create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/session-integrity.js

@@ -15,6 +15,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { writeStartupPointerGuarded, readStartupTaskProjectDir } = require('./lib/startup-pointer-write');
 const crypto = require('crypto');
 const claudeDesktopSessions = require('./lib/claude-desktop-sessions');
 const { agentRowGhostVerdict } = require('./lib/session-identity-guard');
@@ -909,13 +910,8 @@ function recoverMismatches(db, issues, getAllSessionFiles, opts = {}) {
         if (!issue.sessionId || !agentId || !resumeId) { result.skipped++; break; }
         try {
           const projectDir = issue.details?.jsonl_path ? path.dirname(issue.details.jsonl_path) : '';
-          const cols = new Set(db.prepare('PRAGMA table_info(startup_tasks)').all().map(c => c.name));
-          const sets = ['args = ?'];
-          const vals = [JSON.stringify(['resume', resumeId])];
-          if (cols.has('agent_project_dir')) { sets.push('agent_project_dir = ?'); vals.push(projectDir || null); }
-          if (cols.has('claude_project_dir')) { sets.push('claude_project_dir = ?'); vals.push(projectDir || null); }
-          vals.push(issue.sessionId);
-          const fixed = db.prepare(`UPDATE startup_tasks SET ${sets.join(', ')} WHERE ctm_session_id = ?`).run(...vals).changes || 0;
+          // WP-3: guarded writer (lib/startup-pointer-write.js) — an active transition's candidate fork is refused.
+          const fixed = writeStartupPointerGuarded(db, issue.sessionId, ['resume', resumeId], projectDir);
           let removedSelfRows = 0;
           if (issue.details?.has_empty_self_row) {
             removedSelfRows = db.prepare(`
@@ -968,8 +964,10 @@ function recoverMismatches(db, issues, getAllSessionFiles, opts = {}) {
                   return arg;
                 });
                 if (changed) {
-                  fixed += db.prepare('UPDATE startup_tasks SET args = ? WHERE ctm_session_id = ?')
-                    .run(JSON.stringify(healedArgs), issue.sessionId).changes || 0;
+                  // WP-3: guarded writer; the stored dir columns are handed back so the alias heal never clears them.
+                  fixed += writeStartupPointerGuarded(
+                    db, issue.sessionId, healedArgs, readStartupTaskProjectDir(db, issue.sessionId),
+                  );
                 }
               }
             }

package/template/coding-task-manager/workers/db-owner-worker.js

@@ -48,6 +48,11 @@ const {
 
 const db = require('../db');
 const walleTranscript = require('../lib/walle-transcript');
+// WP-3 (worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-5): the boot backfill
+// predicts a transcript path from (cwd, agent_session_id) and VERIFIES it before linking
+// (lib/transcript-link.js) -- the same derived-not-discovered pair WP-2's resume preflight uses.
+const { deriveClaudeTranscriptPath } = require('../lib/resume-cwd');
+const { verifyClaudeTranscriptAt } = require('../lib/transcript-link');
 // WP-0a: the coding-session model-owner batch body (see the store's module doc). Required
 // here (not lazily) because this worker is the only caller, and the store has no db.js edge.
 const { persistModelSelectionBatch } = require('../lib/storage/coding-session-model-store');
@@ -673,7 +678,6 @@ async function _runOp(op, payload = {}, task = null) {
       return { heldMs: durationMs };
     }
     case 'runBootRepairs': {
-      const titleRepair = db.repairSessionTitlesFromStartupTasks?.({ limit: 2000 }) || null;
       const rolloutIdentityRepair = db.repairCodexRolloutAgentIdentities?.() || null;
       const metadataRepair = db.repairCodexSessionMetadataFromConversations?.() || null;
       const walleIdentity = require('../lib/migrations/dc-walle-identity-rekey');
@@ -685,7 +689,7 @@ async function _runOp(op, payload = {}, task = null) {
         coreDb: db.getDomainDb('core'),
       });
       return {
-        titleRepair, rolloutIdentityRepair, metadataRepair,
+        rolloutIdentityRepair, metadataRepair,
         walleIdentityRekey, walleIdentityAudit,
       };
     }
@@ -998,12 +1002,15 @@ async function _runOp(op, payload = {}, task = null) {
       // agent_sessions is CORE; this op runs on the base worker, so route the write to the
       // core handle (pre-flip/flag-off === getDb(); post-flip === core.db). The SQLite write
       // lock serializes it against the core worker's own agent_sessions writes.
+      // jsonl_path is an optional guarded link (WP-1/D-7): an empty payload value never blanks
+      // an existing link, so a caller that only carries file metadata cannot unlink the row.
       const result = db.getDomainDb('core').prepare(
-        "UPDATE agent_sessions SET file_size = ?, compact_bak_size = ?, modified_at = ?, updated_at = datetime('now') WHERE agent_session_id = ?",
+        "UPDATE agent_sessions SET file_size = ?, compact_bak_size = ?, modified_at = ?, jsonl_path = COALESCE(NULLIF(?, ''), jsonl_path), updated_at = datetime('now') WHERE agent_session_id = ?",
       ).run(
         Number(payload.fileSize || 0),
         Number(payload.compactBakSize || 0),
         String(payload.modifiedAt || ''),
+        String(payload.jsonlPath || ''),
         sessionId,
       );
       return { updated: result.changes > 0 };
@@ -1163,8 +1170,8 @@ async function _runOp(op, payload = {}, task = null) {
     case 'flushSessionDiagnostics': {
       // Durable session-diagnostics batch write (INSERT + per-session retention sweep, one txn).
       // Runs on THIS worker — the designated serial writer — so the cross-process SQLite
-      // write-lock claim (_writeLockClaim's sync writeFileSync/linkSync) never blocks the main
-      // event loop under multi-session contention.
+      // write lock (and any wait for it) never blocks the main event loop under
+      // multi-session contention.
       const entries = Array.isArray(payload.entries) ? payload.entries : [];
       if (!entries.length) return { inserted: 0, sessionsSwept: 0 };
       return db.flushSessionDiagnostics(entries);
@@ -1278,10 +1285,10 @@ async function _runOp(op, payload = {}, task = null) {
     case 'persistModelSelections': {
       // The batch body lives in the model-owner store (WP-0a corrective pass); its two helper
       // modules are required here and injected, so the store never requires them itself.
-      const { isGenericCodingSessionLabel, shouldApplyCodexAutoTitle } = require('../lib/coding-agent-models');
+      const { isGenericCodingSessionLabel } = require('../lib/coding-agent-models');
       const { applyProviderTitle, canWriteTier3Title } = require('../lib/session-title-mirror');
       return persistModelSelectionBatch(db, payload, {
-        isGenericCodingSessionLabel, shouldApplyCodexAutoTitle, applyProviderTitle, canWriteTier3Title,
+        isGenericCodingSessionLabel, applyProviderTitle, canWriteTier3Title,
       });
     }
     case 'bindCodingSessionModelState':
@@ -1481,6 +1488,45 @@ async function _runOp(op, payload = {}, task = null) {
         tabs,
       });
     }
+    case 'linkDerivedClaudeTranscripts': {
+      // WP-3 / D-5: bounded, idempotent. agent_sessions is CORE -> flip-aware core handle (see
+      // the updateAgentSessionFileMetadata comment above). `jsonl_path = ''` is the selector, so a
+      // row this op has already linked (or any other writer has) is never re-selected: the pass is
+      // idempotent by construction, not by a marker. A row is linked only when the derived path
+      // resolves to a plain local file whose first record names this very session
+      // (lib/transcript-link.js), so a wrong prediction is counted, never written.
+      const limit = Math.min(500, Math.max(1, Number(payload.limit) || 500));
+      const homeDir = String(payload.homeDir || '');
+      const claudeConfigDir = String(payload.claudeConfigDir || '');
+      const startedAt = Date.now();
+      const rows = db.getDomainDb('core').prepare(
+        "SELECT agent_session_id, project_path FROM agent_sessions WHERE provider = 'claude' AND COALESCE(jsonl_path, '') = '' AND COALESCE(project_path, '') <> '' ORDER BY created_at DESC LIMIT ?",
+      ).all(limit);
+      const out = { checked: rows.length, linked: 0, missing: 0, mismatched: 0, unreadable: 0, ms: 0 };
+      for (const row of rows) {
+        _assertTaskLive(task); // cooperative cancellation: never outlive the caller's deadline
+        let derived;
+        try {
+          derived = deriveClaudeTranscriptPath({
+            cwd: row.project_path,
+            agentSessionId: row.agent_session_id,
+            homeDir: homeDir || undefined,
+            claudeConfigDir,
+          });
+        } catch {
+          out.missing += 1;
+          continue; // expected: an unusable project_path/session id counts as "no transcript there"
+        }
+        const verified = await verifyClaudeTranscriptAt(derived, row.agent_session_id);
+        if (verified.ok) {
+          out.linked += db.updateAgentSessionTranscriptLink(row.agent_session_id, derived).updated ? 1 : 0;
+        } else if (verified.state === 'id-mismatch') out.mismatched += 1;
+        else if (verified.state === 'unreadable' || verified.state === 'archived') out.unreadable += 1;
+        else out.missing += 1;
+      }
+      out.ms = Date.now() - startedAt;
+      return out;
+    }
     case 'recoverSessionIntegrity': {
       // Apply ONLY the recovery WRITES for issues the off-worker (read-pool) detect already
       // found, so the heavy full-corpus detection scan never runs on this single serial

package/template/coding-task-manager/workers/read-pool-worker.js

@@ -21,6 +21,7 @@ require('../../shared/network/external-network-guard').armExternalNetworkGuardFr
 const { parentPort, workerData } = require('node:worker_threads');
 const fs = require('node:fs'), path = require('node:path');
 const transcriptSource = require('../lib/transcript-source');
+const { readAgentTitleBackfillPage } = require('../lib/agent-title-backfill-read');
 const { serializeCleanupError } = require('../lib/worker-error-metadata');
 const { createErrorSink } = require('../lib/error-sink');
 const {
@@ -149,13 +150,13 @@ function _recycleReadonlyDbIfNeeded(now = Date.now()) {
   const expired = !!_roDb
     && (now - _roDbOpenedAt > _roConnMaxAgeMs || _roDbOpsServed >= _roConnMaxOps);
   if (!forced && !expired) return false;
-  const recycled = !!_roDb;
-  if (_roDb) _closeReadonlyDb();
+  // Forced or expired (expired implies an open handle): close and certify a reader gap (R3 D-1b).
+  _closeReadonlyDb();
   _roRecycleRequested = false;
   for (const requestId of _roRecycleRequestIds.splice(0)) {
-    try { parentPort?.postMessage({ type: 'recycle-conn-complete', requestId, recycled }); } catch {}
+    try { parentPort?.postMessage({ type: 'recycle-conn-complete', requestId, recycled: true }); } catch {}
   }
-  return recycled;
+  return true;
 }
 
 function _requestReadonlyRecycle(requestId = 0) {
@@ -1751,7 +1752,7 @@ async function _runOp(op, payload = {}, task = null) {
         const conn = _readonlyRoutedDb(payload.dbPath);
         const rowsForCatalog = require('../lib/all-sessions-query').queryAllSessionsData(conn);
         observeRecentCatalogBacking(rowsForCatalog, { sourceExists });
-        input.sessions = require('../lib/recent-catalog-query').mapRecentSessionRows(rowsForCatalog, { hostname: payload.hostname, liveSessionIds: new Set(payload.liveSessionIds || []) });
+        input.sessions = require('../lib/recent-catalog-query').mapRecentSessionRows(rowsForCatalog, { hostname: payload.hostname, liveSessionIds: new Set(payload.liveSessionIds || []), machineTags: payload.machineTags });
         const rows = conn.prepare("SELECT key, value FROM settings WHERE key IN ('ui_pinned_sessions', 'last_active_project')").all();
         for (const row of rows) {
           let value = null;
@@ -2712,13 +2713,21 @@ async function _runOp(op, payload = {}, task = null) {
       // The retired-store branch was already unreachable once agent_sessions existed. Keeping this
       // query on current metadata tables also prevents an obsolete-schema error path.
       const conn = _readonlyRoutedDb(payload.dbPath);
+      // D-7 (WP-3): the tier-3 input filter classifies a candidate's first_message with
+      // shared/conversation-provenance.js, which reads the row's provider. Project it, but only
+      // when the schema carries it — same "include the column only when present" guard as
+      // startupTasksScan below, so a minimal/legacy agent_sessions never throws "no such column".
+      // ctm_sessions.provider mirrors the same value, so agent_sessions is the only probe needed.
+      const agentCols = new Set(conn.prepare('PRAGMA table_info(agent_sessions)').all().map((c) => c.name));
+      const providerExpr = agentCols.has('provider') ? "COALESCE(NULLIF(a.provider, ''), 'claude')" : "'claude'";
       const rows = conn.prepare(`
-        SELECT session_id, first_message, user_msg_count
+        SELECT session_id, first_message, user_msg_count, provider
           FROM (
             SELECT
               COALESCE(NULLIF(a.ctm_session_id, ''), a.agent_session_id) AS session_id,
               a.first_message,
               COALESCE(a.user_msg_count, 0) AS user_msg_count,
+              ${providerExpr} AS provider,
               COALESCE(NULLIF(a.modified_at, ''), a.updated_at, a.created_at) AS sort_ts,
               ROW_NUMBER() OVER (
                 PARTITION BY COALESCE(NULLIF(a.ctm_session_id, ''), a.agent_session_id)
@@ -2741,6 +2750,8 @@ async function _runOp(op, payload = {}, task = null) {
       return _transferJson({ rows });
     }
 
+    case 'backfillAgentTitles': return _transferJson(readAgentTitleBackfillPage(_readonlyRoutedDb(payload.dbPath), payload)); // WP-6: <=64 KiB tail per row
+
     case 'sessionSearchStatus': {
       const conn = _readonlyRoutedDb(payload.dbPath);
       let runtimeAvailable = false;

package/template/coding-task-manager/workers/session-host-pool-process.js

@@ -207,10 +207,15 @@ function createSessionState(sessionId, o) {
   };
   state.mirrorFeed = createHostedMirrorFeedCoalescer({
     cmd: () => state.cmd || '',
-    deliver: (data) => {
+    // WP-4 (clock-free-tests-followups-r4-2026-10-24.html §5 R-9, §6.5): same `receivedAt` ->
+    // `hostReceivedAt` relay as the dedicated host (workers/session-host-process.js) -- this op
+    // never leaves this process, so the stamp rides the 'typing-stage' message instead.
+    deliver: (data, meta) => {
       if (!data) return;
       if (process.env.CTM_DEBUG_MIRROR_FEED) console.error(`[mirror-feed-debug] deliver sid=${sessionId.slice(0, 8)} bytes=${data.length}`);
-      Promise.resolve(headless.handleMessage({ type: 'feed', sessionId, data }))
+      Promise.resolve(headless.handleMessage({
+        type: 'feed', sessionId, data, hostReceivedAt: meta && meta.receivedAt,
+      }))
         .then(() => { if (process.env.CTM_DEBUG_MIRROR_FEED) console.error(`[mirror-feed-debug] fed-ok sid=${sessionId.slice(0, 8)} bytes=${data.length}`); })
         .catch((err) => hostError(sessionId, err, { code: 'headless_feed_failed' }));
     },
@@ -516,7 +521,7 @@ async function handleHello(msg, ctx) {
   // WP-3: protocolVersion is echoed unconditionally -- the dialer (manager or
   // probeHostAlive) is what decides whether it matches; this worker doesn't
   // validate the hello's own protocolVersion.
-  ctx.reply({ type: 'state', recoveryShutdownVersion: 1, protocolVersion: PROTOCOL_VERSION, floorVersion: FLOOR_VERSION, closureHash: HOST_CLOSURE.closureHash, closureFiles: HOST_CLOSURE.closureFiles, sessions: buildSessionsState() });
+  ctx.reply({ type: 'state', recoveryShutdownVersion: 1, protocolVersion: PROTOCOL_VERSION, floorVersion: FLOOR_VERSION, closureHash: HOST_CLOSURE.closureHash, closureFiles: HOST_CLOSURE.closureFiles, sessions: buildSessionsState(), threadpool: _threadpoolSnapshotForState() });
   if (role === CONTROL_CONNECTION_ROLE.CONTROLLER) probeHold.release(); // probe: held frames go out AFTER `state` (the dial ignores earlier frames)
   if (role === CONTROL_CONNECTION_ROLE.PROBE) return;
   for (const [sessionId, state] of Array.from(sessions)) {
@@ -675,12 +680,19 @@ function shutdownOnSignal() {
 }
 process.on('SIGTERM', shutdownOnSignal);
 process.on('SIGHUP', shutdownOnSignal);
+// D-6 (docs/nightly-followups-r3-pty-selector-flakes-2026-10-22.html §5): process.exit(1) in the
+// same turn as a spawn closes the masters with node-pty's helpers still pre-exec, which parks them
+// in XNU's carrier wait and strands them as ppid-1 orphans (census B, Table 2). SIGHUP every open
+// PTY group synchronously first -- the exit code and the log line are unchanged, and for an
+// already-exec'd child a SIGHUP before exit has the same effect as the kernel hang-up at exit (P-2).
 process.on('uncaughtException', (err) => {
   hostError('', err, { code: 'uncaught_exception' });
+  for (const state of sessions.values()) { if (!state.ptyClosed) signalPtyGroup(state, 'SIGHUP'); }
   process.exit(1);
 });
 process.on('unhandledRejection', (err) => {
   hostError('', err, { code: 'unhandled_rejection' });
+  for (const state of sessions.values()) { if (!state.ptyClosed) signalPtyGroup(state, 'SIGHUP'); }
   process.exit(1);
 });
 
@@ -735,10 +747,12 @@ if (!CONTROL_SOCKET_PATH) send({ type: 'ready', pid: process.pid, closureHash: H
 // Host self-truth watchdog (D-4): a worker_thread reads a SharedArrayBuffer stamped before every headless-term op, so a wedged main
 // thread stays observable (lib/host-self-truth-watchdog.js). Deferred to setImmediate so new Worker() cannot delay the socket chmod.
 setImmediate(() => startHostSelfTruthWatchdog({ role: 'session-host', hostId: `pool-${process.pid}` }));
-
+function _threadpoolSnapshotForState() { try { const s = _threadpoolMonitor.snapshot(); return s ? { state: s.state, oldestPendingMs: Number(s.oldestPendingMs) || 0 } : null; } catch { return null; } /* expected: a state reply must never fail on the probe (WP-3 D-4/S-9) */ }
 // Dead libuv threadpool = a named, REPORT-ONLY fact within 10s (lib/host-threadpool-monitor.js).
 const _threadpoolMonitor = createHostThreadpoolMonitor({
   rootDir: getDataDir(),
+  // WP-0 (D-6): every frame names the sessions with an op in flight (5 oldest).
+  extraSnapshot: () => ({ sessionOps: headless.oldestInFlightOps(5) }),
   onFrame: (frame) => send({ type: 'host-threadpool', pid: process.pid, ...frame }),
 });
 _threadpoolMonitor.start();

package/template/coding-task-manager/workers/session-host-process.js

@@ -123,10 +123,15 @@ const headless = bindHeadlessTerminalService({
 const mirrorFeed = createHostedMirrorFeedCoalescer({
   cmd: () => sessionCmd,
   protectIncompleteOnFlush: MIRROR_CONTROL_FLUSH_GUARD_ENABLED,
-  deliver: (data) => {
+  // WP-4 (clock-free-tests-followups-r4-2026-10-24.html §5 R-9, §6.5): carry the coalescer's own
+  // receipt time (first byte of a held batch, now() for the immediate path) on the op, so
+  // lib/headless-term-service.js can stamp 'host-pty-data' at it. An older caller that passes no
+  // meta simply yields `undefined`, and the service then stamps nothing.
+  deliver: (data, meta) => {
     if (!data) return;
-    Promise.resolve(headless.handleMessage({ type: 'feed', sessionId, data }))
-      .catch((err) => hostError(err, { code: 'headless_feed_failed' }));
+    Promise.resolve(headless.handleMessage({
+      type: 'feed', sessionId, data, hostReceivedAt: meta && meta.receivedAt,
+    })).catch((err) => hostError(err, { code: 'headless_feed_failed' }));
   },
 });
 
@@ -566,12 +571,18 @@ function shutdownOnSignal() {
 }
 process.on('SIGTERM', shutdownOnSignal);
 process.on('SIGHUP', shutdownOnSignal);
+// D-6 (docs/nightly-followups-r3-pty-selector-flakes-2026-10-22.html §5): process.exit(1) in the
+// same turn as a spawn closes the master with node-pty's helper still pre-exec, parking it in
+// XNU's carrier wait as a ppid-1 orphan. SIGHUP the open PTY group synchronously first; the exit
+// code and the log line are unchanged (for an exec'd child this matches the kernel hang-up at exit).
 process.on('uncaughtException', (err) => {
   hostError(err, { code: 'uncaught_exception' });
+  if (!ptyClosed) signalPtyGroup('SIGHUP');
   process.exit(1);
 });
 process.on('unhandledRejection', (err) => {
   hostError(err, { code: 'unhandled_rejection' });
+  if (!ptyClosed) signalPtyGroup('SIGHUP');
   process.exit(1);
 });
 

package/template/coding-task-manager/workers/transcript-archive-worker.js

@@ -42,7 +42,7 @@ async function runOp(message) {
   const input = message.input || {};
   const opts = { ...input, store: createStore(message.requestId) };
   switch (message.op) {
-    case 'archive': return archiver.runArchiveCycle(opts); // WP-9: archive, purge, scrub
+    case 'archive': return archiver.runArchiveCycle(opts); // WP-1/WP-9: archive, recover, scrub
     case 'digest': return archiver.runDigestCycle(opts); // D-24: digest idle files whose size changed, no compression
     case 'restore': return archiver.restoreUnit(input, opts); // D-20: archived / trashed members back as plain files
     default:

package/template/coding-task-manager/workers/worktree-worker.js

@@ -10,6 +10,12 @@ const { createErrorSink } = require('../lib/error-sink');
 const { scanReviewRoots } = require('../lib/review-root-scan');
 const { lsTree } = require('../lib/review-tree-scan')(gitUtils.git);
 const untrackedDiffer = require('../lib/review-untracked-diff').createReviewUntrackedDiff({ git: gitUtils.git, parseDiff: gitUtils.parseDiff });
+// WP-2 (docs/remote-hub-followups-credential-projects-rows-idempotency-2026-10-23.html §6): the ONE
+// lossless project-entry decoder (lib/decode-project-entry.js — backtracking existence search, then
+// the transcript "cwd" fallback; memoized) and the gate-scratch predicate. Both are pure/DB-free,
+// which is why this worker (never db.js) can load them.
+const { decodeClaudeProjectEntry } = require('../lib/decode-project-entry');
+const { isGateScratchPath } = require('../lib/review-repo-admission');
 
 const errorSink = createErrorSink({ name: 'worker:worktree' });
 let activeTask = null;
@@ -104,6 +110,34 @@ async function runOp(op, payload = {}, context = {}) {
       return { observation: await observeWorktree(cwd, payload.integrationBaseRef) };
     case 'listWorktrees':
       return { worktrees: await gitUtils.listWorktrees(cwd) };
+    case 'gitRemoteKeys': {
+      // Remote machine hub WP-4 (§6.5): normalized origin key per /api/projects path ('' for a
+      // non-repo), so a hub can match the same repo across machines. Cached in git-utils.
+      const rows = (Array.isArray(payload.paths) ? payload.paths : []).map(p => ({ path: p }));
+      await gitUtils.attachGitRemoteKeys(rows);
+      return { keys: Object.fromEntries(rows.map(row => [row.path, row.gitRemoteKey || ''])) };
+    }
+    case 'projectRows': {
+      // Remote hub follow-ups WP-2 (D-5..D-8, §9 S-8/S-9): the /api/projects rows for
+      // `$HOME/.claude/projects`. Claude encodes EVERY non-alphanumeric character of a project's
+      // cwd as '-', so the old main-thread `entry.replace(/-/g,'/')` named a path that does not
+      // exist for 529 of the lead's 540 entries (214 ms cold for 540 entries — hence this op).
+      // Per entry, in input order: decode with the lossless decoder, keep the row only when the
+      // decoded path really is a directory and is not one of the gate's own scratch checkouts,
+      // then attach the same normalized origin key the gitRemoteKeys op uses. The entry (not the
+      // decoded path) stays the row id, so the client's project identity is unchanged.
+      const rows = [];
+      for (const entry of Array.isArray(payload.entries) ? payload.entries : []) {
+        const projectPath = decodeClaudeProjectEntry(entry);
+        let isDirectory = false;
+        try { isDirectory = fs.statSync(projectPath).isDirectory(); }
+        catch { /* expected: a decoded path that is gone (or that never existed) is simply not listed */ }
+        if (!isDirectory || isGateScratchPath(projectPath)) continue;
+        rows.push({ id: entry, path: projectPath, exists: true });
+      }
+      await gitUtils.attachGitRemoteKeys(rows);
+      return { rows: rows.map(row => ({ id: row.id, path: row.path, exists: true, gitRemoteKey: row.gitRemoteKey || '' })) };
+    }
     case 'scanRoots':
       // Review Hub root feed (WP-3, task-4-brief.md D-2b): fs-only depth-limited walk, no
       // git at all — a candidate is any directory containing a `.git` entry (file or dir,

package/template/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "walle",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "walle",
-      "version": "0.10.0",
+      "version": "0.10.2",
       "hasInstallScript": true,
       "dependencies": {
         "pg": "^8.22.0"

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "walle",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "private": true,
   "description": "Wall-E — your personal digital twin",
   "walleRuntime": {

package/template/scripts/conversation-storage-v2-migration.js

@@ -25,6 +25,7 @@ const {
   classifyRetainedConversationRow,
   retainedHistorySqlPredicate: _retainedHistoryRowPredicate,
   sanitizeInspectionViolations,
+  WALLE_BASELINE_EMPTY_COLUMNS,
 } = require('../shared/conversation-storage-v2-contract');
 const { classifyUserProvenance } = require('../shared/conversation-provenance');
 const ctmStore = require('../coding-task-manager/lib/conversation-store-v2');
@@ -973,7 +974,11 @@ function _convertWalleConversationEventPayload(db) {
     forked_from_turn_id=substr(json_extract(payload_json,'$.forked_from_turn_id'),1,240),
     permanent=CAST(json_extract(payload_json,'$.permanent') AS INTEGER)
     WHERE json_valid(payload_json)`);
-  return _dropColumns(db, 'conversation_events', ['payload_json']);
+  // R-2 (clock-free r4 D-1): payload_json is one of the 8 allowed Wall-E baseline
+  // columns, so the typed-column conversion above is followed by an in-place
+  // sanitize instead of a DROP. The returned change count replaces the old
+  // _dropColumns result in the purge report.
+  return db.prepare("UPDATE conversation_events SET payload_json='{}' WHERE payload_json <> '{}'").run().changes;
 }
 
 function _retainSafeCtmHistoryRows(db) {
@@ -1091,24 +1096,24 @@ function purgeWalleLegacy(db) {
     }
     if (_tableExists(db, 'chat_messages')) {
       report.chat_messages_deleted = db.prepare("DELETE FROM chat_messages WHERE role NOT IN ('user','assistant') OR length(trim(content))=0").run().changes;
-      if (_columns(db, 'chat_messages').includes('attachments')) {
-        report.chat_messages_sanitized = db.prepare('UPDATE chat_messages SET attachments=NULL WHERE attachments IS NOT NULL').run().changes;
-      }
     }
     if (_tableExists(db, 'runtime_events')) {
       report.runtime_events_deleted = _deleteAll(db, 'runtime_events');
     }
     try { db.exec('DROP INDEX IF EXISTS idx_chat_message_parts_type; DROP INDEX IF EXISTS idx_runtime_events_tool;'); } catch {}
-    report.chat_message_columns = _dropColumns(db, 'chat_messages', ['attachments']);
     report.chat_part_columns = _dropColumns(db, 'chat_message_parts', ['tool_name','status','title','summary','data_json','model_projection']);
     report.runtime_event_columns = _dropColumns(db, 'runtime_events', ['message_id','tool_name','summary','payload_json']);
-    report.skill_execution_columns = _dropColumns(db, 'skill_executions', ['tool_calls','tool_results','error','decision_reason']);
+    report.skill_execution_columns = _dropColumns(db, 'skill_executions', ['tool_calls','tool_results','error']);
     report.coding_session_columns = _dropColumns(db, 'coding_agent_sessions', ['tool_calls','files_modified','git_diff']);
-    report.conversation_turn_columns = _dropColumns(db, 'conversation_turns', ['attachments_json']);
-    report.context_snapshot_columns = _dropColumns(db, 'conversation_context_snapshots', ['messages_json','provider_request_ref']);
-    report.attempt_columns = _dropColumns(db, 'conversation_attempts', ['error']);
-    report.context_generation_columns = _dropColumns(db, 'conversation_context_generations', ['messages_json']);
     report.conversation_event_columns = _convertWalleConversationEventPayload(db);
+    // R-2 (clock-free r4 D-1): the 8 Wall-E baseline columns are sanitized in place, never
+    // dropped -- Wall-E still writes conversation_context_snapshots.messages_json, so a
+    // DROP here breaks every later appendRunAttempt. The generic step replaces the former
+    // inline `UPDATE chat_messages SET attachments=NULL` and the 8 _dropColumns entries;
+    // the other prohibited columns keep their drops above. It runs AFTER
+    // _convertWalleConversationEventPayload so conversation_events.payload_json is still
+    // readable when the typed-column extraction reads it (that call owns emptying it).
+    report.baseline_empty_sanitized = _sanitizeWalleBaselineEmptyColumns(db);
     report.initiative_columns = _dropColumns(db, 'initiative_log', ['state_snapshot','reasoning','decision_data']);
     report.session_columns = _dropColumns(db, 'sessions', ['compacted_messages','metadata']);
     report.shadow_result_columns = _dropColumns(db, 'shadow_results', ['judge_reasoning','error']);
@@ -1175,6 +1180,49 @@ function _prohibitedColumns(kind) {
   };
 }
 
+// D-1 (clock-free r4): the conversation-storage v2 contract protects CONTENT, not
+// columns. These 8 columns are Wall-E's own baseline DDL (wall-e/brain/schema.js
+// createTables(), additive-only) and are legitimately present on every fresh brain.
+// Their mere presence is not a violation; a non-empty value is
+// (code 'prohibited_rows'). The empty set lives in the contract module so no
+// literal is duplicated here. `_quoteIdentifier` guards the identifier; the empty
+// value is a fixed contract constant, inlined as an SQL literal because
+// _countWhere/_existsWhere take no bind parameters.
+function _walleBaselineEmptyColumns() {
+  return Object.entries(WALLE_BASELINE_EMPTY_COLUMNS)
+    .map(([id, { empty }]) => {
+      const separator = id.indexOf('.');
+      return { id, table: id.slice(0, separator), column: id.slice(separator + 1), empty };
+    });
+}
+
+function _walleEmptySqlLiteral(empty) {
+  return empty === null ? 'NULL' : `'${String(empty).replace(/'/g, "''")}'`;
+}
+
+function _walleBaselineEmptyPredicate(column, empty) {
+  const col = _quoteIdentifier(column);
+  // A NULL value is always "empty"; a NOT NULL column (three of the 8) still
+  // takes its literal empty value, which is what the equality branch matches.
+  if (empty === null) return `${col} IS NOT NULL`;
+  return `NOT (${col} IS NULL OR ${col} = ${_walleEmptySqlLiteral(empty)})`;
+}
+
+// R-2 (clock-free r4): sanitize the 8 in place instead of dropping them, so a
+// Wall-E writer naming one of these columns (observed: conversation_context_snapshots.messages_json,
+// wall-e/brain/conversation.js:315-318) keeps working after the purge.
+function _sanitizeWalleBaselineEmptyColumns(db) {
+  const report = {};
+  for (const { id, table, column, empty } of _walleBaselineEmptyColumns()) {
+    if (!_columns(db, table).includes(column)) continue;
+    const where = _walleBaselineEmptyPredicate(column, empty);
+    report[id] = db.prepare(
+      `UPDATE ${_quoteIdentifier(table)} SET ${_quoteIdentifier(column)} = ${_walleEmptySqlLiteral(empty)} WHERE ${where}`,
+    ).run().changes;
+  }
+  return report;
+}
+
 function _countWhere(db, table, where = '1=1') {
   if (!_tableExists(db, table)) return 0;
   try { return Number(db.prepare(`SELECT COUNT(*) AS n FROM ${_quoteIdentifier(table)} WHERE ${where}`).get().n); }
@@ -1195,9 +1243,15 @@ function inspectDatabaseAbsence(db, {
   allowRetainedCtmHistoryRows = false, countViolations = false,
 } = {}) {
   const prohibitedColumns = [];
+  // D-1 (clock-free r4): the 8 Wall-E baseline columns are allowed to be present
+  // while empty, so they are skipped here and content-checked below instead.
+  const baselineEmptyIds = kind === 'walle' ? new Set(Object.keys(WALLE_BASELINE_EMPTY_COLUMNS)) : null;
   for (const [table, names] of Object.entries(_prohibitedColumns(kind))) {
     const present = new Set(_columns(db, table));
-    for (const column of names) if (present.has(column)) prohibitedColumns.push({ table, column });
+    for (const column of names) {
+      if (baselineEmptyIds?.has(`${table}.${column}`)) continue;
+      if (present.has(column)) prohibitedColumns.push({ table, column });
+    }
   }
   const existingLegacyTables = kind === 'ctm'
     ? CTM_LEGACY_CONVERSATION_TABLES.filter((table) => _tableExists(db, table))
@@ -1270,6 +1324,19 @@ function inspectDatabaseAbsence(db, {
     addRows('chat_messages', "role NOT IN ('user','assistant') OR length(trim(content))=0");
     if (_tableExists(db, 'memories')) addRows('memories',
       "source IN ('claude-code-jsonl','codex-jsonl','gemini-jsonl','opencode-jsonl','walle-jsonl') OR memory_type LIKE 'coding_session_%'");
+    // D-1 (clock-free r4): each allowed baseline column still fails closed on
+    // CONTENT -- a row whose value is neither NULL nor the column's empty value
+    // is a prohibited_rows violation keyed by `<table>.<column>`.
+    for (const { id, table, column, empty } of _walleBaselineEmptyColumns()) {
+      if (!_columns(db, table).includes(column)) continue;
+      const where = _walleBaselineEmptyPredicate(column, empty);
+      if (countViolations) {
+        const count = _countWhere(db, table, where);
+        if (count > 0) prohibitedRows.push({ table: id, count });
+      } else if (_existsWhere(db, table, where)) {
+        prohibitedRows.push({ table: id, count: 1 });
+      }
+    }
   }
   const violations = sanitizeInspectionViolations([
     ...prohibitedColumns.map(({ table, column }) => ({

package/template/shared/conversation-storage-v2-contract.js

@@ -171,8 +171,19 @@ const INSPECTION_CODES = Object.freeze(new Set([
   'prohibited_tables',
   'retained_history_guard_missing',
   'retained_history_dirty',
+  'inspection_failed',
 ]));
 
+// REPORT (clock-free r6 OQ-5): an inspection that throws still plans a rerun, but the
+// boot log names the error class -- the handful of SQLite driver codes and errno-style
+// `E*` names -- instead of an empty violation list. Anything else is 'unknown_error'.
+const INSPECTION_ERROR_CLASS_RE = /^(?:SQLITE_[A-Z_]{1,40}|E[A-Z]{2,20})$/;
+
+function inspectionErrorClass(error) {
+  const code = error && typeof error === 'object' ? error.code : undefined;
+  return typeof code === 'string' && INSPECTION_ERROR_CLASS_RE.test(code) ? code : 'unknown_error';
+}
+
 // The walle prohibited-table and table.column ids below are copied verbatim from
 // _prohibitedColumns('walle') in scripts/conversation-storage-v2-migration.js so that a
 // walle inspection violation is nameable in the boot log instead of collapsing to
@@ -230,6 +241,21 @@ const WALLE_PROHIBITED_COLUMN_IDS = Object.freeze([
   'eval_diagnostics.tool_sequence',
 ]);
 
+// The 8 inherited Wall-E baseline columns (wall-e/brain/schema.js createTables(), additive-only
+// ruling wall-e/brain/migrations.js:1741-1745). Allowed while every value is empty; any other
+// value is a prohibited_rows violation (user ruling 2026-10-24, clock-free r4 D-1).
+const WALLE_BASELINE_EMPTY_COLUMNS = Object.freeze({
+  'chat_messages.attachments':                        Object.freeze({ empty: null }),
+  'skill_executions.decision_reason':                 Object.freeze({ empty: null }),
+  'conversation_turns.attachments_json':              Object.freeze({ empty: '[]' }),
+  'conversation_context_snapshots.messages_json':     Object.freeze({ empty: '[]' }),
+  'conversation_context_snapshots.provider_request_ref': Object.freeze({ empty: null }),
+  'conversation_attempts.error':                      Object.freeze({ empty: null }),
+  'conversation_events.payload_json':                 Object.freeze({ empty: '{}' }),
+  'conversation_context_generations.messages_json':   Object.freeze({ empty: '[]' }),
+});
+// exported next to WALLE_PROHIBITED_COLUMN_IDS; every key MUST also be in that list.
+
 const FIXED_INSPECTION_OBJECT_IDS = Object.freeze(new Set([
   ...CTM_KNOWN_CONVERSATION_TABLES,
   ...CTM_RETAINED_HISTORY_TABLES,
@@ -346,12 +372,18 @@ function sanitizeInspectionViolations(violations) {
   for (const violation of violations) {
     if (!violation || typeof violation !== 'object' || Array.isArray(violation)) continue;
     if (typeof violation.code !== 'string' || !INSPECTION_CODES.has(violation.code)) continue;
-    const objectId = typeof violation.objectId === 'string'
-      && (FIXED_INSPECTION_OBJECT_IDS.has(violation.objectId)
-        || (violation.code === 'unknown_conversation_table_rows'
-          && UNKNOWN_TABLE_OBJECT_ID_RE.test(violation.objectId)))
-      ? violation.objectId
-      : 'unknown_schema_object';
+    const objectId = violation.code === 'inspection_failed'
+      ? (typeof violation.objectId === 'string'
+        && (violation.objectId === 'unknown_error'
+          || INSPECTION_ERROR_CLASS_RE.test(violation.objectId))
+        ? violation.objectId
+        : 'unknown_error')
+      : (typeof violation.objectId === 'string'
+        && (FIXED_INSPECTION_OBJECT_IDS.has(violation.objectId)
+          || (violation.code === 'unknown_conversation_table_rows'
+            && UNKNOWN_TABLE_OBJECT_ID_RE.test(violation.objectId)))
+        ? violation.objectId
+        : 'unknown_schema_object');
     const count = Number(violation.count);
     if (!Number.isFinite(count) || count <= 0) continue;
     const key = `${violation.code}\0${objectId}`;
@@ -380,7 +412,11 @@ module.exports = {
   CTM_CONTENT_BEARING_TABLES,
   CTM_KNOWN_CONVERSATION_TABLES,
   CONVERSATION_TABLE_NAME_RE,
+  WALLE_PROHIBITED_TABLES,
+  WALLE_PROHIBITED_COLUMN_IDS,
+  WALLE_BASELINE_EMPTY_COLUMNS,
   classifyRetainedConversationRow,
   retainedHistorySqlPredicate,
   sanitizeInspectionViolations,
+  inspectionErrorClass,
 };