create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/usage-ledger/store.js

@@ -23,6 +23,18 @@ function textOrEmpty(value) {
   return value == null ? '' : value;
 }
 
+// A `usage_reread_prior.fact_key`: the JSON array of a fact's primary-key values, in primary-key
+// column order (WP-3). Every key is written by this module, so a value that cannot be read is a
+// corrupted or future-format row and names no fact.
+function parseFactKey(raw) {
+  try {
+    const parsed = JSON.parse(String(raw));
+    return Array.isArray(parsed) ? parsed : null;
+  } catch (err) {
+    return null; // expected: an unreadable snapshot key names no fact, so the row is ignored
+  }
+}
+
 function callParams(call, fileId) {
   // A row that already declares its own identity ambiguous carries no cost, whatever the caller
   // supplied: the INSERT path has no stored row to compare against, so the rule has to hold here
@@ -657,6 +669,11 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
   // wrote under an older reading, not upsert beside them. These run inside
   // upsertBatchTxn, before the new facts, so the swap is atomic.
   //
+  // CODEX ONLY since WP-3. A Claude file's re-read is a SNAPSHOT plus an EOF sweep
+  // (see "non-destructive Claude re-read" below): the vendor rewrites a compacted
+  // transcript to FEWER rows, so "the new reading did not emit it" is not evidence that
+  // the fact is gone. The statements here are still exactly the Codex path (D-10).
+  //
   // Known limitation: a Codex call key shared by several fork files (a copied parent
   // history) is stored under the FIRST file that wrote it. Resetting that one file
   // deletes the shared row until the file re-reads it -- which happens in the same
@@ -699,6 +716,168 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
     SELECT session_id, prompt_id, 0 FROM usage_prompts
      WHERE source_file_id = @source_file_id AND preview IS NULL`);
 
+  // --- non-destructive Claude re-read (WP-3 D-7/D-8) ---------------------------
+  // Claude Code REWRITES a compacted transcript: it drops every row before the last
+  // compact boundary and renames a new file over the path. A re-read therefore sees
+  // FEWER rows than the reading that wrote the stored facts, and the WP-8b delete above
+  // would destroy usage nothing can re-create (the incident: 4.5 days of a lead
+  // session's calls and every launch receipt). The rule for a Claude file is instead:
+  //
+  //   1. RESET (a re-read from 0): SNAPSHOT the fact keys this file had written into
+  //      `usage_reread_prior`. Nothing is deleted.
+  //   2. EVERY SLICE, after the fact upserts: a fact the slice RE-EMITTED leaves the
+  //      snapshot (it is not missing), and every vendor id the slice OBSERVED is
+  //      recorded in `usage_reread_seen`.
+  //   3. EOF (`final`): a fact still in the snapshot is deleted IFF its vendor id was
+  //      OBSERVED (the vendor still has the row and this reading no longer produces the
+  //      fact) OR its vendor id is not derivable at all (an older identity form, where
+  //      nothing can prove the vendor dropped it). A fact whose source row the vendor
+  //      DELETED has no observed id and is KEPT -- that is D-7.
+  //
+  // Both scratch tables are cleared for the file in the same transaction that writes the
+  // checkpoint, so no re-read state outlives the pass. Codex files never touch them.
+  const clearRereadSeenStmt = db.prepare('DELETE FROM usage_reread_seen WHERE file_id = ?');
+  const clearRereadPriorStmt = db.prepare('DELETE FROM usage_reread_prior WHERE file_id = ?');
+  const insertRereadPriorStmt = db.prepare(`
+    INSERT OR IGNORE INTO usage_reread_prior (file_id, kind, fact_key, vendor_id)
+    VALUES (@file_id, @kind, @fact_key, @vendor_id)`);
+  const deleteRereadPriorKeysStmt = db.prepare(`
+    DELETE FROM usage_reread_prior
+     WHERE file_id = @file_id AND kind = @kind
+       AND fact_key IN (SELECT value FROM json_each(@keys))`);
+  const rereadPriorCountStmt = db.prepare(
+    'SELECT count(*) AS n FROM usage_reread_prior WHERE file_id = ?'
+  );
+  const selectRereadPriorStmt = db.prepare(
+    'SELECT kind, fact_key, vendor_id FROM usage_reread_prior WHERE file_id = ?'
+  );
+  const selectRereadSeenStmt = db.prepare(
+    'SELECT kind, vendor_id FROM usage_reread_seen WHERE file_id = ?'
+  );
+  const insertRereadSeenStmt = db.prepare(`
+    INSERT OR IGNORE INTO usage_reread_seen (file_id, kind, vendor_id)
+    VALUES (@file_id, @kind, @vendor_id)`);
+  // The sessions a doomed CALL attributed: the rollup joins THROUGH the call row, so they
+  // must be re-derived after it goes. (A spawn's session rides its own fact key.) Scoped to
+  // THIS file, exactly like the delete it feeds: another source file may own the row now.
+  const callSessionsByKeysStmt = db.prepare(`
+    SELECT DISTINCT session_id FROM usage_calls
+     WHERE call_key IN (SELECT value FROM json_each(@keys))
+       AND source_file_id = @source_file_id`);
+  // The evidence a doomed PROMPT still holds (an alias's digest is part of its own key).
+  // Scoped to this file: the evidence belongs to the row the sweep is about to delete, so a
+  // prompt another source now owns is neither read for evidence nor tombstoned here.
+  const promptEvidenceByKeyStmt = db.prepare(`
+    SELECT provider_message_digest, source_event_digest, preview FROM usage_prompts
+     WHERE session_id = ? AND prompt_id = ? AND source_file_id = ?`);
+  // The whole-file form of preserveLegacyRedactionsStmt, for ONE doomed prompt (D-8), scoped
+  // to the file that still owns the row for the same reason.
+  const preserveLegacyRedactionStmt = db.prepare(`
+    INSERT OR IGNORE INTO usage_prompt_purges (session_id, prompt_id, purged_at)
+    SELECT session_id, prompt_id, 0 FROM usage_prompts
+     WHERE session_id = @session_id AND prompt_id = @prompt_id AND preview IS NULL
+       AND source_file_id = @source_file_id`);
+
+  // The six fact kinds a Claude file writes, and the snapshot/delete statements per kind.
+  //   * `columns` is the fact's PRIMARY KEY in column order: `fact_key` is the JSON array of
+  //     those values, built identically here and in SQL (`json_array(...)` in the snapshot
+  //     assignments below), so a key written by one side is always found by the other.
+  //   * `vendor` is the id the VENDOR gave the record the fact came from -- the thing D-8
+  //     decides on -- and `seen` is the `usage_reread_seen.kind` that id is recorded under.
+  //     `null` means "not derivable" and is swept, as WP-8b did.
+  //   * `sourceScoped` adds `AND source_file_id = @source_file_id` to the DELETE. The primary
+  //     key alone is not enough: a fact this file snapshotted may have been REWRITTEN by
+  //     another source file before this file's EOF sweep -- the `.jsonl.bak` sibling writes
+  //     the same `call_key` and moves its `source_file_id` -- and deleting by key alone would
+  //     destroy the OTHER source's fact. `alias` is not source-scoped because its own key
+  //     already ends in `source_file_id`, so a key of another source's alias can never match.
+  const CLAUDE_CALL_KEY_RE = /^claude:[^:]*:[^:]*:(.+)$/;
+  const REREAD_KINDS = [
+    {
+      kind: 'call',
+      table: 'usage_calls',
+      columns: ['call_key'],
+      seen: 'response',
+      sourceScoped: true,
+      key: (row) => JSON.stringify([row.call_key]),
+      // Identity is `claude:<session>:<agent>:<message.id>`, so the vendor id is everything after
+      // the third colon. A key of any other shape carries no derivable id, so it is swept.
+      vendor: (row) => {
+        const match = CLAUDE_CALL_KEY_RE.exec(textOrEmpty(row.call_key));
+        return match ? match[1] : null;
+      },
+    },
+    {
+      kind: 'prompt',
+      table: 'usage_prompts',
+      columns: ['session_id', 'prompt_id'],
+      seen: 'prompt',
+      sourceScoped: true,
+      key: (row) => JSON.stringify([row.session_id, row.prompt_id]),
+      vendor: (row) => textOrNull(row.prompt_id),
+    },
+    {
+      kind: 'alias',
+      table: 'usage_prompt_aliases',
+      columns: ['session_id', 'prompt_id', 'provider_message_digest', 'source_file_id'],
+      seen: 'prompt',
+      // NOT source-scoped: `source_file_id` is part of this fact's own key.
+      key: (row, fileId) => JSON.stringify([
+        row.session_id,
+        row.prompt_id,
+        textOrEmpty(row.provider_message_digest),
+        row.source_file_id == null ? fileId : row.source_file_id,
+      ]),
+      vendor: (row) => textOrNull(row.prompt_id),
+    },
+    {
+      kind: 'spawn',
+      table: 'usage_spawns',
+      columns: ['session_id', 'tool_use_id'],
+      seen: 'tool_use',
+      sourceScoped: true,
+      key: (row) => JSON.stringify([row.session_id, row.tool_use_id]),
+      vendor: (row) => textOrNull(row.tool_use_id),
+    },
+    {
+      kind: 'delegation',
+      table: 'usage_delegations',
+      columns: ['session_id', 'call_id'],
+      seen: 'tool_use',
+      sourceScoped: true,
+      key: (row) => JSON.stringify([row.session_id, row.call_id]),
+      vendor: (row) => textOrNull(row.call_id),
+    },
+    {
+      kind: 'attempt',
+      table: 'usage_delegation_attempts',
+      columns: ['session_id', 'call_id'],
+      seen: 'tool_use',
+      sourceScoped: true,
+      key: (row) => JSON.stringify([row.session_id, row.call_id]),
+      vendor: (row) => textOrNull(row.call_id),
+    },
+  ];
+  const WHERE_BY_COLUMNS = (columns) => columns.map((column) => `${column} = @${column}`).join(' AND ');
+  for (const spec of REREAD_KINDS) {
+    spec.selectFileStmt = db.prepare(
+      `SELECT ${spec.columns.join(', ')} FROM ${spec.table} WHERE source_file_id = ?`
+    );
+    // The scope clause is the anti-clobber guard: this file may only delete a fact it still
+    // OWNS. Another source may have re-written the row since the snapshot was taken (WP-3).
+    const scope = spec.sourceScoped ? ' AND source_file_id = @source_file_id' : '';
+    spec.deleteByKeyStmt = db.prepare(
+      `DELETE FROM ${spec.table} WHERE ${WHERE_BY_COLUMNS(spec.columns)}${scope}`
+    );
+  }
+  const REREAD_KIND_BY_NAME = new Map(REREAD_KINDS.map((spec) => [spec.kind, spec]));
+  // The bind object for one snapshot key plus the source scope: the primary-key values, back
+  // under their column names, and `source_file_id` for a source-scoped kind.
+  const rereadKeyParams = (spec, values, fileId) => ({
+    ...Object.fromEntries(spec.columns.map((column, index) => [column, values[index]])),
+    ...(spec.sourceScoped ? { source_file_id: fileId } : {}),
+  });
+
   // --- reprice pass (WP-5) -----------------------------------------------------
   // Keyset, not OFFSET: every row is read EXACTLY once per pass, so a pass is one scan
   // however many rounds it takes (the caller re-enters with the previous lastKey).
@@ -829,6 +1008,10 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
       recompute = true,
       reset = false,
       price = null,
+      // WP-3: the vendor ids this slice OBSERVED and whether this slice reached EOF. Both are
+      // used only for a Claude file (D-10: Codex ignores them).
+      observed = null,
+      final = false,
     } = payload;
 
     const now = Date.now();
@@ -877,11 +1060,16 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
       }).changes;
       return { changes, session_id: stored.session_id };
     };
-    // `reset` (WP-8b): the caller is re-reading this file from byte 0 (a parser_version
-    // or head-fingerprint change discarded its checkpoint), so the facts the file wrote
-    // under the OLD reading must be removed before the new ones land. Read the PREVIOUS
-    // identity before the fill-forward upsert mutates the row.
+    // `reset` (WP-8b, Claude semantics replaced in WP-3): the caller is re-reading this file
+    // from byte 0 (a parser_version or head-fingerprint change discarded its checkpoint), so the
+    // facts the file wrote under the OLD reading must be reconciled before the new ones land.
+    // For a CODEX file that is the eager source-scoped delete; for a CLAUDE file it is a
+    // SNAPSHOT plus an EOF sweep, because the vendor may have removed rows the facts came from.
+    // Read the PREVIOUS identity before the fill-forward upsert mutates the row.
     const prevFileRow = reset ? (selectFileStmt.get(file.source_path) || null) : null;
+    // The provider decides which reconciliation runs, so it is read from the BATCH (never from
+    // the row the upsert is about to write, which the fill-forward keeps either way).
+    const isClaude = textOrEmpty(file.provider) === 'claude';
 
     const fileRow = upsertFileStmt.get({
       source_path: file.source_path,
@@ -895,7 +1083,23 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
 
     const sessionSet = new Set();
     let changedFacts = 0;
-    if (prevFileRow) {
+    if (prevFileRow && isClaude) {
+      // WP-3 D-7: a Claude re-read deletes NOTHING up front. Every fact the file had written is
+      // recorded as a key in `usage_reread_prior`, and the EOF sweep decides which of them the
+      // new reading is allowed to remove. The observations start over with the re-read: ids seen
+      // by the attempt this one replaced must not license a delete.
+      clearRereadSeenStmt.run(prevFileRow.file_id);
+      for (const spec of REREAD_KINDS) {
+        for (const row of spec.selectFileStmt.all(prevFileRow.file_id)) {
+          insertRereadPriorStmt.run({
+            file_id: prevFileRow.file_id,
+            kind: spec.kind,
+            fact_key: spec.key(row, prevFileRow.file_id),
+            vendor_id: spec.vendor(row),
+          });
+        }
+      }
+    } else if (prevFileRow) {
       // Every call the file previously wrote is stale: collect the sessions it touched
       // (their rollups must be re-derived) and delete the rows.
       for (const r of selectFileCallSessionsStmt.all(prevFileRow.file_id)) {
@@ -918,11 +1122,16 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
       changedFacts += deleteFileSpawnsStmt.run(prevFileRow.file_id).changes;
       changedFacts += deleteFileDelegationsStmt.run(prevFileRow.file_id).changes;
       changedFacts += deleteFileAttemptsStmt.run(prevFileRow.file_id).changes;
+      changedFacts += deleteFileAliasesStmt.run(prevFileRow.file_id).changes;
+    }
+    if (prevFileRow) {
+      // The reported row and a stale agent row are replaced for BOTH providers: neither is a
+      // fact the vendor's rows are the only evidence of (a report is a re-derivable summary of
+      // calls the ledger keeps, and an agent row is derived metadata).
       for (const r of selectFileCallSessionsForReportedStmt.all(prevFileRow.file_id)) {
         if (r.session_id != null) sessionSet.add(r.session_id);
       }
       changedFacts += deleteFileReportedStmt.run(prevFileRow.file_id).changes;
-      changedFacts += deleteFileAliasesStmt.run(prevFileRow.file_id).changes;
       // A stale agent row (e.g. a v1 Codex thread id that is no longer the main agent)
       // would show as a phantom subagent; drop it (and re-derive that session's rollup, which
       // joined through the row). `session_id = NULL` matches nothing.
@@ -1006,6 +1215,128 @@ function openUsageLedger(dbPath, { Database = null } = {}) {
     }
     if (reported) changedFacts += upsertReportedStmt.run(reportedParams(reported, fileId)).changes;
 
+    // --- WP-3 D-8: reconcile the snapshot with what this slice saw ------------------
+    // EVERY SLICE, after the facts are written. A fact this slice RE-EMITTED is not missing, so
+    // it leaves the snapshot; the ids this slice OBSERVED are recorded, and the EOF sweep below
+    // deletes a prior fact only when its id is among them. Both halves are gated on a caller that
+    // brought `observed` (the ingestor, for a Claude file), so a plain append -- and a Codex file
+    // -- compiles no statement at all here.
+    if (isClaude && observed) {
+      // With no snapshot there is nothing to reconcile against, and nothing to record: a file
+      // that never reset is simply being appended to.
+      if (rereadPriorCountStmt.get(fileId).n > 0) {
+        const emitted = new Map();
+        const addKeys = (kind, keys) => {
+          if (keys.length === 0) return;
+          emitted.set(kind, [...(emitted.get(kind) || []), ...keys]);
+        };
+        addKeys('call', calls.map((call) => REREAD_KIND_BY_NAME.get('call').key(call)));
+        addKeys('prompt', prompts.map((prompt) => REREAD_KIND_BY_NAME.get('prompt').key(prompt)));
+        addKeys('alias', aliases
+          .filter((alias) => !!textOrEmpty(alias.provider_message_digest))
+          .map((alias) => REREAD_KIND_BY_NAME.get('alias').key(alias, fileId)));
+        addKeys('spawn', spawns.map((spawn) => REREAD_KIND_BY_NAME.get('spawn').key(spawn)));
+        addKeys('delegation', delegations.map((edge) => REREAD_KIND_BY_NAME.get('delegation').key(edge)));
+        addKeys('attempt', attempts.map((attempt) => REREAD_KIND_BY_NAME.get('attempt').key(attempt)));
+        for (const [kind, keys] of emitted) {
+          deleteRereadPriorKeysStmt.run({ file_id: fileId, kind, keys: JSON.stringify(keys) });
+        }
+        const seen = [
+          ['response', observed.responses],
+          ['prompt', observed.prompts],
+          ['tool_use', observed.toolUses],
+        ];
+        for (const [kind, ids] of seen) {
+          for (const id of ids || []) {
+            if (id == null) continue;
+            insertRereadSeenStmt.run({ file_id: fileId, kind, vendor_id: id });
+          }
+        }
+      }
+    }
+
+    // --- WP-3 D-8: the EOF sweep ---------------------------------------------------
+    // A prior fact that this pass never re-emitted is deleted IFF its vendor id was observed
+    // (the vendor still has the row and this reading no longer produces the fact) OR the fact
+    // carries no derivable vendor id (an older identity form, exactly the WP-8b behaviour). A
+    // fact whose source row the vendor DELETED was never observed and is KEPT -- D-7.
+    if (isClaude && final) {
+      const priorRows = selectRereadPriorStmt.all(fileId);
+      if (priorRows.length > 0) {
+        const seen = new Set(selectRereadSeenStmt.all(fileId).map((row) => `${row.kind}\u0000${row.vendor_id}`));
+        const doomed = new Map();
+        for (const row of priorRows) {
+          const spec = REREAD_KIND_BY_NAME.get(row.kind);
+          if (!spec) continue;
+          if (row.vendor_id != null && !seen.has(`${spec.seen}\u0000${row.vendor_id}`)) continue;
+          const values = parseFactKey(row.fact_key);
+          if (!values) continue;
+          if (!doomed.has(spec.kind)) doomed.set(spec.kind, []);
+          doomed.get(spec.kind).push(values);
+        }
+
+        // Calls first, and their sessions collected BEFORE the rows go: the rollup joins through
+        // the call row, so deleting one changes the rollup of the session it attributed. Both
+        // statements are scoped to THIS file, so a call another source now owns is neither
+        // collected nor deleted.
+        const callValues = doomed.get('call') || [];
+        if (callValues.length > 0) {
+          const keys = JSON.stringify(callValues.map((values) => values[0]));
+          for (const r of callSessionsByKeysStmt.all({ keys, source_file_id: fileId })) {
+            if (r.session_id != null) sessionSet.add(r.session_id);
+          }
+          for (const values of callValues) {
+            changedFacts += REREAD_KIND_BY_NAME.get('call')
+              .deleteByKeyStmt.run({ call_key: values[0], source_file_id: fileId }).changes;
+          }
+        }
+
+        // A prompt that goes takes its redaction evidence with it, exactly as the whole-file
+        // reset did: a legacy bare-NULL preview becomes a durable tombstone first (nothing can
+        // prove it was not an older writer's redaction), and any existing tombstone keeps the
+        // digest that identifies the same event under a new identity. The evidence read is
+        // source-scoped, so it runs only for a prompt row this file still owns -- i.e. one the
+        // DELETE below will actually remove.
+        for (const values of doomed.get('prompt') || []) {
+          const [sessionId, promptId] = values;
+          const stored = promptEvidenceByKeyStmt.get(sessionId, promptId, fileId);
+          if (stored) {
+            if (stored.preview == null) {
+              changedFacts += preserveLegacyRedactionStmt.run({
+                session_id: sessionId, prompt_id: promptId, source_file_id: fileId,
+              }).changes;
+            }
+            changedFacts += capturePurgeEvidence(sessionId, promptId, stored);
+          }
+          changedFacts += REREAD_KIND_BY_NAME.get('prompt')
+            .deleteByKeyStmt.run({ session_id: sessionId, prompt_id: promptId, source_file_id: fileId }).changes;
+        }
+        for (const values of doomed.get('alias') || []) {
+          const [sessionId, promptId, digest] = values;
+          changedFacts += capturePurgeEvidence(sessionId, promptId, { provider_message_digest: digest });
+          changedFacts += REREAD_KIND_BY_NAME.get('alias')
+            .deleteByKeyStmt.run(rereadKeyParams(REREAD_KIND_BY_NAME.get('alias'), values, fileId)).changes;
+        }
+
+        // A spawn's session rides its own fact key, so the rollup re-derivation needs no lookup
+        // (re-deriving a session that did not move is harmless, unlike skipping one that did).
+        for (const values of doomed.get('spawn') || []) {
+          if (values[0] != null) sessionSet.add(values[0]);
+          changedFacts += REREAD_KIND_BY_NAME.get('spawn')
+            .deleteByKeyStmt.run(rereadKeyParams(REREAD_KIND_BY_NAME.get('spawn'), values, fileId)).changes;
+        }
+        for (const kind of ['delegation', 'attempt']) {
+          const spec = REREAD_KIND_BY_NAME.get(kind);
+          for (const values of doomed.get(kind) || []) {
+            changedFacts += spec.deleteByKeyStmt.run(rereadKeyParams(spec, values, fileId)).changes;
+          }
+        }
+      }
+      // The pass is over: no re-read state outlives the transaction that writes its checkpoint.
+      clearRereadPriorStmt.run(fileId);
+      clearRereadSeenStmt.run(fileId);
+    }
+
     if (checkpoint) updateCheckpointStmt.run(checkpointParams(file.source_path, checkpoint));
 
     const sessions = [...sessionSet];

package/template/coding-task-manager/lib/usage-ledger/task-read.js

@@ -101,6 +101,17 @@ function buildTaskSnapshot(coreDb, ctmSessionId, scope, ledger, { legacyDb = nul
   // member that was never read at all.)
   const nativePoisoned = new Set();
   let bytes = turns.reduce((n, row) => n + Buffer.byteLength(row.text || ''), 0);
+  // D-3 (WP-1): a prompt written before `usage_prompts.source_file_id` existed carries NO digest and
+  // NO alias -- there is nothing to join on. Its `ts` is the transcript row's own `timestamp`, the
+  // SAME value the canonical turn recorded as `started_at_ms`, so an EXACT-equality index is a proof
+  // (never a window): the legacy prompt and the canonical human turn are the same transcript row.
+  const canonicalHumanByTs = new Map();
+  for (const turn of turns) {
+    if (turn.position_key == null || turn.kind !== 'human') continue;
+    const at = Number(turn.ts);
+    if (!canonicalHumanByTs.has(at)) canonicalHumanByTs.set(at, []);
+    canonicalHumanByTs.get(at).push(turn);
+  }
   for (const prompt of ledger.prompts || []) {
     if (!self.has(prompt.session_id) || !['human', 'user_prompt', 'local_command', 'compact_boundary', 'compaction', 'command', null, undefined].includes(prompt.kind)) continue;
     if (prompt.kind === 'command' && fallbackKind(prompt) === 'human') continue;
@@ -119,6 +130,16 @@ function buildTaskSnapshot(coreDb, ctmSessionId, scope, ledger, { legacyDb = nul
       if (incomplete || targets.size === 0) nativePoisoned.add(nativeKey);
     }
     const ref = { session_id: prompt.session_id, prompt_id: prompt.prompt_id };
+    // D-3 (WP-1): a SOURCE-LESS prompt (no `source_file_id`) with no digest, no event digest and no
+    // aliases has no identity evidence at all, so an EXACT-equal timestamp against a UNIQUE canonical
+    // human turn is the only proof available: same transcript row, therefore same turn. Every other
+    // shape is left untouched -- a prompt WITH a source file is never matched by time.
+    if (targets.size === 0 && !incomplete && prompt.source_less === true
+      && !prompt.provider_message_digest && !prompt.source_event_digest
+      && (!prompt.aliases || prompt.aliases.length === 0)) {
+      const sameStart = canonicalHumanByTs.get(Number(prompt.ts));
+      if (sameStart && sameStart.length === 1) targets.add(sameStart[0]);
+    }
     if (targets.size === 1 && !incomplete) {
       const turn = [...targets][0];
       if (!turn.source_refs.some((r) => qualified(r.session_id, r.prompt_id) === qualified(ref.session_id, ref.prompt_id))) turn.source_refs.push(ref);
@@ -424,9 +445,22 @@ function readAgentGraph(db, ids) {
   const params = { ids: JSON.stringify(ids) };
   if (!columns(db, 'usage_agents').size || !columns(db, 'usage_spawns').has('source_file_id')) return { agents: [], spawns: [], truncated: false };
   const agents = db.prepare(`SELECT session_id,agent_id,parent_tool_use_id FROM usage_agents WHERE session_id IN (SELECT value FROM json_each(@ids)) ORDER BY session_id,agent_id LIMIT ${GRAPH_LIMIT + 1}`).all(params);
-  const spawns = db.prepare(`SELECT s.session_id,s.tool_use_id,s.prompt_id,f.agent_id AS parent_agent_id
-    FROM usage_spawns s JOIN usage_files f ON f.file_id=s.source_file_id AND f.session_id=s.session_id
-    WHERE s.session_id IN (SELECT value FROM json_each(@ids)) ORDER BY s.session_id,s.tool_use_id,s.source_file_id LIMIT ${GRAPH_LIMIT + 1}`).all(params);
+  // D-1 (WP-1): a spawn row written BEFORE the `source_file_id` column existed still names the
+  // prompt it ran under. The join is therefore a LEFT JOIN and the row survives on its prompt_id
+  // alone: the parser sets `prompt_id` only when the spawning file IS the main thread
+  // (claude-parse.js), so a sourceless row with a prompt_id is provably a MAIN-THREAD spawn, whose
+  // parent agent is the empty (main) agent id. A sourceless row with NO prompt_id proves nothing and
+  // is excluded here rather than resolved to an invented owner.
+  const spawns = db.prepare(`SELECT s.session_id, s.tool_use_id, s.prompt_id,
+      CASE WHEN f.file_id IS NOT NULL THEN f.agent_id
+           WHEN s.source_file_id IS NULL AND s.prompt_id IS NOT NULL THEN ''
+           ELSE NULL END AS parent_agent_id
+    FROM usage_spawns s
+    LEFT JOIN usage_files f ON f.file_id = s.source_file_id AND f.session_id = s.session_id
+   WHERE s.session_id IN (SELECT value FROM json_each(@ids))
+     AND (f.file_id IS NOT NULL OR (s.source_file_id IS NULL AND s.prompt_id IS NOT NULL))
+   ORDER BY s.session_id, s.tool_use_id, s.source_file_id
+   LIMIT ${GRAPH_LIMIT + 1}`).all(params);
   return { agents: agents.slice(0, GRAPH_LIMIT), spawns: spawns.slice(0, GRAPH_LIMIT), truncated: agents.length > GRAPH_LIMIT || spawns.length > GRAPH_LIMIT };
 }
 
@@ -443,6 +477,9 @@ const DELEGATION_EDGE_LIMIT = 20000;
 // the worker record it created. The legacy recovery window (R-6b) is exactly this, so a launch can
 // never be matched to a call older than the deadline that could have produced it.
 const MAX_PROXY_TIMEOUT_MS = 900000;
+// The worker-launch fallback window: the same physical bound as R-6 -- a worker record can never
+// be newer than the launch call that created it by more than the proxy deadline.
+const WORKER_LAUNCH_WINDOW_MS = MAX_PROXY_TIMEOUT_MS;
 function readDelegationEdges(db, workerIds, sessionIds) {
   if (!columns(db, 'usage_delegations').size) return { edges: [], truncated: false };
   // The edge's agent is the agent its file's CALLS are stored under. A Codex root rollout's file
@@ -652,6 +689,74 @@ function projectTasks(ledgerDb, snapshot, scope, ledger, { grouping = 'heuristic
       if (ts !== null && ts >= from && ts <= launch.at_ms) addEdgeTarget(key, row);
     }
   }
+  // WP-2: the LAST resort for a worker generation the lead's transcript can no longer prove. When the
+  // vendor REWROTE the lead file, neither the accepted edge (WP-0) nor the launch attempt (R-6)
+  // survives, and the calls fell into `delegation_edge_missing` even though CTM's OWN records say
+  // when the worker was launched (its `created_at` / continuation receipts) and which lead turns
+  // exist (the canonical turn index). The fallback charges the generation to the canonical turn that
+  // was ACTIVE at the launch instant -- the greatest turn start not after it -- and only when no
+  // OTHER canonical turn could have held the launch call: a turn starting inside the proxy deadline
+  // window, or two launches of the same generation naming different turns, is AMBIGUOUS, not a
+  // guess. It never touches a key the edges or R-6 already filled, and it never runs for a NESTED
+  // worker (whose launch was made by another worker, not by a lead turn) or on a canonical window
+  // that is unavailable or capped -- a partial turn index cannot prove which turn was active.
+  const fallbackUsable = snapshot.canonical_available === true && snapshot.canonical_window_truncated !== true;
+  // (worker, generation) keys whose launch-time evidence named more than one possible turn. Kept
+  // beside `edgeTargets` rather than inside it: no target was proven, so no bucket may exist.
+  const launchAmbiguous = new Set();
+  if (fallbackUsable) {
+    const canonicalStarts = resolved
+      .filter((turn) => turn.position_key != null && Number.isFinite(Number(turn.ts)))
+      .map((turn) => ({ turn_key: turn.turn_key, ts: Number(turn.ts) }))
+      .sort((a, b) => a.ts - b.ts);
+    const scopedWorkers = canonicalStarts.length > 0 ? scope.workers || [] : [];
+    for (const worker of scopedWorkers) {
+      if (String(worker.parent_ctm_session_id || '') !== String(snapshot.ctm_session_id)) continue;
+      const byGeneration = new Map();
+      for (const launch of worker.launches || []) {
+        const generation = Number(launch.generation);
+        if (!Number.isInteger(generation) || generation < 1) continue;
+        if (!byGeneration.has(generation)) byGeneration.set(generation, []);
+        byGeneration.get(generation).push(launch);
+      }
+      for (const [generation, launches] of byGeneration) {
+        const key = `${worker.ctm_session_id}\u0000${generation}`;
+        const existing = edgeTargets.get(key);
+        if (existing && existing.size > 0) continue;
+        const ends = worker.generation_ends_ms;
+        let pick = null;
+        let ambiguous = false;
+        let unresolved = false;
+        for (const launch of launches) {
+          // No instant on the launch record: nothing to compare against the turn index.
+          const at = finiteOrNull(launch.at_ms);
+          if (at === null) { unresolved = true; break; }
+          // The turn active at the launch: the greatest canonical start not after it. A launch
+          // before EVERY canonical turn has no active turn, so it stays a named gap.
+          let start = null;
+          for (const candidate of canonicalStarts) {
+            if (candidate.ts > at) break;
+            start = candidate;
+          }
+          if (start === null) { unresolved = true; break; }
+          // A RESUME is only possible after the previous generation ended: the window opens at the
+          // later of the proxy deadline and that boundary.
+          let lo = at - WORKER_LAUNCH_WINDOW_MS;
+          if (generation >= 2 && Array.isArray(ends) && Number.isFinite(ends[generation - 2])) {
+            lo = Math.max(lo, ends[generation - 2]);
+          }
+          // A turn STARTED inside the window, so the launch call could equally have run under it.
+          if (start.ts > lo) { ambiguous = true; continue; }
+          if (pick && pick.turn_key !== start.turn_key) { ambiguous = true; continue; }
+          pick = start;
+        }
+        if (unresolved) continue;
+        if (ambiguous) { launchAmbiguous.add(key); continue; }
+        if (!pick) continue;
+        edgeTargets.set(key, new Map([['fallback', { session_id: null, agent_id: '', prompt_id: null, turn_key: pick.turn_key, ts: pick.ts }]]));
+      }
+    }
+  }
   // D-3: the generation a worker row falls in, from the worker's OWN recorded boundaries. A row
   // past every recorded end belongs to the RUNNING generation (`worker.generation`); a row that
   // starts in one generation and ends in another is split, never silently charged to one of them.
@@ -683,10 +788,19 @@ function projectTasks(ledgerDb, snapshot, scope, ledger, { grouping = 'heuristic
     if (ctm == null || String(ctm) === '') return { reason: 'delegation_edge_missing' };
     const resolvedGeneration = generationOf(workerById.get(String(ctm)), row.first_ts, row.last_ts);
     if (resolvedGeneration.reason) return { reason: resolvedGeneration.reason };
-    const bucket = edgeTargets.get(`${ctm}\u0000${resolvedGeneration.generation}`);
-    if (!bucket || bucket.size === 0) return { reason: 'delegation_edge_missing' };
+    const edgeKey = `${ctm}\u0000${resolvedGeneration.generation}`;
+    const bucket = edgeTargets.get(edgeKey);
+    if (!bucket || bucket.size === 0) {
+      // WP-2: the launch-time evidence named MORE than one possible turn, so the gap is
+      // ambiguity -- a different fact from "no launch record at all".
+      if (launchAmbiguous.has(edgeKey)) return { reason: 'delegation_edge_ambiguous' };
+      return { reason: 'delegation_edge_missing' };
+    }
     if (bucket.size > 1) return { reason: 'delegation_edge_ambiguous' };
     const target = [...bucket.values()][0];
+    // A WP-2 fallback target names a canonical turn directly (it never came from a transcript, so it
+    // has no session/agent/prompt); the caller labels a non-prompt turn `non_prompt_turn`.
+    if (target.turn_key) return { turn: target.turn_key, prompt: null };
     const role = roots.get(target.session_id);
     if (role === 'delegated') {
       // A nested launch carries no timestamp of its own; the launching edge's own time is the
@@ -744,6 +858,10 @@ function projectTasks(ledgerDb, snapshot, scope, ledger, { grouping = 'heuristic
       }
       const edges = spawns.get(qualified(row.session_id, matches[0].parent_tool_use_id)) || [];
       const unique = new Map(edges.map((e) => [qualified(e.parent_agent_id, e.prompt_id), e]));
+      // D-2: NO spawn row and SEVERAL spawn rows are different facts. `size === 0` proves the
+      // parent link was never recorded; only `size > 1` is a genuine ambiguity. Folding them
+      // together misnamed every missing row as a conflict.
+      if (unique.size === 0) return { reason: 'native_spawn_missing' };
       if (unique.size !== 1) return { reason: 'native_spawn_ambiguous' };
       const edge = [...unique.values()][0];
       prompt = edge.prompt_id;

package/template/coding-task-manager/lib/visible-revision-watchdog.js

@@ -8,16 +8,13 @@ const DEFAULT_DEADLINES_MS = Object.freeze({
   applied: 100,
   painted: 50,
 });
-const RECOVERY_ACTION = Object.freeze({
-  'frame-sent': 'targeted-keyframe',
-  // Browser main-thread receipt can legitimately exceed this interaction latency
-  // deadline. It is latency evidence, not proof of baseline corruption, so it
-  // must neither fence the diff stream nor inject a replacement keyframe.
-  'socket-received': 'report-only',
-  'apply-started': 'supersede-obsolete',
-  applied: 'supersede-obsolete',
-  painted: 'report-only',
-});
+// Every incident is report-only: a missed boundary deadline is latency evidence, never proof
+// that a frame was lost. Under host load keydown->frame-sent runs 400-800 ms on a healthy
+// session, and the replacement keyframe the 'frame-sent' miss used to force re-delivered a
+// screen the client had already applied (B3: a duplicate full-grid write per late frame). Lost
+// frames are repaired by the delivery path's own seq/baseline checks, not by a clock.
+// (codex-running-composer-latency-round5-2026-08-09 §11 WP-6 rollback: "Return watchdog to
+// report-only; preserve diagnostics".)
 
 function createVisibleRevisionWatchdog(options = {}) {
   const now = options.now || Date.now;
@@ -88,12 +85,11 @@ function createVisibleRevisionWatchdog(options = {}) {
         deadlineMs,
         previousBoundary,
         missingBoundary,
-        recoveryAction: RECOVERY_ACTION[missingBoundary] || 'report-only',
       };
       row.reported = true;
       incidents.push(incident); report(incident);
       recover({ ...incident, scope: row.clientId ? 'client' : 'session' });
-      if (incident.recoveryAction === 'report-only') pending.delete(id);
+      pending.delete(id);
     }
     return incidents;
   }