create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/js/app/worktrees-panel.js

@@ -1447,9 +1447,10 @@ function _wtProgressDuration(ms) {
   return min + 'm ' + String(rem).padStart(2, '0') + 's';
 }
 
-function _wtProgressApi(path) {
+// `machine` (hub WP-5): the box owning the job — create, poll and cancel must all name it.
+function _wtProgressApi(path, machine) {
   var token = (state && state.token) ? state.token : '';
-  return path + (path.indexOf('?') === -1 ? '?' : '&') + 'token=' + encodeURIComponent(token);
+  return path + (path.indexOf('?') === -1 ? '?' : '&') + 'token=' + encodeURIComponent(token) + (machine ? '&machine=' + encodeURIComponent(machine) : '');
 }
 
 function _wtProgressTerminalStatus(status) {
@@ -1536,7 +1537,7 @@ async function _wtCancelWorktreeProgressJob() {
   var killBtn = document.getElementById('wt-progress-kill-btn');
   if (killBtn) { killBtn.disabled = true; killBtn.textContent = 'Stopping...'; }
   try {
-    var r = await fetch(_wtProgressApi('/api/worktrees/create-jobs/' + encodeURIComponent(st.jobId) + '/cancel'), { method: 'POST' });
+    var r = await fetch(_wtProgressApi('/api/worktrees/create-jobs/' + encodeURIComponent(st.jobId) + '/cancel', st.machine), { method: 'POST' });
     var d = await r.json().catch(function() { return {}; });
     if (!r.ok || d.error) throw new Error(d.error || ('HTTP ' + r.status));
     _wtRenderWorktreeProgress(d);
@@ -1558,7 +1559,7 @@ async function _wtCreateWithProgress(body, options) {
   var lastCreateError = null;
   for (var createAttempt = 1; createAttempt <= maxCreateAttempts; createAttempt++) {
     try {
-      var createResponse = await _wtFetchJsonWithTimeout(_wtProgressApi('/api/worktrees/create?async=1'), {
+      var createResponse = await _wtFetchJsonWithTimeout(_wtProgressApi('/api/worktrees/create?async=1', options.machine), {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(createBody),
@@ -1591,6 +1592,7 @@ async function _wtCreateWithProgress(body, options) {
 
   var st = {
     jobId: first.jobId,
+    machine: options.machine || '',
     branch: options.branch || body.name || first.name || '',
     title: options.title || 'Creating worktree',
     subtitle: options.subtitle || '',
@@ -1613,7 +1615,7 @@ async function _wtCreateWithProgress(body, options) {
       if (st.done) return;
       try {
         var pollResponse = await _wtFetchJsonWithTimeout(
-          _wtProgressApi('/api/worktrees/create-jobs/' + encodeURIComponent(st.jobId)),
+          _wtProgressApi('/api/worktrees/create-jobs/' + encodeURIComponent(st.jobId), st.machine),
           {},
           Math.max(1, Number(options.pollTimeoutMs) || 10000),
         );

package/template/coding-task-manager/public/js/background-work.js

@@ -16,15 +16,15 @@
   }
 
   // D-15: bg shell / bg agent / bg terminal / bg task for one entry, bg ×N for more.
-  function pillText(work) {
+  // D-8: when every listed task is quiet the pill says so (a quiet shell carries no park protection).
+  function pillText(work, now = Date.now()) {
     const tasks = tasksOf(work);
     const count = Number(work && work.count) || tasks.length;
-    if (count > 1) return 'bg ×' + count;
+    const allQuiet = tasks.length > 0 && tasks.every((t) => t && t.quiet === true);
+    if (count > 1) return 'bg ×' + count + (allQuiet ? ' · quiet' : '');
     const type = (tasks[0] && tasks[0].type) || Object.keys((work && work.types) || {})[0] || '';
-    if (type === 'shell') return 'bg shell';
-    if (type === 'subagent') return 'bg agent';
-    if (type === 'terminal') return 'bg terminal';
-    return 'bg task';
+    const word = type === 'shell' ? 'shell' : type === 'subagent' ? 'agent' : type === 'terminal' ? 'terminal' : 'task';
+    return 'bg ' + word + (allQuiet ? ' · quiet ' + ageText(tasks[0].activeAt, now) : '');
   }
 
   function clip(label) {
@@ -42,7 +42,7 @@
 
   // Pill title: one `<type>: <label clipped to 80> · <age>` line per task.
   function titleLines(work, now) {
-    return tasksOf(work).map((t) => ((t && t.type) || 'task') + ': ' + clip(t && t.label) + ' · ' + ageText(t && t.since, now)).join('\n');
+    return tasksOf(work).map((t) => ((t && t.type) || 'task') + ': ' + clip(t && t.label) + ' · ' + ageText(t && t.since, now) + (t && t.quiet === true ? ' · quiet ' + ageText(t.activeAt, now) : '')).join('\n');
   }
 
   // Hover-card body: one row per task (type, label, age). fmt.cap(text, n) and fmt.age(ms) are the card's own
@@ -65,6 +65,12 @@
       age.style.cssText = 'flex:0 0 auto;color:var(--fg-dim,#727aa1);font-size:11px;';
       age.textContent = fmt.age(task.since);
       line.append(type, label, age);
+      if (task.quiet === true) {
+        const quiet = doc.createElement('span');
+        quiet.style.cssText = 'flex:0 0 auto;color:var(--fg-dim,#727aa1);';
+        quiet.textContent = 'quiet ' + fmt.age(task.activeAt); // fmt.age takes a timestamp (stream-view _tooltipAge)
+        line.appendChild(quiet);
+      }
       body.appendChild(line);
     }
     return body;

package/template/coding-task-manager/public/js/client-health-core.js

@@ -25,6 +25,12 @@
     return Math.max(0, Math.round(number));
   }
 
+  // A field that is already a safe integer passes through; anything else (absent key, NaN, a
+  // string, a float) falls back. Used for the probe fields whose "unknown" sentinel is -1.
+  function safeIntOr(value, fallback) {
+    return Number.isSafeInteger(value) ? value : fallback;
+  }
+
   function boundedPush(array, value, limit) {
     const max = Math.max(1, Math.floor(finite(limit, 1)));
     array.push(value);
@@ -209,6 +215,55 @@
     return { capture, observe };
   }
 
+  // WP-B frame-stall probe: two pure helpers that turn a LoAF entry's OWN window into the answer a
+  // single burst row could not give — "the renderer main thread was idle and Chrome never sent a
+  // frame" vs "the main thread itself was not running". Both take plain numbers, never `performance`.
+  // C-2: given the main-thread heartbeat ticks (performance.now() samples, ascending) and one frame
+  // window [startTime, startTime + duration], report how many ticks landed inside the window and the
+  // LARGEST gap between consecutive ticks across it. The last tick BEFORE the window seeds the first
+  // gap (a thread that stopped running before the frame began shows up as a leading gap) and the
+  // window end closes the last one, so a window with no ticks at all reports ~duration.
+  // Interpretation: many ticks with gaps at the tick cadence mean the main thread was free and the
+  // frame was starved upstream (compositor/GPU/browser), even though the frame lasted seconds; a
+  // maxGap near the frame duration means the main thread itself was not running. Hidden tabs throttle
+  // timers, so read `visibility` next to it — a throttled page is not a blocked one.
+  function summarizeHeartbeatGap(ticks, startTime, duration) {
+    const list = Array.isArray(ticks) ? ticks : [];
+    const start = Math.max(0, finite(startTime, 0));
+    const end = start + Math.max(0, finite(duration, 0));
+    let cursor = start;
+    let count = 0;
+    let maxGapMs = 0;
+    for (const tick of list) {
+      const value = Number(tick);
+      if (!Number.isFinite(value)) continue;
+      if (value < start) { cursor = value; continue; }
+      if (value > end) break;
+      maxGapMs = Math.max(maxGapMs, value - cursor);
+      cursor = value;
+      count += 1;
+    }
+    return { ticks: count, maxGapMs: Math.round(Math.max(maxGapMs, end - cursor)) };
+  }
+
+  // C-3: the visibility state as it was DURING the frame. The burst row's own visibility/
+  // sinceVisibleMs are read when the burst is REPORTED — after the frame — so they describe the
+  // wrong instant. Reconstructed from the single run-scoped visibilitychange timestamp: a change
+  // inside the window means the state at startTime was the opposite of the current state, none
+  // inside it means the state at startTime was the current state.
+  function resolveVisibilityInWindow(input) {
+    const frame = input || {};
+    const start = Math.max(0, finite(frame.startTime, 0));
+    const end = start + Math.max(0, finite(frame.duration, 0));
+    const changedAt = finite(frame.lastChangeAt, -1);
+    const current = String(frame.current || '').slice(0, 16);
+    const changedInWindow = changedAt >= start && changedAt <= end;
+    return {
+      visibilityChangedInFrame: changedInWindow ? 1 : 0,
+      visibilityAtStart: changedInWindow ? (current === 'visible' ? 'hidden' : 'visible') : current,
+    };
+  }
+
   // WP-3 (docs/mainloop-composer-freeze-2026-08-20.html §5 D-6, §6, §8 WP-3, §9 C-9): pure
   // burst-detection so it's unit-testable without a PerformanceObserver/DOM (client-health-
   // main.js owns the observer + the actual send; this owns only "when does a burst fire").
@@ -266,6 +321,20 @@
       const scriptsAllCount = nonNegativeRounded(frame && frame.scriptsAllCount, scripts.length);
       const scriptsAllSumMs = nonNegativeRounded(frame && frame.scriptsAllSumMs, Math.round(scriptsTotalMs));
       const dominantRepeat = nonNegativeRounded(frame && frame.dominantRepeat, 0);
+      // WP-B C-1: the frame's own timeline, so a 35s frame reads as idle-and-starved rather than
+      // busy from one row. renderStart > 0 is the browser's own "rendering had begun" marker; with
+      // it, renderDelayMs is the time from frame start until rendering began (script time is NOT in
+      // it — a 35,000ms delay with scriptsAllSumMs 73 is a starved frame, not a busy main thread).
+      // wallStartAt lines the frame up with host logs without a second beacon (the core never reads
+      // `performance`; client-health-main.js puts its `timeOrigin` on the frame).
+      const frameStart = Math.max(0, finite(frame && frame.startTime, 0));
+      const renderStart = Math.max(0, finite(frame && frame.renderStart, 0));
+      const renderDelayMs = renderStart > 0 ? Math.round(renderStart - frameStart) : -1;
+      const firstUIEvent = Math.max(0, finite(frame && frame.firstUIEventTimestamp, 0));
+      const firstUIEventMs = firstUIEvent > 0 ? Math.round(firstUIEvent) : -1;
+      const wallStartAt = frame && Number.isFinite(frame.timeOrigin)
+        ? Math.round(frame.timeOrigin + frameStart)
+        : -1;
       return {
         fn: String((dominant && dominant.fn) || '').slice(0, 80),
         src: String((dominant && dominant.source) || '').slice(0, 160),
@@ -291,6 +360,16 @@
           const value = Number(getSinceVisibleMs());
           return Number.isFinite(value) && value >= 0 ? Math.floor(value) : -1;
         })(),
+        // WP-B C-1/C-2: the frame timeline, carried through verbatim when the caller measured it
+        // (-1 = not measured). C-3's visibility pair is carried the same way.
+        startMs: frameStart,
+        renderDelayMs,
+        firstUIEventMs,
+        wallStartAt,
+        heartbeatTicks: safeIntOr(frame && frame.heartbeatTicks, -1),
+        heartbeatMaxGapMs: safeIntOr(frame && frame.heartbeatMaxGapMs, -1),
+        visibilityChangedInFrame: nonNegativeRounded(frame && frame.visibilityChangedInFrame, 0),
+        visibilityAtStart: String((frame && frame.visibilityAtStart) || '').slice(0, 16),
       };
     }
 
@@ -417,6 +496,8 @@
     classifyInteractionTiming,
     createKeyboardInteractionTracker,
     createLoafBurstTracker,
+    summarizeHeartbeatGap,
+    resolveVisibilityInWindow,
     sameWatchdogGap,
     classifyTerminalBoundary,
     firstTerminalBoundary,

package/template/coding-task-manager/public/js/client-health-main.js

@@ -31,7 +31,16 @@
   let lastLifecycleMarker = null;
   let lifecyclePersisted = false;
   let activeRun = null;
+  // WP-B C-2/C-3: the run's main-thread heartbeat ring (performance.now() samples) and the
+  // performance.now() of the last visibilitychange. Both are per-run evidence, reset with the run.
+  let mainHeartbeatTicks = [];
+  let lastVisibilityChangeAt = -1;
   const LIFECYCLE_STORAGE_KEY = 'ctm_client_health_lifecycle_v2';
+  // C-2: the tick cadence and ring length (240 x 500ms = the last 2 minutes), and the frame length
+  // from which the ring is worth summarizing (the LoAF burst solo threshold).
+  const MAIN_HEARTBEAT_TICK_MS = 500;
+  const MAIN_HEARTBEAT_RING = 240;
+  const MAIN_HEARTBEAT_FRAME_MS = 1000;
 
   function isPrivateContextCurrent(privateContext) {
     try { return privateContext?.isCurrent?.() === true; } catch { return false; }
@@ -562,6 +571,16 @@
     try { return performance.timeOrigin + performance.now(); } catch { return Date.now(); }
   }
 
+  // C-2: LoAF's startTime/duration are on the same monotonic clock as performance.now(), so the
+  // heartbeat ring must sample that clock — not the epoch clock above.
+  function monotonicNow() {
+    try { return performance.now(); } catch { return 0; }
+  }
+
+  function performanceTimeOrigin() {
+    try { return performance.timeOrigin; } catch { return -1; }
+  }
+
   function ring(target, value, limit) {
     return Core.boundedPush(target, value, limit);
   }
@@ -596,6 +615,40 @@
     return typeof window === 'undefined' || window.CTM_CLIENT_PERF_SPANS !== false;
   }
 
+  // WP-B C-2: one 500ms run-scoped ticker — the only positive evidence that the renderer main
+  // thread was RUNNING during a long frame. Owned by the run like every other timer here
+  // (scheduleRunInterval -> run.intervals -> retireRun), so a retired/new run inherits nothing.
+  function startMainHeartbeat(run) {
+    if (!isRunCurrent(run)) return;
+    scheduleRunInterval(run, () => {
+      ring(mainHeartbeatTicks, monotonicNow(), MAIN_HEARTBEAT_RING);
+    }, MAIN_HEARTBEAT_TICK_MS);
+  }
+
+  // WP-B C-1/C-2/C-3: the frame-stall probe fields, measured at frame-report time but describing the
+  // frame's OWN window — so one burst row answers "was the main thread idle while Chrome never gave
+  // it a frame" without a second beacon or a hand-mapped wall clock. `performance` is read here, in
+  // the browser module, never in core.
+  function frameStallProbe(entry) {
+    const startTime = Math.max(0, Number(entry?.startTime) || 0);
+    const duration = Math.max(0, Number(entry?.duration) || 0);
+    const probe = { timeOrigin: performanceTimeOrigin() };
+    if (Core && typeof Core.resolveVisibilityInWindow === 'function') {
+      Object.assign(probe, Core.resolveVisibilityInWindow({
+        startTime,
+        duration,
+        lastChangeAt: lastVisibilityChangeAt,
+        current: typeof document !== 'undefined' ? document.visibilityState : '',
+      }));
+    }
+    if (duration >= MAIN_HEARTBEAT_FRAME_MS && Core && typeof Core.summarizeHeartbeatGap === 'function') {
+      const gap = Core.summarizeHeartbeatGap(mainHeartbeatTicks, startTime, duration);
+      probe.heartbeatTicks = gap.ticks;
+      probe.heartbeatMaxGapMs = gap.maxGapMs;
+    }
+    return probe;
+  }
+
   function _recordLoafBurstCandidate(frame, run = activeRun) {
     if (!isRunCurrent(run) || !loafBurstTracker || !_ctmClientPerfSpansEnabled()) return;
     const burst = loafBurstTracker.record(frame, monotonicEpochNow());
@@ -751,6 +804,8 @@
               invokerType: script.invokerType || '',
               forcedStyleAndLayoutDuration: script.forcedStyleAndLayoutDuration || 0,
             })),
+            // WP-B frame-stall probe (C-1/C-2/C-3): additive fields only.
+            ...frameStallProbe(entry),
           };
           ring(performanceData.longAnimationFrames, frame, 20);
           performanceEvidenceVersion += 1;
@@ -852,6 +907,9 @@
       }
     });
     addRunListener(run, document, 'visibilitychange', () => {
+      // WP-B C-3: the single run-scoped visibilitychange timestamp a later frame reads to recover
+      // the state it actually ran under (the burst row's own visibility is read after the fact).
+      lastVisibilityChangeAt = monotonicNow();
       lifecycleState = document.visibilityState === 'visible' ? 'active' : 'hidden';
       if (document.visibilityState === 'visible') {
         visibleSinceMs = monotonicEpochNow();
@@ -1243,6 +1301,8 @@
     lastLifecycleMarker = null;
     lifecyclePersisted = false;
     loafBurstTracker = _createLoafBurstTracker();
+    mainHeartbeatTicks = [];
+    lastVisibilityChangeAt = -1;
   }
 
   function retireRun(run) {
@@ -1399,6 +1459,7 @@
       drainBootErrors();
       if (document.visibilityState === 'visible') visibleSinceMs = monotonicEpochNow();
       startPaintProgressLoop(run);
+      startMainHeartbeat(run);
       scheduleHeartbeat(run);
       sendHeartbeat(run);
       run.memorySampler = createClientMemorySampler({

package/template/coding-task-manager/public/js/coding-session-model-presentation.js

@@ -8,6 +8,22 @@
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
   if (root) root.CTMCodingModelPresentation = api;
 })(typeof globalThis !== 'undefined' ? globalThis : this, function () {
+  // WP-0: the reserved delegate alias, mirrored from lib/model-proxy/lead-worker-picks.js
+  // (WORKER_MODEL_ALIAS) — browser code cannot require CommonJS, so a parity test pins the literal.
+  // It names what a lead's SUBAGENTS ask for; it is never the lead's own model.
+  var RESERVED_MODEL_ALIAS = 'walle-worker';
+
+  // Reviewed finding: the id is normalised through the SAME one marker rule the server's decoders
+  // apply (`modelClass` strips a trailing `[1m]`), so the alias wearing the session's context marker
+  // is the same reserved alias — exactly one marker, and no lookalike (`walle-worker-2`,
+  // `claude-opus-5-5[1m]`) is affected.
+  function isReservedModelAlias(value) {
+    if (typeof value !== 'string') return false;
+    var folded = value.trim().toLowerCase();
+    var base = folded.slice(-4) === '[1m]' ? folded.slice(0, -4) : folded;
+    return base === RESERVED_MODEL_ALIAS;
+  }
+
   function cleanString(value) {
     if (typeof value !== 'string') return null;
     const text = value.trim();
@@ -34,6 +50,9 @@
     if (!value || typeof observedAtMs !== 'number' || !Number.isFinite(observedAtMs) || observedAtMs < 0 || !source
       || (kind !== null && !['concrete', 'alias', 'policy'].includes(kind))) return null;
     if ((role === 'resolved' || role === 'turn') && (kind === 'alias' || kind === 'policy')) return null;
+    // WP-0: a historical alias fact is IGNORED before any precedence rule runs, so the real
+    // selection/turn headlines instead (an alias-only ledger stays unknown).
+    if (isReservedModelAlias(value)) return null;
     return {
       value,
       providerId: optionalString(fact.providerId),
@@ -198,7 +217,9 @@
     const selection = readFact(state.selection, 'selection');
     const resolved = readFact(state.resolved, 'resolved');
     const turn = readFact(state.lastCompletedTurn, 'turn');
-    const fallback = hasDurableLedger(state) ? null : cleanString(fallbackModelId);
+    // WP-0: the raw id a legacy caller observed is a fallback, never a licence to show the reserved
+    // delegate alias as the lead model.
+    const fallback = hasDurableLedger(state) || isReservedModelAlias(fallbackModelId) ? null : cleanString(fallbackModelId);
     const lastUsed = turn ? turn.value : null;
     const observed = turn ? turn.value : resolved ? resolved.value : fallback;
     const base = {
@@ -274,8 +295,15 @@
   // bare `{model_owner, model_observation_health, model_switch_event}` envelope works too). It must
   // be forwarded EVEN WHEN there is no durable ledger — an explicit `model_owner: null` is an
   // authoritative unknown and must never fall back to the raw observed id.
+  //
+  // WP-0 (reviewed finding): the reserved delegate alias is NOT evidence, so a compat caller that has
+  // nothing else (no typed ledger, no authority) gets the presenter's EXISTING true unknown — the same
+  // projection an explicit null owner produces — instead of an `observed` state carrying an empty id.
+  // A pending request transition and every other non-alias id keep their established behavior.
+  var NO_MODEL_EVIDENCE_AUTHORITY = Object.freeze({ model_owner: null });
   function presentLeadModelCompat(observedModelId, request, modelState, authority = null) {
-    const observed = String(observedModelId || '');
+    const reserved = isReservedModelAlias(observedModelId);
+    const observed = reserved ? '' : String(observedModelId || '');
     if (modelState || authorityOfSession(authority)) {
       return presentLeadModel(modelState || {}, request || null, observed || null, authority);
     }
@@ -283,6 +311,7 @@
     if (request && transition && transition.headline === 'target-pending' && !request.effort_only && request.model_id) {
       return { modelId: String(request.model_id), observedModelId: observed, state: 'awaiting_turn' };
     }
+    if (reserved) return presentLeadModel({}, null, null, NO_MODEL_EVIDENCE_AUTHORITY);
     return { modelId: observed, observedModelId: observed, state: 'observed' };
   }
 
@@ -632,16 +661,22 @@
     walle: 'Wall-E tabs pick their model in the Wall-E picker.',
     agent_unknown: 'CTM cannot switch this agent’s model.',
     no_resume_id: 'This session has not been restored yet, so its model cannot change. Open it first.',
+    source_launch_environment_unavailable: 'CTM cannot recover this session’s original launch environment (it was restored after a restart), so its model and effort are frozen. Close and reopen the session to switch.',
   };
   function leadErrorMessage(status, body) {
     const b = body || {};
     if (b.code === MODEL_ACTION_SNAPSHOT_STALE_CODE) return MODEL_ACTION_SNAPSHOT_STALE_GUIDANCE;
-    if (b.code === 'lead_switch_unsupported') return UNSUPPORTED_SENTENCES[b.reason] || 'This session cannot switch its lead model.';
+    if (b.code === 'lead_switch_unsupported') return UNSUPPORTED_SENTENCES[b.reason] || b.message || 'This session cannot switch its lead model.';
     // U-8: the routed refusals carry server facts (a reason / a message), so they are built here.
     if (b.code === 'lead_route_invalid') return 'That gateway route can’t run this model as your lead right now'
       + (b.reason ? ' (' + String(b.reason).replace(/_/g, ' ') + ')' : '') + '.';
     if (b.code === 'lead_default_routed_unsupported') return b.message || 'A gateway model can’t be your CLI default.';
     if (b.code === 'lead_route_unavailable') return b.message || 'The gateway route is unavailable, so the session stays on its current model.';
+    // WP-1 (§5 D-4, §9 S-8): the launch-time native-provider gate refused this Codex thread. The
+    // message names the gateway provider the thread was created on, so the user knows the picker —
+    // not a retry — is the way out. Server-built sentence wins; the fallback keeps the same meaning.
+    if (b.code === 'codex_provider_missing') return b.message
+      || 'This Codex thread was created on a gateway provider; pick a model for this session to relaunch it.';
     return LEAD_ERROR_SENTENCES[b.code] || b.message || b.detail || b.error || ('HTTP ' + status);
   }
 
@@ -729,12 +764,17 @@
     for (const note of authorityDetailNotes(presentation)) details.push(note);
     return {
       modelId, providerId, awaitingModelTurn, unknown, tags, title: details.join(' · '),
-      tokenModelId: presentation.lastUsedValue || presentation.observedModelId || (unknown ? null : currentModelId),
+      tokenModelId: presentation.lastUsedValue || presentation.observedModelId
+        || (unknown || isReservedModelAlias(currentModelId) ? null : currentModelId),
     };
   }
 
   function sessionModelChipView(presentation, modelState, currentModelId, hasActiveRequest, context, session) {
     presentation = presentation || {};
+    // WP-0: the raw session `model_id` is a legacy fallback; the reserved delegate alias is never a
+    // lead model, so it can neither headline the chip nor title it. (`readFact` already dropped it
+    // from any durable fact.)
+    if (isReservedModelAlias(currentModelId)) currentModelId = null;
     // WP1C: every public entry point is fail-closed for a typed unknown. A caller that hands us the
     // carrier rather than a typed projection still gets the SAME shared projection — never a raw
     // provider borrow or a '(detecting…)' placeholder. A typed projection the caller already holds