `resumesCandidateFork` guard (lib/lead-model-transition-store.js, commit 77b9b3c0e3) keeps the
+// source pointer while a lead-model transition is still active. session-integrity.js used to
+// re-point it with a raw `UPDATE startup_tasks SET args …` that bypassed the guard: the 30-min pass
+// picks the newest transcript row — exactly the uncommitted fork of a half-switched Codex session.
+//
+// Callers hand this the raw better-sqlite3 core handle (workers/db-owner-worker.js
+// 'recoverSessionIntegrity' → db.getDomainDb('core')) or the db module; either way the write goes
+// through the module's guarded writer against the same core table. The writer returns nothing, so
+// `args` is compared before/after to keep the fixed/skipped accounting a raw UPDATE's `.changes` gave.
+
+function readStartupPointerArgs(handle, sessionId) {
+  try {
+    return handle.prepare('SELECT args FROM startup_tasks WHERE ctm_session_id = ?').get(sessionId)?.args;
+  } catch {
+    /* expected: no startup_tasks/args column in a partial fixture schema — the write below reports the real failure */
+    return undefined;
+  }
+}
+
+// Lazy require: db.js is loaded by the owner process already; nothing in its graph requires this file.
+function startupPointerWriter(handle) {
+  if (handle && typeof handle.updateStartupTaskAgentSession === 'function') {
+    return handle.updateStartupTaskAgentSession.bind(handle);
+  }
+  const dbModule = require('../db.js');
+  if (typeof dbModule.updateStartupTaskAgentSession !== 'function') {
+    throw new Error('db.updateStartupTaskAgentSession is unavailable; refusing a raw startup_tasks pointer write');
+  }
+  return dbModule.updateStartupTaskAgentSession;
+}
+
+// The `agent_project_dir`/`claude_project_dir` value currently on the row — the guarded writer
+// rewrites BOTH columns from one argument, so a caller that only means to move `args` hands back
+// what is already stored instead of clearing the dirs.
+function readStartupTaskProjectDir(handle, sessionId) {
+  for (const column of ['agent_project_dir', 'claude_project_dir']) {
+    try {
+      return handle.prepare(`SELECT ${column} AS dir FROM startup_tasks WHERE ctm_session_id = ?`).get(sessionId)?.dir || '';
+    } catch {
+      /* expected: column absent on this schema — try the sibling column */
+    }
+  }
+  return '';
+}
+
+// Move the startup pointer through the guarded writer; returns 1 when the row changed, else 0.
+function writeStartupPointerGuarded(handle, sessionId, resumeArgs, projectDir) {
+  const write = startupPointerWriter(handle);
+  const before = readStartupPointerArgs(handle, sessionId);
+  write(sessionId, Array.isArray(resumeArgs) ? resumeArgs[1] : '', projectDir, resumeArgs);
+  return readStartupPointerArgs(handle, sessionId) === before ? 0 : 1;
+}
+
+module.exports = { writeStartupPointerGuarded, readStartupTaskProjectDir };

package/template/coding-task-manager/lib/state-sync/painted-frame-field.js

@@ -27,12 +27,23 @@ function nearestBreaks(breaks, top) {
   return list.slice().sort((a, b) => Math.abs(top - a.at) - Math.abs(top - b.at)).slice(0, BREAKS_MAX).sort((a, b) => a.at - b.at);
 }
 
+function holdOf(h) {
+  if (!h || typeof h !== 'object') return null;
+  return { kind: typeof h.kind === 'string' ? h.kind : null, rows: isInt(h.rows) && h.rows >= 0 ? h.rows : 0, top: isInt(h.top) ? h.top : null };
+}
+
 // `deps` = { readPainted(id, epoch, from, count), paintedRevisedSince(id, seq) }.
 // -> an object to spread into the frame: {} or { painted: { epoch, top, pinned, floor, revision, breaks, below[, revisedFrom][, from, rows] } }
 function paintedFrameField(deps, id, keyframe, ackedGrid, grid) {
   const now = grid && grid.painted;
   if (!now || typeof now !== 'object') return {};
   const state = { epoch: now.epoch, top: now.top, pinned: now.pinned, floor: now.floor, revision: isInt(now.revision) ? now.revision : 0, breaks: nearestBreaks(now.breaks, now.top), below: isInt(now.below) && now.below > 0 ? now.below : 0 }; // R-F2 (reader-seam-proof-followups): rows the app holds below its screen; a host that never measured it (or an at-rest app) sends 0
+  // Clock-free tests (WP-6): `samples` (the recorder's monotone observe count) and `hold` (the rejected, uncommitted samples) ride
+  // the field so a reader waits on "this write was sampled" instead of a window; neither one decides whether a frame is sent.
+  // Each is present only when the recorder published it, so an older recorder's field is unchanged.
+  if (isInt(now.samples) && now.samples >= 0) state.samples = now.samples;
+  const hold = holdOf(now.hold);
+  if (hold) state.hold = hold;
   const before = ackedGrid && ackedGrid.painted;
   if (keyframe || !before || before.epoch !== now.epoch) return { painted: state };
   const beforeRevision = isInt(before.revision) ? before.revision : 0;

package/template/coding-task-manager/lib/storage/coding-session-model-store.js

@@ -282,10 +282,10 @@ function persistModelSelectionBatch(db, payload = {}, deps = {}) {
   if (!intents.length) return { generation, entries: [] };
   // Fail fast on a wiring mistake instead of a half-working batch (the model half would
   // persist while the codex title half silently threw).
-  for (const name of ['isGenericCodingSessionLabel', 'shouldApplyCodexAutoTitle', 'applyProviderTitle', 'canWriteTier3Title']) {
+  for (const name of ['isGenericCodingSessionLabel', 'applyProviderTitle', 'canWriteTier3Title']) {
     if (typeof deps[name] !== 'function') throw new TypeError(`persistModelSelectionBatch requires deps.${name}`);
   }
-  const { isGenericCodingSessionLabel, shouldApplyCodexAutoTitle } = deps;
+  const { isGenericCodingSessionLabel } = deps;
   const { applyProviderTitle, canWriteTier3Title } = deps;
   const entries = [];
   for (const intent of intents) {
@@ -326,27 +326,26 @@ function persistModelSelectionBatch(db, payload = {}, deps = {}) {
     if (intent.agentType === 'codex') {
       const existingTitle = db.getSessionTitleNew(id) || null;
       const liveLabel = String(intent.liveLabel || '').trim();
-      const session = { label: liveLabel };
-      if (existingTitle?.userRenamed) {
-        entry.titleSynced = true;
-      } else if (!shouldApplyCodexAutoTitle({ session, existingTitle }) && canWriteTier3Title({ userRenamed: existingTitle?.userRenamed, title_source: db.getDomainDb('core').prepare('SELECT title_source FROM ctm_sessions WHERE id=?').get(id)?.title_source })) {
-        if (liveLabel
-            && !isGenericCodingSessionLabel(liveLabel, 'codex')
-            && String(existingTitle?.title || '').trim() !== liveLabel) {
-          db.setSessionTitleNew(id, liveLabel, false);
-          entry.titleApplied = true;
-          entry.title = liveLabel;
-          entry.titleKind = 'live';
-        }
-        entry.titleSynced = true;
-      } else {
-        const agentName = String(intent.title || '').trim();
-        if (agentName) {
-          const outcome = applyProviderTitle({ db, sessionId: id, provider: 'codex', agentName });
-          if (outcome.applied === 'agent') { entry.titleApplied = true; entry.title = agentName; entry.titleKind = 'provider'; }
-          entry.titleSynced = true;
-        }
+      // WP-4/D-10: the thread's own name wins on EVERY observation — no one-shot `titleSynced`
+      // latch, and no `shouldApplyCodexAutoTitle` precedence test that could let a CTM title block
+      // the name (S-22). applyProviderTitle owns the tier rules (tier-1 re-assert, equal-name
+      // no-op, tier-2 write); the label-only fallback runs only when the thread has no name.
+      const agentName = String(intent.title || '').trim();
+      if (agentName) {
+        const outcome = applyProviderTitle({ db, sessionId: id, provider: 'codex', agentName });
+        if (outcome.applied === 'agent') { entry.titleApplied = true; entry.title = agentName; entry.titleKind = 'provider'; }
+      } else if (liveLabel
+          && !isGenericCodingSessionLabel(liveLabel, 'codex')
+          && String(existingTitle?.title || '').trim() !== liveLabel
+          && canWriteTier3Title({ userRenamed: existingTitle?.userRenamed, title_source: db.getDomainDb('core').prepare('SELECT title_source FROM ctm_sessions WHERE id=?').get(id)?.title_source })) {
+        db.setSessionTitleNew(id, liveLabel, false);
+        entry.titleApplied = true;
+        entry.title = liveLabel;
+        entry.titleKind = 'live';
       }
+      // The decision RAN (whatever it decided) — this receipt is the batch's completion signal
+      // (cacheCompleted) and the durable applier's latch; it is no longer a one-shot name gate.
+      entry.titleSynced = true;
     }
     entries.push(entry);
   }

package/template/coding-task-manager/lib/surviving-owner-bootstrap.js

@@ -6,7 +6,7 @@ const { createRecoveryProductionAdapters } = require('./recovery-production-adap
 const { waitFor } = require('../../bin/wait-for');
 
 function createSurvivingOwnerBootstrap(options) {
-  const { dataDir, log = console.warn } = options;
+  const { dataDir, log = console.warn, onSkip = () => {} } = options;
   const adapters = createRecoveryProductionAdapters(options);
   const recovery = createSurvivingOwnerRecovery({ dataDir, ...adapters });
   let loaded = false, unresolved = false, failed = false, lastReason = '';
@@ -28,10 +28,15 @@ function createSurvivingOwnerBootstrap(options) {
   function assertAdmission() {
     if (protectsSession()) throw Object.assign(new Error('Session is preserved by pending owner recovery'), { code: 'OWNER_RECOVERY_PENDING', status: 409 });
   }
-  function admissionResult() {
+  // WP-3 (§9 S-20 / AC-3e): `(id, task)` are accepted for the skip DIAGNOSTIC only -- callers
+  // (server.js _startDeferredRestoreSession/_Attempt/Now) have always passed them and were silently
+  // ignored. The fence VERDICT is unchanged and never inspects them: it is still exactly
+  // "is any owner-recovery operation still pending?".
+  function admissionResult(id, task) {
     try { assertAdmission(); return null; }
     catch (error) {
       if (error.code !== 'OWNER_RECOVERY_PENDING') throw error;
+      onSkip('OwnerRecoveryFence', id || task?.session_id || '', null);
       return { ok: false, status: 'blocked', code: 'owner_recovery_pending', reason: 'owner_recovery_pending', retryable: true, message: error.message };
     }
   }

package/template/coding-task-manager/lib/surviving-owner-recovery.js

@@ -10,6 +10,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { readPrivateJson } = require('./recovery-private-file');
 const { assertRecoveryInput, verifyConfirmationReceipt } = require('./recovery-evidence');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 const DIRNAME = 'surviving-owner-recovery';
 const STAGES = new Set(['staged', 'awaiting-preservation', 'retiring', 'ready-to-adopt', 'completed']);
@@ -27,7 +28,7 @@ function operationPath(dataDir, operationId) {
 async function ensureOperationDir(dataDir) {
   if (!path.isAbsolute(dataDir)) throw new Error('recovery data directory must be absolute');
   const root = await fs.promises.lstat(dataDir);
-  if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.() || (root.mode & 0o022)) throw new Error('unsafe recovery data directory');
+  if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.() || !isWritableOnlyByOwner(root)) throw new Error('unsafe recovery data directory');
   const dir = operationDir(dataDir);
   try { await fs.promises.mkdir(dir, { mode: 0o700 }); }
   catch (error) { if (error.code !== 'EEXIST') throw error; /* expected: existing private operation directory */ }

package/template/coding-task-manager/lib/terminal-draft-http-status.js

@@ -0,0 +1,25 @@
+'use strict';
+
+function terminalDraftHttpStatus(error) {
+  if (!error) return 500;
+  if (error.code === 'CTM_MAIN_DB_REQUEST_FORBIDDEN') return 501;
+  if (error.code === 'CTM_OWNERSHIP_UNAVAILABLE' || error.code === 'CTM_DB_OWNER_UNAVAILABLE' ||
+      error.code === 'CTM_MEDIA_JOURNAL_UNAVAILABLE') return 503;
+  if (error.code === 'CTM_DRAFT_NOT_FOUND' || error.code === 'CTM_DRAFT_SESSION_NOT_FOUND') return 404;
+  if (error.code === 'CTM_DRAFT_PURGED') return 410;
+  if (error.code === 'CTM_DRAFT_SESSION_RETIRING') return 409;
+  if (error.code === 'CTM_SESSION_OWNER_MISMATCH') return 409;
+  if (error.code === 'CTM_DRAFT_REVISION_CONFLICT') return 412;
+  // CTM_IMAGE_IDEMPOTENCY_CONFLICT is the legacy/mobile lanes' equivalent of the draft
+  // lane's idempotency conflict (media-store requestId dedupe) — same 409 semantic
+  // (WP-9 lane-parity: distinguishable from a malformed 400 without inspecting `code`).
+  if (error.code === 'CTM_DRAFT_IDEMPOTENCY_CONFLICT' || error.code === 'CTM_IMAGE_IDEMPOTENCY_CONFLICT' ||
+      error.code === 'CTM_DRAFT_DELIVERY_SUPERSEDED' ||
+      error.code === 'CTM_DRAFT_DELIVERY_STATE') return 409;
+  if (error.code === 'CTM_DRAFT_FROZEN' || error.code === 'CTM_DRAFT_REQUEST_CANCELLED') return 409;
+  if (error.code === 'CTM_DRAFT_IMAGE_INVALID' || error.code === 'CTM_DRAFT_SESSION_REQUIRED' ||
+      error.code === 'CTM_DRAFT_IDENTITY_INVALID' || error.code === 'CTM_DRAFT_DELIVERY_OUTCOME_INVALID') return 400;
+  return 500;
+}
+
+module.exports = { terminalDraftHttpStatus };