create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/js/queue-panel-submission-reconcile.js

@@ -4,6 +4,31 @@
 })(typeof globalThis !== 'undefined' ? globalThis : this, function() {
   'use strict';
 
+  // WP-1 (C3, design §6): the same closed recovery vocabulary the server publishes. Send
+  // Next reads `lastAttempt.recoveryAction` directly, so this module normalizes
+  // independently of the manager: an unrecognized value never grants a fresh id, and a
+  // frame with no usable verdict is conservative (review -- restore + explicit confirm).
+  var RECOVERY_ACTIONS = new Set(['retry', 'resend', 'review', 'none']);
+
+  function normalizeRecoveryAction(value, retryable) {
+    var clean = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    if (RECOVERY_ACTIONS.has(clean)) return clean;
+    return retryable === true ? 'retry' : 'review';
+  }
+
+  // R7 (AC-1e): the recovery policy a queue item's last failure published, so "Send Next" can
+  // never silently repeat an identity the server already refused.
+  //   retry / none -> keep the admitted identity (a fresh id would be a second submission)
+  //   resend       -> certified no-effect recovery: drop the dead identity, one new attempt
+  //   review       -> uncertain: never dispatched, the user confirms first
+  // An item with no recorded attempt is an ordinary unsent draft and keeps the historical
+  // same-identity behavior.
+  function itemRecoveryPolicy(item) {
+    var lastAttempt = item && item.lastAttempt;
+    if (!lastAttempt) return 'retry';
+    return normalizeRecoveryAction(lastAttempt.recoveryAction, lastAttempt.retryable === true);
+  }
+
   function positiveTimestamp(value, fallback) {
     var timestamp = Number(value);
     if (Number.isFinite(timestamp) && timestamp > 0) return timestamp;
@@ -34,13 +59,20 @@
     var status = String(message && message.status || '').toLowerCase();
     if (status === 'sent') return { status: 'sent', message: '' };
     if (status === 'blocked' || status === 'failed' || status === 'needs_attention') {
+      var retryable = !!(message && message.retryable === true);
+      var reason = String((message && (message.reason || message.code)) || '');
       return {
         status: 'pending',
         lastAttempt: {
           at: Number(message && message.observedAt) || Date.now(),
           outcome: message && message.status,
           message: String((message && message.message) || ''),
-          retryable: !!(message && message.retryable === true),
+          retryable: retryable,
+          // Additive for the recovery lanes: which action the server granted this
+          // failure (`recoveryAction`) and why (`reason`). Always derived, never
+          // invented from prose, so Send Next has a policy even for a legacy frame.
+          recoveryAction: normalizeRecoveryAction(message && message.recoveryAction, retryable),
+          ...(reason ? { reason: reason } : {}),
         },
       };
     }
@@ -135,10 +167,151 @@
     return params.toString();
   }
 
+  // R6 (AC-1d/AC-1f): the ONE route from a tray recovery gesture into the queue. It never mints an
+  // identity itself: when the panel still owns the exact submission, the owner-fenced resendItem
+  // (passed in as `resendItem`) is the only thing allowed to drop the old ID; otherwise the record
+  // stays with the manager, whose own rules decide whether a replacement is permitted at all.
+  function routeTrayRecovery(action, record, options, deps) {
+    deps = deps || {};
+    // Captured once, up front: the gesture is fenced by the manager that owned the record when the
+    // gesture started, and its own scope guard applies on completion. Never re-read mid-flight.
+    var manager = typeof deps.getManager === 'function' ? deps.getManager() : null;
+    var clientMessageId = String(record && record.clientMessageId || '');
+    if (action !== 'resend' || !manager || !clientMessageId) return Promise.resolve(false);
+    // AC-1e: the failure's own verdict decides whether a fresh attempt is permitted at all.
+    // `review` is uncertainty -- only this call being the explicit confirmation may proceed --
+    // `resend` is the certified no-effect recovery, and retry/none/unknown can never start a
+    // fresh send from here (a legacy frame with no verdict normalizes to `review`).
+    var policy = normalizeRecoveryAction(record.recoveryAction, record.retryable === true);
+    var confirmed = !!(options && options.confirmUncertain === true);
+    if (policy === 'review' ? !confirmed : policy !== 'resend') return Promise.resolve(false);
+    var sessionId = String(record && record.sessionId || '');
+    // Exact session AND exact item only: a tab switch between the gesture and this call must never
+    // touch another session's item, and an item that already moved to a newer identity is not this
+    // record's item any more.
+    var items = sessionId && typeof deps.getSessionId === 'function' && sessionId === deps.getSessionId()
+      && typeof deps.getItems === 'function' && Array.isArray(deps.getItems())
+      ? deps.getItems() : [];
+    var index = items.findIndex(function(item) {
+      return item && String(item._submissionClientMessageId || '') === clientMessageId;
+    });
+    if (index < 0) {
+      // A record the queue panel produced belongs to the panel: with no exact current item there is
+      // nothing this route may send, and it must NEVER fall back to a manager resend -- that would
+      // mint a fresh identity for a prompt the panel still owns (or send it into another session).
+      if (String(record.source || '') === 'queue-panel') return Promise.resolve(false);
+      var pending = manager.resend(clientMessageId, {
+        confirmUncertain: confirmed,
+      });
+      // resend() refuses outright, or registers its successor synchronously before returning. The
+      // original only disappears once that controlled successor really exists, so a refused
+      // preflight leaves the preserved text exactly where it was.
+      var superseded = Array.from(manager.records.values()).some(function(candidate) {
+        return candidate && String(candidate.supersedesClientMessageId || '') === clientMessageId;
+      });
+      if (!superseded) return pending;
+      manager.dismiss(clientMessageId);
+      return Promise.resolve(true);
+    }
+    return Promise.resolve(deps.resendItem(index)).then(function(dispatched) {
+      // The stale manager row retires only after the controlled successor has started.
+      if (dispatched) manager.dismiss(clientMessageId);
+      return dispatched === true;
+    });
+  }
+
+  // ---------------------------------------------------------------------------
+  // R7 (AC-1e, WP-1 fix): the review surface for a queue item whose last attempt is uncertain.
+  // "Send Next" used to open the edit box for such an item, which was a dead end: saving unchanged
+  // text does not clear lastAttempt/the dead id, so the next Send Next reopened it forever. The
+  // queue-owned review below is the explicit confirmation path instead, and it works for a
+  // preserved item after a reload -- the manager may hold no record for it at all.
+  // ---------------------------------------------------------------------------
+
+  var REVIEW_WARNING = 'CTM could not confirm what happened to this prompt.';
+
+  // The first pending item whose failure verdict is `review`, i.e. the first item Send Next must
+  // NOT dispatch. Scanned from the pending set so an auto/multi-item queue POST cannot bypass it.
+  function pendingReviewItem(items) {
+    if (!Array.isArray(items)) return null;
+    for (var index = 0; index < items.length; index += 1) {
+      var item = items[index];
+      if (!item || item._forceResend === true) continue;
+      if (!String(item._submissionClientMessageId || '')) continue;
+      if (String(item.status || 'pending').toLowerCase() === 'sent') continue;
+      if (itemRecoveryPolicy(item) !== 'review') continue;
+      return { index: index, item: item };
+    }
+    return null;
+  }
+
+  // A READ-ONLY snapshot of the exact live item: the prompt the user typed, its attachments and the
+  // server's own warning. Nothing is written back onto the item (no review-authority flag survives a
+  // reload) and nothing is dispatched from here.
+  function buildReviewRecord(item, deps) {
+    var lastAttempt = item && item.lastAttempt ? item.lastAttempt : null;
+    return {
+      clientMessageId: String(item && item._submissionClientMessageId || ''),
+      sessionId: deps && typeof deps.getSessionId === 'function' ? String(deps.getSessionId() || '') : '',
+      source: 'queue-panel',
+      status: 'needs_attention',
+      reason: String((lastAttempt && lastAttempt.reason) || 'review_required'),
+      message: String((lastAttempt && lastAttempt.message) || REVIEW_WARNING),
+      text: String(item && item.text || ''),
+      images: item && Array.isArray(item.images) ? item.images.slice() : [],
+      recoveryAction: 'review',
+      retryable: false,
+      reviewOnly: true,
+    };
+  }
+
+  // The surface's lifetime: the manager identity, the selected session, the exact items array and
+  // the exact original item all have to still be the ones the review was opened for. Captured here,
+  // never re-read from live state at click time -- and the id is never authority on its own.
+  function createReviewGuard(record, item, deps) {
+    var manager = typeof deps.getManager === 'function' ? deps.getManager() : null;
+    var items = typeof deps.getItems === 'function' ? deps.getItems() : null;
+    var sessionId = typeof deps.getSessionId === 'function' ? String(deps.getSessionId() || '') : '';
+    var originalId = String((record && record.clientMessageId) || '');
+    return function isCurrent(candidate) {
+      if (typeof deps.getManager === 'function' && deps.getManager() !== manager) return false;
+      if (typeof deps.getSessionId === 'function' && String(deps.getSessionId() || '') !== sessionId) return false;
+      if (typeof deps.getItems === 'function' && deps.getItems() !== items) return false;
+      if (String((candidate && candidate.clientMessageId) || '') !== originalId) return false;
+      if (!Array.isArray(items) || items.indexOf(item) < 0) return false;
+      return String(item._submissionClientMessageId || '') === originalId;
+    };
+  }
+
+  // Opens the explicit review surface for the first review-blocked pending item. `deps.renderReview`
+  // is the renderer (the tray module owns the DOM) and receives the read-only record plus the
+  // lifetime predicate above; its confirmation travels back through routeTrayRecovery, so the only
+  // thing that can drop the dead identity is the existing owner-fenced resendItem.
+  function openItemReview(items, deps) {
+    deps = deps || {};
+    var candidate = pendingReviewItem(items);
+    if (!candidate) return false;
+    var record = buildReviewRecord(candidate.item, deps);
+    var isCurrent = createReviewGuard(record, candidate.item, deps);
+    if (!isCurrent(record)) return false;
+    if (typeof deps.notify === 'function') {
+      deps.notify(String((candidate.item.lastAttempt && candidate.item.lastAttempt.message) || ''));
+    }
+    if (typeof deps.renderReview === 'function') deps.renderReview(record, isCurrent);
+    return true;
+  }
+
   return {
     buildSubmissionLookupQuery: buildSubmissionLookupQuery,
+    buildReviewRecord: buildReviewRecord,
+    createReviewGuard: createReviewGuard,
+    itemRecoveryPolicy: itemRecoveryPolicy,
     markItemSentById: markItemSentById,
+    normalizeRecoveryAction: normalizeRecoveryAction,
+    openItemReview: openItemReview,
+    pendingReviewItem: pendingReviewItem,
     reconcileSubmissionRows: reconcileSubmissionRows,
     reconcileSubmissionStatus: reconcileSubmissionStatus,
+    routeTrayRecovery: routeTrayRecovery,
   };
 });

package/template/coding-task-manager/public/js/reviews.js

@@ -859,6 +859,8 @@ CR.openSessionForProject = function() {
       args: [],
       cwd: projectPath,
       label: projectPath.replace(/^.*\//, '') + ' (review)',
+      // D-13: a review session's name is composed here, so it is a default (tier 3), not a rename.
+      titleIntent: 'default',
     });
     if (typeof window.toast === 'function') {
       window.toast('Starting Claude session at ' + projectPath.replace(/^.*\//, ''), { type: 'success' });
@@ -1425,9 +1427,10 @@ function _crumbDir(relPath) {
 
 // R-5: the review chat is no longer a sidebar — it is the Wall-E chat's review
 // thread (`review-<ctmSessionId>`). One button opens it on the WALL-E tab; the
-// server ensures the thread row on the first message.
+// server ensures the thread row on the first message. The label is its own span
+// so the one-line doc header can show the icon alone (reviews.css).
 function _chatToggleHTML() {
-  return `<button class="cr-chat-toggle" onclick="CR.toggleChat()" title="Discuss this review in the Wall-E chat (Cmd+Shift+C)" id="cr-chat-toggle-btn">&#x1F4AC; Discuss in Wall-E chat</button>`;
+  return `<button class="cr-chat-toggle" onclick="CR.toggleChat()" title="Discuss this review in the Wall-E chat (Cmd+Shift+C)" aria-label="Discuss in Wall-E chat" id="cr-chat-toggle-btn">&#x1F4AC;<span class="cr-chat-toggle-label"> Discuss in Wall-E chat</span></button>`;
 }
 
 function renderDocHeader() {
@@ -3013,7 +3016,8 @@ function _createSessionAndSendReview(prompt) {
     window.toast('Creating new Claude session...', { type: 'info' });
   }
 
-  window.send({ type: 'create', id: sessionId, cmd: 'claude', args: [], cwd, label: label.slice(0, 60) });
+  // D-13: `Code Review:`/`Doc Review:` is CTM-composed — mark it default so it lands tier 3.
+  window.send({ type: 'create', id: sessionId, cmd: 'claude', args: [], cwd, label: label.slice(0, 60), titleIntent: 'default' });
 
   setTimeout(() => {
     if (_pendingReviewSend?.sessionId === sessionId) {

package/template/coding-task-manager/public/js/root-draft-lifetime.js

@@ -14,6 +14,10 @@
     const requests = new WeakMap();
     const contexts = new WeakMap();
     const imageUploads = new WeakMap();
+    const unmatchedPublications = new WeakMap();
+    // Bounded like every other retained-evidence store here: newest version per durable attachment
+    // id, oldest entry evicted past the cap. A session has at most a handful of drafts in flight.
+    const UNMATCHED_PUBLICATION_LIMIT = 16;
     const activeById = new Map();
 
     // Same rule as Draft.stateVersionOf (§6: a lifecycle integer is never coerced from a
@@ -92,6 +96,11 @@
         for (const reservation of [...uploads.values()]) disposeImageUpload(reservation);
         uploads.clear();
       }
+      // Same rule for a publication retained for an attachment this context had no row for: an
+      // in-app retirement is revocation, not a licence to keep applying server truth to a dead
+      // draft (the map is keyed by the context, so this also drops the last reference early).
+      const retainedUnmatched = unmatchedPublications.get(context);
+      if (retainedUnmatched) retainedUnmatched.clear();
       const attachments = context.draft && Array.isArray(context.draft.attachments)
         ? context.draft.attachments : [];
       for (const attachment of attachments) {
@@ -269,6 +278,89 @@
       return true;
     }
 
+    function unmatchedPublicationsOf(context) {
+      let map = unmatchedPublications.get(context);
+      if (!map) { map = new Map(); unmatchedPublications.set(context, map); }
+      return map;
+    }
+
+    // A client that has never seen this draft before -- the normal shape after a page reload, or a
+    // second tab opened on a session with a durable draft -- learns its rows from the restore LIST,
+    // but the server starts publishing the moment the row commits. A publication that arrives
+    // before that list has been applied therefore has NO row to join (`onTerminalImageDraftState`'s
+    // correlation finds nothing), and dropping it there left the restored chip frozen on the list's
+    // OLDER state -- typically `delivery_pending` -> 'attaching' -- while the terminal publication
+    // had in fact already arrived, so the chip showed "Attached ✓" (from the local client hint) over
+    // `data-status="attaching"` forever. Retain it instead, fenced by the CAPTURED context (session)
+    // and the publication's own durable attachment id, and consume it exactly once from the restore
+    // that creates the row.
+    //
+    // The list stays the EXISTENCE authority: an attachment the server never lists never gains a
+    // row, so a retained publication can never resurrect a chip the user dismissed or one that was
+    // retired by a submitted snapshot. Identity is validated here with what is honestly known
+    // without a row (session + durable id); the restore re-validates the full identity (owner,
+    // and for a local row its request id) before adopting.
+    function retainUnmatchedPublication(context, snapshot, hint) {
+      if (!current(context) || !snapshot || typeof snapshot !== 'object') return false;
+      const version = lifecycleVersion(snapshot.stateVersion);
+      if (version === null || !isCanonicalState(String(snapshot.state || ''))) return false;
+      const attachmentId = String(snapshot.attachmentId || '');
+      if (!attachmentId) return false;
+      if (!DraftApi || !DraftApi.validateServerSnapshot(snapshot, {
+        sessionId: context.id, attachmentId, ownerHostId: String(snapshot.ownerHostId || ''),
+      }).ok) return false;
+      const map = unmatchedPublicationsOf(context);
+      const retained = map.get(attachmentId);
+      if (retained && version < retained.version) return true;
+      if (retained && version === retained.version
+        && DraftApi.canonicalSnapshotsEqual(retained.snapshot, snapshot)) return true;
+      const copy = {};
+      for (const key of Object.keys(snapshot)) {
+        if (key === 'hint' || key === 'type' || key === 'timestamp') continue;
+        copy[key] = snapshot[key];
+      }
+      map.delete(attachmentId);
+      map.set(attachmentId, {
+        snapshot: copy,
+        hint: _retainedHint(null, hint, version, String(snapshot.deliveryAttemptId || '')),
+        version,
+      });
+      while (map.size > UNMATCHED_PUBLICATION_LIMIT) {
+        const oldest = map.keys().next();
+        if (oldest.done) break;
+        map.delete(oldest.value);
+      }
+      return true;
+    }
+
+    // Read-only observability for the bounded-work contract: never allocates, reports 0 for an
+    // unknown/retired context.
+    function unmatchedPublicationCount(context) {
+      if (!current(context)) return 0;
+      const map = unmatchedPublications.get(context);
+      return map ? map.size : 0;
+    }
+
+    // The consuming half, called from `mergeServerSnapshot` once the restore list has given the
+    // attachment a row: the retained publication is newer server truth for that durable id, so it
+    // is ADOPTED (never a local transition) under the restore's own identity envelope. Consumed
+    // exactly once -- the entry is dropped whether or not it was newer than the list row -- so a
+    // later restore cannot replay it. Returns whether the row changed.
+    function applyUnmatchedPublication(context, attachment, identity) {
+      if (!current(context) || !attachment) return false;
+      const attachmentId = String(attachment.attachmentId || '');
+      if (!attachmentId) return false;
+      const map = unmatchedPublications.get(context);
+      const retained = map && map.get(attachmentId);
+      if (!retained) return false;
+      map.delete(attachmentId);
+      const rowVersion = DraftApi && typeof DraftApi.stateVersionOf === 'function'
+        ? DraftApi.stateVersionOf(attachment.stateVersion) : null;
+      if (rowVersion !== null && retained.version <= rowVersion) return false;
+      return DraftApi.adoptServerSnapshot(context.draft, attachment.clientId, retained.snapshot,
+        retained.hint, { ...identity, attachmentId }) === true;
+    }
+
     // §6/AC-3 + review finding 1: choose the newest VALID canonical snapshot among the verified
     // HTTP metadata, the retained publication and the already-adopted watermark; bind the verified
     // durable ID and adopt atomically. Outcomes (callers never guess whether a rejection is the
@@ -395,6 +487,43 @@
       throw lastError || new Error('Request failed');
     }
 
+    // A DELETE is owned by its captured root. Aborting it does not undo server-side work.
+    async function deleteServerDraft({ id, attachment, options = {}, context, token, retry, isCurrent }) {
+      const live = () => Boolean(context) && contexts.get(context.draft) === context
+        && current(context) && context.id === id && (typeof isCurrent !== 'function' || isCurrent() === true);
+      if (!live()) return false;
+      const clientId = String(attachment?.clientId || '');
+      const attachmentId = String(attachment?.attachmentId || '');
+      const etag = String(attachment?.etag || '');
+      const base = '/api/sessions/' + encodeURIComponent(id) + '/image-drafts';
+      const requestToken = encodeURIComponent(String(token || ''));
+      let url;
+      let headers;
+      if (!attachmentId) {
+        if (!options.cancelRequest || !clientId) return true;
+        url = base + '?request_id=' + encodeURIComponent(clientId) + '&purge=1&token=' + requestToken;
+      } else {
+        url = base + '/' + encodeURIComponent(attachmentId) + '?token=' + requestToken
+          + (options.purge === true ? '&purge=1' : '');
+        headers = etag ? { 'If-Match': etag } : {};
+      }
+      if (typeof retry !== 'function') return false;
+      try {
+        const result = await request(context, async signal => {
+          if (!live()) return false;
+          const response = await retry(url, { method: 'DELETE', ...(headers ? { headers } : {}), signal },
+            { attempts: 3, isCurrent: live });
+          if (!response || !live()) return false;
+          if (!response.ok && response.status !== 404) throw new Error('HTTP ' + response.status);
+          return true;
+        });
+        return result === true && live();
+      } catch (error) {
+        if (!live()) return false;
+        throw error;
+      }
+    }
+
     async function completeDelivery({ id, attachment, attemptId, outcome, reason, providerOrdinal, diagnostics,
       context, token, getToken, fetchFn, retry }) {
       const isCurrent = () => attachmentCurrent(context, id, context && context.draft, attachment);
@@ -528,6 +657,10 @@
             Draft.adoptServerSnapshot(draft, existing.clientId, item, null, identity);
             if (existing._serverSnapshotInvalid || existing._serverSnapshotConflict
               || existing._serverIdentityMismatch || existing._serverSnapshotStale !== undefined) continue;
+            // B9: a publication that arrived before this restore gave the attachment a row is
+            // NEWER server truth for the same durable id, so it is adopted before the row is
+            // decorated/published rather than being lost to the ordering.
+            applyUnmatchedPublication(context, existing, identity);
             const rawPreview = existing.canonicalPreviewUrl;
             if (typeof rawPreview === 'string') existing.previewUrl = previewUrlFor({ previewUrl: rawPreview });
             Draft.reactivateWriteProof(existing, { ...identity, deliveryAttemptId: String(existing.deliveryAttemptId || '') });
@@ -541,6 +674,9 @@
               Draft.removeAttachment(draft, added.clientId);
               continue;
             }
+            // The restore is the ONLY writer of a `server_` row, and the row now exists: this is
+            // where a publication retained while it was missing is consumed (B9).
+            applyUnmatchedPublication(context, added, identity);
             added.previewUrl = previewUrlFor({ previewUrl: added.canonicalPreviewUrl });
             byServerId.set(serverId, added);
             if (added.status === 'ready' && item.state === 'ready') attachAfterRestore.push(added);
@@ -595,9 +731,10 @@
     }
 
     return Object.freeze({ capture, createDraft, current, attachmentCurrent, retire: dispose, request,
-      fetchWithRetry, completeDelivery, readDraftImage, schedule, clear, mergeServerSnapshot,
+      fetchWithRetry, completeDelivery, readDraftImage, schedule, clear, mergeServerSnapshot, deleteServerDraft,
       registerRequest, releaseRequest, reserveImageUpload, imageUploadReservation,
-      retainImagePublication, finishImageUpload, resetImageHints, disposeImageUpload, imageUploadCount });
+      retainImagePublication, finishImageUpload, resetImageHints, disposeImageUpload, imageUploadCount,
+      retainUnmatchedPublication, applyUnmatchedPublication, unmatchedPublicationCount });
   }
 
   return Object.freeze({ createRootDraftLifetime });

package/template/coding-task-manager/public/js/root-queue-builder-lifetime.js

@@ -17,6 +17,14 @@
     const leaseRegistries = new WeakMap();
     const cleanupFailures = [];
     let droppedCleanupFailures = 0;
+    // WP-1 (C4, AC-1d): exactly ONE replacement gesture per session at a time. Both the
+    // row's ↻ and the tray's recovery reach resendItem, and a double click runs it twice
+    // before either await returns. The second run must be refused HERE -- before the
+    // async verify and before the ID deletion below -- because sendQueueFromPanel's
+    // _qpManualSendInFlight is only consulted after the old identity is already gone, so
+    // it cannot stop the second gesture from minting a second replacement. A lock whose
+    // owner has retired or gone stale is reclaimed instead of blocking forever.
+    let resendGesture = null;
 
     function rememberCleanupFailure(phase) {
       if (cleanupFailures.length < 8) cleanupFailures.push(phase);
@@ -482,6 +490,13 @@
       });
       if (!captured) return false;
       const { view, action } = captured;
+      if (resendGesture && resendGesture.sessionId === sessionId && current(resendGesture.action)) {
+        finish(action);
+        finish(view);
+        return false;
+      }
+      const gesture = { sessionId, action };
+      resendGesture = gesture;
       try {
         if (!await verify(action) || !current(action) || action.loadingAtClick === true
           || action.visibleSessionAtClick !== sessionId || !Array.isArray(action.items)
@@ -500,6 +515,7 @@
         if (current(action) && dependencies.getVisibleSession?.() === sessionId) dependencies.onError?.();
         return false;
       } finally {
+        if (resendGesture === gesture) resendGesture = null;
         finish(action);
         finish(view);
       }

package/template/coding-task-manager/public/js/row-join.js

@@ -24,12 +24,14 @@
   // first row in the transcript, never for what gets painted. R-11: a turn-end STATUS row (`✻ Worked for 18s · done 4:35 PM`)
   // carries NO words at all -- its verb is one Claude picks at random (`Worked`, `Brewed`, ...) and its elapsed seconds are the
   // terminal's own clock (observed live `16s` against the transcript's `17s`), so the transcript cannot hold them; only a row
-  // that is ENTIRELY that shape is dropped, and every other row keeps its words.
+  // that is ENTIRELY that shape is dropped, and every other row keeps its words. A blockquote's bar is decoration too: Claude's
+  // live screen draws it `▎` (U+258E) where the transcript's own rendering draws `│` (observed 2026-10-24: a kept `▎` made the
+  // quoted rows owe a word the transcript never holds, so the proof refused and 21 live rows stayed duplicated as an overlap).
   function cutWordsOf(text) {
     const plain = stripForCompare(text);
     if (/^\s*[^\s\p{L}\p{N}]\s+\p{L}+\s+for\s+(?:\d+[hms]\s*)+(?:·\s*done\s+\d{1,2}:\d{2}\s*[AP]M)?\s*$/u.test(plain)) return [];
     return plain
-      .replace(/[|\u2500\u2501\u2502\u250c\u2510\u2514\u2518\u251c\u2524\u252c\u2534\u253c\u2550\u2026]/g, ' ')
+      .replace(/[|\u2500\u2501\u2502\u250c\u2510\u2514\u2518\u251c\u2524\u252c\u2534\u253c\u2550\u2026\u258e]/g, ' ')
       .split(/\s+/)
       .flatMap((token) => token.split(/(?<=[\p{L}\p{N}]-)(?=[\p{L}\p{N}])/u))
       .filter(Boolean);
@@ -40,6 +42,17 @@
   // (R-1), and a prose row such as "Updated 2 tests" must keep owing its words there (R-3).
   const LIVE_CHROME = /^\s*(?:⎿|✻\s|─{4,}|·\s*task notification|⏺\s+(?:MCP task\b|Background command\b|Called\b|Ran\b|Searched\b|Listed\b|Read\b.*\(\d+ lines\)|Edited\b|Wrote\b)|(?:Ran|Searched for|Listed|Called|Read|Fetched|Wrote|Added|Updated)\b[^|]*\b\d|Referenced file\b|Skills restored\b|Compacted\b)/u;
   function isLiveChrome(row) { return LIVE_CHROME.test(stripForCompare(row)); }
+  // seam-proof-r3 R-3 (WP-3): Codex's PINNED PROMPT HEADER, the one presentation-only row the TUI draws at the very top of the
+  // transcript view when the user's prompt itself has scrolled above the viewport -- `› ` (U+203A, a space) then that prompt,
+  // whitespace-collapsed and truncated with `…` (codex-rs/tui/src/transcript_view/prompt_header.rs: "The header is never transcript
+  // content, so copying, searching and exporting stay exact"; the TUI pins exactly one row, at the top, and only then). CTM's
+  // recorder infers pins from motion and can report `ref.pinned` 0 on such a screen, so the client's slice keeps the row and the
+  // join would take it for the live screen's first CONTENT row: it then owes the prompt's words, its coverage walk lands on the
+  // transcript's own prompt row, and the loss guard refuses over every row the screen between them never drew (field incident
+  // f04c2864, 2026-10-19: none/loss, five rows drawn twice). Live row 0 matching this shape is therefore treated as a BLANK row --
+  // index 0 only, live side only, transcript rows untouched -- and a wordless row can never hide content (R-2). Only U+203A marks
+  // the header: Claude draws `❯`, so a Claude screen is unaffected, and every other row beginning `› ` keeps its words.
+  const CODEX_PROMPT_HEADER = /^› /u;
   // Where the live screen's rows begin in the transcript, by WORDS (R-5..R-7): T = stripped transcript rows, firstT = the twin's
   // transcript index (the live screen's row `liveRow`), liveTop = the stripped live rows [0, liveRow). N = the multiset of the live
   // rows' cut words; walking up from firstT - 1, r0 is the first row whose words (with everything below it) cover N. A row between
@@ -170,6 +183,7 @@
     const paintedRows = ((painted && painted.rows) || []).map(stripForCompare);
     const from = painted ? Number(painted.from) || 0 : 0;
     const live = (liveRows || []).map(stripForCompare);
+    if (live.length && CODEX_PROMPT_HEADER.test(live[0])) live[0] = ''; // R-3: Codex's pinned prompt header is presentation-only, never content
     const P = paintedRows.concat(live);
     const top = from + paintedRows.length;
     const allowance = Number.isSafeInteger(appBelow) && appBelow > 0 ? appBelow : 0; // R-F2/R-F5: only a positive measured count opens the window
@@ -407,6 +421,7 @@
   function landingDiag(transcriptRows, liveRows, transcriptKinds) {
     const T = (transcriptRows || []).map(stripForCompare);
     const live = (liveRows || []).map(stripForCompare);
+    if (live.length && CODEX_PROMPT_HEADER.test(live[0])) live[0] = ''; // R-3: the same header row is no `dup` and no known row (S-8)
     const kinds = Array.isArray(transcriptKinds) ? transcriptKinds : null;
     const isE = (i) => !kinds || kinds[i] === 'text' || kinds[i] === 'prompt';
     const TW = T.map((row, i) => (isE(i) ? cutWordsOf(row) : []));
@@ -440,5 +455,5 @@
     return { dup, blk: classes.join(','), why: w ? 'cut' : why.rule, lossAt: loss ? T.length - why.at : null, lossCls: loss ? diagClass(T[why.at]) : '' };
   }
 
-  return Object.freeze({ RUN_ROWS, RUN_NONBLANK, RUN_MIN_CHARS, PARAGRAPH_KEY_MIN_CHARS, stripForCompare, runKeys, findJoin, anchorChain, cutWordsOf, wordCut, tailWordCut, landingDiag, LIVE_CHROME, isLiveChrome });
+  return Object.freeze({ RUN_ROWS, RUN_NONBLANK, RUN_MIN_CHARS, PARAGRAPH_KEY_MIN_CHARS, stripForCompare, runKeys, findJoin, anchorChain, cutWordsOf, wordCut, tailWordCut, landingDiag, LIVE_CHROME, isLiveChrome, CODEX_PROMPT_HEADER });
 });

package/template/coding-task-manager/public/js/session-model-picker.js

@@ -801,6 +801,7 @@
   }
 
   function leadNote(agent) {
+    if (agent === 'claude') return 'Same Claude session: your history continues here, and the next completed turn confirms this model.';
     return 'History moves only after source and target compatibility is verified. A native fork uses a new provider thread; the next completed root turn confirms the target.';
   }
 
@@ -1497,7 +1498,6 @@
       if (typeof row.data.context_window === 'number' && row.data.context_window > 0) {
         pane.appendChild(textLine('walle-model-effort-note', 'Context window: ' + row.data.context_window.toLocaleString('en-US') + ' tokens'));
       }
-      pane.appendChild(textLine('walle-model-effort-note', 'History is carried forward only after source and target compatibility is verified. A native fork uses a new provider thread.'));
       // R-6: the same Route line the Delegate pane has — the routed row's route is choosable.
       appendRouteLine(pane, row.data, { onRoutes: lead && lead.onRoutes });
     } else {

package/template/coding-task-manager/public/js/session-search-utils.js

@@ -105,6 +105,18 @@
     return normalizedValue ? normalizedValue.split(/\s+/).filter(Boolean) : [];
   }
 
+  // D-1/D-3 of the separator-ranking design (docs/session-search-separator-
+  // ranking-2026-10-24.html §6): slash and backslash are component boundaries
+  // for the non-exact evidence grades, so "resume/hung" contributes whole-word
+  // evidence for "resume" instead of one stem-exempt token. Hyphens,
+  // underscores, dots and digits stay inside a component. Contract: ordered
+  // string[], duplicates and order retained, no empty strings. The raw
+  // whitespace representation above is deliberately NOT changed -- it still
+  // decides the exact / stem-exact / legacy-command branches.
+  function titleComponentTokens(normalizedValue) {
+    return String(normalizedValue || '').split(/[\s/\\]+/u).filter(Boolean);
+  }
+
   const TITLE_GRADE_NONE_RESULT = Object.freeze({
     grade: TITLE_GRADE.NONE,
     rank: TITLE_GRADE_RANK.none,
@@ -171,48 +183,63 @@
       };
     }
 
+    // D-1/D-3: only after both raw equality branches have failed do the
+    // evidence grades run, and they run on separator components (the same
+    // helper for title and query) rather than on the raw whitespace tokens.
+    // Component arrays keep repetition and order; the score denominator is the
+    // component count only, never raw tokens plus components.
+    const titleComponents = titleComponentTokens(normalizedTitle);
+    const queryComponents = titleComponentTokens(normalizedQuery);
+    if (!titleComponents.length || !queryComponents.length) return TITLE_GRADE_NONE_RESULT;
+
+    const componentCount = titleComponents.length;
+    const queryComponentCount = queryComponents.length;
+    const titleComponentForms = titleComponents.map(titleTokenForm);
+    const queryComponentForms = queryComponents.map(titleTokenForm);
+
     const minPrefixLen = TITLE_SCORE_WEIGHTS.MIN_PREFIX_LEN;
-    const wordHit = (queryForm) => titleForms.includes(queryForm);
-    const prefixHit = (queryTok) => queryTok.length >= minPrefixLen && titleToks.some(t => t.startsWith(queryTok));
-    const containsHit = (queryTok) => titleToks.some(t => t.includes(queryTok));
+    const wordHit = (queryForm) => titleComponentForms.includes(queryForm);
+    const prefixHit = (queryTok) => queryTok.length >= minPrefixLen
+      && titleComponents.some(t => t.startsWith(queryTok));
+    const containsHit = (queryTok) => titleComponents.some(t => t.includes(queryTok));
 
-    const wordAll = queryForms.every(wordHit);
-    const prefixAll = !wordAll && queryToks.every(prefixHit);
-    const containsAll = !wordAll && !prefixAll && queryToks.every(containsHit);
+    const wordAll = queryComponentForms.every(wordHit);
+    const prefixAll = !wordAll && queryComponents.every(prefixHit);
+    const containsAll = !wordAll && !prefixAll && queryComponents.every(containsHit);
 
     let grade;
     let matchTest;
     if (wordAll) {
       grade = TITLE_GRADE.WORD;
-      matchTest = (token, form) => queryForms.includes(form);
+      matchTest = (token, form) => queryComponentForms.includes(form);
     } else if (prefixAll) {
       grade = TITLE_GRADE.PREFIX;
-      matchTest = (token) => queryToks.some(q => q.length >= minPrefixLen && token.startsWith(q));
+      matchTest = (token) => queryComponents.some(q => q.length >= minPrefixLen && token.startsWith(q));
     } else if (containsAll) {
       grade = TITLE_GRADE.CONTAINS;
-      matchTest = (token) => queryToks.some(q => token.includes(q));
+      matchTest = (token) => queryComponents.some(q => token.includes(q));
     } else {
-      const anyPartial = queryToks.some((queryTok, index) => (
-        wordHit(queryForms[index]) || prefixHit(queryTok) || containsHit(queryTok)
+      const anyPartial = queryComponents.some((queryTok, index) => (
+        wordHit(queryComponentForms[index]) || prefixHit(queryTok) || containsHit(queryTok)
       ));
       grade = anyPartial ? TITLE_GRADE.PARTIAL : TITLE_GRADE.NONE;
-      matchTest = (token, form) => queryForms.includes(form)
-        || queryToks.some(q => (q.length >= minPrefixLen && token.startsWith(q)) || token.includes(q));
+      matchTest = (token, form) => queryComponentForms.includes(form)
+        || queryComponents.some(q => (q.length >= minPrefixLen && token.startsWith(q)) || token.includes(q));
     }
 
     let matchedTitleTokens = 0;
     let firstMatchedIndex = -1;
     if (grade !== TITLE_GRADE.NONE) {
-      titleToks.forEach((token, index) => {
-        if (matchTest(token, titleForms[index])) {
+      titleComponents.forEach((token, index) => {
+        if (matchTest(token, titleComponentForms[index])) {
           matchedTitleTokens += 1;
           if (firstMatchedIndex === -1) firstMatchedIndex = index;
         }
       });
     }
 
-    const coverage = titleTokenCount ? matchedTitleTokens / titleTokenCount : 0;
-    const position = firstMatchedIndex === -1 ? 0 : 1 - (firstMatchedIndex / titleTokenCount);
+    const coverage = componentCount ? matchedTitleTokens / componentCount : 0;
+    const position = firstMatchedIndex === -1 ? 0 : 1 - (firstMatchedIndex / componentCount);
     const score = TITLE_GRADE_BASE[grade] + TITLE_SCORE_WEIGHTS.COVERAGE * coverage + TITLE_SCORE_WEIGHTS.POSITION * position;
 
     return {
@@ -222,8 +249,8 @@
       position,
       score,
       matchedTitleTokens,
-      titleTokens: titleTokenCount,
-      queryTokens: queryTokenCount,
+      titleTokens: componentCount,
+      queryTokens: queryComponentCount,
     };
   }