create-walle 0.10.0 → 0.10.2

package/template/wall-e/http/helper-rules-api.js

@@ -0,0 +1,321 @@
+'use strict';
+
+// WP-4 (lead-cost-routing-round1-2026-10-21.html §6.4): the read-only state endpoint the stdio
+// proxy calls before it answers a client's `initialize` locally.
+//
+//   GET /api/wall-e/helper-rules/guidance?agent=codex|claude
+//     -> { ok: true, explore: 'on' | 'off' | 'probe' }
+//
+// Read-only and idempotent: it never creates the cell table (WP-5 owns the migration) and it
+// never writes. An unknown/missing `agent` reads as 'claude'; a missing table or row reads 'on'
+// (lib/helper-rules/cell-state.js owns that fail-open default).
+//
+// Mounted from api-walle.js's routeWalleApi() -- deliberately NOT inside handleWalleApi(), whose
+// body is frozen by lint/file-size.config.json.
+//
+// WP-7 (design §6.9, D-18): the same module carries the panel's four routes -- the cell list with
+// its trailing-window metrics, the labelled-outcome window, and the user's two switches:
+//
+//   GET  /api/wall-e/helper-rules/cells
+//   GET  /api/wall-e/helper-rules/cells/:key/outcomes?limit=20
+//   POST /api/wall-e/helper-rules/cells/:key/veto    -> state 'off', user_veto 1
+//   POST /api/wall-e/helper-rules/cells/:key/enable  -> state 'on',  user_veto 0
+//
+// The reads go through lib/helper-rules/store.js (the record's one reader) on the brain handle;
+// the two switches go through brainWrite('helperRulesSetCellState', ...) -- the owner path, so
+// this module holds no write SQL of its own (AC-7c). Every read is fail-open: a brain without the
+// migration 100 tables answers 200 with the two explore cells and an empty window, never a 500.
+
+const { jsonResponse } = require('./api-utils');
+const { readExploreCellState } = require('../lib/helper-rules/cell-state');
+const {
+  CELL_STATES,
+  kindFromCellKey,
+  listCells,
+  readCell,
+  readTrailingOutcomes,
+} = require('../lib/helper-rules/store');
+
+const BASE_PATH = '/api/wall-e/helper-rules';
+const GUIDANCE_PATH = `${BASE_PATH}/guidance`;
+const CELLS_PATH = `${BASE_PATH}/cells`;
+// `:key` carries the cell key verbatim (URL-encoded); the action is the last path segment.
+const CELL_ACTION_RE = /^\/api\/wall-e\/helper-rules\/cells\/(.+)\/(outcomes|veto|enable)$/;
+// The two shapes the record mints: wait-watch|default|<route alias> and explore|default|<harness>.
+const CELL_KEY_RE = /^(wait-watch|explore)\|default\|[A-Za-z0-9._:-]{1,120}$/;
+// The panel must always show the exploration switch, even before the first outcome row exists.
+const SYNTHETIC_EXPLORE_KEYS = Object.freeze(['explore|default|claude', 'explore|default|codex']);
+const COLLECTING_MIN = 10;
+const OUTCOMES_DEFAULT_LIMIT = 20;
+const OUTCOMES_MAX_LIMIT = 100;
+
+// brainWrite is required lazily: api-walle.js boots this module on every start, and the write
+// path is only reachable from the two POST routes (same lazy-require idiom as
+// coding-context.js). Tests inject their own writer through `deps.brainWrite`.
+let _brainWriteImpl = null;
+function _brainWrite(method, ...args) {
+  if (!_brainWriteImpl) ({ brainWrite: _brainWriteImpl } = require('../loops/brain-write'));
+  return _brainWriteImpl(method, ...args);
+}
+
+function _servedBrainDb(brain, ensureBrainInit) {
+  try {
+    if (!brain || (typeof ensureBrainInit === 'function' && !ensureBrainInit())) return null;
+    return typeof brain.getDb === 'function' ? brain.getDb() : null;
+  } catch {
+    // expected: the brain has not opened its DB yet -- readExploreCellState answers 'on'
+    return null;
+  }
+}
+
+function _cellState(row) {
+  const state = row && typeof row.state === 'string' ? row.state.trim() : '';
+  return CELL_STATES.includes(state) ? state : 'on';
+}
+
+function _parseMetrics(raw) {
+  if (raw && typeof raw === 'object') return raw;
+  if (raw == null || raw === '') return {};
+  try {
+    const parsed = JSON.parse(String(raw));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    // expected: a malformed metrics_json carries no metrics -- the panel shows '-'
+    return {};
+  }
+}
+
+/** The most recent state event for one cell, or null. Read-only; a missing table is "no event". */
+function _lastEvent(d, cellKey) {
+  if (!d || typeof d.prepare !== 'function') return null;
+  try {
+    const row = d.prepare('SELECT to_state, reason, created_at FROM helper_rule_events WHERE cell_key = ? ORDER BY id DESC LIMIT 1')
+      .get(String(cellKey));
+    return row ? { to_state: row.to_state, reason: row.reason, created_at: row.created_at } : null;
+  } catch {
+    // expected: helper_rule_events is absent until migration 100 -- no event to show
+    return null;
+  }
+}
+
+/**
+ * WP-6 (§6.9): the label version the panel stamps on the window -- the max the rows carry, or null
+ * when the window is empty (nothing has been labelled yet, which is not "v1").
+ */
+function _windowLabelVersion(rows) {
+  let max = null;
+  for (const row of rows) {
+    const version = Number(row?.label_version);
+    if (Number.isFinite(version) && (max === null || version > max)) max = version;
+  }
+  return max;
+}
+
+/**
+ * One panel row. `n_window` is the trailing window the evaluator reads (readTrailingOutcomes'
+ * default limit), not a stored counter, so it cannot drift from the outcomes table.
+ * `collecting` prefers the stored metric (evaluate.js's D-7 measurability guard) and only falls
+ * back to the round-1 window-size rule when the row carries no stored verdict.
+ */
+function _cellView(d, row) {
+  const cellKey = String(row.cell_key);
+  const window = readTrailingOutcomes(d, cellKey);
+  const metrics = _parseMetrics(row.metrics_json);
+  return {
+    cell_key: cellKey,
+    kind: row.kind || kindFromCellKey(cellKey),
+    state: _cellState(row),
+    user_veto: Number(row.user_veto) === 1 ? 1 : 0,
+    n_window: window.length,
+    label_version: _windowLabelVersion(window),
+    metrics,
+    collecting: typeof metrics.collecting === 'boolean' ? metrics.collecting : window.length < COLLECTING_MIN,
+    last_event: _lastEvent(d, cellKey),
+  };
+}
+
+function _syntheticExploreCell(cellKey) {
+  return {
+    cell_key: cellKey,
+    kind: 'explore',
+    state: 'on',
+    user_veto: 0,
+    n_window: 0,
+    label_version: null,
+    metrics: {},
+    collecting: true,
+    last_event: null,
+  };
+}
+
+function _cellsPayload(d) {
+  const views = listCells(d).map((row) => _cellView(d, row));
+  const known = new Set(views.map((view) => view.cell_key));
+  for (const key of SYNTHETIC_EXPLORE_KEYS) {
+    if (!known.has(key)) views.push(_syntheticExploreCell(key));
+  }
+  return views.sort((a, b) => (a.cell_key < b.cell_key ? -1 : a.cell_key > b.cell_key ? 1 : 0));
+}
+
+/** project the grader's JSON down to the verdict the panel shows -- never the raw blob. */
+function _gradeView(raw) {
+  if (raw == null || raw === '') return null;
+  let parsed = raw;
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      // expected: an unparsable grade_json carries no verdict -- the row reads as ungraded
+      return null;
+    }
+  }
+  if (!parsed || typeof parsed !== 'object') return null;
+  if (parsed.unavailable === true) return { unavailable: true };
+  const view = {};
+  for (const field of ['sufficient', 'coverage', 'inaccuracies']) {
+    if (field in parsed) view[field] = parsed[field];
+  }
+  return Object.keys(view).length ? view : null;
+}
+
+// WP-6 (§6.9): the ONLY fact fields the panel shows. The stored facts_json also holds the
+// delegation's report/brief paths (grade.js reads them) and the wait's next_call arguments -- none
+// of those may leave the brain over this read route, so the projection is a fixed allow-list,
+// never a spread.
+const FACT_VIEW_KEYS = Object.freeze([
+  'terminal_status',
+  'report_source',
+  'report_citation_rows',
+  'wait_variant',
+  'harness',
+]);
+
+/** The five displayable facts, or null when the row kept none (round-1 rows, unparsable blobs). */
+function _factsView(raw) {
+  if (raw == null || raw === '') return null;
+  let parsed = raw;
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      // expected: a row whose facts_json cannot be parsed carries no observed facts -- the panel shows '-'
+      return null;
+    }
+  }
+  if (!parsed || typeof parsed !== 'object') return null;
+  const view = {};
+  for (const key of FACT_VIEW_KEYS) {
+    if (key in parsed) view[key] = parsed[key];
+  }
+  return view;
+}
+
+/**
+ * One outcome row, field by field. Deliberately NOT a spread of the table row: the outcome
+ * window never carries the delegation's brief/report text, the grade's free-text `why`, the facts'
+ * paths/next-call args, or any session id beyond the row id itself (which, for wait-watch rows, is
+ * '<wait_id>:<worker_id>:<n>' by the schema -- an opaque handle the panel never decodes).
+ */
+function _outcomeView(row) {
+  return {
+    id: row.id,
+    seq: row.seq,
+    kind: row.kind,
+    label: row.label ?? null,
+    decision: row.decision ?? null,
+    helper_usd: row.helper_usd ?? null,
+    lead_usd: row.lead_usd ?? null,
+    seconds_to_report: row.seconds_to_report ?? null,
+    report_rows: row.report_rows ?? null,
+    worker_id: row.worker_id ?? null,
+    label_version: row.label_version ?? null,
+    facts: _factsView(row.facts_json),
+    grade: _gradeView(row.grade_json),
+    created_at: row.created_at ?? null,
+  };
+}
+
+function _limitOf(url) {
+  const raw = Number.parseInt(url.searchParams.get('limit'), 10);
+  if (!Number.isFinite(raw)) return OUTCOMES_DEFAULT_LIMIT;
+  return Math.min(OUTCOMES_MAX_LIMIT, Math.max(1, raw));
+}
+
+function _decodeCellKey(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    // expected: a malformed percent-escape is not a cell key -- answered as cell_key_invalid
+    return null;
+  }
+}
+
+function _methodNotAllowed(res) {
+  jsonResponse(res, { ok: false, error: 'Method not allowed' }, 405);
+  return true;
+}
+
+// The two switches. D-18: a veto is final -- only the user's enable clears it, and the decision
+// is recorded as an event row by store.setCellState (reason 'user_veto' / 'user_enable').
+async function _applyCellState(res, deps, cellKey, action) {
+  const patch = action === 'veto'
+    ? { state: 'off', user_veto: 1, reason: 'user_veto', evidence: { by: 'user' } }
+    : { state: 'on', user_veto: 0, reason: 'user_enable', evidence: { by: 'user' } };
+  const write = typeof deps.brainWrite === 'function' ? deps.brainWrite : _brainWrite;
+  try {
+    await write('helperRulesSetCellState', cellKey, patch);
+  } catch (err) {
+    jsonResponse(res, { ok: false, error: err?.message || 'helper_rules_write_failed' }, 503);
+    return true;
+  }
+  const d = _servedBrainDb(deps.brain, deps.ensureBrainInit);
+  const row = readCell(d, cellKey);
+  const cell = row ? _cellView(d, row) : { ..._syntheticExploreCell(cellKey), kind: kindFromCellKey(cellKey), state: patch.state, user_veto: patch.user_veto };
+  jsonResponse(res, { ok: true, cell }, 200);
+  return true;
+}
+
+function handleHelperRulesApi(req, res, url, deps = {}) {
+  const { brain, ensureBrainInit } = deps;
+
+  if (url.pathname === GUIDANCE_PATH) {
+    if (req.method !== 'GET') return _methodNotAllowed(res);
+    const agent = url.searchParams.get('agent') === 'codex' ? 'codex' : 'claude';
+    jsonResponse(res, { ok: true, explore: readExploreCellState(_servedBrainDb(brain, ensureBrainInit), agent) }, 200);
+    return true;
+  }
+
+  if (url.pathname === CELLS_PATH) {
+    if (req.method !== 'GET') return _methodNotAllowed(res);
+    jsonResponse(res, { ok: true, cells: _cellsPayload(_servedBrainDb(brain, ensureBrainInit)) }, 200);
+    return true;
+  }
+
+  const match = CELL_ACTION_RE.exec(url.pathname);
+  if (!match) return false;
+  const cellKey = _decodeCellKey(match[1]);
+  if (!cellKey || !CELL_KEY_RE.test(cellKey)) {
+    jsonResponse(res, { ok: false, error: 'cell_key_invalid' }, 400);
+    return true;
+  }
+  const action = match[2];
+
+  if (action === 'outcomes') {
+    if (req.method !== 'GET') return _methodNotAllowed(res);
+    const outcomes = readTrailingOutcomes(_servedBrainDb(brain, ensureBrainInit), cellKey, _limitOf(url))
+      .map((row) => _outcomeView(row));
+    jsonResponse(res, { ok: true, outcomes }, 200);
+    return true;
+  }
+
+  if (req.method !== 'POST') return _methodNotAllowed(res);
+  // Same precondition the sibling mutating Wall-E route next to the mount applies
+  // (routeWalleApi's POST /api/wall-e/background/completion): no brain, no write.
+  if (!brain || (typeof ensureBrainInit === 'function' && !ensureBrainInit())) {
+    jsonResponse(res, { error: 'Brain module not available' }, 503);
+    return true;
+  }
+  return _applyCellState(res, deps, cellKey, action);
+}
+
+module.exports = { handleHelperRulesApi };

package/template/wall-e/http/model-proxy-providers.js

@@ -54,7 +54,9 @@ function handleModelProxyProvidersFeed(req, res, url, {
           // D-3/D-5: the route's CLI-expressible effort levels, resolved from the
           // same row the route descriptor is built from, so the brain's deployment
           // facts carry them (they were always [] — the levels never reached CTM's
-          // Codex model catalog).
+          // Codex model catalog). The per-(route, wire model) half of D-2 is
+          // derived inside the deployment projection from `protocol` (the only
+          // serializable route fact that survives this read's JSON IPC hop).
           const routeReasoningLevels = routeReasoningLevelsForRow(fullRow);
           profileFacts = await readBrain('workerRouteProfileFacts', [row.id, protocol, routeConfigRevision, { routeReasoningLevels }]);
         } catch {

package/template/wall-e/http/telemetry-api.js

@@ -17,6 +17,11 @@
 // module-state rate-limit bookkeeping (renamed from handleWalleApi._rlMap/
 // _rlTimer, moved verbatim).
 const { jsonResponse, readBody } = require('./api-utils');
+// WP-1 (blog-view-counts, docs/blog-view-counts-2026-10-22.html §5 D-4): the
+// public blog-view counter is a sibling of the telemetry routes — same module
+// boundary, same injected deps, same dispatch chain — and is claimed FIRST so
+// its exact path can never fall through to a telemetry handler.
+const { handleBlogViewsApi } = require('./blog-views-api');
 
 function handleTelemetryApi(req, res, url, deps) {
   const {
@@ -47,6 +52,13 @@ function handleTelemetryApi(req, res, url, deps) {
   const m = req.method;
   const params = url.searchParams;
 
+  // --- Blog view counts (public, unauthenticated, exact path only) ---
+  // Before the telemetry routes: the handler claims only
+  // /api/wall-e/telemetry/blog-views and returns false for everything else, so the
+  // existing dispatch order and behavior below are untouched.
+  const blogViewsHandled = handleBlogViewsApi(req, res, url, { getTelemetryDb, errorSink });
+  if (blogViewsHandled !== false) return blogViewsHandled;
+
   // --- Telemetry endpoints (server mode only) ---
 
   // POST /api/wall-e/telemetry/ingest — receive anonymous telemetry from users

package/template/wall-e/lib/blog-view-policy.js

@@ -0,0 +1,88 @@
+'use strict';
+
+// WP-1 (docs/blog-view-counts-2026-10-22.html §5/§6): the ONE place the blog
+// view counter's public surface is described — route, article allowlist, policy
+// ceilings, accepted browser origins and the approximate bot filter. Pure data
+// and pure predicates: no env read, no database handle, no module state, no
+// side effects at require time.
+//
+// Counting semantics are deliberately approximate (design §11): one visible
+// article opening per 30-minute per-tab token, no unique-person claim, no
+// historical backfill.
+
+// The EXACT public path. It lives under the /api/wall-e/telemetry/ prefix on
+// purpose (design §5 D-4, lead review correction): api-walle.js already routes
+// that prefix to lib/telemetry-process-client.js in the daemon role, so the
+// counter runs in the isolated telemetry process — no SQLite on the foreground
+// daemon — without touching the frozen dispatcher.
+const BLOG_VIEWS_PATH = '/api/wall-e/telemetry/blog-views';
+
+// The three published static articles. A slug outside this frozen list is never
+// a valid counter key, so an arbitrary/hostile value can never reach a query.
+const BLOG_POSTS = Object.freeze(['delegation-economics', 'delegation-guide', 'paste-the-link']);
+
+// Repeat-visit suppression window: a per-tab random token counts once per 30 min.
+const BLOG_VIEW_WINDOW_MS = 1800000;
+
+// Product policy ceilings (conservative, not measured traffic — design §11).
+const BLOG_VIEW_MAX_RECEIPTS = 100000;
+const BLOG_VIEW_MAX_BODY_BYTES = 1024;
+
+// Bounded receipt pruning: a POST removes at most this many expired receipts.
+const BLOG_VIEW_PRUNE_BATCH = 1000;
+
+// The only browser origins whose POST may increment a counter (and the only ones
+// reflected back in CORS). Both the apex and the www host serve the site.
+const BLOG_VIEW_ORIGINS = Object.freeze(['https://walle.sh', 'https://www.walle.sh']);
+
+// User-Agent input is truncated before matching; the pattern is an approximate
+// filter (design D-4), never proof that a visitor is human.
+const BLOG_VIEW_USER_AGENT_MAX = 1024;
+const BLOG_VIEW_BOT_PATTERN = /bot|crawler|spider|headless|curl|wget|python|preview|facebookexternalhit|meta-externalagent|bytespider|gptbot|claudebot/i;
+
+// Canonical lowercase 8-4-4-4-12 UUID text (the shape crypto.randomUUID emits).
+const BLOG_VIEW_TOKEN_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+function isBlogViewsPath(pathname) {
+  return pathname === BLOG_VIEWS_PATH;
+}
+
+// Returns the request's origin only when it is EXACTLY one of the two published
+// site origins; every other present origin is null (the caller turns that into a
+// refusal — the private API's localhost-only set is never widened).
+function getBlogViewOrigin(origin) {
+  if (typeof origin !== 'string') return null;
+  return BLOG_VIEW_ORIGINS.includes(origin) ? origin : null;
+}
+
+function isBlogPostSlug(slug) {
+  return typeof slug === 'string' && BLOG_POSTS.includes(slug);
+}
+
+function isBlogViewToken(token) {
+  return typeof token === 'string' && BLOG_VIEW_TOKEN_PATTERN.test(token);
+}
+
+// Truncated, case-insensitive, deliberately approximate reconnaissance filter.
+function isKnownBotUserAgent(userAgent) {
+  if (typeof userAgent !== 'string' || userAgent === '') return false;
+  return BLOG_VIEW_BOT_PATTERN.test(userAgent.slice(0, BLOG_VIEW_USER_AGENT_MAX));
+}
+
+module.exports = {
+  BLOG_POSTS,
+  BLOG_VIEWS_PATH,
+  BLOG_VIEW_BOT_PATTERN,
+  BLOG_VIEW_MAX_BODY_BYTES,
+  BLOG_VIEW_MAX_RECEIPTS,
+  BLOG_VIEW_ORIGINS,
+  BLOG_VIEW_PRUNE_BATCH,
+  BLOG_VIEW_TOKEN_PATTERN,
+  BLOG_VIEW_USER_AGENT_MAX,
+  BLOG_VIEW_WINDOW_MS,
+  getBlogViewOrigin,
+  isBlogPostSlug,
+  isBlogViewsPath,
+  isBlogViewToken,
+  isKnownBotUserAgent,
+};

package/template/wall-e/lib/blog-view-store.js

@@ -0,0 +1,169 @@
+'use strict';
+
+// WP-1 (docs/blog-view-counts-2026-10-22.html §5 D-2, §6): durable per-article
+// view counters on the EXISTING telemetry.db. Two additive tables — a running
+// total per article and a bounded set of short-lived per-tab receipts — updated
+// in one IMMEDIATE transaction, so a replay is a no-op and a concurrent writer
+// can never double-count.
+//
+// The handle is ALWAYS injected: nothing here opens a database, calls initDb(),
+// schedules a job or reads the environment. This module contains NO DDL: the two
+// tables are declared and created by lib/telemetry-db-schema.js (the
+// walle-telemetry migration owner), whose baseline and additive migration 2 both
+// call its own createBlogViewTables(). Only queries live here, and the module
+// requires nothing but the pure policy module — no cycle back through the schema.
+//
+// Privacy (design D-5): a receipt stores the slug, the opaque random per-tab
+// token and its expiry — nothing else. No IP address, User-Agent, referrer,
+// account or derived fingerprint is ever written; the raw token is a
+// deduplication key, not a credential, and expires in 30 minutes.
+//
+// Counting semantics are approximate (design §11): a 30-minute per-tab
+// suppression window, not unique people.
+
+const {
+  BLOG_VIEW_MAX_RECEIPTS,
+  BLOG_VIEW_PRUNE_BATCH,
+  BLOG_VIEW_WINDOW_MS,
+  BLOG_POSTS,
+  isBlogPostSlug,
+  isBlogViewToken,
+} = require('./blog-view-policy');
+
+// Typed store errors: the API layer maps them to status codes without ever
+// having to parse a message.
+const BLOG_VIEW_INVALID_SLUG = 'blog_view_invalid_slug';
+const BLOG_VIEW_INVALID_TOKEN = 'blog_view_invalid_token';
+const BLOG_VIEW_INVALID_STATE = 'blog_view_invalid_state';
+const BLOG_VIEW_CAPACITY = 'blog_view_capacity';
+const BLOG_VIEW_OVERFLOW = 'blog_view_overflow';
+
+function blogViewError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// Current totals for every published article, as {slug: views}. A known article
+// with no row yet is authoritatively 0; an unsafe or negative stored value is
+// refused rather than rendered.
+function getBlogViewCounts(db) {
+  const placeholders = BLOG_POSTS.map(() => '?').join(', ');
+  const rows = db.prepare(
+    `SELECT slug, views FROM blog_view_counts WHERE slug IN (${placeholders})`
+  ).all(...BLOG_POSTS);
+  const counts = {};
+  for (const slug of BLOG_POSTS) counts[slug] = 0;
+  for (const row of rows) {
+    // Prototype-safe: only the frozen allowlist's own keys are ever assigned to,
+    // so a hostile stored slug can never write through to Object.prototype.
+    if (!Object.prototype.hasOwnProperty.call(counts, row.slug)) continue;
+    if (!Number.isSafeInteger(row.views) || row.views < 0) {
+      throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+    }
+    counts[row.slug] = row.views;
+  }
+  return counts;
+}
+
+// Records one view for `slug` from the per-tab `token` at `nowMs`, returning
+// {slug, views, counted}. `counted` is false when this exact token already has
+// an unexpired receipt (a refresh or a duplicate submission) — the stored total
+// is then returned unchanged, even when the receipt table is at its cap.
+//
+// Throws a typed error for an unknown slug, a non-canonical token, a full
+// receipt table or a total at the safe-integer ceiling; the caller maps those to
+// a refusal and never acknowledges an uncounted view.
+function recordBlogView(db, slug, token, nowMs = Date.now()) {
+  // Validate the ONLY two things that can reach SQL, before any statement runs:
+  // a frozen-allowlist slug and canonical UUID text. No arbitrary key ever
+  // becomes a query parameter.
+  if (!isBlogPostSlug(slug)) {
+    throw blogViewError(BLOG_VIEW_INVALID_SLUG, 'unknown blog post slug');
+  }
+  // Canonical text only, and nothing below folds case: isBlogViewToken() accepts
+  // ONLY the lowercase 8-4-4-4-12 spelling, so an uppercased uuid is refused as a
+  // malformed token rather than silently normalized into somebody else's receipt
+  // key.
+  if (!isBlogViewToken(token)) {
+    throw blogViewError(BLOG_VIEW_INVALID_TOKEN, 'token is not a canonical uuid');
+  }
+  const now = Number.isSafeInteger(nowMs) ? nowMs : Date.now();
+
+  const record = db.transaction(() => {
+    // 1. Bounded, indexed prune of expired receipts (at most
+    //    BLOG_VIEW_PRUNE_BATCH rows): the table stays bounded with no job.
+    db.prepare(
+      `DELETE FROM blog_view_receipts WHERE rowid IN (
+         SELECT rowid FROM blog_view_receipts
+         WHERE expires_at_ms <= ?
+         ORDER BY expires_at_ms
+         LIMIT ?
+       )`
+    ).run(now, BLOG_VIEW_PRUNE_BATCH);
+
+    // 2. An EXACT unexpired receipt is a duplicate: the stored total is returned
+    //    unchanged, even when the table is at its cap.
+    const existing = db.prepare(
+      'SELECT expires_at_ms FROM blog_view_receipts WHERE slug = ? AND token = ?'
+    ).get(slug, token);
+    if (existing && existing.expires_at_ms > now) {
+      const current = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+      const views = current ? current.views : 0;
+      if (!Number.isSafeInteger(views) || views < 0) {
+        throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+      }
+      return { slug, views, counted: false };
+    }
+    // An expired receipt for this exact token is removed before its replacement
+    // is inserted, so the primary key never collides and no stale expiry is
+    // reused. (Step 1 usually removed it already; this is the exact case.)
+    if (existing) {
+      db.prepare('DELETE FROM blog_view_receipts WHERE slug = ? AND token = ?').run(slug, token);
+    }
+
+    // 3. Capacity is a policy bound, not memory: a full table refuses the view
+    //    (the transaction rolls back, so the cap stays full) instead of
+    //    acknowledging an uncounted one.
+    const receiptCount = db.prepare('SELECT count(*) AS n FROM blog_view_receipts').get().n;
+    if (receiptCount >= BLOG_VIEW_MAX_RECEIPTS) {
+      throw blogViewError(BLOG_VIEW_CAPACITY, 'blog view receipt capacity reached');
+    }
+
+    // 4. Never wrap: a total at the safe-integer ceiling refuses the view.
+    const currentRow = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+    const currentViews = currentRow ? currentRow.views : 0;
+    if (!Number.isSafeInteger(currentViews) || currentViews < 0) {
+      throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+    }
+    if (currentViews >= Number.MAX_SAFE_INTEGER) {
+      throw blogViewError(BLOG_VIEW_OVERFLOW, 'blog view count reached the safe integer ceiling');
+    }
+
+    db.prepare(
+      `INSERT INTO blog_view_receipts (slug, token, expires_at_ms) VALUES (?, ?, ?)
+       ON CONFLICT(slug, token) DO UPDATE SET expires_at_ms = excluded.expires_at_ms`
+    ).run(slug, token, now + BLOG_VIEW_WINDOW_MS);
+    db.prepare(
+      `INSERT INTO blog_view_counts (slug, views) VALUES (?, 1)
+       ON CONFLICT(slug) DO UPDATE SET views = views + 1`
+    ).run(slug);
+
+    const committed = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+    return { slug, views: committed ? committed.views : 0, counted: true };
+  });
+
+  // IMMEDIATE: take the write lock at BEGIN, so two competing writers serialize
+  // instead of one failing late with SQLITE_BUSY after a stale read.
+  return record.immediate();
+}
+
+module.exports = {
+  BLOG_VIEW_CAPACITY,
+  BLOG_VIEW_INVALID_SLUG,
+  BLOG_VIEW_INVALID_STATE,
+  BLOG_VIEW_INVALID_TOKEN,
+  BLOG_VIEW_OVERFLOW,
+  getBlogViewCounts,
+  recordBlogView,
+};

package/template/wall-e/lib/client-config-lock.js

@@ -43,6 +43,7 @@ const os = require('os');
 const path = require('path');
 
 const { ClientConfigError, isClientConfigError } = require('./mcp-client-config');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 const POLL_MS = 100; // admission cadence, never a performance budget
 const DEFAULT_TIMEOUT_MS = 10000; // admission deadline only
@@ -145,7 +146,7 @@ function _modeBits(stat) {
 }
 
 function _isGroupOrOtherWritable(stat) {
-  return (_exactInteger(stat.mode) & 0o022n) !== 0n;
+  return !isWritableOnlyByOwner(stat);
 }
 
 function _hasStickyBit(stat) {