create-walle 0.10.0 → 0.10.2

package/template/shared/storage/contract.js

@@ -363,7 +363,7 @@ const OP_META = {
   materializeRestoredSessionIndex: { kind: 'write', equality: 'exact', domain: 'core' },
   persistJsonlReconciliationBatch: { kind: 'write', equality: 'exact', domain: 'core' },
   getAllSessionTitles:      { kind: 'read',  equality: 'exact' },
-  setSessionTitleStatusNew: { kind: 'write', equality: 'exact', domain: 'core' }, setSessionTitleMirror: { kind: 'write', equality: 'exact', domain: 'core' }, getSessionTitleMirror: { kind: 'read', equality: 'exact' }, // WP-1
+  setSessionTitleStatusNew: { kind: 'write', equality: 'exact', domain: 'core' }, setSessionTitleMirror: { kind: 'write', equality: 'exact', domain: 'core' }, getSessionTitleMirror: { kind: 'read', equality: 'exact' }, applyAgentTitleBackfillRows: { kind: 'write', equality: 'exact', domain: 'core' }, // WP-1 / session-name WP-6
   updateSessionTokens: { kind: 'write', equality: 'exact', domain: 'core' },
   getSessionTokens:         { kind: 'read',  equality: 'exact' },
   // WP-1 (design doc §5/§9 S-19): last known physical-footprint sample, persisted at
@@ -426,6 +426,40 @@ const OP_META = {
   getHostedSyncSchemaStatus: { kind: 'sqlite-only', equality: 'exact' },
   listHostedWorkspaceBindings: { kind: 'sqlite-only', equality: 'set', idKey: 'logical_id' },
   upsertHostedWorkspaceBinding: { kind: 'write', equality: 'exact', domain: 'core' },
+  // WP-2 (docs/remote-machine-hub-sessions-2026-10-22.html §6.1/§8, deferred from WP-0): the hub
+  // machine-registry writes. Single-table (`machines`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js) — hence the explicit `tables` list Gate 2i
+  // checks against the tag, and the domain tag itself, which is what keeps these off the base
+  // (firehose) writer behind conversation import once the domain split is on.
+  upsertMachineRow: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  recordMachineProbe: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  deleteMachineRow: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  // WP-1 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-11, §9 S-4): the
+  // host-sample pair. `recordHostSample` is one INSERT OR REPLACE plus the 24 h DELETE in a single
+  // transaction, single-table (`host_samples`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js) — so the explicit `tables` list Gate 2i checks
+  // against the tag is exact, and Gate 2g finds the routing declaration the action needs.
+  recordHostSample: { kind: 'write', equality: 'exact', domain: 'core', tables: ['host_samples'] },
+  // The bounded read beside it (oldest first, `sinceMs`/`limit`). `set` equality, keyed on `at`
+  // — the same shape as listSyncOutbox below.
+  listHostSamples: { kind: 'read', equality: 'set', idKey: 'at' },
+  // WP-2a (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/P-5/P-6, §9 S-4):
+  // the machine-owned settings write (single row, single table `machine_self`), the P-5 roster
+  // replacement (single table `machines`, one transaction) and the leave() sweep (`machines`).
+  // Both tables are classified 'core' in coding-task-manager/lib/db-domain-tables.js.
+  setMachineSelf: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_self'] },
+  replaceRosterMachines: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  deleteAllMachineRows: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9, §9 S-15/S-16): the
+  // pairing-offer trio — mint one offer, mark exactly one redeemed (single-use), and the AC-3c burn
+  // that flips every live offer at once. Single-table (`machine_pairing_offers`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js), so Gate 2i's `tables` list is exact. The bounded
+  // read beside them (`listLivePairingOffers`, unspent+unexpired as of `at`) is `set` equality keyed
+  // on `id`, the same shape as listHostSamples above.
+  insertPairingOffer: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  markPairingOfferRedeemed: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  burnLivePairingOffers: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  listLivePairingOffers: { kind: 'read', equality: 'set', idKey: 'id' },
   seedHostedWorkspaceBindings: { kind: 'sqlite-only', equality: 'exact', domain: 'core', tables: ['workspace_bindings'] },
   updateStartupTaskWorkspaceMapping: { kind: 'write', equality: 'exact', domain: 'core' },
   repointStartupTaskWorkspace: { kind: 'sqlite-only', equality: 'exact', domain: 'core', tables: ['startup_tasks', 'sync_outbox', 'synced_entities'] },
@@ -784,8 +818,6 @@ const OP_META = {
   // the live scrollback_identity table is listed.
   prepareScrollbackForSession: { kind: 'write', equality: 'exact', domain: 'core', tables: ['scrollback_identity'] },
   upsertAgentSessionIdentity: { kind: 'write', equality: 'exact', domain: 'core', tables: ['agent_sessions'] },
-  promoteStartupTaskTitleIfUserNamed: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_sessions'] },
-  repairSessionTitlesFromStartupTasks: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_sessions'] },
   repairCodexRolloutAgentIdentities: { kind: 'write', equality: 'exact', domain: 'core', tables: ['agent_sessions', 'ctm_sessions'] },
   cleanupOrphanScrollbackIdentities: { kind: 'write', equality: 'exact', domain: 'core', tables: ['scrollback_identity', 'startup_tasks'] },
   // --- writer:'base' pins (deliberately NOT re-routed; behaviour unchanged) ---

package/template/wall-e/agent.js

@@ -1790,6 +1790,27 @@ async function main() {
     onError: (err) => console.error('[weekly-eval] Error:', err.message),
   });
 
+  // Lead-cost routing WP-5b §6.8: the daily rules probe. The outcome stream alone cannot move
+  // an off explore cell -- the 7-day probe window needs elapsed time -- so one job per day runs
+  // the evaluator over every explore cell. The write crosses to the brain owner through
+  // runRuntimeJob (the $WALLE_OWNER path), the same shape as the sibling daily brain jobs; there
+  // is no day-of-week gate because the evaluator owns its own timing.
+  scheduler.register({
+    name: 'helper-rules-probe',
+    networkClass: 'local', // local sqlite read + one owner-path write, no provider call
+    run: async () => runRuntimeJob(
+      'helper-rules-probe',
+      () => require('./loops/brain-write').brainWrite('helperRulesDailyTick'),
+    ),
+    intervalMs: 24 * 60 * 60 * 1000, // daily
+    pool: 'maintenance',
+    lane: 2,
+    priority: 11,
+    restartCatchupPolicy: 'defer',
+    startDelayMs: 240000, // 4min — well off the boot/readiness path and unique in the maintenance pool
+    onError: (err) => console.error('[helper-rules-probe] Error:', err.message),
+  });
+
   // Note: session mining runs inside weekly-eval-loop (step 3), no separate scheduler needed.
 
   const _bootPostRegisterT = _perf.now();

package/template/wall-e/api-walle.js

@@ -12,6 +12,7 @@ const syncApiModule = require('./http/sync-api');
 const { handleAdminApi } = require('./http/admin-api');
 const { handleAssistantApi } = require('./http/assistant-api');
 const { handleBackgroundCompletionApi } = require('./http/background-completion-api');
+const { handleHelperRulesApi } = require('./http/helper-rules-api');
 const { handleContextApi } = require('./http/context-api');
 const { handleFeedbackApi } = require('./http/feedback-api');
 const { handleCodingApi } = require('./http/coding-api');
@@ -2337,6 +2338,10 @@ function routeWalleApi(req, res, url, routeHandlers = {}) {
     if (!brain || !ensureBrainInit()) return jsonResponse(res, { error: 'Brain module not available' }, 503), true;
     return handleBackgroundCompletionApi(req, res, url, { brain });
   }
+  // WP-4 (lead-cost-routing-round1-2026-10-21.html §6.4): the stdio MCP proxy's read-only state
+  // read, dispatched here (not inside the frozen handleWalleApi) alongside the block above.
+  // WP-7 extends the same handler with the panel's /cells routes; it answers false for anything else under the prefix.
+  if (url.pathname === '/api/wall-e/helper-rules/guidance' || url.pathname.startsWith('/api/wall-e/helper-rules/cells')) return handleHelperRulesApi(req, res, url, { brain, ensureBrainInit });
   if ((url.pathname === '/api/decisions' && req.method === 'POST') || (url.pathname === '/api/decisions/status' && req.method === 'GET')) return require('./http/decisions-api').handleDecisionsApi(req, res, url, routeHandlers.decisions);
   // multi-machine WP-5 (§6.6): the brain sync pair. Dispatched here, not inside
   // the frozen handleWalleApi, because the doc's spelling is `/api/walle/sync/*`

package/template/wall-e/bin/brain-purge-legacy-ctm.js

@@ -234,11 +234,12 @@ function isConfiguredBrain(dbPath) {
 }
 
 // Returns '' when the db is not live, otherwise the reason. The write-lock owner check is the one
-// check --force-live does not skip.
+// check --force-live does not skip. The protocol-2 record persists after release (D-3), so a live
+// pid here means "the last write-lock holder is still alive", not "a write is in flight".
 async function liveReason(dbPath, { forceLive, deps }) {
   try {
     const info = JSON.parse(fs.readFileSync(`${dbPath}.write-lock`, 'utf8'));
-    if (info && info.pid !== process.pid && pidAlive(info.pid)) return `write-lock held by alive pid ${info.pid}`;
+    if (info && info.pid !== process.pid && pidAlive(info.pid)) return `last write-lock holder pid ${info.pid} is alive`;
   } catch {
     /* expected: no lock file, or an unparseable stale one, is "no alive owner" */
   }

package/template/wall-e/bin/walle-mcp-stdio.js

@@ -8,6 +8,7 @@ const { ctmPort: resolveCtmPort } = require('../lib/ctm-endpoint');
 const {
   handleProtocolMessage,
 } = require('../mcp-protocol-contract');
+const { fetchExploreCellState, httpJsonGet, leadAgentFromClientInfo } = require('../lib/helper-rules/cell-state');
 const {
   attachDelegateCallerContext,
   resolveCallerParentAgentSessionId,
@@ -166,10 +167,15 @@ function _localControlPlaneEnabled() {
   return !/^(0|false|no|off)$/i.test(String(process.env.WALLE_MCP_LOCAL_CONTROL_PLANE || '').trim());
 }
 
-function _localControlResponseOne(message) {
-  let control = handleProtocolMessage(message);
+async function _localControlResponseOne(message) {
+  // WP-4 §6.4: the caller harness's `explore` cell lives in the daemon (this process owns no
+  // brain): read-only endpoint, existing breaker machinery, 1500 ms bound, fail-open 'on'.
+  const options = message?.method === 'initialize'
+    ? { leadGuidance: { explore: await fetchExploreCellState({ agent: leadAgentFromClientInfo(message.params?.clientInfo), requestFn: (path) => _executeDaemonRequest(() => httpJsonGet({ host: process.env.WALLE_HOST || '127.0.0.1', port: _wallePort(), path })) }) } }
+    : undefined;
+  let control = handleProtocolMessage(message, options);
   if (!control.handled) {
-    control = require('../mcp-contract').handleControlMessage(message);
+    control = require('../mcp-contract').handleControlMessage(message, options);
   }
   return control.handled ? {
     handled: true,
@@ -178,10 +184,10 @@ function _localControlResponseOne(message) {
   } : { handled: false, response: null, protocolVersion: '' };
 }
 
-function _localControlResponse(message) {
+async function _localControlResponse(message) {
   if (!_localControlPlaneEnabled()) return { handled: false, response: null };
   if (!Array.isArray(message)) return _localControlResponseOne(message);
-  const results = message.map(_localControlResponseOne);
+  const results = await Promise.all(message.map((item) => _localControlResponseOne(item)));
   if (!results.every((result) => result.handled)) return { handled: false, response: null };
   const responses = results.map((result) => result.response).filter(Boolean);
   return { handled: true, response: responses.length ? responses : null, protocolVersion: '' };
@@ -655,7 +661,7 @@ async function handleOne(message) {
       protocol,
     });
   }
-  const control = _localControlResponse(message);
+  const control = await _localControlResponse(message);
   if (control.handled) {
     const selectedProtocol = control.protocolVersion || protocol;
     mcpDiagnostics.recordPhase('local_response_built', {

package/template/wall-e/brain/helper-rules-schema.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// Lead-cost routing WP-5a (design §6.6): the helper-rules record — three tables and one
+// seeded kv row. The DDL is a plain string with two callers rather than an exec-in-place,
+// exactly like brain/schema.js's ensureBrainSyncSchema: `MIGRATIONS[100]` runs it on an
+// existing brain walking the ladder forward, and the runner's `ensures` list
+// (brain/schema-ensures.js) runs it on a fresh install, which stamps SCHEMA_VERSION
+// directly and never replays a migration body. Both paths execute the SAME text, which is
+// what tests-integration/migration-baseline-parity.test.js compares.
+//
+// Migration IDs, once written, are never renumbered. Additive and idempotent: a second run
+// changes nothing (IF NOT EXISTS throughout, INSERT OR IGNORE for the seed).
+
+const HELPER_RULES_DDL = `
+CREATE TABLE IF NOT EXISTS helper_outcomes (
+  id TEXT PRIMARY KEY,                      -- wait-watch: '<wait_id>:<worker_id>:<n>' ; explore: the delegation invocation id
+  cell_key TEXT NOT NULL,                   -- wait-watch|default|<route_alias>  or  explore|default|<codex|claude>
+  kind TEXT NOT NULL,                       -- 'wait-watch' | 'explore'
+  seq INTEGER NOT NULL,                     -- per-cell sequence (trailing windows)
+  label TEXT,                               -- wait-watch: useful | empty | late | silent_useful | silent_empty ; explore: NULL
+  decision TEXT,                            -- wait-watch: KEEP_WAITING | WAKE_LEAD ; explore: open | handoff | fallback
+  helper_usd REAL, lead_usd REAL,
+  seconds_to_report REAL, reread_rate REAL, report_rows INTEGER,
+  grade_json TEXT,                          -- WP-6 fills it; NULL here
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_helper_outcomes_cell ON helper_outcomes(cell_key, seq);
+CREATE TABLE IF NOT EXISTS helper_rule_cells (
+  cell_key TEXT PRIMARY KEY, kind TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'on',         -- on | off | probe   (missing row = on)
+  user_veto INTEGER NOT NULL DEFAULT 0,     -- no probe while set
+  metrics_json TEXT,
+  state_changed_at TEXT, updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE TABLE IF NOT EXISTS helper_rule_events (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, cell_key TEXT NOT NULL, from_state TEXT, to_state TEXT NOT NULL,
+  reason TEXT NOT NULL, evidence_json TEXT NOT NULL, created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+`;
+
+// Lead-cost routing round 2 WP-2 (§6.4, S-15): migration 101's additive columns. Round 1 kept
+// only the derived label (`report_rows`), which is precisely what made the mislabelled round-1
+// history impossible to correct — the observed inputs were thrown away. These three columns keep
+// them: `worker_id` is the ctm_session_id the row is addressable by (D-5, `closeOutcomeByWorker`),
+// `facts_json` is the §6.2 facts object the label is re-derivable from (D-1/D-5), and
+// `label_version` says which rule produced the stored decision (NULL facts ⇒ 1, the round-1 rows).
+//
+// SQLite has no `ADD COLUMN IF NOT EXISTS`, so the driver probes `PRAGMA table_info` per column —
+// the same shape brain/recall-hints-migration.js uses. `MIGRATIONS[101]` runs this on an existing
+// brain; the runner's ensures list runs it (right after migration 100's text) on a fresh install,
+// so `baseline + stamp` and the ladder produce byte-identical schemas
+// (tests-integration/migration-baseline-parity.test.js compares sqlite_master, and an ALTER
+// rewrites the stored CREATE TABLE text, so this is load-bearing).
+const HELPER_RULES_V2_COLUMNS = [
+  ['worker_id', 'TEXT'],                          // ctm_session_id of the review worker (explore) or watched worker (wait-watch)
+  ['facts_json', 'TEXT'],                         // round-2 facts; NULL on round-1 rows
+  ['label_version', 'INTEGER NOT NULL DEFAULT 1'],
+];
+const HELPER_RULES_V2_INDEX = 'CREATE INDEX IF NOT EXISTS idx_helper_outcomes_worker ON helper_outcomes(worker_id)';
+
+// D-6: the `helper_rules.relabelled_to` watermark — the label version the one-time relabel +
+// recovery pass has already run for. Seeded at 1 (the round-1 version) so the FIRST run at
+// LABEL_VERSION 2 does the recovery, and every later call is a no-op.
+const RELABELLED_TO_KEY = 'helper_rules.relabelled_to';
+const RELABELLED_TO_SEED = '1';
+
+// WP-0's census measurement (the lead's own cost per burst): the explore rule's
+// "handing off costs more than the lead was already spending" ceiling. Seeded, not
+// hard-coded, so the panel and the evaluator read one number the user can move.
+const LEAD_BURST_USD_KEY = 'helper_rules.lead_burst_usd';
+const LEAD_BURST_USD_SEED = '0.46';
+
+// WP-6 (§6.5, D-19): the spot-check grader's pin. Seeded, not hard-coded at the call site, so the
+// user can move it in kv_store and the grader follows — the ONE place a grader model id appears.
+// No fallback is derived from it: an empty value stores the sample as `unavailable`.
+const GRADER_MODEL_KEY = 'helper_rules.grader_model';
+const GRADER_MODEL_SEED = 'claude-opus-5-5';
+
+/** Idempotent, additive. Both the ladder (migration 100) and the fresh-install ensures call this. */
+function ensureHelperRulesSchema(d) {
+  if (!d || typeof d.exec !== 'function') return;
+  d.exec(HELPER_RULES_DDL);
+  // Same shape as brain.js's kv writes (INSERT ... ON CONFLICT): a plain INSERT OR IGNORE
+  // so a value the user (or a later census) already wrote is never overwritten.
+  const seedKv = d.prepare("INSERT OR IGNORE INTO kv_store (key, value, updated_at) VALUES (?, ?, datetime('now'))");
+  seedKv.run(LEAD_BURST_USD_KEY, LEAD_BURST_USD_SEED);
+  seedKv.run(GRADER_MODEL_KEY, GRADER_MODEL_SEED);
+}
+
+/**
+ * Lead-cost routing round 2 WP-2 (S-15): the migration-101 additions — `worker_id`, `facts_json`,
+ * `label_version`, their index, and the `helper_rules.relabelled_to` watermark. Idempotent: each
+ * ALTER is skipped once the column exists, the index is `IF NOT EXISTS`, and the seed is
+ * `INSERT OR IGNORE`, so the invariant-repair rewind and the fresh-install ensures may re-run it
+ * any number of times.
+ */
+function ensureHelperRulesSchemaV2(d) {
+  if (!d || typeof d.exec !== 'function') return;
+  // Migration 101 sits directly above 100, and the ensures list runs 100's text first, so the
+  // table always exists on both paths; a bare handle still gets a complete v2 schema rather than
+  // an "no such table" from the first ALTER.
+  const readColumns = () => d.prepare('PRAGMA table_info(helper_outcomes)').all().map((row) => row.name);
+  let present = new Set(readColumns());
+  if (!present.size) {
+    ensureHelperRulesSchema(d);
+    present = new Set(readColumns());
+  }
+  for (const [name, type] of HELPER_RULES_V2_COLUMNS) {
+    if (present.has(name)) continue;
+    d.exec(`ALTER TABLE helper_outcomes ADD COLUMN ${name} ${type}`);
+  }
+  d.exec(HELPER_RULES_V2_INDEX);
+  d.prepare("INSERT OR IGNORE INTO kv_store (key, value, updated_at) VALUES (?, ?, datetime('now'))")
+    .run(RELABELLED_TO_KEY, RELABELLED_TO_SEED);
+}
+
+module.exports = {
+  GRADER_MODEL_KEY,
+  GRADER_MODEL_SEED,
+  HELPER_RULES_DDL,
+  HELPER_RULES_V2_COLUMNS,
+  HELPER_RULES_V2_INDEX,
+  LEAD_BURST_USD_KEY,
+  LEAD_BURST_USD_SEED,
+  RELABELLED_TO_KEY,
+  RELABELLED_TO_SEED,
+  ensureHelperRulesSchema,
+  ensureHelperRulesSchemaV2,
+};

package/template/wall-e/brain/migrations.js

@@ -160,6 +160,32 @@ function ensureSlackInboundJobSeed(d, { now = Date.now } = {}) {
   return SLACK_INBOUND_JOB_ID;
 }
 
+// Migration 57's body (WP-2 fix round 1, db-migration-consolidation), lifted
+// into a named export (clock-free r4 R-4). Heals databases whose
+// conversation_context_snapshots.messages_json was physically dropped by
+// migration 52's now-retired fresh-only branch. That branch used to run right
+// after createTables() on every from-0 install, so any DB created while it was
+// live (almost every live fresh install pre-WP-2) is missing this column —
+// including the column existing but no longer nullable-write-compatible: the
+// write path (_appendRunAttempt, brain/conversation.js) names messages_json
+// unconditionally (with a literal '[]' placeholder — it never carries real
+// content, storage minimization is unaffected), so a DB without the column
+// throws "no such column" on every run-attempt write. Additive + idempotent
+// (column probe). Also run every boot from brain/schema-ensures.js because a
+// later CTM v2 purge can drop it again — clock-free r4 R-4.
+function ensureContextSnapshotMessagesJson(d) {
+  const hasTable = d.prepare(
+    "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'conversation_context_snapshots' LIMIT 1"
+  ).get();
+  if (!hasTable) return;
+  const hasColumn = d.prepare("PRAGMA table_info(conversation_context_snapshots)").all()
+    .some((row) => row.name === 'messages_json');
+  if (hasColumn) return;
+  d.prepare(
+    "ALTER TABLE conversation_context_snapshots ADD COLUMN messages_json TEXT NOT NULL DEFAULT '[]'"
+  ).run();
+}
+
 function createMigrationsModule({
   backfillChatMessageParents,
   backfillDefaultBenchmarkProvidersForDb,
@@ -1821,29 +1847,12 @@ const MIGRATIONS = {
     // deletion/repair rules. Idempotent: a second run finds nothing to do.
     sweepModelRegistryAnomalies(d);
   },
-  // Migration 57 (WP-2 fix round 1, db-migration-consolidation): heals databases
-  // whose conversation_context_snapshots.messages_json was physically dropped by
-  // migration 52's now-retired fresh-only branch. That branch used to run right
-  // after createTables() on every from-0 install, so any DB created while it was
-  // live (almost every live fresh install pre-WP-2) is missing this column —
-  // including the column existing but no longer nullable-write-compatible: the
-  // write path (_appendRunAttempt) names messages_json unconditionally (with a
-  // literal '[]' placeholder — it never carries real content, storage
-  // minimization is unaffected), so a DB without the column throws "no such
-  // column" on every run-attempt write. Additive + idempotent (column probe) —
+  // Migration 57 (WP-2 fix round 1, db-migration-consolidation): re-adds a dropped
+  // conversation_context_snapshots.messages_json. The body is
+  // ensureContextSnapshotMessagesJson() above (see its comment), which the boot
+  // `ensures` list also runs (clock-free r4 R-4). Additive + idempotent, so
   // rerunSafe:true is correct.
-  57: (d) => {
-    const hasTable = d.prepare(
-      "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'conversation_context_snapshots' LIMIT 1"
-    ).get();
-    if (!hasTable) return;
-    const hasColumn = d.prepare("PRAGMA table_info(conversation_context_snapshots)").all()
-      .some((row) => row.name === 'messages_json');
-    if (hasColumn) return;
-    d.prepare(
-      "ALTER TABLE conversation_context_snapshots ADD COLUMN messages_json TEXT NOT NULL DEFAULT '[]'"
-    ).run();
-  },
+  57: (d) => ensureContextSnapshotMessagesJson(d),
   // Migration 58 (WP-3, db-migration-consolidation S-7): the one-time destructive
   // RENAME/DROP rebuild of conversation_artifact_provenance's PK (3-col -> 7-col),
   // moved here from ensurePromptPurgeSchema (conversation/prompt-purge.js), which now
@@ -2528,6 +2537,21 @@ const MIGRATIONS = {
   99: (d) => {
     d.exec(DROP_TASK_LEDGER_REMNANTS_SQL);
   },
+  // Migration 100 (lead-cost routing WP-5a, §6.6): the helper-rules record — the two rule
+  // cells' outcome/event log, their state rows and the WP-0 `lead_burst_usd` seed. The DDL
+  // lives in brain/helper-rules-schema.js so the fresh-install path (baseline + stamp, zero
+  // migration bodies) creates the identical text through brain/schema-ensures.js — see
+  // tests-integration/migration-baseline-parity.test.js. Additive and idempotent.
+  100: (d) => { require('./helper-rules-schema').ensureHelperRulesSchema(d); },
+  // Migration 101 (lead-cost routing round 2 WP-2, §6.4 D-1/D-5): the ADDITIVE half of the
+  // helper-rules record — `worker_id` (D-5: a row is addressable by worker, so a close survives
+  // a Wall-E restart), `facts_json` (D-1: the observed inputs the label is re-derivable from) and
+  // `label_version` (which rule produced the stored label), plus the worker index and the
+  // `helper_rules.relabelled_to` watermark the one-time relabel/recovery pass reads and sets.
+  // Same two callers as 100 (this ladder entry + the ensures list in brain/schema-ensures.js),
+  // same text, same reason (tests-integration/migration-baseline-parity.test.js). Additive and
+  // idempotent: the ALTERs are `PRAGMA table_info`-guarded, the index is `IF NOT EXISTS`.
+  101: (d) => { require('./helper-rules-schema').ensureHelperRulesSchemaV2(d); },
 };
 
 // --- Migration 91 (surface-redesign WP-3) ---------------------------------
@@ -2937,6 +2961,11 @@ module.exports = createMigrationsModule;
 // path run — a seed that lived only in MIGRATIONS[94] would exist on an upgraded
 // brain and be missing on a brand-new one.
 module.exports.ensureSlackInboundJobSeed = ensureSlackInboundJobSeed;
+// clock-free r4 R-4 (WP-2): migration 57's body, shared with the boot `ensures`
+// list (brain/schema-ensures.js). A migration body runs once per ladder, so a
+// column dropped by a LATER CTM v2 purge was never healed; the ensures list runs
+// on every open.
+module.exports.ensureContextSnapshotMessagesJson = ensureContextSnapshotMessagesJson;
 module.exports.SLACK_INBOUND_JOB_ID = SLACK_INBOUND_JOB_ID;
 module.exports.SLACK_INBOUND_JOB_CONFIG = SLACK_INBOUND_JOB_CONFIG;
 // WP-14: the exact table set migration 97 drops, so the migration test asserts

package/template/wall-e/brain/model-deployment-facts.js

@@ -11,6 +11,11 @@ function _isoStored(value) {
   return parsed.toISOString();
 }
 
+// D-5: an anthropic-messages route relays the Claude CLI's own
+// `output_config.effort` verbatim, so a deployment's levels are the Claude
+// matrix for its own wire model id -- see `perModelLevels` below.
+const ANTHROPIC_MESSAGES_PROTOCOL = 'anthropic-messages';
+
 function buildModelDeploymentFacts({ db, providerId, protocol, getFactRow, routePolicy = {}, routeConfigRevision, routeReasoningLevels = [] } = {}) {
   if (!db || typeof db.prepare !== 'function') throw new TypeError('supplied db handle required');
   if (typeof getFactRow !== 'function') throw new TypeError('getFactRow required');
@@ -23,6 +28,23 @@ function buildModelDeploymentFacts({ db, providerId, protocol, getFactRow, route
     || routeReasoningLevels.some((level) => typeof level !== 'string' || !['low', 'medium', 'xhigh'].includes(level))) {
     throw new TypeError('routeReasoningLevels invalid');
   }
+  // D-1/D-2: the per-(route, wire model) producer (llm/worker-route.js
+  // routeModelReasoningLevels), called with each registry row's wireModelId.
+  // Only an anthropic-messages route has one: `protocol` IS that route's
+  // classified upstream API (upstreamApisForRow returns anthropic-messages for
+  // exactly one row type), so it is the serializable fact that decides the
+  // branch -- a function callback cannot travel here, this module runs inside
+  // the brain read worker, whose JSON IPC drops it. The require is lazy for the
+  // same reason brain/ never requires llm/ at load time (the seam
+  // brain/delegate-model-prefs-store.js already uses). A non-array producer
+  // result is a programming error and fails validateModelDeployments below.
+  const perModelLevels = protocol === ANTHROPIC_MESSAGES_PROTOCOL
+    ? (wireModelId) => require('../llm/worker-route').routeModelReasoningLevels({
+      type: 'anthropic',
+      upstream_apis: [ANTHROPIC_MESSAGES_PROTOCOL],
+      model_id: wireModelId,
+    })
+    : null;
   const routeId = String(providerId || '');
   if (!routeId) throw new TypeError('providerId required');
   const rows = db.prepare(`SELECT r.provider_id, r.model_id, r.max_context_tokens, r.max_output_tokens, r.source AS registry_source, r.last_seen_at,
@@ -46,6 +68,14 @@ function buildModelDeploymentFacts({ db, providerId, protocol, getFactRow, route
     const factRow = limits.factRow;
     const observedAt = _isoStored(factRow?.updated_at || factRow?.fetched_at || row.last_seen_at);
     const sourceKey = factRow ? (factRow.source === 'provider-api' ? 'model-facts-provider-api' : 'model-facts-vendor') : 'unknown';
+    // D-2: a per-model routePolicy override still wins (existing precedence);
+    // otherwise an anthropic-messages deployment gets the Claude matrix for its
+    // own wire model id, and every other route keeps the route-wide list. The
+    // caller's array is copied, never aliased.
+    let reasoningLevels = routePolicy[wireModelId]?.reasoningLevels;
+    if (!Array.isArray(reasoningLevels)) {
+      reasoningLevels = perModelLevels ? perModelLevels(wireModelId) : routeReasoningLevels.slice();
+    }
     const descriptorBase = {
       version: 1, providerId: routeId, routeId, wireModelId, identityId,
       protocol,
@@ -54,7 +84,7 @@ function buildModelDeploymentFacts({ db, providerId, protocol, getFactRow, route
       sourceKey, observedAt,
       inputModalities: Array.isArray(routePolicy[wireModelId]?.inputModalities) ? routePolicy[wireModelId].inputModalities : ['text'],
       toolCalling: typeof routePolicy[wireModelId]?.toolCalling === 'boolean' ? routePolicy[wireModelId].toolCalling : null,
-      reasoningLevels: Array.isArray(routePolicy[wireModelId]?.reasoningLevels) ? routePolicy[wireModelId].reasoningLevels : routeReasoningLevels.slice(),
+      reasoningLevels,
     };
     const revisionInput = {
       version: descriptorBase.version,

package/template/wall-e/brain/owner-call-whitelist.js

@@ -257,6 +257,22 @@ const BRAIN_CALL_WHITELIST = new Set([
   // 500 so the live 2,619-question backlog never holds one unbounded write. No
   // provider is reachable from here, so the owner stays credential-free.
   'resolveMemoryConflicts',
+  // WP-5a (lead-cost routing §6.6/§6.8): the helper-rules record's four writes. Same
+  // CUSTOM_BRAIN_CALLS pattern as commitThinkExtraction above — see
+  // wall-e/loops/brain-custom-writes.js and wall-e/lib/helper-rules/store.js (the only
+  // writer of the three helper_* tables).
+  'helperRulesRecordOutcome',
+  'helperRulesCloseOutcome',
+  'helperRulesSetCellState',
+  'helperRulesDailyTick',
+  // Round 2 WP-2 (§6.4 S-16): the close path resolves an open explore row BY worker id (D-5 —
+  // a restart cannot orphan it), and the one-time relabel/recovery pass (D-5/D-6) runs through
+  // the same owner seam. `helperRulesCloseOutcome` above stays for the id-keyed callers.
+  'helperRulesCloseOutcomeByWorker',
+  'helperRulesRelabel',
+  // WP-6 (§6.5): the spot-check grader's verdict on one explore row — pure DB, written
+  // fire-and-forget from the lead-call hook, which runs in the read-only MCP worker.
+  'helperRulesSetGrade',
 ]);
 
 const { OWNER_METHOD_PRIORITY, ownerPriorityFor } = require('../lib/brain-owner-op-priority');

package/template/wall-e/brain/schema-ensures.js

@@ -20,6 +20,28 @@ function createSchemaEnsuresModule({ conversationProjectionV2, ensureModelFactsS
     // MIGRATIONS[95]. Idempotent (INSERT OR IGNORE), so re-running on every boot
     // changes nothing. Required lazily, inside run(), exactly like the two above.
     { label: 'chat-thread-backfill', run: (d) => require('./chat-thread-store').backfillChatThreads(d) },
+    // WP-5a (lead-cost routing §6.6): the helper-rules record + the `helper_rules.lead_burst_usd`
+    // seed, which MIGRATIONS[100] owns for an existing brain. Same reasoning as the two above —
+    // a brand-new database runs `baseline + stamp` and never replays a migration body, and
+    // brain/schema.js's createTables() is frozen (lint/file-size.config.json frozenFunctions), so
+    // this list is the one vehicle both paths run for the new tables. Idempotent
+    // (IF NOT EXISTS / INSERT OR IGNORE), so re-running on every boot changes nothing.
+    { label: 'helper-rules-schema', run: (d) => require('./helper-rules-schema').ensureHelperRulesSchema(d) },
+    // Lead-cost routing round 2 WP-2 (§6.4 S-15): migration 101's additive columns — `worker_id`,
+    // `facts_json`, `label_version`, their index and the `helper_rules.relabelled_to` watermark.
+    // Runs immediately after the entry above for the same reason (a fresh database is
+    // `baseline + stamp` and never replays a migration body), and the ordering is load-bearing:
+    // the ALTERs need the table migration 100's text just created. Idempotent.
+    { label: 'helper-rules-schema-v2', run: (d) => require('./helper-rules-schema').ensureHelperRulesSchemaV2(d) },
+    // clock-free r4 R-4 (WP-2): migration 57 owns this heal for the ladder, but a
+    // migration body runs only once — a CTM v2 purge that drops
+    // conversation_context_snapshots.messages_json AFTER 57 already ran was never
+    // repaired, and every run-attempt write (_appendRunAttempt) then threw "table
+    // conversation_context_snapshots has no column named messages_json". Running
+    // the same body on every boot closes that hole. Idempotent (column probe), so
+    // re-running on every boot changes nothing. Same lazy-require reasoning as the
+    // entries above.
+    { label: 'context-snapshot-messages-json', run: (d) => require('./migrations').ensureContextSnapshotMessagesJson(d) },
   ];
 }
 module.exports = { brainSchemaEnsures: createSchemaEnsuresModule };

package/template/wall-e/brain.js

@@ -1912,7 +1912,7 @@ function initDb(dbPath) {
     installSqliteWriteLock(newDb, dbPath, {
       label: 'wall-e-brain', purpose: 'wall-e-brain-primary', // R3 identity (WP-0)
       holdBudgetMs: WRITE_LOCK_HOLD_BUDGET_MS, // WP-7b Item 4: bound the PRIMARY brain lock's holder
-      timeoutMs: _sqliteWriteLockTimeoutMs(), staleMs: Number(process.env.WALL_E_SQLITE_WRITE_LOCK_STALE_MS || 10 * 60 * 1000),
+      timeoutMs: _sqliteWriteLockTimeoutMs(),
       onEvent: _onWriteLockEvent,
       onAcquire: () => _assertSchemaUnchanged(newDb, isBrainOwnerWorker), // D-3: mid-life schema-moved guard, owner-role only
       incidentLog: { record: (rec) => require('./lib/incident-log').getIncidentLog().record(rec) }, // R3: lazy sink, shared/ never requires this

package/template/wall-e/coding/host-capabilities.js

@@ -369,7 +369,7 @@ function _execCapture(bin, args, { timeoutMs = 5000 } = {}) { // timeoutMs: prod
   }
 }
 
-async function _probeBrowserHeadless() {
+async function _probeBrowserHeadless(probeOptions) { // probeOptions.timeoutMs: the seam inspectChromeCapability hands to _autoChromeUsable; its production default (15000) is unchanged and no production caller passes this
   // eslint-disable-next-line global-require
   const { inspectChromeCapability } = require('../tools/local-tools');
   // D-3: inspectChromeCapability() is async (a concurrent work package is
@@ -379,7 +379,7 @@ async function _probeBrowserHeadless() {
   // works" without one — omitting it silently turns `capability` into a
   // Promise, `capability.detected` into undefined, and every host gets
   // misreported as binary_missing. Do not "simplify" this back to a bare call.
-  const capability = await inspectChromeCapability();
+  const capability = await inspectChromeCapability({ probeOptions });
   const detectedCount = (capability.detected || []).length;
   const evidence = [`chrome candidates on disk: ${detectedCount}`];
   if (capability.executable) {

package/template/wall-e/coding/journal-dispatcher.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// One chooser for the coding-journal write path: an explicit dispatcher wins,
+// then the daemon's shared brain-owner client, then the bounded one-shot child
+// this process owns. Choosing a route resolves no brain DB path, starts no
+// child and creates no brain — those stay inside the later persistence
+// callback. The explicit dispatcher option is captured once, so a caller's
+// accessor property is read exactly once.
+function selectJournalDispatcher(options = {}, { createJournalWriteDispatcher, defaultBrainDbPath }) {
+  const explicitDispatcher = options.dispatcher;
+  if (explicitDispatcher) return Object.freeze({
+    dispatcher: explicitDispatcher, defaultAwaitTerminalJournal: true,
+  });
+  const { getSharedBrainOwnerClient } = require('../lib/brain-owner-worker-client');
+  const shared = getSharedBrainOwnerClient();
+  if (shared) return Object.freeze({
+    dispatcher: createJournalWriteDispatcher({ client: shared }),
+    defaultAwaitTerminalJournal: false,
+  });
+  // Stop hooks and standalone lifecycle processes cannot see the daemon's
+  // process-local singleton. The bounded one-shot child owns SQLite and keeps
+  // this process free from better-sqlite3 teardown hazards.
+  const { writeJournalEntryInChild } = require('../lib/coding-journal-writer-child-client');
+  const dispatcher = createJournalWriteDispatcher({
+    client: {
+      persistCodingJournal(entry) {
+        const dbPath = options.dbPath || defaultBrainDbPath(options.env);
+        // J-1: no daemon is actually serving a brain (no explicit dbPath, no
+        // WALL_E_DATA_DIR, no live-data instance-id.json) — never spawn the
+        // one-shot child, which holds an owner grant and would create/migrate
+        // the phantom ~/.walle/data brain. Write nothing; skip loudly.
+        if (!dbPath) {
+          console.error('[wall-e] coding journal write skipped: reason=no_served_brain (no daemon-served brain to write to)');
+          return Promise.resolve({ ok: true, skipped: true, reason: 'no_served_brain' });
+        }
+        return writeJournalEntryInChild(entry, {
+          dbPath,
+          // S-8: state THIS process's schema generation so the fresh-code child
+          // refuses rather than migrating the brain out from under us.
+          parentSchemaVersion: require('../brain').SCHEMA_VERSION,
+          timeoutMs: options.timeoutMs,
+          forkImpl: options.forkImpl,
+          env: options.env,
+        });
+      },
+    },
+  });
+  return Object.freeze({ dispatcher, defaultAwaitTerminalJournal: true });
+}
+
+module.exports = { selectJournalDispatcher };