create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/db.js

@@ -8,6 +8,9 @@ function listPurgedDraftAttachmentIds(dbHandle) {
 }
 
 const path = require('path');
+// WP-6 (session-name-agent-title-precedence §6): the single tier-2 agent-title apply, reused by the
+// one-shot backfill (applyAgentTitleBackfillRows below) exactly as the ingest path uses it.
+const { applyAgentTitleSignals } = require('./lib/agent-title-apply');
 const { createLegacyTerminalDraftCreate } = require('./lib/terminal-draft-create');
 // WP-1 (§6, §6.1): the shared canonical draft lifecycle contract — lifecycle-version reader,
 // complete canonical field projection + comparator, and the single version allocator. Shared with
@@ -43,6 +46,8 @@ const conversationStoreV2 = require('./lib/conversation-store-v2');
 const walleHistoryCutoverV2 = require('./lib/walle-history-cutover-v2');
 const { createReviewReposStore } = require('./lib/storage/review-repos-store');
 const { insertResumeLineage } = require('./lib/storage/resume-lineage-store');
+// WP-4 (§9 S-21): workspace_bindings.git_remote stores the NORMALIZED key, never a raw remote URL.
+const { normalizeGitRemote } = require('../shared/git-remote-key');
 
 const { execFileSync } = require('child_process');
 const { normalizeAgentType } = require('./lib/agent-capabilities');
@@ -122,7 +127,7 @@ const {
   ensureSessionModelIntentSchema,
 } = require('./lib/migrations/v53-session-model-intent');
 const { createCodingSessionGenerationStore } = require('./lib/storage/coding-session-generation-store');
-const { createLeadModelTransitionStore } = require('./lib/lead-model-transition-store');
+const { createLeadModelTransitionStore, resumesCandidateFork } = require('./lib/lead-model-transition-store');
 const { createSessionModelIntentStore } = require('./lib/storage/session-model-intent-store');
 const { createSessionLeadEffortStore } = require('./lib/storage/session-lead-effort-store');
 const { createSessionLeadModelStore } = require('./lib/storage/session-lead-model-store');
@@ -207,7 +212,9 @@ const {
   ensureHostIdentity,
   identityFilePath,
   isSameOwnerLineage: _isSameOwnerLineagePure,
+  lineageCrossHost: _lineageCrossHost,
   ownerLineageComponent: _ownerLineageComponentPure,
+  readOsMachineIdHash,
 } = require('./lib/host-identity');
 const {
   ensureResourceLeaseSchema,
@@ -350,8 +357,9 @@ let hostedIdentityState = null;
 // import, clone/re-key handling) ever needs to change the instance identity WHILE the process is
 // already serving traffic, it MUST also null out hostedIdentitySnapshot right there, or every
 // caller downstream of getOrCreateInstanceIdentity silently keeps serving the stale identity for
-// the rest of the process's life. tests/instance-identity-snapshot-invariant.test.js grep-asserts
-// this invariant holds (no new instance_identity writer, no new snapshot reset site).
+// the rest of the process's life. NOTHING test-enforces this today: the grep-based
+// tests/instance-identity-snapshot-invariant.test.js was deleted on 2026-09-15
+// (tests/.deflake/wp5-deletions-2026-09-15.txt) -- a new writer/reset site must be reviewed by hand.
 let hostedIdentitySnapshot = null;
 
 // WP-0 (docs/instance-identity-boot-order design, C3): lib/instance-identity-access.js keeps its
@@ -1219,6 +1227,10 @@ function _ensureHostedPrimarySchema(d = getDb()) {
 
   _invalidateTableExistsMemo(); // R4-10: the exec above may have created the sync/instance tables
   _ensureSyncedEntitiesOriginKey(target);
+  // WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1): the hub-side machine registry.
+  // The DDL body lives in _ensureMachineRegistrySchema (defined further down this file, next to
+  // the other schema-ensure helpers) for the reason stated there.
+  _ensureMachineRegistrySchema(target);
   for (const tableName of ['ctm_sessions', 'prompts', 'folders']) {
     _safeAlterAddColumn(tableName, "origin_instance_id TEXT DEFAULT ''");
     _safeAlterAddColumn(tableName, "current_owner_instance_id TEXT DEFAULT ''");
@@ -1234,6 +1246,25 @@ function _ensureHostedPrimarySchema(d = getDb()) {
   _safeAlterAddColumn('startup_tasks', "current_owner_instance_id TEXT DEFAULT ''");
   _safeAlterAddColumn('startup_tasks', "parked_at TEXT DEFAULT ''");
   _safeAlterAddColumn('startup_tasks', "park_reason TEXT DEFAULT ''");
+  // WP-2 (docs/remote-hub-ownership-fences-and-restore-skip-diagnostics-2026-10-23.html §5 D-3,
+  // §6, §9 S-5): was this re-mint edge minted ACROSS a host boundary?
+  //   1    — the prior instance_identity row's stored host_fingerprint was non-empty and was NOT
+  //          in this host's live ∪ compatible fingerprint set at detection (_hostIdentityFingerprints,
+  //          below): the DATABASE FILE itself arrived from another machine (the 2026-10-14 Spark
+  //          file-clone whose re-mint rewrote 3779 Mac-owned rows to Spark-owned).
+  //   0    — the stored fingerprint matches this host: a legitimate same-host re-mint (the Mac's
+  //          own 2026-09-30 ctm-LLXYK6XTNF-3456 → …-1a2c9c), or no stored fingerprint at all
+  //          (empty ⇒ cannot prove foreign ⇒ fail toward today's behavior, AC-2c).
+  //   NULL — legacy edge minted before this column existed. Treated exactly like 0 everywhere
+  //          (restampOwnerLineage only refuses to traverse a literal 1), so pre-existing installs
+  //          keep today's claiming behavior.
+  // The ALTER lives HERE, in the hosted-schema block, and deliberately NOT in a new
+  // lib/migrations/vNN file: instance_lineage is created by the DDL above (not by the versioned
+  // ladder), and a post-v18 ALTER against an enrolled table breaks the rollback tests
+  // (memory: ctm-domain-split-post-v18-alter-on-enrolled-table-breaks-rollback-tests).
+  _safeAlterAddColumn('instance_lineage', 'cross_host INTEGER');
+  // WP-B §5 D-B1: the hashed OS machine id of the boot that wrote this row — the cross-host verdict's primary fact.
+  _safeAlterAddColumn('instance_identity', "machine_id TEXT NOT NULL DEFAULT ''");
   _safeAlterAddColumn('ctm_sessions', "continued_from_session_id TEXT DEFAULT ''");
   _safeAlterAddColumn('ctm_sessions', "handoff_target_session_id TEXT DEFAULT ''");
   // WP-1 (design doc §5/§8/§9 S-19): last known physical-footprint sample, persisted at
@@ -1284,6 +1315,9 @@ function _hostIdentityDataDir() {
   return path.dirname(currentDbPath || DEFAULT_DB_PATH);
 }
 
+let _osMachineIdHashMemo = null; // WP-B §9 B-4: OS machine id read ONCE per process ('' memoized too); tests inject `machineId`
+function _osMachineIdHashOnce() { if (_osMachineIdHashMemo === null) _osMachineIdHashMemo = readOsMachineIdHash(); return _osMachineIdHashMemo; }
+
 function _hostIdentityFingerprints(options = {}) {
   const hostname = options.hostname || _identityHostname();
   const port = options.port || process.env.CTM_PORT || '';
@@ -1320,6 +1354,7 @@ function _hostIdentityFingerprints(options = {}) {
 
 function _recordInstanceLineage(d, lineage) {
   if (!lineage || !lineage.priorInstanceId || !lineage.newInstanceId) return null;
+  const crossHost = Number(lineage.crossHost) === 1 ? 1 : 0;
   const existing = d.prepare(`
     SELECT * FROM instance_lineage
     WHERE prior_instance_id = ? AND new_instance_id = ? AND reason = ?
@@ -1327,17 +1362,28 @@ function _recordInstanceLineage(d, lineage) {
   `).get(lineage.priorInstanceId, lineage.newInstanceId, lineage.reason || 'clone_detected');
   if (existing) return existing;
   d.prepare(`
-    INSERT INTO instance_lineage (prior_instance_id, new_instance_id, reason, detected_at)
-    VALUES (?, ?, ?, ?)
+    INSERT INTO instance_lineage (prior_instance_id, new_instance_id, reason, detected_at, cross_host)
+    VALUES (?, ?, ?, ?, ?)
   `).run(
     lineage.priorInstanceId,
     lineage.newInstanceId,
     lineage.reason || 'clone_detected',
-    lineage.detectedAt || new Date().toISOString()
+    lineage.detectedAt || new Date().toISOString(),
+    crossHost
   );
   return d.prepare('SELECT * FROM instance_lineage WHERE rowid = last_insert_rowid()').get();
 }
 
+// WP-C §9 C-2: both read wrappers below must see each edge's cross_host verdict, or they would
+// keep traversing a cloned-DB edge and treat the source machine's ids as this host's own (design
+// §1.3 C-1..C-9). The column is added by the hosted-schema ALTER block, so it exists on any DB
+// this build has booted; a legacy schema without it reads no key, which the pure closure treats
+// as NULL — traversable — i.e. exactly today's behavior.
+function _ownerLineageReadRows() {
+  const crossHost = _tableHasColumn('instance_lineage', 'cross_host') ? ', cross_host' : '';
+  return getDomainDb('core').prepare(`SELECT prior_instance_id, new_instance_id${crossHost} FROM instance_lineage`).all();
+}
+
 // WP-3 (docs/ctm-session-restore-loss-and-render-wedge-2026-07-26.html) — DB-backed wrapper
 // around lib/host-identity.js's pure isSameOwnerLineage: reads the full instance_lineage table
 // (small, control-plane, per BASE_RESIDENT-adjacent core classification — never large) and
@@ -1347,8 +1393,7 @@ function _recordInstanceLineage(d, lineage) {
 function isSameOwnerLineage(candidateId, currentId) {
   const current = String(currentId || _currentHostedInstanceId() || '').trim();
   if (!_tableExists('instance_lineage')) return String(candidateId || '').trim() === current;
-  const rows = getDomainDb('core').prepare('SELECT prior_instance_id, new_instance_id FROM instance_lineage').all();
-  return _isSameOwnerLineagePure(candidateId, current, rows);
+  return _isSameOwnerLineagePure(candidateId, current, _ownerLineageReadRows());
 }
 
 // WP-3: returns the full lineage CONNECTED COMPONENT for `currentId` (every instance id
@@ -1361,8 +1406,7 @@ function getOwnerLineageComponent(currentId) {
   const current = String(currentId || _currentHostedInstanceId() || '').trim();
   if (!current) return [];
   if (!_tableExists('instance_lineage')) return [current];
-  const rows = getDomainDb('core').prepare('SELECT prior_instance_id, new_instance_id FROM instance_lineage').all();
-  return [..._ownerLineageComponentPure(current, rows)];
+  return [..._ownerLineageComponentPure(current, _ownerLineageReadRows())];
 }
 
 // WP-3 re-stamp migration (docs/ctm-session-restore-loss-and-render-wedge-2026-07-26.html):
@@ -1383,9 +1427,9 @@ const _RESTAMP_EMPTY_RESULT = Object.freeze({
   ctm_sessions: 0,
   startup_tasks: 0,
   ctm_sessions_execution_host: 0,
-  // WP-5 (docs/instance-identity-boot-order-2026-08-08.html S-8/S-9/S-10): three more live
-  // ownership pointers the census found unrestamped.
-  terminal_draft_images: 0,
+  // WP-5 (docs/instance-identity-boot-order-2026-08-08.html S-8/S-9/S-10): more live ownership
+  // pointers the census found unrestamped. Drafts are not one of them: the media-store allocator
+  // normalizes their owner at boot, never this transaction (R2 OQ-4 removed the dead counter).
   workspace_bindings: 0,
   workspace_bindings_conflicts_resolved: 0,
   startup_tasks_ctm_instance: 0,
@@ -1395,28 +1439,39 @@ const _RESTAMP_EMPTY_RESULT = Object.freeze({
   resource_leases: 0,
 });
 
+// WP-C §5 D-C2: the one closure (shared/host-identity.js ownerLineageComponent) is called twice
+// here — with the default options for the set this host may claim, and with
+// `{ traverseCrossHost: true }` to discover the ids that hang off the current host's component
+// ONLY across a cloned-DB edge. Those are foreign mirrors: rows they own belong to another
+// machine and are never claimed (P-2). The private cross-host-only twin this replaces is gone —
+// its one extra predicate now lives in the shared closure above (REPLACE IN PLACE).
 function restampOwnerLineage(options = {}) {
   if (process.env.CTM_OWNER_LINEAGE_RESTAMP === '0') return { ok: false, skipped: true, reason: 'disabled' };
   const currentId = String(options.currentId || _currentHostedInstanceId() || '').trim();
   if (!currentId) return { ok: false, skipped: true, reason: 'no-current-identity' };
-  if (!_tableExists('instance_lineage')) return { ok: true, restamped: { ..._RESTAMP_EMPTY_RESULT } };
-  const d = getDomainDb('core');
-  const lineageRows = d.prepare('SELECT prior_instance_id, new_instance_id FROM instance_lineage').all();
-  // Every DISTINCT owner id currently on record that is lineage-linked to currentId (excluding
-  // currentId itself — nothing to restamp there). Bounded by the lineage graph's own size, never
-  // a full table scan of distinct owner ids beyond what instance_lineage actually references.
-  const candidateIds = new Set();
-  for (const row of lineageRows) {
-    for (const id of [row.prior_instance_id, row.new_instance_id]) {
-      const clean = String(id || '').trim();
-      if (clean && clean !== currentId) candidateIds.add(clean);
-    }
+  if (!_tableExists('instance_lineage')) {
+    return { ok: true, restamped: { ..._RESTAMP_EMPTY_RESULT }, foreignParked: { startup_tasks: 0, ctm_sessions: 0 } };
   }
-  const lineageLinked = [...candidateIds].filter((id) => _isSameOwnerLineagePure(id, currentId, lineageRows));
+  const d = getDomainDb('core');
+  const lineageRows = _ownerLineageReadRows();
+  // Every owner id transitively lineage-linked to currentId (excluding currentId itself — nothing
+  // to restamp there). Bounded by the lineage graph's own size, never a full table scan of distinct
+  // owner ids beyond what instance_lineage actually references.
+  const lineageLinked = [..._ownerLineageComponentPure(currentId, lineageRows, { traverseCrossHost: true })]
+    .filter((id) => id !== currentId);
   const result = { ..._RESTAMP_EMPTY_RESULT };
-  if (!lineageLinked.length) return { ok: true, restamped: result };
+  // WP-2 §5 D-3 / §9 S-6/S-8: split the lineage-linked owners by WHICH EDGES connect them to
+  // currentId. `claimable` reached currentId without crossing a cross_host = 1 edge (this host's
+  // own history, including a live same-host re-mint) — the legacy claim set. `foreign` reached it
+  // only across a cloned-DB edge: rows they own belong to another machine and are MIRRORED, never
+  // claimed (P-2: foreign state is a mirror, never a peer write).
+  const sameHostComponent = _ownerLineageComponentPure(currentId, lineageRows);
+  const claimable = lineageLinked.filter((id) => sameHostComponent.has(id));
+  const foreign = lineageLinked.filter((id) => !sameHostComponent.has(id));
+  const foreignParked = { startup_tasks: 0, ctm_sessions: 0 };
+  if (!lineageLinked.length) return { ok: true, restamped: result, foreignParked };
   const txn = d.transaction(() => {
-    for (const staleId of lineageLinked) {
+    for (const staleId of claimable) {
       if (_tableHasColumn('ctm_sessions', 'current_owner_instance_id')) {
         result.ctm_sessions += d.prepare(
           'UPDATE ctm_sessions SET current_owner_instance_id = ? WHERE current_owner_instance_id = ?'
@@ -1483,15 +1538,46 @@ function restampOwnerLineage(options = {}) {
         ).run(currentId, staleId).changes || 0;
       }
     }
+    // WP-2 §5 D-3 / §9 S-6: the rows owned by the FOREIGN ids are mirrored, not claimed — in the
+    // SAME transaction, so a boot can never observe half a decision. The owner column stays
+    // untouched on every table (P-2: foreign state is a mirror; ownership leaves a host only via
+    // the explicit transfer path, design R-14), and startup_tasks gets the established parked
+    // representation (status='parked' + park_reason='foreign-clone'), the same shape
+    // lib/remote-machine-catalog.js reads as "exists, owned elsewhere" and _startupTaskRestorable
+    // already refuses to restore. Idempotent: the != 'foreign-clone' predicate makes a second boot
+    // over the same cloned DB park nothing new, and an already-'exited' row is left alone (its
+    // bookkeeping is terminal).
+    //
+    // ctm_sessions has NO status/park_reason columns (verified with PRAGMA table_info on a temp-db
+    // clone built by this file's own schema: it carries sync_status and parked_at but no park
+    // vocabulary — the hosted ALTER block above never adds one), so there is no park
+    // representation to write there; leaving its owner untouched IS the fence (no claim, no
+    // park), and foreignParked.ctm_sessions stays 0 rather than inventing a second representation.
+    if (foreign.length && _tableHasColumn('startup_tasks', 'status')
+      && _tableHasColumn('startup_tasks', 'park_reason') && _tableHasColumn('startup_tasks', 'parked_at')) {
+      const parkedAt = new Date().toISOString();
+      for (const foreignId of foreign) {
+        foreignParked.startup_tasks += d.prepare(`
+          UPDATE startup_tasks
+             SET status = 'parked', park_reason = 'foreign-clone', parked_at = ?
+           WHERE current_owner_instance_id = ?
+             AND COALESCE(status, 'running') != 'exited'
+             AND COALESCE(park_reason, '') != 'foreign-clone'
+        `).run(parkedAt, foreignId).changes || 0;
+      }
+    }
   });
   txn();
   const total = result.ctm_sessions + result.startup_tasks + result.ctm_sessions_execution_host
-    + result.terminal_draft_images + result.workspace_bindings + result.workspace_bindings_conflicts_resolved
+    + result.workspace_bindings + result.workspace_bindings_conflicts_resolved
     + result.startup_tasks_ctm_instance + result.resource_leases;
   if (total > 0) {
-    console.log(`[owner-lineage-restamp] restamped ${total} row(s) to ${currentId} (ctm_sessions=${result.ctm_sessions}, startup_tasks=${result.startup_tasks}, ctm_sessions_execution_host=${result.ctm_sessions_execution_host}, terminal_draft_images=${result.terminal_draft_images}, workspace_bindings=${result.workspace_bindings}, workspace_bindings_conflicts_resolved=${result.workspace_bindings_conflicts_resolved}, startup_tasks_ctm_instance=${result.startup_tasks_ctm_instance}, resource_leases=${result.resource_leases})`);
+    console.log(`[owner-lineage-restamp] restamped ${total} row(s) to ${currentId} (ctm_sessions=${result.ctm_sessions}, startup_tasks=${result.startup_tasks}, ctm_sessions_execution_host=${result.ctm_sessions_execution_host}, workspace_bindings=${result.workspace_bindings}, workspace_bindings_conflicts_resolved=${result.workspace_bindings_conflicts_resolved}, startup_tasks_ctm_instance=${result.startup_tasks_ctm_instance}, resource_leases=${result.resource_leases})`);
   }
-  return { ok: true, restamped: result };
+  if (foreignParked.startup_tasks > 0) {
+    console.log(`[owner-lineage-restamp] parked ${foreignParked.startup_tasks} foreign row(s) as park_reason='foreign-clone' (owner preserved) — ${foreign.length} id(s) reached ${currentId} only across a cross-host lineage edge`);
+  }
+  return { ok: true, restamped: result, foreignParked };
 }
 
 // Explicit, idempotent retirement utility for an auto-learned approval rule. Callers must
@@ -1558,21 +1644,28 @@ function _latestInstanceLineage(d, instanceId) {
     reason: row.reason || '',
     detectedAt: row.detected_at || '',
     detected_at: row.detected_at || '',
+    // WP-2 §5 D-3: read the STORED verdict — never recomputed at read time (the prior identity
+    // row this was derived from no longer exists). NULL = legacy edge (pre-WP-2), reported as 0
+    // so consumers see the same "same host" default restampOwnerLineage applies.
+    crossHost: Number(row.cross_host) === 1 ? 1 : 0,
+    cross_host: Number(row.cross_host) === 1 ? 1 : 0,
   };
 }
 
-function _replaceInstanceIdentityRow(d, identity, source) {
+function _replaceInstanceIdentityRow(d, identity, source, machineId = '') {
+  const hasMachineId = _tableHasColumn('instance_identity', 'machine_id');
   d.prepare('DELETE FROM instance_identity').run();
   d.prepare(`
-    INSERT INTO instance_identity (instance_id, created_at, host_fingerprint, source)
-    VALUES (?, ?, ?, ?)
+    INSERT INTO instance_identity (instance_id, created_at, host_fingerprint, source${hasMachineId ? ', machine_id' : ''})
+    VALUES (?, ?, ?, ?${hasMachineId ? ', ?' : ''})
   `).run(
     identity.instanceId,
     identity.createdAt || new Date().toISOString(),
     identity.hostFingerprint || '',
-    source || identity.source || 'generated'
-  );
-  return d.prepare('SELECT * FROM instance_identity WHERE instance_id = ?').get(identity.instanceId);
+    source || identity.source || 'generated',
+    ...(hasMachineId ? [String(machineId || '')] : []));
+  // WP-B D-B3: machine_id is not selected — this row spreads into the boot identity state & manifest.
+  return d.prepare('SELECT instance_id, created_at, host_fingerprint, source FROM instance_identity WHERE instance_id = ?').get(identity.instanceId);
 }
 
 function _backfillHostedIdentityProvenance(d, state) {
@@ -1653,6 +1746,7 @@ function getOrCreateInstanceIdentity(options = {}) {
   const hostname = options.hostname || _identityHostname();
   const port = options.port || process.env.CTM_PORT || '';
   const fingerprints = _hostIdentityFingerprints({ hostname, port });
+  const machineId = options.machineId ?? _osMachineIdHashOnce(); // WP-B D-B2: the verdict's primary fact
   const existing = d.prepare('SELECT * FROM instance_identity ORDER BY created_at LIMIT 1').get();
   const ensured = ensureHostIdentity({
     dataDir: _hostIdentityDataDir(),
@@ -1684,8 +1778,15 @@ function getOrCreateInstanceIdentity(options = {}) {
       console.log(mintLog);
     }
   }
-  const row = _replaceInstanceIdentityRow(d, identity, source);
-  const lineageRow = _recordInstanceLineage(d, ensured.lineage);
+  const row = _replaceInstanceIdentityRow(d, identity, source, machineId);
+  // WP-2 §5 D-3 / §9 S-5 / WP-B D-B2: stamp whether THIS re-mint edge crosses a host boundary,
+  // computed from the prior instance_identity row (`existing`, read above and churned by the line
+  // just before) plus the live OS machine id (WP-B: it decides alone when both sides know theirs),
+  // falling back to this host's fingerprint set (`fingerprints`, :1308-1325) when either is unknown.
+  // After _replaceInstanceIdentityRow the prior row is gone, so the verdict is stored (AC-2c).
+  const lineageRow = _recordInstanceLineage(d, ensured.lineage
+    ? { ...ensured.lineage, crossHost: _lineageCrossHost(existing, fingerprints, (priorPort) => _hostIdentityFingerprints({ hostname, port: priorPort }), machineId) }
+    : ensured.lineage);
   const backfill = _backfillHostedIdentityProvenance(d, ensured);
   const lineage = ensured.lineage
     ? _latestInstanceLineage(d, identity.instanceId)
@@ -1763,7 +1864,7 @@ function upsertHostedWorkspaceBinding(binding = {}) {
   const logicalId = _hostedToken(binding.logicalId || binding.logical_id || binding.id || '', '');
   const hostInstanceId = _hostedToken(binding.hostInstanceId || binding.host_instance_id || binding.currentOwnerInstanceId || '', '');
   const hostPath = String(binding.hostPath || binding.host_path || binding.path || '').trim();
-  const gitRemote = String(binding.gitRemote || binding.git_remote || binding.repoRemote || '').trim();
+  const gitRemote = normalizeGitRemote(binding.gitRemote || binding.git_remote || binding.repoRemote || '');
   if (!logicalId) throw new Error('logical_id required');
   if (!hostInstanceId) throw new Error('host_instance_id required');
   if (!hostPath) throw new Error('host_path required');
@@ -1799,7 +1900,7 @@ function seedHostedWorkspaceBindings(bindings = [], instanceId = '') {
       const hostPath = String(binding.hostPath || binding.host_path || '').trim();
       const logicalId = _hostedToken(binding.logicalId || binding.logical_id || binding.id || '', '');
       if (!hostPath || !logicalId) continue;
-      stmt.run(logicalId, id, hostPath, String(binding.gitRemote || binding.git_remote || binding.repoRemote || '').trim());
+      stmt.run(logicalId, id, hostPath, normalizeGitRemote(binding.gitRemote || binding.git_remote || binding.repoRemote || ''));
       count += 1;
     }
   });
@@ -3326,22 +3427,15 @@ function applySyncSnapshot(options = {}) {
   return value;
 }
 
+// S-19 (remote-machine-hub-sessions-2026-10-22.html §9): this used to carry its own copy of
+// the CTM_SYNC_PEERS grammar (JSON array vs `id=url` CSV) — for every caller that read it and
+// for lib/hosted-sync-worker.js#parseSyncPeers, which parses the same env. One parser now:
+// the sync worker's, which the machines registry also seeds from. (The old copy additionally
+// ignored CTM_SYNC_PEER_ALLOWLIST; nothing depends on that difference — this helper has no
+// callers in the tree today, and the allowlist-filtered set is the correct peer list.)
 function _syncConfiguredPeerIds(env = process.env) {
-  const raw = String(env.CTM_SYNC_PEERS || env.CTM_SYNC_PEER_URLS || '').trim();
-  if (!raw) return [];
-  if (raw.startsWith('[')) {
-    try {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        return parsed.map((entry) => _hostedToken(entry.instanceId || entry.instance_id || entry.id || entry.name || '', '')).filter(Boolean);
-      }
-    } catch {}
-  }
-  return raw.split(',')
-    .map((part) => {
-      const [id, ...rest] = part.split('=');
-      return rest.length ? _hostedToken(id, '') : '';
-    })
+  return require('./lib/hosted-sync-worker').parseSyncPeers(env)
+    .map((peer) => _hostedToken(peer.instanceId, ''))
     .filter(Boolean);
 }
 
@@ -4174,7 +4268,7 @@ function importHostedMigrationPack(pack = {}, options = {}) {
           host_path = excluded.host_path,
           git_remote = excluded.git_remote,
           updated_at = datetime('now')
-      `).run(logicalId, targetInstanceId, hostPath, String(binding.gitRemote || binding.git_remote || '').trim());
+      `).run(logicalId, targetInstanceId, hostPath, normalizeGitRemote(binding.gitRemote || binding.git_remote || ''));
       bindingsImported += 1;
     }
     for (const task of tasks) {
@@ -4689,7 +4783,6 @@ function _openDbConnection(dbPath) {
     label: 'ctm-task-manager',
     mainWriteInventory: isMainThread,
     timeoutMs: _sqliteTimeoutMs('CTM_SQLITE_WRITE_LOCK_TIMEOUT_MS', 0),
-    staleMs: Number(process.env.CTM_SQLITE_WRITE_LOCK_STALE_MS || 10 * 60 * 1000),
     // Phase 3 fairness: the db-owner worker (a background thread that waits up to
     // 5s) polls tightly so it reliably claims the lock the instant the main thread
     // releases, instead of starving behind a burst of fast main-thread writes. The
@@ -7474,8 +7567,8 @@ function _defaultMigrationSteps() {
     // v53 (WP-2A): the approved session-model-intent table. Schema-only + a one-time row
     // integrity pass; it creates no other table, seeds nothing and stamps only after both hold.
     53: () => _migrateToV53Impl({ getDb: () => dbFor('session_model_intent'), setSchemaVersion }),
-    // v54 (WP-0) the per-session lead model pin — an explicit model choice replayed on resume; v55 (WP-2, multi-machine) stamps blank agent_sessions.origin_instance_id rows with this database's identity (one idempotent UPDATE, sharing this line because db.js is at its size ceiling).
-    54: () => _migrateToV54Impl({ getDb: () => dbFor('session_lead_model'), setSchemaVersion }), 55: () => require('./lib/migrations/v55-agent-origin-backfill').migrateToV55({ getDb: () => dbFor('agent_sessions'), getIdentityDb: () => dbFor('instance_identity'), setSchemaVersion }),
+    // v54 (WP-0) the per-session lead model pin — an explicit model choice replayed on resume; v55 (WP-2, multi-machine) stamps blank agent_sessions.origin_instance_id rows with this database's identity (one idempotent UPDATE, sharing this line because db.js is at its size ceiling); v56 (WP-1, machine pool) is host_samples + machine_self + machine_pairing_offers + machines.urls_json, all domain 'core'.
+    54: () => _migrateToV54Impl({ getDb: () => dbFor('session_lead_model'), setSchemaVersion }), 55: () => require('./lib/migrations/v55-agent-origin-backfill').migrateToV55({ getDb: () => dbFor('agent_sessions'), getIdentityDb: () => dbFor('instance_identity'), setSchemaVersion }), 56: () => require('./lib/migrations/v56-host-samples-and-machine-pool').migrateToV56({ getDb: () => dbFor('machines'), setSchemaVersion }),
   }, { reservedVersions: [18] });
 }
 let _migrationSteps = _defaultMigrationSteps();
@@ -7991,6 +8084,366 @@ function _ensureSessionModelPreferenceRoutingColumns(d = getDb()) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1) — the hub-side machine registry:
+// the durable list of boxes this CTM can drive sessions on (lib/machine-registry.js owns the
+// policy; the SQL lives here, in the owner zone, like every other CTM table).
+//
+// WHY THE DDL SITS HERE RATHER THAN IN _ensureHostedPrimarySchema'S EXEC BLOB: it is called
+// from there (one line), but the CREATE TABLE literal itself must stay late in the file.
+// persistence-format surfaces are ORDINAL-keyed in release/ownership-registry.json
+// (`coding-task-manager/db.js:ddl#N`, N = the statement's position in file order), so putting
+// the statement in the schema blob would renumber every later DDL surface in db.js and force
+// ~230 unrelated registry re-registrations for one new table. The contract is identical — one
+// idempotent CREATE TABLE IF NOT EXISTS, reached from the same ensure pass as sync_*.
+//
+// DOMAIN: `machines` has no entry in lib/db-domain-tables.js yet (that file is outside this
+// work package), so the handles below resolve via getDomainDb('core') — the same flip-aware
+// CORE handle dbFor('machines') returns once the classification lands.
+function _machinesDb() {
+  return getDomainDb('core');
+}
+
+/** Idempotent: creates the hub machine registry (called from _ensureHostedPrimarySchema). */
+function _ensureMachineRegistrySchema(target = _machinesDb()) {
+  target.exec(`
+    CREATE TABLE IF NOT EXISTS machines (
+      instance_id TEXT PRIMARY KEY,               -- pinned minted id of the box (D-3)
+      display_name TEXT NOT NULL DEFAULT '',      -- user label, e.g. "spark"
+      url TEXT NOT NULL,                          -- e.g. http://127.0.0.1:3556
+      walle_url TEXT NOT NULL DEFAULT '',         -- '' = derive (CTM port + 1), same rule as parseSyncPeers
+      enabled INTEGER NOT NULL DEFAULT 1,
+      last_seen_at INTEGER NOT NULL DEFAULT 0,    -- hub clock, ms
+      health TEXT NOT NULL DEFAULT 'unknown',     -- reachable|unknown|unreachable|unhealthy
+      health_detail TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      urls_json TEXT NOT NULL DEFAULT '[]'        -- rev 2 P-1/P-4: the member's dialable URLs, in dial order
+    );
+  `);
+  _invalidateTableExistsMemo();
+  return target;
+}
+
+const MACHINE_ROW_COLUMNS = 'instance_id, display_name, url, walle_url, enabled, last_seen_at, health, health_detail, created_at, updated_at, urls_json';
+
+function _machineRow(row = {}) {
+  return {
+    instanceId: String(row.instance_id || ''),
+    displayName: String(row.display_name || ''),
+    url: String(row.url || ''),
+    walleUrl: String(row.walle_url || ''),
+    enabled: Number(row.enabled || 0) || 0,
+    lastSeenAt: Number(row.last_seen_at || 0) || 0,
+    health: String(row.health || 'unknown'),
+    healthDetail: String(row.health_detail || ''),
+    createdAt: String(row.created_at || ''),
+    updatedAt: String(row.updated_at || ''),
+    urls: _machineUrls(row.urls_json),
+  };
+}
+
+/** P-1/P-4: `urls_json` is a JSON array of dialable URLs; bad JSON reads as [] (never throws). */
+function _machineUrls(value) {
+  try { const parsed = JSON.parse(String(value || '[]')); return Array.isArray(parsed) ? parsed.map((u) => String(u || '')).filter(Boolean) : []; }
+  catch { return []; } // expected: a hand-edited/garbled column must not break every machine list
+}
+
+/** Read the hub machine registry. Pre-boot/pre-migration reads return [] rather than throwing. */
+function listMachineRows() {
+  try {
+    const d = _machinesDb();
+    return d.prepare(`SELECT ${MACHINE_ROW_COLUMNS} FROM machines ORDER BY instance_id ASC`)
+      .all()
+      .map(_machineRow);
+  } catch {
+    return []; // expected: the machines table does not exist yet (pre-boot handle)
+  }
+}
+
+/**
+ * Insert-or-update one machine. `enabled` is honoured on conflict: registration is an explicit
+ * "use this box" act, seeding (lib/machine-registry.js) never calls this for a row it did not
+ * just find missing.
+ *
+ * WP-3 P-4: an optional `urls` (dial list) is written to `urls_json`. It is written ONLY when the
+ * caller supplies a non-empty list — `registerMachine` and the probe sweep never pass one, and they
+ * must not blank the dial list a roster push (replaceRosterMachines) or a pairing (POST
+ * /api/machines/pair) put there. The `CASE` below is that guard: an empty `excluded` list leaves the
+ * stored column alone instead of resetting it to '[]' (the column DEFAULT only applies to INSERT).
+ */
+function upsertMachineRow(row = {}) {
+  const instanceId = _hostedToken(row.instanceId || row.instance_id || '', '');
+  const url = String(row.url || '').trim().replace(/\/+$/, '');
+  if (!instanceId || !url) return 0;
+  const urls = (Array.isArray(row.urls) ? row.urls : [])
+    .map((entry) => String(entry || '').trim().replace(/\/+$/, ''))
+    .filter(Boolean);
+  const d = _machinesDb();
+  _ensureMachineRegistrySchema();
+  const changes = d.prepare(`
+    INSERT INTO machines (instance_id, display_name, url, walle_url, enabled, updated_at, urls_json)
+    VALUES (?, ?, ?, ?, ?, datetime('now'), ?)
+    ON CONFLICT(instance_id) DO UPDATE SET
+      display_name = excluded.display_name,
+      url = excluded.url,
+      walle_url = excluded.walle_url,
+      enabled = excluded.enabled,
+      urls_json = CASE WHEN excluded.urls_json = '[]' THEN machines.urls_json ELSE excluded.urls_json END,
+      updated_at = datetime('now')
+  `).run(
+    instanceId,
+    String(row.displayName || row.display_name || '').slice(0, 200),
+    url,
+    String(row.walleUrl || row.walle_url || '').replace(/\/+$/, ''),
+    Number(row.enabled ?? 1) ? 1 : 0,
+    JSON.stringify(urls),
+  ).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/** Probe outcome for one machine: health + detail, and last_seen_at when the box answered. */
+function recordMachineProbe(instanceId, patch = {}) {
+  const id = _hostedToken(instanceId || '', '');
+  if (!id) return 0;
+  const health = String(patch.health || '').trim();
+  if (!health) return 0;
+  const d = _machinesDb();
+  const lastSeenAt = Number(patch.lastSeenAt ?? patch.last_seen_at ?? 0) || 0;
+  const changes = d.prepare(`
+    UPDATE machines
+    SET health = ?, health_detail = ?, last_seen_at = ?, updated_at = datetime('now')
+    WHERE instance_id = ?
+  `).run(health, String(patch.healthDetail || patch.health_detail || '').slice(0, 500), lastSeenAt, id).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/** Unregister a machine (route: POST /api/machines/:id/remove). Nothing else keys on the row. */
+function deleteMachineRow(instanceId) {
+  const id = _hostedToken(instanceId || '', '');
+  if (!id) return 0;
+  const d = _machinesDb();
+  const changes = d.prepare('DELETE FROM machines WHERE instance_id = ?').run(id).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/**
+ * WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4 rev 2, §9 S-25): this
+ * machine's OWN settings. Exactly one row (id = 1); a missing row reads as the defaults, so no
+ * seeding step is needed. lib/machine-self.js caches this so the manifest path never hits the DB.
+ */
+function getMachineSelf() {
+  try {
+    const d = _machinesDb();
+    const row = d.prepare('SELECT display_name, favorite, hidden, updated_at FROM machine_self WHERE id = 1').get();
+    return _machineSelfRow(row);
+  } catch {
+    return _machineSelfRow(null); // expected: machine_self does not exist yet (pre-boot/pre-migration)
+  }
+}
+
+function _machineSelfRow(row) {
+  return {
+    displayName: String((row && row.display_name) || ''),
+    favorite: Number((row && row.favorite) || 0) || 0,
+    hidden: Number((row && row.hidden) || 0) || 0,
+    updatedAt: Number((row && row.updated_at) || 0) || 0,
+  };
+}
+
+/**
+ * D-4 write: ONLY the given fields change (a partial patch merges over the stored row, so a
+ * favorite toggle never clears the display name). `at` is the caller's clock.
+ */
+function setMachineSelf({ displayName, favorite, hidden, at = 0 } = {}) {
+  const d = _machinesDb();
+  const current = getMachineSelf();
+  const next = {
+    displayName: displayName === undefined ? current.displayName : String(displayName || '').slice(0, 80),
+    favorite: favorite === undefined ? current.favorite : (favorite ? 1 : 0),
+    hidden: hidden === undefined ? current.hidden : (hidden ? 1 : 0),
+    updatedAt: Math.trunc(Number(at) || 0) || current.updatedAt,
+  };
+  d.prepare(`
+    INSERT INTO machine_self (id, display_name, favorite, hidden, updated_at)
+    VALUES (1, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      display_name = excluded.display_name,
+      favorite = excluded.favorite,
+      hidden = excluded.hidden,
+      updated_at = excluded.updated_at
+  `).run(next.displayName, next.favorite, next.hidden, next.updatedAt);
+  flushWal();
+  return getMachineSelf();
+}
+
+/**
+ * P-5 receive side (§6.1): replace this member's machinery membership with the pushed set in ONE
+ * transaction — upsert every listed member (url = urls[0], urls_json = urls), delete every row not
+ * listed, and NEVER write this instance's own row (a member is not in its own roster). `enabled` is
+ * left alone on conflict (it stays a per-primary local switch, D-4).
+ */
+// `removable` = the PREVIOUS pool members: only those may be deleted when absent from `members`. A legacy
+// env-token row (P-8) is never a pool member, so a roster push/pull can never drop it.
+function replaceRosterMachines({ members = [], selfInstanceId = '', removable = [] } = {}) {
+  const self = _hostedToken(selfInstanceId || '', '');
+  const listed = [];
+  const seen = new Set();
+  for (const member of Array.isArray(members) ? members : []) {
+    const instanceId = _hostedToken((member && (member.instanceId || member.instance_id)) || '', '');
+    if (!instanceId || instanceId === self || seen.has(instanceId)) continue;
+    const urls = (Array.isArray(member.urls) ? member.urls : []).map((u) => String(u || '').trim().replace(/\/+$/, '')).filter(Boolean);
+    const url = String((member && (member.url || urls[0])) || '').trim().replace(/\/+$/, '');
+    if (!url) continue;
+    seen.add(instanceId);
+    listed.push({ instanceId, url, urls: urls.length ? urls : [url], displayName: String((member && (member.displayName || member.display_name)) || '').slice(0, 200) });
+  }
+  const d = _machinesDb();
+  _ensureMachineRegistrySchema();
+  const txn = d.transaction(() => {
+    let upserted = 0;
+    for (const row of listed) {
+      upserted += d.prepare(`
+        INSERT INTO machines (instance_id, display_name, url, walle_url, enabled, updated_at, urls_json)
+        VALUES (?, ?, ?, '', 1, datetime('now'), ?)
+        ON CONFLICT(instance_id) DO UPDATE SET
+          url = excluded.url,
+          urls_json = excluded.urls_json,
+          updated_at = datetime('now')
+      `).run(row.instanceId, row.displayName, row.url, JSON.stringify(row.urls)).changes || 0;
+    }
+    let deleted = 0;
+    const keep = new Set(listed.map((row) => row.instanceId));
+    // A blank `self` means identity is not ready: delete nothing in that state.
+    if (self) {
+      const del = d.prepare('DELETE FROM machines WHERE instance_id = ?');
+      for (const raw of Array.isArray(removable) ? removable : []) {
+        const id = _hostedToken(raw || '', '');
+        if (id && id !== self && !keep.has(id)) deleted += del.run(id).changes || 0;
+      }
+    }
+    return { upserted, deleted };
+  });
+  const result = txn();
+  flushWal();
+  return result;
+}
+
+/** WP-2a P-6 leave(): drop every roster row (the member is no longer in any pool). */
+function deleteAllMachineRows() {
+  const d = _machinesDb();
+  const changes = d.prepare('DELETE FROM machines').run().changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/**
+ * WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9, §9 S-15/S-16): the
+ * pairing-offer rows. Table `machine_pairing_offers` (id, code_hash UNIQUE, created_at, expires_at,
+ * redeemed_at, redeemed_by) comes from migration v56 and is classified 'core' in
+ * lib/db-domain-tables.js.
+ *
+ * INVARIANT: the plaintext CODE never reaches this file. The caller (lib/machine-pairing.js) hashes
+ * it and passes only `codeHash`; nothing here formats, logs or returns a code.
+ */
+
+/** Mint one offer. Returns the number of rows written (0 for a blank id/hash). */
+function insertPairingOffer({ id, codeHash, createdAt = 0, expiresAt = 0 } = {}) {
+  const offerId = String(id || '').trim();
+  const hash = String(codeHash || '').trim();
+  if (!offerId || !hash) return 0;
+  const d = _machinesDb();
+  const changes = d.prepare(`
+    INSERT INTO machine_pairing_offers (id, code_hash, created_at, expires_at)
+    VALUES (?, ?, ?, ?)
+  `).run(offerId, hash, Math.trunc(Number(createdAt) || 0), Math.trunc(Number(expiresAt) || 0)).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/**
+ * Single-use: the `redeemed_at IS NULL` predicate makes two concurrent redemptions of the same offer
+ * a 1-and-0 instead of a double-spend, so the loser is answered `pairing_code_invalid`.
+ */
+function markPairingOfferRedeemed({ id, at = 0, redeemedBy = '' } = {}) {
+  const offerId = String(id || '').trim();
+  if (!offerId) return 0;
+  const d = _machinesDb();
+  const changes = d.prepare(`
+    UPDATE machine_pairing_offers
+    SET redeemed_at = ?, redeemed_by = ?
+    WHERE id = ? AND redeemed_at IS NULL
+  `).run(Math.trunc(Number(at) || 0), String(redeemedBy || '').slice(0, 200), offerId).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/**
+ * AC-3c: the 5th consecutive wrong redeem burns every LIVE offer (unspent and unexpired) in one
+ * statement. `redeemed_by = 'burned'` is what makes the burn visible in the table without ever
+ * naming a code — and it is a reserved sentinel, not an instance id.
+ */
+function burnLivePairingOffers({ at = 0 } = {}) {
+  const ts = Math.trunc(Number(at) || 0);
+  const d = _machinesDb();
+  const changes = d.prepare(`
+    UPDATE machine_pairing_offers
+    SET redeemed_at = ?, redeemed_by = 'burned'
+    WHERE redeemed_at IS NULL AND expires_at > ?
+  `).run(ts, ts).changes || 0;
+  if (changes) flushWal();
+  return changes;
+}
+
+/**
+ * The live set — unspent and unexpired as of `at`. Ordered oldest-first so the 3-offer ceiling is
+ * deterministic. Pre-boot/pre-migration reads return [] rather than throwing (house read rule).
+ */
+function listLivePairingOffers({ at = 0 } = {}) {
+  try {
+    const d = _machinesDb();
+    return d.prepare(`
+      SELECT id, code_hash, created_at, expires_at
+      FROM machine_pairing_offers
+      WHERE redeemed_at IS NULL AND expires_at > ?
+      ORDER BY created_at ASC
+    `).all(Math.trunc(Number(at) || 0)).map((row) => ({
+      id: String(row.id || ''),
+      codeHash: String(row.code_hash || ''),
+      createdAt: Number(row.created_at) || 0,
+      expiresAt: Number(row.expires_at) || 0,
+    }));
+  } catch {
+    return []; // expected: machine_pairing_offers does not exist yet (pre-boot / pre-migration)
+  }
+}
+
+/** WP-1 D-11 (§6.1): one sample per resource tick; the 24 h purge rides the SAME transaction. */
+function recordHostSample({ at = 0, sampleJson = '', purgeBeforeMs = 0 } = {}) {
+  const d = _machinesDb();
+  const txn = d.transaction(() => {
+    d.prepare('INSERT OR REPLACE INTO host_samples (at, sample_json) VALUES (?, ?)').run(Math.trunc(Number(at) || 0), String(sampleJson || ''));
+    return d.prepare('DELETE FROM host_samples WHERE at < ?').run(Math.trunc(Number(purgeBeforeMs) || 0)).changes || 0;
+  });
+  const purged = txn() || 0;
+  flushWal();
+  return purged;
+}
+
+/** Oldest first — the wire order in §6.1. Pre-migration reads return [] rather than throwing. */
+function listHostSamples({ sinceMs = 0, limit = 1440 } = {}) {
+  try {
+    const d = _machinesDb();
+    return d.prepare('SELECT at, sample_json FROM host_samples WHERE at >= ? ORDER BY at ASC LIMIT ?')
+      .all(Math.trunc(Number(sinceMs) || 0), Math.max(1, Math.trunc(Number(limit) || 1440)));
+  } catch {
+    return []; // expected: host_samples does not exist yet (pre-boot handle)
+  }
+}
+
 /**
  * Schema v12: durable smart-routing manager state.
  *
@@ -8413,6 +8866,11 @@ const SESSION_DIAGNOSTIC_CLIENT_MEMORY_SQL = `(event = 'client-memory')`;
 const SESSION_DIAGNOSTIC_SEAM_RESERVE = 64;
 const SESSION_DIAGNOSTIC_SEAM_SQL = `(event = 'client-history-seam-crossing')`;
 
+// reader-evidence-retention D-1/D-2: the reader incident beacons (scroll-write, chain-advance, page-fetch, parked) are the
+// evidence of a reader jump; a fifth lane, newest 10 rows PER EVENT, never a glob.
+const SESSION_DIAGNOSTIC_READER_PER_EVENT_RESERVE = 10;
+const SESSION_DIAGNOSTIC_READER_SQL = `(event IN ('client-history-reader-scroll-write', 'client-history-reader-chain-advance', 'client-history-page-fetch', 'client-history-reader-parked'))`;
+
 function _sessionDiagnosticRetentionStatements(d) {
   return {
     // 1) Protected rows keep their OWN reserve — trimmed to the newest
@@ -8457,19 +8915,35 @@ function _sessionDiagnosticRetentionStatements(d) {
             LIMIT ${SESSION_DIAGNOSTIC_SEAM_RESERVE}
          )
     `),
-    // 4) Unprotected rows (neither protected-lifecycle, client-memory, nor seam-beacon) are
-    // trimmed to whatever budget remains under the TOTAL cap once the (already-trimmed)
-    // protected, client-memory and seam rows are accounted for — run AFTER all three trims
-    // above so this subquery sees their post-trim counts, not the pre-trim ones.
+    // 4) Reader-beacon rows (the four incident events in SESSION_DIAGNOSTIC_READER_SQL) get their
+    // OWN reserve too — a FIFTH lane, independent of the three above and of the unprotected budget
+    // below. Unlike the other lanes it is partitioned PER EVENT (ROW_NUMBER() OVER (PARTITION BY
+    // event)), because one incident chain fetched 11 pages: a shared lane would let a page-fetch
+    // burst evict the single scroll-write row that names the cause (reader-evidence-retention D-2).
+    trimReader: d.prepare(`
+      DELETE FROM session_diagnostics
+       WHERE id IN (
+         SELECT id FROM (
+           SELECT id, ROW_NUMBER() OVER (PARTITION BY event ORDER BY id DESC) AS rn
+             FROM session_diagnostics
+            WHERE session_id = ? AND ${SESSION_DIAGNOSTIC_READER_SQL}
+         ) WHERE rn > ${SESSION_DIAGNOSTIC_READER_PER_EVENT_RESERVE}
+       )
+    `),
+    // 5) Unprotected rows (neither protected-lifecycle, client-memory, seam-beacon, nor
+    // reader-beacon) are trimmed to whatever budget remains under the TOTAL cap once the
+    // (already-trimmed) protected, client-memory, seam and reader rows are accounted for — run
+    // AFTER all four trims above so this subquery sees their post-trim counts, not the pre-trim ones.
     trimUnprotected: d.prepare(`
       DELETE FROM session_diagnostics
        WHERE session_id = ?
          AND NOT ${SESSION_DIAGNOSTIC_PROTECTED_SQL}
          AND NOT ${SESSION_DIAGNOSTIC_CLIENT_MEMORY_SQL}
          AND NOT ${SESSION_DIAGNOSTIC_SEAM_SQL}
+         AND NOT ${SESSION_DIAGNOSTIC_READER_SQL}
          AND id NOT IN (
            SELECT id FROM session_diagnostics
-            WHERE session_id = ? AND NOT ${SESSION_DIAGNOSTIC_PROTECTED_SQL} AND NOT ${SESSION_DIAGNOSTIC_CLIENT_MEMORY_SQL} AND NOT ${SESSION_DIAGNOSTIC_SEAM_SQL}
+            WHERE session_id = ? AND NOT ${SESSION_DIAGNOSTIC_PROTECTED_SQL} AND NOT ${SESSION_DIAGNOSTIC_CLIENT_MEMORY_SQL} AND NOT ${SESSION_DIAGNOSTIC_SEAM_SQL} AND NOT ${SESSION_DIAGNOSTIC_READER_SQL}
             ORDER BY id DESC
             LIMIT (${SESSION_DIAGNOSTIC_TOTAL_CAP} - (
               SELECT COUNT(*) FROM session_diagnostics WHERE session_id = ? AND ${SESSION_DIAGNOSTIC_PROTECTED_SQL}
@@ -8477,6 +8951,8 @@ function _sessionDiagnosticRetentionStatements(d) {
               SELECT COUNT(*) FROM session_diagnostics WHERE session_id = ? AND ${SESSION_DIAGNOSTIC_CLIENT_MEMORY_SQL}
             ) - (
               SELECT COUNT(*) FROM session_diagnostics WHERE session_id = ? AND ${SESSION_DIAGNOSTIC_SEAM_SQL}
+            ) - (
+              SELECT COUNT(*) FROM session_diagnostics WHERE session_id = ? AND ${SESSION_DIAGNOSTIC_READER_SQL}
             ))
          )
     `),
@@ -8487,7 +8963,8 @@ function _sweepSessionDiagnosticsRetention(d, statements, sessionId) {
   statements.trimProtected.run(sessionId, sessionId);
   statements.trimClientMemory.run(sessionId, sessionId);
   statements.trimSeam.run(sessionId, sessionId);
-  statements.trimUnprotected.run(sessionId, sessionId, sessionId, sessionId, sessionId);
+  statements.trimReader.run(sessionId);
+  statements.trimUnprotected.run(sessionId, sessionId, sessionId, sessionId, sessionId, sessionId);
 }
 
 /*
@@ -8557,6 +9034,25 @@ function flushSessionMetadataUpdates(entries) {
   return { updated: prepared.length };
 }
 
+// WP-2 (worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-4/D-7, §8 WP-2): the
+// ONE writer for the "link a provider transcript to an agent_session" repair. A resume preflight
+// that DERIVED the transcript path (lib/transcript-link.js verified the file really is that
+// session's) calls this so the next resume finds the link instead of deriving it again.
+//
+// The WHERE clause is the safety property: only a row whose jsonl_path is empty (or NULL) is
+// touched, so a derived guess can never REPLACE a link someone else recorded -- `updated: 0`
+// means "nothing was written", which is the correct answer for a row that is already linked.
+function updateAgentSessionTranscriptLink(agentSessionId, jsonlPath) {
+  const id = String(agentSessionId || '').trim();
+  const p = String(jsonlPath || '').trim();
+  if (!id || !p) return { updated: 0 };
+  // agent_sessions is CORE -- flip-aware handle, matching every other writer of jsonl_path.
+  const result = dbFor('agent_sessions').prepare(
+    "UPDATE agent_sessions SET jsonl_path = COALESCE(NULLIF(?, ''), jsonl_path), updated_at = datetime('now') WHERE agent_session_id = ? AND COALESCE(jsonl_path, '') = ''",
+  ).run(p, id);
+  return { updated: result.changes };
+}
+
 function listSessionDiagnostics(sessionId, limit = 120) {
   const cleanSessionId = String(sessionId || '').trim();
   if (!cleanSessionId) return [];
@@ -15141,6 +15637,24 @@ function getSmartRoutingSummaryRefreshInput(ctmSessionId, { limit = 24 } = {}) {
 }
 
 // --- Startup Tasks (crash-safe session restore) ---
+//
+// S-28 (remote-machine-hub-sessions-2026-10-22.html §9): THREE different things in this repo
+// are called an "instance id". They are not interchangeable, and only ONE of them is identity:
+//
+//   1. THE MINTED IDENTITY ROW — instance_identity.instance_id (db.js getOrCreateInstanceIdentity,
+//      lib/instance-identity-*.js). A random, durable, per-DATABASE id minted once at boot,
+//      transferable on an ownership handoff. THE HUB KEYS ON THIS ONE (D-3: `machines.instance_id`
+//      is exactly this value, pinned from the box's GET /api/sync/manifest) and it is what
+//      workspace/ownership lineage and the sync layer compare against. Reminting it is a visible
+//      event with a restamp path (restampOwnerLineage) — never a side effect.
+//   2. THE LIVENESS STAMP BELOW — `${hostname}:${pid}:${Date.now()}`, deliberately NOT durable and
+//      NOT unique per database: it is regenerated on every process start and exists to answer
+//      "is the process that wrote this startup_tasks row still the one running?" inside one boot.
+//   3. CTM_EXECUTION_HOST — the env var a remote/forwarded launch may name for the PTY child
+//      (server.js's create path), i.e. "where the work ran", a display/attribution field.
+//
+// The hub (lib/machine-registry.js) keys ONLY on (1). (2) must never be registered as a machine
+// — it changes on every restart; (3) is not an identity at all.
 const CTM_INSTANCE_ID = `${require('os').hostname()}:${process.pid}:${Date.now()}`;
 
 function _insertStartupTaskRow(d, {
@@ -15157,7 +15671,18 @@ function _insertStartupTaskRow(d, {
   if (cols.has('parked_at')) { names.push('parked_at'); values.push(''); }
   if (cols.has('park_reason')) { names.push('park_reason'); values.push(''); }
   const hostedInstanceId = (cols.has('origin_instance_id') || cols.has('current_owner_instance_id')) ? _currentHostedInstanceId() : '';
-  if (cols.has('origin_instance_id')) { names.push('origin_instance_id'); values.push(hostedInstanceId); }
+  if (cols.has('origin_instance_id')) {
+    // S-6 (WP-2, docs/remote-machine-hub-sessions-2026-10-22.html §9): origin_instance_id is
+    // WRITE-ONCE. INSERT OR REPLACE deletes and reinserts the row, so a RE-CREATE of an existing
+    // ctm_session_id (crash recovery, restore of an exited session) used to re-stamp origin with
+    // whatever instance is running now — destroying the only record of where the session was
+    // first created (the hub's D-3/D-7 machine routing keys on it). Preserve the recorded origin;
+    // fill from this instance only when the column is blank/missing (the same fill-if-blank shape
+    // the sync/ownership writers use, e.g. the COALESCE(NULLIF(origin_instance_id, ''), ?) seed).
+    const priorOrigin = _startupTaskRawOnHandle(d, sessionId);
+    names.push('origin_instance_id');
+    values.push(_hostedToken(priorOrigin && priorOrigin.origin_instance_id, '') || hostedInstanceId);
+  }
   if (cols.has('current_owner_instance_id')) { names.push('current_owner_instance_id'); values.push(hostedInstanceId); }
   const placeholders = names.map(() => '?').join(', ');
   d.prepare(`INSERT OR REPLACE INTO startup_tasks (${names.join(', ')}) VALUES (${placeholders})`).run(...values);
@@ -15245,6 +15770,7 @@ function updateStartupTaskAgentSession(sessionId, agentSessionId, agentProjectDi
   vals.push(sessionId);
   let changes = 0;
   d.transaction(() => {
+    if (cols.has('args') && resumesCandidateFork(d, sessionId, resumeArgs)) return; // only the transition commit moves it
     changes = d.prepare(`UPDATE startup_tasks SET ${sets.join(', ')} WHERE ctm_session_id = ?`).run(...vals).changes || 0;
     if (changes) _maybeEnqueueStartupTaskOutbox(d, sessionId, 'upsert');
   })();
@@ -15521,6 +16047,19 @@ function listStartupTasks(opts = {}) {
   return rows.filter((row) => _startupTaskRestorable(row, opts)).map(_startupTaskRow);
 }
 
+// Ingest-fence D-1 clause (d) (docs/remote-hub-ownership-fences-and-restore-skip-diagnostics-2026-10-23.html):
+// the durable-ledger read. ctm_sessions is the one ledger that still holds an ENDED session —
+// listStartupTasks() above drops exited rows — so "does this hub's ledger know the id, and who owns
+// it" is answered here. Deliberately throw-through: the catalog's per-clause guard counts the fault
+// and fails OPEN, which a silent empty answer here would hide.
+function getCtmSessionOwnerRow(ctmSessionId) {
+  const id = String(ctmSessionId || '').trim();
+  if (!id) return { exists: false, currentOwner: '' };
+  const row = getDomainDb('core').prepare('SELECT current_owner_instance_id FROM ctm_sessions WHERE id = ?').get(id);
+  if (!row) return { exists: false, currentOwner: '' };
+  return { exists: true, currentOwner: String(row.current_owner_instance_id || '').trim() };
+}
+
 // WP-2 restore-side backstop (docs/ctm-session-restore-loss-and-render-wedge-2026-07-26.html):
 // listStartupTasks() above is restore's SOLE input — a ctm_sessions row that has no
 // startup_tasks row (whatever the cause: RC-1's domain-routing bug, a write that exhausted its
@@ -18771,196 +19310,10 @@ function _normalizeSessionTitle(value, maxLen = 120) {
   return String(value || '').replace(/\s+/g, ' ').trim().slice(0, maxLen);
 }
 
-function _branchTitleCandidates(branch) {
-  const full = String(branch || '').trim().replace(/^refs\/heads\//, '');
-  if (!full) return [];
-  const parts = full.split('/').filter(Boolean);
-  const leaf = parts.length ? parts[parts.length - 1] : full;
-  const namespace = parts.length > 1 ? parts.slice(0, -1).join('/') : '';
-  const displayNamespace = namespace.replace(/^ctm\//, '');
-  return Array.from(new Set([
-    full,
-    leaf,
-    namespace && leaf ? `${namespace}/${leaf}` : '',
-    displayNamespace && leaf ? `${displayNamespace}/${leaf}` : '',
-  ].filter(Boolean).map(_normalizeSessionTitle)));
-}
-
-function _looksLikeWorktreeCwdTitle(title, cwd) {
-  const t = _normalizeSessionTitle(title);
-  const dir = String(cwd || '').trim();
-  if (!t || !dir) return false;
-  const base = _normalizeSessionTitle(path.basename(dir));
-  if (!base || t.toLowerCase() !== base.toLowerCase()) return false;
-  return /(?:^|[/\\])(?:\.claude[/\\])?worktrees[/\\][^/\\]+$/i.test(dir);
-}
-
-function isUserSessionTitleCandidate(title, context = {}) {
-  const t = _normalizeSessionTitle(title);
-  if (!t) return false;
-  if (/^Resume:\s*/i.test(t)) return false;
-  if (/^Wall-?E session$/i.test(t)) return false;
-  if (/^(Claude Code|Codex|Gemini|Aider):\s*(~\/|\/|[A-Za-z]:[\\/])/i.test(t)) return false;
-  if (/^Shell:\s*/i.test(t)) return false;
-  if (/^(~\/|\/|[A-Za-z]:[\\/])/.test(t)) return false;
-  const cwd = _normalizeSessionTitle(context.cwd || '');
-  if (cwd && (t === cwd || t === cwd.replace(process.env.HOME || '', '~'))) return false;
-  if (_looksLikeWorktreeCwdTitle(t, context.cwd)) return false;
-  if (_branchTitleCandidates(context.branch).some(candidate => candidate.toLowerCase() === t.toLowerCase())) return false;
-  const cmd = _normalizeSessionTitle(context.cmd || '');
-  if (cmd && t === cmd) return false;
-  return true;
-}
-
-function promoteStartupTaskTitleIfUserNamed(sessionId, { dryRun = false, reason = 'startup_task_title' } = {}) {
-  const cleanId = String(sessionId || '').trim();
-  if (!cleanId || !_tableExists('startup_tasks') || !_tableExists('ctm_sessions')) {
-    return { promoted: false, reason: 'missing_table_or_id' };
-  }
-  const ctmId = _resolveCtmSessionIdForWrite(cleanId);
-  const row = getDomainDb('core').prepare(`
-    SELECT
-      c.id,
-      c.title,
-      COALESCE(c.user_renamed, 0) AS user_renamed,
-      s.label,
-      s.cmd,
-      s.cwd,
-      s.branch,
-      s.type
-    FROM ctm_sessions c
-    JOIN startup_tasks s ON s.ctm_session_id = c.id
-    WHERE c.id = ?
-    LIMIT 1
-  `).get(ctmId);
-  if (!row) return { promoted: false, reason: 'no_startup_task' };
-  if (row.user_renamed) return { promoted: false, protected: true, title: row.title || '', reason: 'already_user_title' };
-
-  const title = _normalizeSessionTitle(row.label);
-  if (!isUserSessionTitleCandidate(title, row)) {
-    return { promoted: false, reason: 'runtime_generated_title', title };
-  }
-
-  if (dryRun) {
-    return {
-      promoted: row.title !== title || !row.user_renamed,
-      title,
-      previousTitle: row.title || '',
-      reason,
-    };
-  }
-
-  const hasTitleStatus = _tableHasColumn('ctm_sessions', 'title_status');
-  const now = new Date().toISOString();
-  const result = hasTitleStatus
-    ? getDomainDb('core').prepare(`
-      UPDATE ctm_sessions SET
-        title = ?,
-        title_source = 'user',
-        title_status = 'user_named',
-        title_status_reason = ?,
-        title_updated_at = ?,
-        user_renamed = 1,
-        updated_at = datetime('now')
-      WHERE id = ? AND COALESCE(user_renamed, 0) = 0
-    `).run(title, reason, now, ctmId)
-    : getDomainDb('core').prepare(`
-      UPDATE ctm_sessions SET
-        title = ?,
-        user_renamed = 1,
-        updated_at = datetime('now')
-      WHERE id = ? AND COALESCE(user_renamed, 0) = 0
-    `).run(title, ctmId);
-  if (result.changes) flushWal();
-  return {
-    promoted: result.changes > 0,
-    protected: true,
-    title,
-    previousTitle: row.title || '',
-    reason,
-  };
-}
-
-function repairSessionTitlesFromStartupTasks({ dryRun = false, limit = 1000 } = {}) {
-  if (!_tableExists('startup_tasks') || !_tableExists('ctm_sessions')) {
-    return { scanned: 0, promoted: 0, skipped: 0, items: [] };
-  }
-  const rows = getDomainDb('core').prepare(`
-    SELECT
-      c.id,
-      c.title,
-      COALESCE(c.user_renamed, 0) AS user_renamed,
-      s.label,
-      s.cmd,
-      s.cwd,
-      s.branch,
-      s.type
-    FROM startup_tasks s
-    JOIN ctm_sessions c ON c.id = s.ctm_session_id
-    WHERE COALESCE(c.user_renamed, 0) = 0
-      AND COALESCE(s.label, '') != ''
-    ORDER BY s.created_at DESC
-    LIMIT ?
-  `).all(Math.max(1, Number(limit) || 1000));
-  const items = [];
-  for (const row of rows) {
-    const title = _normalizeSessionTitle(row.label);
-    if (!isUserSessionTitleCandidate(title, row)) continue;
-    items.push({
-      sessionId: row.id,
-      title,
-      previousTitle: row.title || '',
-    });
-  }
-  if (!dryRun && items.length) {
-    const hasTitleStatus = _tableHasColumn('ctm_sessions', 'title_status');
-    const now = new Date().toISOString();
-    const update = hasTitleStatus
-      ? getDomainDb('core').prepare(`
-        UPDATE ctm_sessions SET
-          title = ?,
-          title_source = 'user',
-          title_status = 'user_named',
-          title_status_reason = 'startup_task_title_repair',
-          title_updated_at = ?,
-          user_renamed = 1,
-          updated_at = datetime('now')
-        WHERE id = ? AND COALESCE(user_renamed, 0) = 0
-      `)
-      : getDomainDb('core').prepare(`
-        UPDATE ctm_sessions SET
-          title = ?,
-          user_renamed = 1,
-          updated_at = datetime('now')
-        WHERE id = ? AND COALESCE(user_renamed, 0) = 0
-      `);
-    const txn = getDomainDb('core').transaction(() => {
-      for (const item of items) {
-        if (hasTitleStatus) update.run(item.title, now, item.sessionId);
-        else update.run(item.title, item.sessionId);
-      }
-    });
-    txn();
-    flushWal();
-  }
-  return {
-    scanned: rows.length,
-    promoted: items.length,
-    skipped: rows.length - items.length,
-    items,
-  };
-}
-
 function setSessionTitleNew(id, title, userRenamed = false, meta = {}) {
   const ctmId = _resolveCtmSessionIdForWrite(id);
   const cleanTitle = _normalizeSessionTitle(title);
   if (!cleanTitle) return;
-  if (!userRenamed) {
-    const protectedTitle = promoteStartupTaskTitleIfUserNamed(ctmId, {
-      reason: meta.source === 'ai_title' ? 'protected_from_ai_title' : 'protected_from_auto_title',
-    });
-    if (protectedTitle && protectedTitle.protected) return;
-  }
   const hasTitleStatus = _tableHasColumn('ctm_sessions', 'title_status');
   const source = userRenamed ? 'user' : (meta.source || '');
   const status = userRenamed ? 'user_renamed' : (meta.status || '');
@@ -19051,12 +19404,16 @@ function setSessionTitleStatusNew(id, status, reason = '', source = 'ai_title')
 
 // WP-1 (session-rename-mirror §6b/§6c): outcome of mirroring a CTM title to its provider.
 // UPDATE only, no stub rows (a mirror attempt is meaningless for a row that doesn't exist).
+// WP-4/D-12 (S-24): the REASON is persisted with the outcome — title_mirror_error is
+// `reason + (error ? ': ' + error : '')`, so an `unsupported` outcome can no longer be stored with
+// an empty error and no recorded cause.
 const TITLE_MIRROR_STATES = new Set(['mirrored', 'unsupported', 'failed']);
-function setSessionTitleMirror(ctmSessionId, { state, error = '', value = '', at = new Date().toISOString() } = {}) {
+function setSessionTitleMirror(ctmSessionId, { state, reason = '', error = '', value = '', at = new Date().toISOString() } = {}) {
   if (!TITLE_MIRROR_STATES.has(state)) throw new TypeError(`setSessionTitleMirror: invalid state ${JSON.stringify(state)}`);
   const ctmId = _resolveCtmSessionIdForWrite(ctmSessionId);
+  const mirrorError = reason ? (error ? `${reason}: ${error}` : reason) : (error || '');
   const result = getDomainDb('core').prepare('UPDATE ctm_sessions SET title_mirror_state=?, title_mirror_error=?, title_mirror_value=?, title_mirror_at=? WHERE id=?')
-    .run(state, error || '', value || '', at, ctmId);
+    .run(state, mirrorError, value || '', at, ctmId);
   if (result.changes > 0) flushWal();
 }
 function getSessionTitleMirror(ctmSessionId) {
@@ -19160,12 +19517,7 @@ function getSessionDisplayTitleInfo(id) {
       COALESCE(a.rename_name, '') as rename_name,
       COALESCE(a.first_message, '') as first_message,
       COALESCE(a.last_user_content, '') as last_user_content,
-      COALESCE(a.first_assistant_text, '') as first_assistant_text,
-      st.label AS startup_label,
-      st.cmd AS startup_cmd,
-      st.cwd AS startup_cwd,
-      st.branch AS startup_branch,
-      st.type AS startup_type
+      COALESCE(a.first_assistant_text, '') as first_assistant_text
     FROM ctm_sessions c
     LEFT JOIN (
       SELECT *, ROW_NUMBER() OVER (
@@ -19177,8 +19529,6 @@ function getSessionDisplayTitleInfo(id) {
       FROM agent_sessions
       WHERE ctm_session_id = ?
     ) a ON a.ctm_session_id = c.id AND a.rn = 1
-    LEFT JOIN startup_tasks st
-      ON st.ctm_session_id = c.id
     WHERE c.id = ?
     LIMIT 1
   `).get(ctmId, ctmId);
@@ -19189,27 +19539,19 @@ function getSessionDisplayTitleInfo(id) {
     if (agent && agent.ctm_session_id) row = rowForCtmId(agent.ctm_session_id);
   }
   if (!row) return null;
-  const startupTitle = !row.user_renamed && isUserSessionTitleCandidate(row.startup_label, {
-    cmd: row.startup_cmd,
-    cwd: row.startup_cwd,
-    branch: row.startup_branch,
-    type: row.startup_type,
-  }) ? _normalizeSessionTitle(row.startup_label) : '';
-  const effectiveRow = startupTitle ? {
-    ...row,
-    title: startupTitle,
-    user_renamed: 1,
-  } : row;
-  const displayTitle = pickDisplayTitle(effectiveRow);
+  // The row as stored. Title provenance (userRenamed/titleSource/…) is read from
+  // ctm_sessions only — a user-looking startup_tasks.label is never inferred here
+  // (design 2026-10-23 D-3: store provenance with the value, never infer it).
+  const displayTitle = pickDisplayTitle(row);
   return {
     ctmSessionId: row.id,
-    title: effectiveRow.title || '',
+    title: row.title || '',
     aiTitle: row.user_renamed ? '' : (row.title || ''),
     displayTitle: displayTitle || '',
-    userRenamed: !!effectiveRow.user_renamed,
-    titleSource: startupTitle ? 'user' : (row.title_source || ''),
-    titleStatus: startupTitle ? 'user_named' : (row.title_status || ''),
-    titleStatusReason: startupTitle ? 'startup_task_title' : (row.title_status_reason || ''),
+    userRenamed: !!row.user_renamed,
+    titleSource: row.title_source || '',
+    titleStatus: row.title_status || '',
+    titleStatusReason: row.title_status_reason || '',
     titleUpdatedAt: row.title_updated_at || '',
     renameName: row.rename_name || '',
   };
@@ -19344,6 +19686,7 @@ function repairCodexSessionMetadataFromConversations({ dryRun = false, limit = 5
           title_updated_at = ?,
           updated_at = datetime('now')
         WHERE id = ? AND COALESCE(user_renamed, 0) = 0
+          AND COALESCE(title_source, '') <> 'provider_title'
       `)
       : d.prepare(`
         UPDATE ctm_sessions SET
@@ -19867,6 +20210,39 @@ function getDirectShadowStats() {
   return null;
 }
 
+// WP-6 (design doc session-name-agent-title-precedence §6, §8 WP-6): the ONE-SHOT agent-title
+// backfill's write half. The read pool did the transcript I/O (workers/read-pool-worker.js's
+// 'backfillAgentTitles'); this is the owner-side apply, so it runs on the DB-owner worker's core
+// handle and is reached from the main thread through DB_OWNER_MUTATION_ACTIONS like every other
+// mutation. Every row goes through lib/agent-title-apply.js — the SINGLE tier-2 apply — so the
+// backfill obeys exactly the ingest rules: tier 1 is never rewritten, a custom-title equal to
+// title_mirror_value is CTM's own echo (the ai-title wins), and a uuid-like name is not a name.
+// A row whose apply lands also moves startup_tasks.label (D-13: the restore label and the durable
+// title must never disagree).
+/**
+ * @param {Array<{ id: string, customTitle?: string, aiTitle?: string }>} rows one read-pool page
+ * @returns {{ scanned: number, applied: number, reasons: Record<string, number> }}
+ */
+function applyAgentTitleBackfillRows(rows = []) {
+  const coreDb = getDomainDb('core');
+  const result = { scanned: 0, applied: 0, reasons: {} };
+  for (const row of (Array.isArray(rows) ? rows : [])) {
+    const id = String(row?.id || '').trim();
+    if (!id) continue;
+    result.scanned += 1;
+    const outcome = applyAgentTitleSignals(coreDb, {
+      ctmSessionId: id, customTitle: row?.customTitle, aiTitle: row?.aiTitle,
+    });
+    const reason = String(outcome.reason || 'unknown');
+    result.reasons[reason] = (result.reasons[reason] || 0) + 1;
+    if (outcome.applied === 'agent' && outcome.title) {
+      result.applied += 1;
+      try { updateStartupTaskLabel(id, outcome.title); } catch (error) { console.error('[agent-title-backfill] label sync failed:', error.message); }
+    }
+  }
+  return result;
+}
+
 // Explicit mutation surface allowed to cross from the main process to the DB-owner
 // worker. Keep this as a closed map of local function references: the worker never
 // accepts an arbitrary exported method name, SQL string, or callback from the caller.
@@ -19967,6 +20343,7 @@ const DB_OWNER_MUTATION_ACTIONS = Object.freeze({
   setSessionTitle,
   setSessionTitleNew,
   setSessionTitleStatusNew,
+  applyAgentTitleBackfillRows,
   createTemplate,
   deleteTemplate,
   trackPromptUsage,
@@ -20024,6 +20401,37 @@ const DB_OWNER_MUTATION_ACTIONS = Object.freeze({
   transferLease,
   transferSessionOwnership,
   upsertHostedWorkspaceBinding,
+  // WP-2 (docs/remote-machine-hub-sessions-2026-10-22.html §6.1/§8, deferred from WP-0): the
+  // machine-registry writes are reachable as named db.js exports so they route through the DB-owner
+  // mutation Proxy — the same shape as the Review Hub registry writes above. Without these three
+  // entries lib/machine-registry.js's dispatchOwnerMutation() calls landed on the MAIN thread
+  // (db-owner-client's Proxy only crosses for a member of this map), which is exactly the
+  // serial-writer contention the owner worker exists to prevent. Their OP_META rows
+  // (shared/storage/contract.js) tag them domain:'core' on `machines`.
+  upsertMachineRow,
+  recordMachineProbe,
+  deleteMachineRow,
+  // WP-1 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-11): the 60 s host
+  // sample write. It joins this map for the same reason the three rows above did — the tick must
+  // not put an insert+purge on the main thread — and its OP_META row tags domain:'core' on
+  // `host_samples` (lib/db-domains.js CTM_WRITE_OPS carries the same name).
+  recordHostSample,
+  // WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/P-5/P-6): the
+  // machine-owned settings write, the P-5 roster replacement, and the leave() sweep. All three are
+  // single-domain 'core' mutations over `machines`/`machine_self`, so they join this map for the
+  // same main-thread reason as the rows above; lib/db-domains.js CTM_WRITE_OPS and
+  // shared/storage/contract.js OP_META carry the matching names.
+  setMachineSelf,
+  replaceRosterMachines,
+  deleteAllMachineRows,
+  // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9): the three
+  // pairing-offer writes. They join this map for the same main-thread reason as the rows above —
+  // `machine_pairing_offers` is domain 'core' (lib/db-domain-tables.js), and each op's OP_META row in
+  // shared/storage/contract.js carries the matching kind:'write' + tables:['machine_pairing_offers'].
+  // `listLivePairingOffers` is the bounded read beside them and is deliberately NOT here.
+  insertPairingOffer,
+  markPairingOfferRedeemed,
+  burnLivePairingOffers,
   seedHostedWorkspaceBindings,
   updateStartupTaskWorkspaceMapping,
   repointStartupTaskWorkspace,
@@ -20088,8 +20496,6 @@ const DB_OWNER_MUTATION_ACTIONS = Object.freeze({
   upsertAgentSessionIdentity,
   recordResumeLineage,
   setSessionStar,
-  promoteStartupTaskTitleIfUserNamed,
-  repairSessionTitlesFromStartupTasks,
   repairCodexSessionMetadataFromConversations,
   repairCodexRolloutAgentIdentities,
   detachPromotedProviderChildSessions,
@@ -20128,6 +20534,7 @@ module.exports = {
   SESSION_DIAGNOSTIC_PROTECTED_RESERVE,
   SESSION_DIAGNOSTIC_CLIENT_MEMORY_RESERVE,
   SESSION_DIAGNOSTIC_SEAM_RESERVE,
+  SESSION_DIAGNOSTIC_READER_PER_EVENT_RESERVE,
   MigrationFailedError,
   migrateSchemaIfNeeded,
   // WP-6 (docs/approval-delivery-truth-host-skew-2026-09-01.html §5 D-9, §8
@@ -20243,7 +20650,7 @@ module.exports = {
   deleteSessionLeadModel: sessionLeadModelStore.remove,
   getSessionLeadRoute: sessionLeadRouteStore.get, setSessionLeadRoute: sessionLeadRouteStore.set, deleteSessionLeadRoute: sessionLeadRouteStore.remove,
   getCodingModelTransition: leadModelTransitionStore.get,
-  getActiveCodingModelTransitionForSession: leadModelTransitionStore.getActiveForSession,
+  getActiveCodingModelTransitionForSession: leadModelTransitionStore.getActiveForSession, getCodingModelTransitionsForThread: leadModelTransitionStore.listForThread,
   recordLeadRouteLaunchOwnership,
   getCodingModelTransitionStagedToken: leadModelTransitionStore.getStagedToken,
   // WP-2A: the bounded owner-side approved-intent read. Synchronous BY DESIGN — it is the DB-owner
@@ -20273,10 +20680,22 @@ module.exports = {
   updateStartupTaskWorkspaceMapping, repointStartupTaskWorkspace,
   _syncFeatureEnabled,
   enqueueSyncOutbox, listSyncOutbox, markSyncOutboxDeliveredThrough, recordSyncOutboxServed, getSyncOutboxDeliveredSeq, reconcileSyncOutbox, pruneSyncOutbox,
+  // WP-0 hub machine registry (lib/machine-registry.js): read + the three writes it takes so
+  // far (register/enable, probe outcome, unregister). Handles resolve via getDomainDb('core').
+  listMachineRows, upsertMachineRow, recordMachineProbe, deleteMachineRow, _ensureMachineRegistrySchema,
+  // WP-1 D-11: the host-sample pair. `recordHostSample` is a DB_OWNER_MUTATION_ACTIONS entry
+  // (above); `listHostSamples` is the bounded read beside it, both on the domain-'core' handle.
+  recordHostSample, listHostSamples,
+  // WP-2a D-4/P-5/P-6: the machine-owned settings read/write, the P-5 roster replacement and the
+  // leave() sweep — all on the domain-'core' handle beside the registry pair above.
+  getMachineSelf, setMachineSelf, replaceRosterMachines, deleteAllMachineRows,
+  // WP-3 §6.3: the pairing-offer trio (DB_OWNER_MUTATION_ACTIONS entries above) plus its read —
+  // all on the domain-'core' handle beside the machine rows.
+  insertPairingOffer, markPairingOfferRedeemed, burnLivePairingOffers, listLivePairingOffers,
   createSyncResyncSnapshot, createSyncLocalSnapshot, applySyncSnapshot, applySyncEntries, validateSyncEntries, applySyncPurgeCommand,
   getSessionContentGeneration, getSyncHighWaterMark, getOpenSyncGapConflict, recordSyncPeerConflict, offerStoppedSessionHandoff,
   createHostedMigrationPack, importHostedMigrationPack,
-  addStartupTask, updateStartupTaskLabel, updateStartupTaskTitle, updateStartupTaskMcpProfile, updateStartupTaskClaudeSession, updateStartupTaskAgentSession, updateStartupTaskBranch, updateStartupTaskCwd, updateStartupTaskAttentionDismissal, updateStartupTaskLifecycle, backfillWalleStartupTaskActivity, markStartupTaskUserPromptInput, removeStartupTask, markStartupTaskExited, markStartupTaskParked, reviveStartupTask, heartbeatStartupTasks, getStartupTask, listStartupTasks, findSessionsMissingStartupTask, clearStartupTasks, listSessionLinkedRefs,
+  addStartupTask, updateStartupTaskLabel, updateStartupTaskTitle, updateStartupTaskMcpProfile, updateStartupTaskClaudeSession, updateStartupTaskAgentSession, updateStartupTaskBranch, updateStartupTaskCwd, updateStartupTaskAttentionDismissal, updateStartupTaskLifecycle, backfillWalleStartupTaskActivity, markStartupTaskUserPromptInput, removeStartupTask, markStartupTaskExited, markStartupTaskParked, reviveStartupTask, heartbeatStartupTasks, getStartupTask, listStartupTasks, getCtmSessionOwnerRow, findSessionsMissingStartupTask, clearStartupTasks, listSessionLinkedRefs,
   createSessionWithStartupTask,
   appendScrollbackBatch, cleanupScrollbackChunkSeqIntegrity, getNextScrollbackSeq, loadScrollback, loadScrollbackTail, clearScrollback,
   getScrollbackIdentity, setScrollbackIdentity, inspectScrollbackForSession, prepareScrollbackForSession,
@@ -20302,11 +20721,11 @@ module.exports = {
   upsertSessionIndex, resolveSessionId,
   // CTM Sessions + Agent Sessions (v1 schema)
   getSessionIdentity, getLatestAgentSessionForCtm, getSessionConversationSourceIds, getSessionMessageIndexFreshness, getSessionUserPromptFreshness, resolveSession, batchRestoreIdentities, upsertSession, upsertAgentSessionIdentity, recordResumeLineage, setSessionStar, getStarredSessionIds,
-  setSessionTitleNew, setSessionTitleStatusNew, getSessionTitleNew, getSessionTitlesByIds, getSessionTitleSourceById, getSessionDisplayTitleInfo, isUserSessionTitleCandidate, promoteStartupTaskTitleIfUserNamed, repairSessionTitlesFromStartupTasks, getAllSessionsData, setSessionTitleMirror, getSessionTitleMirror,
+  setSessionTitleNew, setSessionTitleStatusNew, getSessionTitleNew, getSessionTitlesByIds, getSessionTitleSourceById, getSessionDisplayTitleInfo, getAllSessionsData, setSessionTitleMirror, getSessionTitleMirror, applyAgentTitleBackfillRows,
   repairCodexSessionMetadataFromConversations, repairCodexRolloutAgentIdentities, detachPromotedProviderChildSessions,
   listProviderChildAgentOwnerMappings,
   getAgentSessions, getAgentSession, getAgentSessionByCtmId, getForkForDesktopUuid, listDesktopForks, deleteCtmSession,
-  deleteAgentSessionIdentity, clearScrollbackIdentities,
+  deleteAgentSessionIdentity, clearScrollbackIdentities, updateAgentSessionTranscriptLink,
   // worker_sessions (WP-0 §6.2) — one writer: lib/session-create/delegate-worker.js
   insertWorkerSession, getWorkerSession, listWorkerTranscriptRows, updateWorkerSession, listLiveWorkerSessions, listWorkerSessionsByParent, listHiddenWorkerStartupTaskIds, listWorkerStartupTaskIds, listLatestTerminalWorkerSessionsByRoute, listTerminalWorkerSessionsSince,
   // Schema version