create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/js/session-usage-view.js

@@ -19,6 +19,7 @@
     native_prompt_unresolved: 'Native turn has no matching human prompt',
     native_spawn_unresolved: 'Parent link not recorded',
     native_spawn_ambiguous: 'Parent link is ambiguous',
+    native_spawn_missing: 'Subagent spawn record missing',
     native_agent_cycle: 'Agent parent links form a cycle',
     delegation_edge_missing: 'Worker launch not recorded in the lead transcript',
     delegation_edge_ambiguous: 'Worker launch matches several lead prompts',

package/template/coding-task-manager/public/js/state-sync-client.js

@@ -125,6 +125,10 @@
     if (!ok) return { painted: null, invalid: true };
     const base = { epoch: p.epoch, top: p.top, pinned: p.pinned, floor: p.floor, revision: p.revision, breaks: Object.freeze(breaks.map((b) => Object.freeze({ at: b.at, reason: b.reason }))), below: Number.isSafeInteger(p.below) && p.below > 0 ? p.below : 0 }; // R-F2: rows the app holds below its screen; an older host omits it (0), and it is never a rejection reason
     if (p.revisedFrom !== undefined) base.revisedFrom = p.revisedFrom;
+    // Clock-free tests (WP-6): the recorder's observe count and its uncommitted hold pass through (HistoryPaintedRows publishes them);
+    // an older host sends neither, and a malformed value is dropped, never a rejection reason.
+    if (integer(p.samples) && p.samples >= 0) base.samples = p.samples;
+    if (p.hold && typeof p.hold === 'object' && integer(p.hold.rows)) base.hold = Object.freeze({ kind: typeof p.hold.kind === 'string' ? p.hold.kind : null, rows: p.hold.rows, top: integer(p.hold.top) ? p.hold.top : null });
     return { painted: Object.freeze(withRows ? { ...base, from: p.from, rows: Object.freeze(p.rows.slice()) } : base), invalid: false };
   }
 

package/template/coding-task-manager/public/js/terminal/runtime-02.js

@@ -81,12 +81,15 @@ function _onTerminalGeometryClaimAckV2(msg) {
     s._sessionGeometryRuntime?.setQueued(true);
     // A correction fit has already resized the local xterm to the proposed
     // grid, but a queued ACK proves the PTY is still on the incumbent grid.
-    // Roll the presentation back immediately; the exact target proof remains
-    // in the ledger and the server's queued claim for the later terminal ACK.
+    // Roll the presentation back immediately. WP-1 (docs/codex-terminal-geometry-sticky-cols-
+    // 2026-10-24.html; tests/geometry-queued-rollback.test.js): the rollback is presentation only
+    // and records no measurement, so the queued claim's proof stays the ledger's current proof and
+    // the server's bounded replay can commit it. Recording here replaced that proof (single-slot
+    // ledger), and the replay was rejected `measurement-stale` -- the widening never committed.
     const committedCols = Number(msg.committedGrid?.cols || 0);
     const committedRows = Number(msg.committedGrid?.rows || 0);
     if (s._terminalGeometryPendingResizeV2 && committedCols > 0 && committedRows > 0) {
-      _applyTerminalActivationGrid(s, { cols: committedCols, rows: committedRows });
+      _applyTerminalActivationGrid(s, { cols: committedCols, rows: committedRows }, undefined, { recordMeasurement: false });
     }
     _syncTerminalInputOwnership(s, _resumeStateForSession(s));
     return false;
@@ -1313,15 +1316,21 @@ function _syncCodexActiveComposerGeometry(s, id, reason, opts) {
     }
   }
 
+  // G-4 (D-2): report the grid xterm HOLDS after the resize above, never the proposal. The local
+  // agent-TUI cols pin refuses a narrower proposal, so `cols`/`rows` are often not what the client
+  // ended up with -- and `_sendTerminalResizeIfChanged` puts opts.cols on the wire verbatim, which
+  // would tell the server to resize its PTY to a width this client does not hold.
+  const heldCols = Number(s.term.cols) || currentCols;
+  const heldRows = Number(s.term.rows) || currentRows;
   const sent = _sendTerminalResizeIfChanged(s, id, reason || 'codex-active-composer-geometry', {
-    cols: allowTermResize ? cols : currentCols,
-    rows: allowTermResize ? rows : currentRows,
+    cols: allowTermResize ? heldCols : currentCols,
+    rows: allowTermResize ? heldRows : currentRows,
   });
   if (resizeNeeded || sent) {
     s._codexActiveComposerGeometrySyncedAt = now;
     s._codexActiveComposerGeometrySyncReason = reason || 'codex-active-composer-geometry';
-    s._codexActiveComposerGeometrySyncedCols = allowTermResize ? cols : currentCols;
-    s._codexActiveComposerGeometrySyncedRows = allowTermResize ? rows : currentRows;
+    s._codexActiveComposerGeometrySyncedCols = allowTermResize ? heldCols : currentCols;
+    s._codexActiveComposerGeometrySyncedRows = allowTermResize ? heldRows : currentRows;
   }
   return !!(resizeNeeded || sent);
 }

package/template/coding-task-manager/public/js/terminal/runtime-03.js

@@ -22,6 +22,46 @@ function _reportReadinessViolationOnce(s, kind, since, gates, extraDetails) {
   _reportResumeBeacon('readiness-violation', s._id, since, { kind, gates: gates || [], ...(extraDetails || {}) });
 }
 
+// WP-4a (§5 OQ-4, §6, S-21): the durable cover-over-content row recorded only gates=[], so a cover
+// that outlived its session by ~11 min could not be attributed. This snapshot names the three
+// candidate holders beside the mounted element: H-A storeLifecycle null/'active' with an overlay
+// still in the DOM (the store forgot the session or already cleared it, so the clear is a silent
+// no-op), H-B storeLifecycle 'resume-blocked' (shared element, every dismissal refuses it),
+// H-C lastDismiss null or older than the cover (no dismissal ran). Instrumentation only: it reads
+// state and never shows, dismisses or re-mounts anything (A-9). A missing/blocked DOM or CSS.escape
+// degrades to 0/'' -- instrumentation must never be able to break the readiness sweep.
+function _coverTruthSnapshot(s) {
+  const id = String(s?._id || '');
+  let containers = [];
+  let overlaysInDom = 0;
+  let label = null;
+  try {
+    if (id && typeof document !== 'undefined' && typeof document.querySelectorAll === 'function') {
+      const escaped = typeof CSS !== 'undefined' && typeof CSS.escape === 'function' ? CSS.escape(id) : id;
+      containers = Array.from(document.querySelectorAll('.term-container[data-session-id="' + escaped + '"]'));
+    }
+    overlaysInDom = containers.reduce((n, c) => n + (c?.querySelectorAll?.(':scope > .snapshot-loading-overlay')?.length || 0), 0);
+    label = s?.container?.querySelector?.('.snapshot-loading-overlay .snapshot-loading-text') || null;
+  } catch (_) { /* expected: a missing/blocked DOM or CSS.escape must degrade the snapshot to zeros, never break the sweep */ }
+  const rs = _resumeStateForSession(s);
+  return {
+    storeLifecycle: _presentationStore.getSessionState(id)?.lifecycle ?? null,
+    termContainers: containers.length,
+    overlaysInDom,
+    labelHead: String(label?.textContent || '').slice(0, 48),
+    rsState: String(rs?.state || ''),
+    rsDismissBlocked: rs?.dismissBlocked === true,
+    restoreFlags: {
+      resumeLoading: s?.resumeLoading === true,
+      deferred: !!s?._restoreDeferred,
+      resuming: !!s?._restoreResuming,
+      starting: !!s?._restoreStarting,
+    },
+    bootstrapPending: s?._terminalBootstrapPending === true,
+    lastDismiss: s?._lastOverlayDismiss || null,
+  };
+}
+
 // Invariant: while a view is visible, blocked and not excluded, exactly one backstop is pending,
 // armed with the current epoch tuple (a re-arm on a changed tuple replaces the timer; a fire on a
 // stale tuple re-arms), so a blocked visible terminal can never be left without a rescue.
@@ -183,6 +223,7 @@ function _sweepVisibleSessionReadinessAndPaint(now) {
       if (now - s._readinessCoverContentSince >= 1000) {
         _reportReadinessViolationOnce(s, 'cover-over-content', s._readinessCoverContentSince, blockers, {
           predicate: 'cover-over-content',
+          coverTruth: _coverTruthSnapshot(s),
         });
       }
     } else {

package/template/coding-task-manager/public/js/terminal/runtime-04.js

@@ -46,7 +46,13 @@ function _terminalLocalFitProposal(s) {
   return cols > 0 && rows > 0 ? { cols, rows } : null;
 }
 
-function _applyTerminalActivationGrid(s, grid, viewportIntent) {
+// WP-1 (docs/codex-terminal-geometry-sticky-cols-2026-10-24.html): `opts.recordMeasurement: false`
+// is a PRESENTATION-ONLY adoption -- no ledger write, no claim, no bare resize report. Its one
+// caller is the queued claim-ACK rollback: the ledger is single-slot, so recording there replaced
+// the queued claim's proof and its server replay was rejected `measurement-stale`. Every other
+// caller omits `opts` and records exactly as before.
+function _applyTerminalActivationGrid(s, grid, viewportIntent, opts = {}) {
+  const recordMeasurement = opts.recordMeasurement !== false;
   const cols = Math.floor(Number(grid?.cols) || 0); const rows = Math.floor(Number(grid?.rows) || 0);
   if (!s?.term || cols < 1 || rows < 1) return false;
   if (s.term.cols === cols && s.term.rows === rows) {
@@ -55,7 +61,7 @@ function _applyTerminalActivationGrid(s, grid, viewportIntent) {
     // is already at the PTY grid (seeded there, or a repeat apply) never reaches it, never
     // gets a measurement ledger, and `_sendTerminalGeometryClaimV2` vetoes every claim on
     // the missing ledger forever (wedge-two-viewer.spec.js test 2 -- zero claim rows for B).
-    if (!s._terminalMeasurementLedger && s._id
+    if (recordMeasurement && !s._terminalMeasurementLedger && s._id
       && typeof _recordTerminalFitMeasurement === 'function'
       && typeof window !== 'undefined' && window.TerminalGeometryClaim) {
       _recordTerminalFitMeasurement(s, s._id, { cols, rows });
@@ -94,9 +100,9 @@ function _applyTerminalActivationGrid(s, grid, viewportIntent) {
     const canRecordMeasurement = !!(s._id
       && typeof _recordTerminalFitMeasurement === 'function'
       && typeof window !== 'undefined' && window.TerminalGeometryClaim);
-    if (canRecordMeasurement) {
+    if (recordMeasurement && canRecordMeasurement) {
       _recordTerminalFitMeasurement(s, s._id || '', { cols, rows });
-    } else if (typeof _sendTerminalResizeIfChanged === 'function') {
+    } else if (recordMeasurement && typeof _sendTerminalResizeIfChanged === 'function') {
       _sendTerminalResizeIfChanged(s, s._id || '', 'activation-grid-apply');
     }
   }
@@ -139,6 +145,37 @@ function _undoRefusedTerminalGridAdoption(s, cols, rows) {
   return true;
 }
 
+// WP-1 (docs/nightly-browser-tier-round2-2026-10-21.html §5 D-1, §9 G-1..G-3): the ONE
+// all-or-nothing grid-adoption primitive. Every resize whose grid the client did NOT fit itself --
+// the authoritative snapshot replay (index.html onSnapshot), the rows-only restore (runtime-19.js),
+// the dims-reassert capitulation (runtime-16.js) -- goes through here, and each caller stops on a
+// `false` (no replay of grid-relative bytes, no `_lastResizeSentCols/Rows` seed, no recorded fit).
+// Applies, reads back the grid xterm actually holds, and on mismatch restores the prior grid
+// through _undoRefusedTerminalGridAdoption. It never sends and never records a fit: reporting the
+// held grid is the caller's job (D-2), which is why callers must not report the requested values.
+function _adoptTerminalGrid(s, cols, rows, reason) {
+  if (!s || !s.term) return false;
+  const c = Math.floor(Number(cols) || 0);
+  const r = Math.floor(Number(rows) || 0);
+  if (c < 1 || r < 1) return false;
+  const priorCols = Number(s.term.cols || 0);
+  const priorRows = Number(s.term.rows || 0);
+  if (priorCols === c && priorRows === r) return true;
+  const wasSuppressed = !!s._suppressResize;
+  s._suppressResize = true;
+  try {
+    _runTerminalMutation(s, reason || 'terminal-grid-adopt', () => s.term.resize(c, r));
+  } catch (_) {
+    /* expected: a refused/throwing resize must not escape an adoption that only restores the
+       caller's prior grid below; the read-back decides, not the throw */
+  } finally {
+    s._suppressResize = wasSuppressed;
+  }
+  if (Number(s.term.cols) === c && Number(s.term.rows) === r) return true;
+  _undoRefusedTerminalGridAdoption(s, priorCols, priorRows);
+  return false;
+}
+
 // 2026-10-11 incident: every .term-container measured half of #terminal-area; this names the in-flow element that took the other half (flat keys survive lib/client-diag-handler.js sanitizer).
 function _terminalAreaLayoutCensus(container) {
   try {

package/template/coding-task-manager/public/js/terminal/runtime-12.js

@@ -1030,6 +1030,21 @@ function _terminalDraftUploadOwnership(id) {
   return { lifetime, context };
 }
 
+// This adapter has no terminal-local captures; the lifetime owns its HTTP work and abort signal.
+async function _terminalDeleteServerDraft(id, attachment, options = {}, operation = {}) {
+  const lifetime = _terminalRootDraftLifetime;
+  const owned = operation.context ? null : _terminalDraftUploadOwnership(id);
+  const context = operation.context || (owned && !owned.reason ? owned.context : null);
+  if (!lifetime || !context || typeof lifetime.deleteServerDraft !== 'function') return false;
+  const isCurrent = () => lifetime === _terminalRootDraftLifetime && context.id === id
+    && lifetime.current(context) && (typeof operation.isCurrent !== 'function' || operation.isCurrent() === true);
+  if (!isCurrent()) return false;
+  const retry = (url, request, retryOptions) => lifetime.fetchWithRetry(fetch, url, request, retryOptions);
+  const accepted = await lifetime.deleteServerDraft({ id, attachment, options, context, isCurrent,
+    token: String(state.token || ''), retry });
+  return accepted === true && isCurrent();
+}
+
 // §6.3.1 + review finding 4: the verified private continuity key is the ROOT SCOPE's own
 // continuity hash for the live lease -- not a host+session string (which would let the same
 // host/session under a different authenticated principal reactivate an old proof). Fail closed.
@@ -1127,6 +1142,23 @@ function _terminalFailAttachmentUpload(id, attachment, error) {
   return true;
 }
 
+// R-4: a verified upload whose server snapshot this tab refused must not hang on "Uploading". The
+// server already holds (and may deliver) the draft, so this is NOT retryable -- a re-upload would
+// paste the same image twice; a reload restores the true row from the list. Every silent caller of a
+// verified-adoption result reports here so a refused publication is visible with a reason.
+function _terminalRejectedUploadOutcome(id, attachment, outcome, deps) {
+  const reason = String(outcome && outcome.reason || 'rejected');
+  const failed = _terminalFailAttachmentUpload(id, attachment, {
+    code: 'CTM_UPLOAD_PUBLICATION_REJECTED',
+    message: 'Uploaded, but this tab could not confirm it (' + reason + '). Reload to see its real state.',
+    retryable: false,
+  });
+  if (!failed) return false;
+  deps.metric(id, 'upload_publication_rejected', { reason, attachmentOrdinal: attachment.ordinal });
+  void deps.postDiagnostic(id, 'upload_publication_rejected', attachment, { reason });
+  return true;
+}
+
 // Review finding 9 (§9 rows: index.html retry / edit conflict / submission resume, runtime-10.js
 // freeze): the ONE server-derived-metadata entry for call sites that used to Object.assign() a
 // response body straight onto a draft row. A payload carrying a lifecycle version is adopted
@@ -1181,7 +1213,10 @@ async function _terminalRetryAttachmentUploadOwned(id, attachment, deps) {
       return false;
     }
     const outcome = _terminalFinishAttachmentUpload(id, attachment, uploaded);   // WP-3 §6: adopt or legacy ready
-    if (outcome.outcome === 'rejected') return false;
+    if (outcome.outcome === 'rejected') {
+      _terminalRejectedUploadOutcome(id, attachment, outcome, { metric: deps.metric, postDiagnostic: deps.postDiagnostic });
+      return false;
+    }
     // The server's 'create' op (inside _terminalUploadPastedImage) already nudged the
     // reconciler for this newly-created draft row -- do not also race it here.
     if (serverDeliveryOn) return true;
@@ -1281,7 +1316,22 @@ function onTerminalImageDraftState(msg) {
     reservation = owned.lifetime.imageUploadReservation(owned.context, requestId);
     if (reservation) attachment = reservation.attachment;
   }
-  if (!attachment) return;
+  if (!attachment) {
+    // B9: an upload this client never started -- the usual shape right after a reload, or in a
+    // second tab on a session with a durable draft -- has no row yet even though the server may
+    // already have published its terminal outcome: the restore LIST is what creates the row, and
+    // it can still be in flight. Dropping the publication here left the restored chip frozen on
+    // the list's older state (`delivery_pending` -> 'attaching') for the life of the page, while
+    // the chip title already claimed "Attached ✓" from the local client hint. Retain it instead
+    // (identity-fenced, newest-version-wins) and let the restore that creates the row adopt it.
+    // The publication is only ever retained against a LIVE captured context: `owned.reason`
+    // means there is no restore in flight for this session, and the list read that follows is
+    // necessarily fresh.
+    if (owned.context && !owned.reason && typeof owned.lifetime.retainUnmatchedPublication === 'function') {
+      owned.lifetime.retainUnmatchedPublication(owned.context, msg, msg.hint);
+    }
+    return;
+  }
 
   const stateVersion = typeof Draft.stateVersionOf === 'function' ? Draft.stateVersionOf(msg.stateVersion) : null;
   if (stateVersion === null) {

package/template/coding-task-manager/public/js/terminal/runtime-16.js

@@ -712,18 +712,18 @@ function _maybeReassertStateSyncDims(s, msg) {
     });
     if (bounded.action === 'capitulate') {
       s._stateSyncDimsSkipStreak = 0;
-      const wasSuppressed = !!s._suppressResize;
-      s._suppressResize = true;
-      let resizeSucceeded = false;
-      try {
-        resizeSucceeded = _runFrameGateMutation(
-          s,
-          'dims-reassert-capitulation',
-          () => s.term.resize(mCols, mRows),
-        );
-      } finally {
-        s._suppressResize = wasSuppressed;
-      }
+      // WP-1 (D-1, G-3): the losing viewer adopts the mirror grid through the shared all-or-nothing
+      // primitive -- the cols-pin chokepoint refuses a narrower mirror, so a bare resize would land
+      // a hybrid AND seed _lastResizeSentCols/Rows with a grid that was never sent. The frame gate
+      // still owns this mutation (withOwnedTerminalMutation); _adoptTerminalGrid reads the grid
+      // back, so a mutation the gate only QUEUED is not an adoption.
+      let adopted = false;
+      const gated = _runFrameGateMutation(
+        s,
+        'dims-reassert-capitulation',
+        () => { adopted = _adoptTerminalGrid(s, mCols, mRows, 'dims-reassert-capitulation') === true; },
+      );
+      const resizeSucceeded = gated === true && adopted;
       if (resizeSucceeded) {
         const cellHeight = Number(s.term?._core?._renderService?.dimensions?.css?.cell?.height) || 0;
         const containerHeight = Number(s.container?.clientHeight) || 0;

package/template/coding-task-manager/public/js/terminal/runtime-18.js

@@ -151,6 +151,11 @@ function _normalizeTerminalColsToFitBaseline(s, id, proposal) {
       // count (up OR down) so the rendered/serialized width stays consistent.
       try {
         _runTerminalMutation(s, 'fit-baseline-correction', () => s.term.resize(baseline.cols, s.term.rows));
+        // WP-1 (D-3, G-5): only claim a correction that actually happened. The cols-pin chokepoint
+        // can refuse this snap (a narrowing onto the remembered col count), and reporting
+        // "corrected" plus refreshing the baseline would then describe a grid this client never
+        // held -- the next fit would keep snapping toward it.
+        if (Number(s.term.cols) !== baseline.cols) return false;
         baseline.width = width;
         baseline.at = Date.now();
         s._fitBaselineCorrectedAt = Date.now();
@@ -179,6 +184,15 @@ function _normalizeTerminalColsToFitBaseline(s, id, proposal) {
       toCols: cols,
       widthPx: Math.round(width),
       reason: 'large-divergence',
+      // WP-2 (docs/codex-terminal-geometry-sticky-cols-2026-10-24.html §5): the fit width
+      // alone could not explain a "pane measured 721 px" incident -- the browser viewport width
+      // and whether split view was on are the layout facts that separate a real pane resize from
+      // a transient container reading. `window` is probed (not dereferenced bare) because this
+      // function is evaluated by several existing windowless harnesses
+      // (tests/terminal-fit-baseline-adopted-beacon.test.js, tests/terminal-grid-pane-fit.test.js);
+      // it is always defined in the page, and the guard only keeps the beacon from throwing there.
+      viewportWidthPx: Math.round(Number(typeof window === 'undefined' ? 0 : window.innerWidth) || 0),
+      split: !!state.splitRoot,
     });
     baseline.cols = cols;
     baseline.width = width;

package/template/coding-task-manager/public/js/terminal/runtime-19.js

@@ -319,11 +319,15 @@ function _restoreSnapshotDataImpl(s, data, onDone, opts) {
     && rowsOnlyCols > 0
     && rowsOnlyCols === Math.floor(Number(s._snapshotRestoreGridCols) || 0)
     && opts.snapshotScrollbackFp === s._snapshotScrollbackFp;
-  if (rowsOnlyEligible) {
+  // WP-1 (D-1, G-2): the rows-only fast path replays a grid-relative viewport slice, so it may
+  // only run on a grid this client actually adopted. A narrow refused at the cols-pin chokepoint
+  // lands as a hybrid (local cols, snapshot rows), and the slice would then be replayed onto a
+  // grid nobody holds -- skip the fast path and fall through to the full restore below.
+  const rowsOnlyAdopted = rowsOnlyEligible
+    ? _adoptTerminalGrid(s, rowsOnlyCols, rowsOnlyRows, 'rows-only-restore-resize')
+    : false;
+  if (rowsOnlyEligible && rowsOnlyAdopted) {
     try {
-      if (s.term.cols !== rowsOnlyCols || s.term.rows !== rowsOnlyRows) {
-        _runTerminalMutation(s, 'rows-only-restore-resize', () => s.term.resize(rowsOnlyCols, rowsOnlyRows));
-      }
       // Slice raw data at the server-stamped boundary, then use the same transform chain as
       // the full restore. The existing scrollback remains untouched.
       const rowsOnlySource = restoreOpts.source || restoreOpts.kind || 'snapshot';