create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/m/pool-failover.js

@@ -0,0 +1,391 @@
+// public/m/pool-failover.js — WP-6 P-7 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html
+// §5 P-7, §6.4 "rev 2 P-7 phone pool", §8 WP-6, §9 S-26).
+//
+// The phone signs in (passkey) once per member origin, so passkeys — and the per-origin outbox — are
+// pinned to a hostname. When the origin the phone is on stops answering, this module probes the other
+// pool members' public origins with an opaque `fetch(origin + '/m/manifest.json', {mode:'no-cors'})`
+// and sends the browser to the first that answers, carrying `?poolFrom=<this instance>` so the
+// receiving member can say who it took over from (P-7).
+//
+// It is a classic script, loaded by public/m/index.html BEFORE /m/app.js and listed in sw.js
+// SHELL_ASSETS, because the whole point is that it runs while the app's own API is unreachable.
+//
+//   * localStorage holds ONLY the dial cache `ctm.pool.origins`
+//     ([{ instanceId, displayName, origin, lastState, lastSeenAt }], last-reached first) and the
+//     content-free presence marker `ctm.pool.outboxPending` ('1' while app.js has queued outbox
+//     entries, absent otherwise — see below). Never a secret, never a token, never an entry, never a
+//     machine setting (D-4: settings live on the machine).
+//   * Every dependency is injectable (storage, location, fetch, confirm, setTimeout/clearTimeout,
+//     AbortController, clock, DOM host), so both the boot-failure path and the banner are provable
+//     without a browser. Nothing here reads Date.now() on a path a test drives: `now` is injected.
+//   * Every storage access is wrapped: a private-mode or blocked localStorage returns the empty dial
+//     cache and boot continues, it never throws.
+(function (root) {
+  'use strict';
+
+  var POOL_ORIGINS_KEY = 'ctm.pool.origins';
+  // P-7 boot seam. The outbox itself is private: it lives behind the private lease (IndexedDB plus a
+  // leased localStorage mirror), and the boot-failure path runs BEFORE any lease exists — so it cannot
+  // read the queue and `state.remoteOutbox` is always empty there. app.js therefore mirrors ONLY the
+  // queue's presence into plain window.localStorage: this one key, the string '1' while entries are
+  // queued, and no key at all the moment the queue empties. Never an entry, an id, a count, a command
+  // or a principal — a boolean's worth of state, which is exactly what P-7's "ask before leaving an
+  // origin that still holds unsent messages" prompt needs.
+  var POOL_OUTBOX_PENDING_KEY = 'ctm.pool.outboxPending';
+  var PROBE_PATH = '/m/manifest.json';
+  var PROBE_TIMEOUT_MS = 4000;
+  var BANNER_ID = 'pool-from-banner';
+  // A pool is 2-20 of the user's own machines (design §2). The cache is capped so a runaway roster
+  // can never fill the 5 MB localStorage quota the outbox also lives in.
+  var ORIGINS_MAX = 24;
+
+  function trims(value) {
+    return String(value == null ? '' : value).trim();
+  }
+
+  // The one escaper. This module deliberately does not depend on the app's escAbsent esc: it runs in
+  // the shell before app.js and inside a vm test.
+  function poolEsc(value) {
+    return String(value == null ? '' : value).replace(/[&<>"']/g, function (ch) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch];
+    });
+  }
+
+  // A public origin: scheme + host (+ port), no path, no trailing slash. Anything that is not http(s)
+  // is not a dial target (a blob:/data: URL would be a bug, not a member).
+  function normalizePoolOrigin(value) {
+    var raw = trims(value).replace(/\/+$/, '');
+    if (!/^https?:\/\/[^/?#]+/i.test(raw)) return '';
+    var match = raw.match(/^(https?:\/\/[^/?#]+)/i);
+    return match ? match[1] : '';
+  }
+
+  // One stored row, or null. Exactly the five documented fields — a row that carries anything else
+  // (a token, a secret, a session id) is rebuilt from the five, so nothing extra is ever re-persisted.
+  function normalizePoolOriginRow(row) {
+    if (!row || typeof row !== 'object') return null;
+    var origin = normalizePoolOrigin(row.origin);
+    if (!origin) return null;
+    return {
+      instanceId: trims(row.instanceId),
+      displayName: trims(row.displayName),
+      origin: origin,
+      lastState: trims(row.lastState),
+      lastSeenAt: Number(row.lastSeenAt) || 0,
+    };
+  }
+
+  function poolStorage(storage) {
+    if (storage) return storage;
+    try {
+      return typeof localStorage !== 'undefined' ? localStorage : null;
+    } catch (error) {
+      return null; // expected: a blocked/opaque context throws on the localStorage getter itself
+    }
+  }
+
+  function readPoolOrigins(storage) {
+    var store = poolStorage(storage);
+    if (!store || typeof store.getItem !== 'function') return [];
+    var raw = null;
+    try {
+      raw = store.getItem(POOL_ORIGINS_KEY);
+    } catch (error) {
+      return []; // HANDLE: private mode / blocked storage — the dial cache is optional, boot continues
+    }
+    if (!raw) return [];
+    var parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (error) {
+      return []; // HANDLE: a corrupted cache is dropped, never fatal — the phone boots with no roster
+    }
+    if (!Array.isArray(parsed)) return [];
+    return parsed.map(normalizePoolOriginRow).filter(Boolean).slice(0, ORIGINS_MAX);
+  }
+
+  function writePoolOrigins(storage, rows) {
+    var store = poolStorage(storage);
+    if (!store || typeof store.setItem !== 'function') return false;
+    var clean = (Array.isArray(rows) ? rows : []).map(normalizePoolOriginRow).filter(Boolean).slice(0, ORIGINS_MAX);
+    try {
+      store.setItem(POOL_ORIGINS_KEY, JSON.stringify(clean));
+    } catch (error) {
+      return false; // REPORT: quota/blocked storage — the caller keeps the in-memory rows it just built
+    }
+    return true;
+  }
+
+  // P-7 boot seam, read half: is there anything queued on this origin? `true` only for the presence
+  // marker app.js writes; a missing key, a blocked storage or a corrupted value all mean "nothing
+  // queued" so the caller can fall through to the ordinary boot. Storage is injectable.
+  function readOutboxPendingMarker(storage) {
+    var store = poolStorage(storage);
+    if (!store || typeof store.getItem !== 'function') return false;
+    var raw = null;
+    try {
+      raw = store.getItem(POOL_OUTBOX_PENDING_KEY);
+    } catch (error) {
+      return false; // HANDLE: private mode / blocked storage — boot continues as if nothing is queued
+    }
+    return String(raw) === '1';
+  }
+
+  // P-7 boot seam, write half: presence only — '1' while `pending`, the key removed when not. Called
+  // from every app.js outbox persist and from every path that clears the queue.
+  function writeOutboxPendingMarker(storage, pending) {
+    var store = poolStorage(storage);
+    if (!store) return false;
+    try {
+      if (pending) {
+        if (typeof store.setItem !== 'function') return false;
+        store.setItem(POOL_OUTBOX_PENDING_KEY, '1');
+      } else {
+        if (typeof store.removeItem !== 'function') return false;
+        store.removeItem(POOL_OUTBOX_PENDING_KEY);
+      }
+    } catch (error) {
+      return false; // HANDLE: quota / blocked storage — the marker is an optimisation, never fatal
+    }
+    return true;
+  }
+
+  // P-7: called after every successful phone /api/machines load. THIS origin is the one just reached,
+  // so it is stamped `now` (and therefore sorts first: "last reached, then the next reachable"); every
+  // other member keeps the lastSeenAt it already had. `self` is the phone's own manifest/machine-self
+  // row — used for the display name only, never for a credential.
+  function rememberPoolOrigins(machines, self, deps) {
+    var options = deps || {};
+    var at = Number(typeof options.now === 'function' ? options.now() : Date.now()) || 0;
+    var store = poolStorage(options.storage);
+    var previous = readPoolOrigins(store);
+    var selfId = trims((self && self.instanceId) || options.selfInstanceId);
+    var selfName = trims(self && (self.displayName || self.hostname));
+    var selfOrigin = normalizePoolOrigin((self && machinePoolOrigin(self)) || options.origin || '');
+    var reachable = {};
+    var rows = [];
+    var push = function (row) {
+      var clean = normalizePoolOriginRow(row);
+      if (!clean || reachable[clean.origin]) return;
+      reachable[clean.origin] = true;
+      rows.push(clean);
+    };
+    var lastSeenFor = function (origin) {
+      var found = previous.filter(function (row) { return row.origin === origin; })[0];
+      return found ? found.lastSeenAt : 0;
+    };
+    if (selfOrigin) {
+      push({ instanceId: selfId, displayName: selfName, origin: selfOrigin, lastState: trims(self && self.health) || 'reachable', lastSeenAt: at });
+    }
+    (Array.isArray(machines) ? machines : []).forEach(function (machine) {
+      if (!machine || !machine.instanceId) return;
+      var origin = typeof machinePoolOrigin === 'function' ? machinePoolOrigin(machine) : '';
+      if (!origin) return;
+      push({
+        instanceId: trims(machine.instanceId),
+        displayName: trims(machine.displayName || machine.hostname || machine.url),
+        origin: origin,
+        lastState: trims(machine.health) || 'unknown',
+        lastSeenAt: lastSeenFor(origin),
+      });
+    });
+    rows.sort(function (a, b) {
+      return (b.lastSeenAt - a.lastSeenAt) || a.displayName.localeCompare(b.displayName) || a.origin.localeCompare(b.origin);
+    });
+    writePoolOrigins(store, rows);
+    return rows;
+  }
+
+  // P-7: `fetch(origin + '/m/manifest.json', { mode:'no-cors', cache:'no-store' })` with an
+  // AbortController timeout. An OPAQUE response (type 'opaque') is the reachable signal: a cross-origin
+  // no-cors read can never expose a status, and a request that resolved at all proves the origin
+  // answered. A rejection, a synchronous throw, or the timeout is `false` — never a throw.
+  function probeOrigin(origin, options) {
+    var settings = options || {};
+    var base = normalizePoolOrigin(origin);
+    if (!base) return Promise.resolve(false);
+    var fetchImpl = settings.fetchImpl || (typeof fetch === 'function' ? fetch : null);
+    if (typeof fetchImpl !== 'function') return Promise.resolve(false);
+    var setTimer = settings.setTimeoutImpl || (typeof setTimeout === 'function' ? setTimeout : null);
+    var clearTimer = settings.clearTimeoutImpl || (typeof clearTimeout === 'function' ? clearTimeout : null);
+    var AbortCtor = settings.AbortControllerImpl || (typeof AbortController === 'function' ? AbortController : null);
+    var timeoutMs = Number(settings.timeoutMs == null ? PROBE_TIMEOUT_MS : settings.timeoutMs);
+    if (!Number.isFinite(timeoutMs) || timeoutMs < 0) timeoutMs = PROBE_TIMEOUT_MS;
+    var controller = AbortCtor ? new AbortCtor() : null;
+    return new Promise(function (resolve) {
+      var settled = false;
+      var timer = null;
+      var finish = function (ok) {
+        if (settled) return;
+        settled = true;
+        if (timer != null && typeof clearTimer === 'function') clearTimer(timer);
+        resolve(!!ok);
+      };
+      if (typeof setTimer === 'function') {
+        timer = setTimer(function () {
+          // The probe is cut at the timeout: an unresolved fetch is not evidence the origin is up.
+          try {
+            if (controller && typeof controller.abort === 'function') controller.abort();
+          } catch (error) {
+            /* expected: aborting a request that already settled is a no-op */
+          }
+          finish(false);
+        }, timeoutMs);
+      }
+      var request = null;
+      try {
+        request = fetchImpl(base + PROBE_PATH, {
+          mode: 'no-cors',
+          cache: 'no-store',
+          signal: controller ? controller.signal : undefined,
+        });
+      } catch (error) {
+        finish(false); // HANDLE: a synchronous fetch throw (blocked URL, no CORS) is "not reachable"
+        return;
+      }
+      Promise.resolve(request).then(function (res) {
+        // No status is readable through an opaque response, so "it resolved" is the whole signal.
+        finish(!!res);
+      }, function () {
+        finish(false); // HANDLE: a network error is exactly "this member does not answer"
+      });
+    });
+  }
+
+  function poolOriginsListHtml(rows) {
+    var items = (Array.isArray(rows) ? rows : []).map(function (row) {
+      var name = row.displayName || row.instanceId || row.origin;
+      var state = row.lastState || 'unknown';
+      var seen = row.lastSeenAt ? 'last seen ' + new Date(row.lastSeenAt).toLocaleString() : 'never seen';
+      return '<li class="pool-origin-row" data-origin="' + poolEsc(row.origin) + '">'
+        + '<span class="pool-origin-name">' + poolEsc(name) + '</span>'
+        + '<span class="pool-origin-state">' + poolEsc(state + ' · ' + seen) + '</span>'
+        + '<span class="pool-origin-address">' + poolEsc(row.origin) + '</span>'
+        + '</li>';
+    }).join('');
+    return '<div class="pool-failover-list" role="status">'
+      + '<p class="pool-failover-copy">No machine in this pool answered from this phone. '
+      + 'These are their last known states.</p>'
+      + '<ul class="pool-origin-rows">' + items + '</ul>'
+      + '</div>';
+  }
+
+  function mountPoolOriginsList(html, rows, deps) {
+    var host = (deps && deps.document) || (typeof document !== 'undefined' ? document : null);
+    if (!host || typeof host.getElementById !== 'function') return null;
+    var node = host.getElementById('pool-failover-list');
+    if (!node) return null;
+    if (typeof node.innerHTML === 'string' || node.innerHTML === '') node.innerHTML = String(html);
+    return node;
+  }
+
+  // P-7 boot failure. Called by app.js when the FIRST API call of a boot does not answer (a network
+  // error, or a 5xx/offline-tunnel answer from the relay):
+  //   * with nothing queued, the first member that answers takes over (location.assign, carrying
+  //     `?poolFrom=<this instance>`);
+  //   * with unsent outbox items the switch is ASKED for first, because the outbox is per origin and
+  //     would otherwise be stranded — "no" leaves the user exactly where they are;
+  //   * when no member answers, the roster renders with its last-known states.
+  function failoverOnBootFailure(options) {
+    var settings = options || {};
+    var loc = settings.location || (typeof location !== 'undefined' ? location : null);
+    var rows = readPoolOrigins(settings.storage);
+    var selfOrigin = normalizePoolOrigin(settings.origin
+      || (loc && (loc.origin || (loc.protocol && loc.host ? loc.protocol + '//' + loc.host : ''))) || '');
+    var selfId = trims(settings.selfInstanceId);
+    var candidates = rows.filter(function (row) { return row.origin !== selfOrigin; });
+    if (!candidates.length) {
+      return Promise.resolve({ switched: false, to: '', asked: false, reason: 'no_members', rows: rows });
+    }
+    var selfName = (rows.filter(function (row) { return row.origin === selfOrigin; })[0] || {}).displayName
+      || selfOrigin || selfId;
+    if (settings.hasUnsentOutbox) {
+      var ask = settings.confirmImpl || (typeof confirm === 'function' ? confirm : null);
+      var question = settings.confirmText
+        || ('This phone has messages that have not been sent from ' + selfName + '. Switch to another machine anyway?');
+      var yes = false;
+      if (typeof ask === 'function') {
+        try {
+          yes = !!ask(question);
+        } catch (error) {
+          yes = false; // expected: a blocked/dismissed confirm dialog means "do not navigate away"
+        }
+      }
+      if (!yes) {
+        return Promise.resolve({ switched: false, to: '', asked: true, reason: 'outbox_unsent', rows: rows });
+      }
+    }
+    var index = 0;
+    var attempt = function () {
+      if (index >= candidates.length) {
+        var html = poolOriginsListHtml(rows);
+        var render = settings.renderList || function (markup, list) { return mountPoolOriginsList(markup, list, settings); };
+        render(html, rows);
+        return { switched: false, to: '', asked: false, reason: 'no_member_answered', html: html, rows: rows };
+      }
+      var row = candidates[index];
+      index += 1;
+      return probeOrigin(row.origin, settings).then(function (reachable) {
+        if (!reachable) return attempt();
+        var target = row.origin + '/m/?poolFrom=' + encodeURIComponent(selfId || selfOrigin);
+        if (loc && typeof loc.assign === 'function') loc.assign(target);
+        else if (loc) loc.href = target;
+        return { switched: true, to: row.origin, asked: false, reason: 'switched', href: target, rows: rows };
+      });
+    };
+    return Promise.resolve().then(attempt);
+  }
+
+  // `?poolFrom=<id>` on arrival: "<from name> is unreachable — switched to <this name>". Both names
+  // come from the stored roster (fall back to the id), every string is escaped, and the banner mounts
+  // into #pool-from-banner when the page has one.
+  function showPoolFromBanner(options) {
+    var settings = options || {};
+    var loc = settings.location || (typeof location !== 'undefined' ? location : null);
+    var search = settings.search != null ? String(settings.search) : String((loc && loc.search) || '');
+    var match = search.match(/[?&]poolFrom=([^&#]*)/);
+    var from = match ? decodeURIComponent(match[1].replace(/\+/g, ' ')) : '';
+    if (!from) return null;
+    var rows = settings.origins || readPoolOrigins(settings.storage);
+    var find = function (id) {
+      return rows.filter(function (row) { return row.instanceId === id; })[0] || null;
+    };
+    var self = settings.self || null;
+    var selfId = trims((self && self.instanceId) || settings.selfInstanceId);
+    var fromRow = find(from);
+    var selfRow = find(selfId);
+    var fromName = (fromRow && fromRow.displayName) || from;
+    var selfName = (selfRow && selfRow.displayName) || trims(self && self.displayName) || selfId || trims(settings.origin);
+    var text = fromName + ' is unreachable — switched to ' + selfName;
+    var html = '<div class="pool-from-banner" role="status">' + poolEsc(text) + '</div>';
+    var host = settings.document || (typeof document !== 'undefined' ? document : null);
+    var node = null;
+    if (host && typeof host.getElementById === 'function') {
+      node = host.getElementById(BANNER_ID);
+      if (node && typeof node.innerHTML === 'string') node.innerHTML = String(html);
+    }
+    return { from: from, selfId: selfId, fromName: fromName, selfName: selfName, text: text, html: html, node: node };
+  }
+
+  var out = {
+    POOL_ORIGINS_KEY: POOL_ORIGINS_KEY,
+    POOL_OUTBOX_PENDING_KEY: POOL_OUTBOX_PENDING_KEY,
+    PROBE_PATH: PROBE_PATH,
+    PROBE_TIMEOUT_MS: PROBE_TIMEOUT_MS,
+    BANNER_ID: BANNER_ID,
+    poolEsc: poolEsc,
+    normalizePoolOrigin: normalizePoolOrigin,
+    normalizePoolOriginRow: normalizePoolOriginRow,
+    readPoolOrigins: readPoolOrigins,
+    writePoolOrigins: writePoolOrigins,
+    readOutboxPendingMarker: readOutboxPendingMarker,
+    writeOutboxPendingMarker: writeOutboxPendingMarker,
+    rememberPoolOrigins: rememberPoolOrigins,
+    probeOrigin: probeOrigin,
+    poolOriginsListHtml: poolOriginsListHtml,
+    failoverOnBootFailure: failoverOnBootFailure,
+    showPoolFromBanner: showPoolFromBanner,
+  };
+  if (typeof module === 'object' && module.exports) module.exports = out;
+  else root.CtmPoolFailover = out;
+})(typeof window !== 'undefined' ? window : this);

package/template/coding-task-manager/public/m/private-queue-actions.js

@@ -167,15 +167,34 @@
     }
 
     function captureSelectedRows(pane, selected) {
-      return selected.map(({ item }, index) => ({
-        item,
-        fingerprint: JSON.stringify(item),
-        payload: {
+      return selected.map(({ item }, index) => {
+        const payload = {
           title: item.title || `Prompt ${index + 1}`,
           text: dependencies.itemText(item),
           images: Array.isArray(item.images) ? item.images : [],
-        },
-      }));
+        };
+        // D-7/R-3: posting the pane's own id lets the engine (lib/queue-item.js:32 keeps a
+        // supplied id) and every reader match the durable row to this draft row by identity.
+        if (typeof item.id === 'string' && item.id) payload.id = item.id;
+        return { item, fingerprint: JSON.stringify(item), payload };
+      });
+    }
+
+    // R-3: a queue-draft echo or a queue-state delivery frame for the open pane reloads the
+    // draft through the existing loadDraft path. Skipped (and retried on the next frame) while
+    // the user is mid-operation, so a reload can never clobber an in-flight save/send or an
+    // open edit. NOTE: the design text says "editingIndex != null", but the phone stores -1
+    // (never null) for "no row being edited" (public/m/app.js:10862, :10835), so a literal
+    // `!= null` guard would never reload at all. The guard therefore tests the index
+    // (`>= 0`), which is the pane's own meaning of "an edit row is open" (app.js:10747).
+    async function reloadIfIdle(sessionId) {
+      const pane = getState()?.queueBuilder || null;
+      if (!pane || pane.open !== true) return false;
+      if (String(pane.sessionId || '') !== String(sessionId ?? '')) return false;
+      const editing = Number.isInteger(pane.editingIndex) && pane.editingIndex >= 0;
+      if (pane.saving || pane.sending || editing) return false;
+      await loadDraft(pane.sessionId);
+      return true;
     }
 
     async function sendQueue(options = {}) {
@@ -274,7 +293,7 @@
       return true;
     }
 
-    return Object.freeze({ captureOrigin, isOriginCurrent, runMutation, confirmStepUp, saveDraft, loadDraft, sendQueue, retire });
+    return Object.freeze({ captureOrigin, isOriginCurrent, runMutation, confirmStepUp, saveDraft, loadDraft, reloadIfIdle, sendQueue, retire });
   }
 
   return Object.freeze({ createPrivateQueueActions });

package/template/coding-task-manager/public/m/sw.js

@@ -23,6 +23,11 @@ const SHELL_ASSETS = [
   '/m/principal-access.js?v=__CTM_MOBILE_ASSET__',
   '/m/principal-ui-policy.js?v=__CTM_MOBILE_ASSET__',
   '/m/command-outcome-policy.js?v=__CTM_MOBILE_ASSET__',
+  // WP-6 (S-26/P-7): the cached shell must be able to fail over to another pool member with no
+  // network, so the failover module and the two machine-pool files ride the precache allowlist.
+  '/js/machine-pool-shared.js?v=__CTM_MOBILE_ASSET__',
+  '/m/pool-failover.js?v=__CTM_MOBILE_ASSET__',
+  '/m/machines.js?v=__CTM_MOBILE_ASSET__',
   '/m/outbox-persistence.js?v=__CTM_MOBILE_ASSET__',
   '/js/private-state-scope.js?v=__CTM_MOBILE_ASSET__',
   '/m/private-state-runtime.js?v=__CTM_MOBILE_ASSET__',

package/template/coding-task-manager/queue-engine.js

@@ -489,6 +489,18 @@ function getQueue(sessionId) {
   return queues.get(sessionId) || null;
 }
 
+// Durable per-item status for readers that must not see the WS broadcast
+// shape (queue-draft GET overlay, R-1/R-2/D-6). Returns null when the
+// session has no in-memory queue. getState() is deliberately untouched: its
+// item shape feeds the queue-state broadcast.
+function getItemStatusMap(sessionId) {
+  const q = queues.get(sessionId);
+  if (!q) return null;
+  const map = new Map();
+  for (const i of q.items) if (i && i.id) map.set(i.id, { status: i.status, statusUpdatedAt: Number(i.statusUpdatedAt) || 0 });
+  return map;
+}
+
 function getState(sessionId) {
   const q = queues.get(sessionId);
   if (!q) return null;
@@ -1233,6 +1245,7 @@ module.exports = {
   createQueue,
   appendItems,
   getQueue,
+  getItemStatusMap,
   getState,
   getPersistedState,
   stateFromSavedQueue,

package/template/coding-task-manager/server/approvals.js

@@ -979,6 +979,10 @@ function createApprovals(deps) {
         policyDecision: `rescue_provider_rejected_${admittedInteraction.reasonCode || 'unknown'}`,
         keystrokeStatus: 'not_sent',
       });
+      // Drift alarm: the screen is a live approval the rescuer refused to admit. If NO provider
+      // recognizes it, the rejection itself is the drift signal — surface it here, not only on
+      // the later choice branch (which the very same rejection makes unreachable).
+      if (admittedInteraction.reasonCode === 'provider_unknown') _recordApprovalDrift(sessionId, approvalDrift.driftIfUnrecognized({ text, detectProvider: approvalProviders.detectProvider }));
       return;
     }
     // Fully hands-off on plan approvals (ExitPlanMode). The main path skips these
@@ -1008,12 +1012,7 @@ function createApprovals(deps) {
         // passed the isLiveApprovalPrompt gate above). If NO provider recognized it yet
         // its options carry approval verbs, a provider that SHOULD have matched didn't —
         // i.e. the CLI changed its prompt UI. Record it so the miss is loud, not silent.
-        try {
-          if (!approvalProviders.detectProvider(text)) {
-            const drift = approvalDrift.evaluateDrift({ text, providerMatched: false, waitingForInput: true });
-            if (drift) _recordApprovalDrift(sessionId, drift);
-          }
-        } catch { /* alarm is best-effort */ }
+        _recordApprovalDrift(sessionId, approvalDrift.driftIfUnrecognized({ text, detectProvider: approvalProviders.detectProvider }));
         if (!buf._lastRescueChoiceSkipLogAt || Date.now() - buf._lastRescueChoiceSkipLogAt > 30000) {
           buf._lastRescueChoiceSkipLogAt = Date.now();
           logger.log(`[shadow-approver] Ignoring choice/question menu in rescue path for session ${sessionId.slice(0, 8)} — agent is asking the user, not a missed permission (via ${source})`);