create-walle 0.10.0 → 0.10.2

package/template/wall-e/shared/storage/contract.js

@@ -363,7 +363,7 @@ const OP_META = {
   materializeRestoredSessionIndex: { kind: 'write', equality: 'exact', domain: 'core' },
   persistJsonlReconciliationBatch: { kind: 'write', equality: 'exact', domain: 'core' },
   getAllSessionTitles:      { kind: 'read',  equality: 'exact' },
-  setSessionTitleStatusNew: { kind: 'write', equality: 'exact', domain: 'core' }, setSessionTitleMirror: { kind: 'write', equality: 'exact', domain: 'core' }, getSessionTitleMirror: { kind: 'read', equality: 'exact' }, // WP-1
+  setSessionTitleStatusNew: { kind: 'write', equality: 'exact', domain: 'core' }, setSessionTitleMirror: { kind: 'write', equality: 'exact', domain: 'core' }, getSessionTitleMirror: { kind: 'read', equality: 'exact' }, applyAgentTitleBackfillRows: { kind: 'write', equality: 'exact', domain: 'core' }, // WP-1 / session-name WP-6
   updateSessionTokens: { kind: 'write', equality: 'exact', domain: 'core' },
   getSessionTokens:         { kind: 'read',  equality: 'exact' },
   // WP-1 (design doc §5/§9 S-19): last known physical-footprint sample, persisted at
@@ -426,6 +426,40 @@ const OP_META = {
   getHostedSyncSchemaStatus: { kind: 'sqlite-only', equality: 'exact' },
   listHostedWorkspaceBindings: { kind: 'sqlite-only', equality: 'set', idKey: 'logical_id' },
   upsertHostedWorkspaceBinding: { kind: 'write', equality: 'exact', domain: 'core' },
+  // WP-2 (docs/remote-machine-hub-sessions-2026-10-22.html §6.1/§8, deferred from WP-0): the hub
+  // machine-registry writes. Single-table (`machines`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js) — hence the explicit `tables` list Gate 2i
+  // checks against the tag, and the domain tag itself, which is what keeps these off the base
+  // (firehose) writer behind conversation import once the domain split is on.
+  upsertMachineRow: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  recordMachineProbe: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  deleteMachineRow: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  // WP-1 (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-11, §9 S-4): the
+  // host-sample pair. `recordHostSample` is one INSERT OR REPLACE plus the 24 h DELETE in a single
+  // transaction, single-table (`host_samples`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js) — so the explicit `tables` list Gate 2i checks
+  // against the tag is exact, and Gate 2g finds the routing declaration the action needs.
+  recordHostSample: { kind: 'write', equality: 'exact', domain: 'core', tables: ['host_samples'] },
+  // The bounded read beside it (oldest first, `sinceMs`/`limit`). `set` equality, keyed on `at`
+  // — the same shape as listSyncOutbox below.
+  listHostSamples: { kind: 'read', equality: 'set', idKey: 'at' },
+  // WP-2a (docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/P-5/P-6, §9 S-4):
+  // the machine-owned settings write (single row, single table `machine_self`), the P-5 roster
+  // replacement (single table `machines`, one transaction) and the leave() sweep (`machines`).
+  // Both tables are classified 'core' in coding-task-manager/lib/db-domain-tables.js.
+  setMachineSelf: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_self'] },
+  replaceRosterMachines: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  deleteAllMachineRows: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machines'] },
+  // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9, §9 S-15/S-16): the
+  // pairing-offer trio — mint one offer, mark exactly one redeemed (single-use), and the AC-3c burn
+  // that flips every live offer at once. Single-table (`machine_pairing_offers`, classified 'core' in
+  // coding-task-manager/lib/db-domain-tables.js), so Gate 2i's `tables` list is exact. The bounded
+  // read beside them (`listLivePairingOffers`, unspent+unexpired as of `at`) is `set` equality keyed
+  // on `id`, the same shape as listHostSamples above.
+  insertPairingOffer: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  markPairingOfferRedeemed: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  burnLivePairingOffers: { kind: 'write', equality: 'exact', domain: 'core', tables: ['machine_pairing_offers'] },
+  listLivePairingOffers: { kind: 'read', equality: 'set', idKey: 'id' },
   seedHostedWorkspaceBindings: { kind: 'sqlite-only', equality: 'exact', domain: 'core', tables: ['workspace_bindings'] },
   updateStartupTaskWorkspaceMapping: { kind: 'write', equality: 'exact', domain: 'core' },
   repointStartupTaskWorkspace: { kind: 'sqlite-only', equality: 'exact', domain: 'core', tables: ['startup_tasks', 'sync_outbox', 'synced_entities'] },
@@ -784,8 +818,6 @@ const OP_META = {
   // the live scrollback_identity table is listed.
   prepareScrollbackForSession: { kind: 'write', equality: 'exact', domain: 'core', tables: ['scrollback_identity'] },
   upsertAgentSessionIdentity: { kind: 'write', equality: 'exact', domain: 'core', tables: ['agent_sessions'] },
-  promoteStartupTaskTitleIfUserNamed: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_sessions'] },
-  repairSessionTitlesFromStartupTasks: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_sessions'] },
   repairCodexRolloutAgentIdentities: { kind: 'write', equality: 'exact', domain: 'core', tables: ['agent_sessions', 'ctm_sessions'] },
   cleanupOrphanScrollbackIdentities: { kind: 'write', equality: 'exact', domain: 'core', tables: ['scrollback_identity', 'startup_tasks'] },
   // --- writer:'base' pins (deliberately NOT re-routed; behaviour unchanged) ---

package/template/wall-e/skills/_templates/delegate-worker/VERSION

@@ -1 +1 @@
-4.6.0
+4.7.0

package/template/wall-e/skills/_templates/delegate-worker/released-sha256.json

@@ -5,6 +5,7 @@
     "06efbe01e436b34adb7102fe04a5d59748dc4834b1ae6c4c45a492b2e1e79e9a": "4.1.0",
     "0dde179abdab5d523da264cab944ce48306009807e5dc566ffa14aa0c8017186": "3.0.0",
     "0e162871e8fd037c6a954c491ba5100d3f64cede44a8f82c519d2d2e33e032e3": "3.3.0",
+    "120cc88fa7b15ca0b75cf68873cde02bf56f867331e45a545589062b87127a89": "4.6.0",
     "14d6d156625905d0b7ed12dea1c2131edc62146f61b6f9fd187a422773d7f300": "4.4.0",
     "24a429b3c1b3651cad34317fd74d574ddb2f4863252b60db0d6b3b76050607f5": "3.8.0",
     "31e405815c6010db8a90897d69b6448dfd4c3b21cc464e5b447ab43e60f6c69e": "3.1.0",
@@ -21,7 +22,9 @@
     "9253a28aa91552c0555c0bc248ed66c61cc98ec716d517b9d1c8c3204d46d590": "3.7.0",
     "a224ec90dc7df131415d89e2fa2df82c62e7ee2981c73c0c3cae8ec35e8c3d9e": "3.2.0",
     "a87cd74831aa010a9fa28a68242038ca3e91461b070cf43ea91b4ff08848c54c": "3.8.0",
+    "b6c9bdc82070a8458af94d5bdad9026806e378b3adee8fe2c135f9bc3c72d720": "4.6.0",
     "c5c66a11c5262014f58b127c4b7e21e0cfaf1179f2678ee6dc6a922d27362cbe": "4.2.0",
+    "c9e6f75ab694bbd66c841979fe2468db2c57177d6cfc18ea4eb97e034e5d98dc": "4.7.0",
     "d9d6e3687ff5f626258f0b629e74829719df82bfcc25e079456bdd667e30abb8": "3.2.1",
     "e22741fb1233863289757660b546691b7bfd70d21f3f641d82b743324c335f9c": "3.4.0",
     "eba2b4dea2eb856fe3933be618730f75f8fc3c38c554e3a6063438bafa41d368": "4.6.0",
@@ -34,10 +37,12 @@
     "21c9ca776a755692b0bfe64960c909db804dcaaf803c725c1684e53317d9f288": "3.2.0",
     "290a270a69332fb18289f153b46b67f8a6e06459891665b952bbeca9e54d7371": "3.8.0",
     "3c5d22d4a7c432662ca8036022b79a5b9097357f2139eda7ebf4acb3c18f2b71": "3.1.0",
+    "3e5db71601f075a303a1a7442cc1fbac11a37362e60fd25b717e86b180c177cc": "4.7.0",
     "3ea78bdc6c5cd377e01b2061f63a4586e4859159f5c771eafea7ca0e984c8969": "4.2.0",
     "4461f6ebdf10398b6529bff84f3cd3b4145f2935fd3a5f0f1efe38ab52b2c871": "4.6.0",
     "56a9df7b9a49e7a47abadfa6c026ee599bf12f6a3cc5fc9370bfdc776f46e835": "3.4.0",
     "576083d2286162eed343150f0a28305863fb7773960f2618ddb033c6d2e1f306": "3.8.0",
+    "5f9eb74ee52154661e2d572269b121b45d5d76e42989a091fa83086ba5eef3ec": "4.6.0",
     "60a96b080de8243321fb68c76d664d5be9cb9983c3088e64b31da8b53b8bca5b": "4.3.0",
     "75be2666f123930e7f655ad03ed6e18b512c8349bc1cca8af7a92699616e1074": "3.2.1",
     "7de463c9f1647140a636b5155c2291c2df207e088d109ca7db6d16d2591fd948": "3.5.0",
@@ -47,6 +52,7 @@
     "8aad4b5b96ff40df281b1657a390cd8f350d3608f2349f3867d2bc985a7fe979": "3.1.0",
     "8c94e50631795fece512e58d1f849e2abd28f181ae66088806df75f718aeae61": "3.2.0",
     "b7f5ba39bd37adf2f126b07b288a1ed4195ae2c9a87a3d6db642ecb8c83b776c": "4.1.0",
+    "bf16fbc5d9dadb36163dd161e8621158a90c9e79b3fd72ecd6b6bcbb701ad440": "4.6.0",
     "c6cb630aca4487c95311146b5f0c148b9d6f68d42f88fc8a9a6a5fec663b54e6": "3.0.0",
     "c75019cf38784040fda2f63e8be8c8aaf988d612fb1c868a3e5f2064b971cb42": "4.3.0",
     "e1a85b80e419b38459a45c5d6c4884931b97b10a1e4e6a352af626f7a40dcd9d": "4.0.0",

package/template/wall-e/skills/_templates/delegate-worker/templates/claude/SKILL.md

@@ -52,6 +52,11 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
 - `lane: "native"`: Wall-E launched nothing; spawn a read-only helper (an Agent with read-only tools) for the review as before.
 - Either way you own the verdict: check each claim against the code before acting on it. A review worker's lease does not renew (renewal needs file writes); resume it if it needs more, and a resume cannot change its profile.
 
+## Lead: waiting
+- Wait on workers with walle_worker_wait and omit wait_ms. It wakes on a finished, failed, resumed or stuck worker,
+  on a question, and when your user types. Do not sleep-and-check and do not wrap it in a script with a short yield.
+- The exploration hand-off rule (write a four-field brief before the third read; hand it to a review worker) arrives in Wall-E's MCP instructions at connect; follow it when present.
+
 ## Worker: implement and test
 
 Give the worker these requirements in its brief:
@@ -67,8 +72,8 @@ Use additional workers only for independent, useful subtasks with clear ownershi
 ## Lead: wait for the worker
 
 - Native lane: the Agent tool returns when the worker finishes; then read the report file.
-- While workers run, do non-overlapping work. When you are blocked, call `walle_worker_wait({})` with no id: it waits for all of your workers at once, in stretches of minutes, and returns as soon as one finishes or starts a new run. `woke_on: "user_input"` means your user just spoke — answer them before waiting again. Re-issue the wait while `woke_on` is `timeout`.
-- `woke_on: "advisory"` means the worker has gone many turns without a verified write; read its status and decide — keep waiting or stop it. `walle_stop_worker({ ctm_session_id, mode, reason })` stops a worker you own: mode `after_turn` (default) lets the in-flight request finish then ends the process; mode `now` ends it immediately. The transcript and report stay and the worker can be resumed. Use it when a worker is off-brief, duplicating another worker, or no longer needed; never DELETE the session.
+- While workers run, do non-overlapping work. When you are blocked, call `walle_worker_wait({})` with no id: it waits for all of your workers at once, in stretches of minutes, and returns as soon as one finishes or starts a new run. `woke_on: "user_input"` means your user just spoke — answer them before waiting again. Until every worker is terminal, re-issue the wait after any non-terminal wake (`timeout`, `advisory`, `generation`, `user_input` once you have answered your user); the result's `lead_next_step` says so. Ending your turn with a live worker and no wait in flight leaves you idle until your user types.
+- `woke_on: "advisory"` means the worker has gone many turns without a verified write; read its status and decide — call `walle_worker_wait` again to keep waiting, or stop it. `walle_stop_worker({ ctm_session_id, mode, reason })` stops a worker you own: mode `after_turn` (default) lets the in-flight request finish then ends the process; mode `now` ends it immediately. The transcript and report stay and the worker can be resumed. Use it when a worker is off-brief, duplicating another worker, or no longer needed; never DELETE the session.
 - Routed lane: never sleep-loop on the report file (a failed worker never writes one — `terminal_path` is written on every stop). For a one-off status read, poll `walle_worker_status({ ctm_session_id })` no sooner than its `poll_after_ms` (30 s when the field is absent). Terminal states are `report_ready`, `failed`, and `exited`; also stop when `exitCode` is not null. If `report_ready` arrives while `exitCode` is still null, poll once more before reading `report_text`. `exited` without a report, or a `report_text_error`, is a failure — say so. `throttled` means the worker is alive and mid-retry; keep polling; stop it only with walle_stop_worker, never by killing the process.
 - On `failed`, follow `failure.next_step`; it is written for the exact failure. `budget` means the proxy stopped the worker at a limit of its lease (`failure.budget` names the kind, the task total used, and the lease). The lease renews in place while the worker makes verifiable progress, and the ×4 ceiling covers the whole task, resumes included — but a resume never uses a lease: it is accepted at the task's current lease while `lease.headroom_requests` in `walle_worker_status` is above zero. Only a 409 `task_lease_ceiling` refusal means the task spent its whole budget; report its `task_requests` and `base_requests` to the user and pass `extra_leases` only on their word, never pre-emptively. Never switch models because of a budget stop.
 - `terminal` with `worker_repeated_action` or `worker_repeated_error` means the worker repeated the same step without new results: read what it repeated, fix the brief or the environment, then resume with a corrective message — never resume blind.

package/template/wall-e/skills/_templates/delegate-worker/templates/codex/SKILL.md

@@ -50,6 +50,11 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
 - `lane: "native"`: Wall-E launched nothing; spawn a read-only helper (`spawn_agent`) for the review as before.
 - Either way you own the verdict: check each claim against the code before acting on it. A review worker's lease does not renew (renewal needs file writes); resume it if it needs more, and a resume cannot change its profile.
 
+## Lead: waiting
+- Wait on workers with walle_worker_wait and omit wait_ms. It wakes on a finished, failed, resumed or stuck worker,
+  on a question, and when your user types. Do not sleep-and-check and do not wrap it in a script with a short yield.
+- The exploration hand-off rule (write a four-field brief before the third read; hand it to a review worker) arrives in Wall-E's MCP instructions at connect; follow it when present.
+
 ## Worker: implement and test
 
 Give the worker these requirements in its brief:
@@ -65,8 +70,8 @@ Use additional workers only for independent, useful subtasks with clear ownershi
 ## Lead: wait for the worker
 
 - Native lane: `wait_agent` returns when the worker finishes; then read the report file.
-- While workers run, do non-overlapping work. When you are blocked, call `walle_worker_wait({})` with no id: it waits for all of your workers at once, in stretches of minutes, and returns as soon as one finishes or starts a new run. `woke_on: "user_input"` means your user just spoke — answer them before waiting again. Re-issue the wait while `woke_on` is `timeout`.
-- `woke_on: "advisory"` means the worker has gone many turns without a verified write; read its status and decide — keep waiting or stop it. `walle_stop_worker({ ctm_session_id, mode, reason })` stops a worker you own: mode `after_turn` (default) lets the in-flight request finish then ends the process; mode `now` ends it immediately. The transcript and report stay and the worker can be resumed. Use it when a worker is off-brief, duplicating another worker, or no longer needed; never DELETE the session.
+- While workers run, do non-overlapping work. When you are blocked, call `walle_worker_wait({})` with no id: it waits for all of your workers at once, in stretches of minutes, and returns as soon as one finishes or starts a new run. `woke_on: "user_input"` means your user just spoke — answer them before waiting again. Until every worker is terminal, re-issue the wait after any non-terminal wake (`timeout`, `advisory`, `generation`, `user_input` once you have answered your user); the result's `lead_next_step` says so. Ending your turn with a live worker and no wait in flight leaves you idle until your user types.
+- `woke_on: "advisory"` means the worker has gone many turns without a verified write; read its status and decide — call `walle_worker_wait` again to keep waiting, or stop it. `walle_stop_worker({ ctm_session_id, mode, reason })` stops a worker you own: mode `after_turn` (default) lets the in-flight request finish then ends the process; mode `now` ends it immediately. The transcript and report stay and the worker can be resumed. Use it when a worker is off-brief, duplicating another worker, or no longer needed; never DELETE the session.
 - Routed lane: never sleep-loop on the report file (a failed worker never writes one — `terminal_path` is written on every stop). For a one-off status read, poll `walle_worker_status({ ctm_session_id })` no sooner than its `poll_after_ms` (30 s when the field is absent). Terminal states are `report_ready`, `failed`, and `exited`; also stop when `exitCode` is not null. If `report_ready` arrives while `exitCode` is still null, poll once more before reading `report_text`. `exited` without a report, or a `report_text_error`, is a failure — say so. `throttled` means the worker is alive and mid-retry; keep polling; stop it only with walle_stop_worker, never by killing the process.
 - On `failed`, follow `failure.next_step`; it is written for the exact failure. `budget` means the proxy stopped the worker at a limit of its lease (`failure.budget` names the kind, the task total used, and the lease). The lease renews in place while the worker makes verifiable progress, and the ×4 ceiling covers the whole task, resumes included — but a resume never uses a lease: it is accepted at the task's current lease while `lease.headroom_requests` in `walle_worker_status` is above zero. Only a 409 `task_lease_ceiling` refusal means the task spent its whole budget; report its `task_requests` and `base_requests` to the user and pass `extra_leases` only on their word, never pre-emptively. Never switch models because of a budget stop.
 - `terminal` with `worker_repeated_action` or `worker_repeated_error` means the worker repeated the same step without new results: read what it repeated, fix the brief or the environment, then resume with a corrective message — never resume blind.

package/template/wall-e/tools/local-tools.js

@@ -2555,7 +2555,9 @@ async function _autoChromeUsable(chromePath, { timeoutMs = 15000, pollMs = 100 }
       '--window-size=200,200',
       '--virtual-time-budget=2000',
       'data:text/html,<title>walle-probe</title><p>ok</p>',
-    ], { stdio: 'ignore', env: hostAutomationEnv() });
+    // Own process group (detached): Chrome forks GPU/renderer/utility helpers into it,
+    // and the cleanup below must reach them, not just the browser pid.
+    ], { stdio: 'ignore', env: hostAutomationEnv(), detached: process.platform !== 'win32' });
     child.on('error', () => { /* expected: the poll loop below is the single source of truth for usability, not this event */ });
 
     const deadline = Date.now() + timeoutMs;
@@ -2570,9 +2572,9 @@ async function _autoChromeUsable(chromePath, { timeoutMs = 15000, pollMs = 100 }
     /* expected: spawn/stat failures (e.g. ENOENT, EACCES) mean unusable, not a bug to surface */
     usable = false;
   } finally {
-    if (child && child.pid) {
-      try { child.kill('SIGKILL'); } catch { /* expected: probe child may already be gone */ }
-    }
+    // Kill the whole tree: SIGKILL to the browser pid alone left its helpers alive,
+    // re-parented to launchd, after every probe (observed: 2-4 helpers per probe).
+    if (child && child.pid) terminateForegroundProcessTree(child, 'SIGKILL');
     try { fs.rmSync(userDataDir, { recursive: true, force: true }); } catch { /* expected: probe child may already be gone */ }
   }
   _chromeProbeCache.set(chromePath, usable);
@@ -2586,6 +2588,11 @@ async function _autoChromeUsable(chromePath, { timeoutMs = 15000, pollMs = 100 }
 async function inspectChromeCapability({
   candidates = CHROME_CANDIDATES,
   probe = _autoChromeUsable,
+  // probeOptions (no default): the same timer seam host-capabilities.js's
+  // getCapability() already exposes for pdf.poppler (WP-3). It is handed to
+  // the probe unchanged; production callers omit it, so _autoChromeUsable's
+  // own 15000/100 defaults stand.
+  probeOptions,
   overridePath = process.env.WALLE_CHROME_PATH || '',
 } = {}) {
   if (overridePath && fs.existsSync(overridePath)) {
@@ -2595,7 +2602,7 @@ async function inspectChromeCapability({
   let executable = null;
   for (const candidate of detected) {
     // eslint-disable-next-line no-await-in-loop -- probes must run sequentially: first usable wins
-    if (await probe(candidate)) { executable = candidate; break; }
+    if (await probe(candidate, probeOptions)) { executable = candidate; break; }
   }
   if (executable) return { executable, detected, source: 'auto' };
   const installedButUnavailable = detected.length > 0;

package/template/wall-e/workers/brain-owner-worker.js

@@ -318,6 +318,15 @@ const CUSTOM_BRAIN_CALLS = { agentRunShadowOperation: (args) => require('../runt
   recordProviderHealthStatus: (args) => require('../llm/provider-health-state').recordProviderHealthStatus(args[0], { brain, ...(args[1] || {}) }),
   reserveProviderModelCircuitProbe: (args) => require('../llm/provider-health-state').reserveProviderModelCircuitProbe(args[0], args[1], { brain }),
   workflowStoreOperation: (args) => require('../routing/workflow-store-operations').runWorkflowStoreOperation(brain, args[0], args[1] || {}),
+  helperRulesRecordOutcome: (args) => require('../loops/brain-custom-writes').helperRulesRecordOutcome(args[0]),
+  helperRulesCloseOutcome: (args) => require('../loops/brain-custom-writes').helperRulesCloseOutcome(args[0], args[1]),
+  helperRulesSetCellState: (args) => require('../loops/brain-custom-writes').helperRulesSetCellState(args[0], args[1]),
+  helperRulesDailyTick: () => require('../loops/brain-custom-writes').helperRulesDailyTick(),
+  helperRulesSetGrade: (args) => require('../loops/brain-custom-writes').helperRulesSetGrade(args[0], args[1]), // WP-6
+  // Round 2 WP-2 (§6.4 S-16): D-5's close-by-worker (the hook's terminal-read path) and the
+  // one-time relabel/recovery pass (D-5/D-6).
+  helperRulesCloseOutcomeByWorker: (args) => require('../loops/brain-custom-writes').helperRulesCloseOutcomeByWorker(args[0], args[1]),
+  helperRulesRelabel: (args) => require('../loops/brain-custom-writes').helperRulesRelabel(args[0]),
 };
 
 async function _brainCall(payload = {}) {

package/template/wall-e/workers/coding-journal-writer-child.js

@@ -54,7 +54,7 @@ async function reply(message) {
 // If the daemon dies before sending it (or mid-write), there is no other
 // exit path — install the backstop before anything else so an orphaned
 // instance can't hold the WAL open indefinitely.
-installParentDeathWatch({
+const parentDeathWatch = installParentDeathWatch({
   label: 'coding-journal-writer-child',
   onShutdown: async () => {
     if (!openBrain) return;
@@ -102,6 +102,13 @@ process.once('message', async (message) => {
       code: error?.code ? String(error.code).slice(0, 100) : undefined,
     });
   } finally {
+    // The watch is a backstop for a parent that dies mid-write, so it stays
+    // armed for as long as this child is doing work. On our OWN completed
+    // request path it must be disarmed immediately BEFORE this self-initiated
+    // disconnect: otherwise our own disconnect looks like parent death to the
+    // watch, whose shutdown hook calls exit(0) and erases the exit status set
+    // above (a schema/owner refusal must leave the process exiting 1, not 0).
+    parentDeathWatch.stop();
     try { process.disconnect(); } catch { /* expected: process.disconnect() throws ERR_IPC_DISCONNECTED when the parent already closed the channel after taking the reply; this one-shot worker is finished either way and exits when the loop drains */ }
   }
 });

package/template/wall-e/workers/telemetry-worker.js

@@ -28,6 +28,14 @@ function runRequest(payload, maxResponseBytes) {
     req.method = payload.method || 'GET';
     req.headers = payload.headers || {};
     req.url = payload.path;
+    // WP-1 (blog-view-counts): the parent sends the TCP peer it observed in its own
+    // IPC field (never as a header, so a client cannot forge it). Re-attach it as
+    // the request's socket address — the blog counter's per-IP limiter reads it
+    // there. Routes that do not carry the field keep the request exactly as before
+    // (no req.socket at all).
+    if (typeof payload.clientAddress === 'string' && payload.clientAddress) {
+      req.socket = { remoteAddress: payload.clientAddress };
+    }
     req.destroy = () => {};
     let status = 200;
     let headers = {};

package/template/coding-task-manager/lib/giant-freeze-park.js

@@ -1,31 +0,0 @@
-'use strict';
-
-const DEFAULT_GIANT_ROLLOUT_BYTES = 500 * 1024 * 1024;
-const RECLAIM_REASONS = new Set([
-  'cap',
-  'interactive-preempt',
-  'prewarm-cap',
-  'pressure',
-  'pressure-relief',
-  'rss-budget',
-]);
-
-function shouldFreezeParkGiant({
-  enabled = true,
-  fileSizeBytes = 0,
-  pressure = 'normal',
-  reason = 'idle',
-  thresholdBytes = DEFAULT_GIANT_ROLLOUT_BYTES,
-  alreadyFrozen = false,
-} = {}) {
-  if (!enabled || alreadyFrozen) return false;
-  if (String(pressure || 'normal') !== 'normal') return false;
-  if (RECLAIM_REASONS.has(String(reason || ''))) return false;
-  return Math.max(0, Number(fileSizeBytes) || 0)
-    >= Math.max(1, Number(thresholdBytes) || DEFAULT_GIANT_ROLLOUT_BYTES);
-}
-
-module.exports = {
-  DEFAULT_GIANT_ROLLOUT_BYTES,
-  shouldFreezeParkGiant,
-};