create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/codex-launch-health.js

@@ -26,6 +26,13 @@ const PROJECT_TRUST_ENV = 'CTM_CODEX_PROJECT_TRUST';
 const HTTP_TRANSPORT_ENV = 'CTM_CODEX_HTTP_TRANSPORT';
 const HTTP_TRANSPORT_PROVIDER_ID = 'ctm-openai-https';
 
+// WP-2 (lead-cost-routing-round1-2026-10-21.html §5 D-6): a Codex LEAD calls Wall-E's MCP tools
+// as direct function calls instead of invoking them from inside a code-mode `exec` script, so a
+// long `walle_worker_wait` is a real client-side MCP call the client can hold. The key lives
+// under `[features.code_mode]` (`features.code_mode.direct_only_tool_namespaces`, verified on
+// codex-cli 0.162.1). Codex WORKERS never carry it -- they are denied walle_worker_wait anyway.
+const CODEX_LEAD_DIRECT_TOOL_ARGS = Object.freeze(['-c', 'features.code_mode.direct_only_tool_namespaces=["mcp__wall_e"]']);
+
 function isCodexCommand(cmd) {
   return path.basename(String(cmd || '')).toLowerCase() === 'codex';
 }
@@ -527,6 +534,20 @@ function applyCodexHttpTransportOverride(args, options = {}) {
   };
 }
 
+// WP-2 (D-6): the lead-only direct-tool namespace, its own prepareCodexLaunch step so it does not
+// depend on the HTTP-transport flag (off by default). A LEAD is the launch that reaches
+// prepareCodexLaunch with no model_provider override: every Codex worker already carries one
+// (codexWorkerProviderArgs, resolve-launch-params.js), while a routed lead gets its override later
+// in provider-process.js's argsTransform. Idempotent: a pair already present is never doubled.
+function applyCodexLeadDirectToolArgs(args) {
+  const originalArgs = Array.isArray(args) ? args.slice() : [];
+  if (argsContainCodexModelProviderOverride(originalArgs)) return { args: originalArgs, added: false, skipped: 'worker_provider_override' };
+  if (originalArgs.some((value) => String(value).startsWith('features.code_mode.direct_only_tool_namespaces='))) {
+    return { args: originalArgs, added: false, skipped: 'already_configured' };
+  }
+  return { args: [...CODEX_LEAD_DIRECT_TOOL_ARGS, ...originalArgs], added: true };
+}
+
 function argsContainProjectTrustOverride(args, projectPath) {
   const resolved = path.resolve(String(projectPath || '').trim());
   const quoted = JSON.stringify(resolved);
@@ -842,7 +863,10 @@ function prepareCodexLaunch(options = {}) {
   // in this branch.
   const _cfgStartedAt = Date.now();
   const projectTrustReport = applyProjectTrustOverride(args, options);
-  const transportReport = applyCodexHttpTransportOverride(projectTrustReport.args, options);
+  // WP-2 (D-6): the lead step runs BEFORE the transport step -- the transport override is itself a
+  // model_provider block, and only a WORKER's override (present before the launch plan) means skip.
+  const leadDirectReport = applyCodexLeadDirectToolArgs(projectTrustReport.args);
+  const transportReport = applyCodexHttpTransportOverride(leadDirectReport.args, options);
   const missingEnvReport = applyMissingMcpEnvOverrides(transportReport.args, options);
   const learnedMcpReport = applyLearnedMcpFailureOverrides(missingEnvReport.args, options);
   const cfgMs = Date.now() - _cfgStartedAt;
@@ -856,7 +880,7 @@ function prepareCodexLaunch(options = {}) {
     learned: learnedMcpReport,
   };
   return {
-    args: mcpReport.args, skillReport, mcpReport, projectTrustReport, transportReport,
+    args: mcpReport.args, skillReport, mcpReport, projectTrustReport, transportReport, leadDirectReport,
     timings: { skillWalkMs, cfgMs },
   };
 }
@@ -962,6 +986,8 @@ module.exports = {
   MCP_FAILURE_TTL_MS,
   QUARANTINE_TTL_STARTUP_MS,
   MCP_READINESS_PROBE_TIMEOUT_MS,
+  CODEX_LEAD_DIRECT_TOOL_ARGS,
+  applyCodexLeadDirectToolArgs,
   applyLearnedMcpFailureOverrides,
   applyMissingMcpEnvOverrides,
   applyCodexHttpTransportOverride,
@@ -980,6 +1006,7 @@ module.exports = {
     argsContainCodexModelProviderOverride,
     applyCodexHttpTransportOverride,
     applyMissingMcpEnvOverrides,
+    CODEX_LEAD_DIRECT_TOOL_ARGS,
     applyProjectTrustOverride,
     argsContainProjectTrustOverride,
     codexHttpTransportConfigArgs,

package/template/coding-task-manager/lib/codex-link-preparation.js

@@ -97,15 +97,16 @@ async function prepareCodexLink(payload, db, assertLive = () => {}) {
   assertLive();
   const resumeId = thread?.id || payload.threadId;
   if (!resumeId) return { status, thread, known, resolved: null, modelTruth: null };
-  // WP-1 (nightly-followups 2026-10-17): findCodexSessionFiles(..., { indexOnly: true }) answers only
-  // from the in-memory rollout index or the Codex state-DB row, and this op path never built that
-  // index -- so a missing/unreadable state_5.sqlite left a link IDENTITY-ONLY while the rollout file
-  // sat right there (server persists jsonl_path='' and never attaches the stream). Build/refresh the
-  // async index here first, exactly as lib/session-file-resolver.js does before its own indexOnly
-  // lookups. No synchronous directory walk: that walk was removed on purpose (commit 84cf35c69).
-  await history.ensureCodexRolloutIndex(payload.homeDir);
+  // The verified native state path already has precedence in findCodexSessionFiles. It does not
+  // depend on a global index refresh. Missing/mismatched native state still needs the async index
+  // recovery: an index-only miss must not leave a discoverable rollout linked as identity-only.
+  let rolloutPath = history.findCodexStateRolloutPath(resumeId, payload.homeDir);
+  if (!rolloutPath || !history.codexRolloutFileMatchesThread(rolloutPath, resumeId)) {
+    await history.ensureCodexRolloutIndex(payload.homeDir);
+    assertLive();
+    rolloutPath = history.findCodexSessionFiles(resumeId, null, payload.homeDir, { indexOnly: true })[0] || '';
+  }
   assertLive();
-  const rolloutPath = history.findCodexSessionFiles(resumeId, null, payload.homeDir, { indexOnly: true })[0] || '';
   const observation = await observeCodexRollout(rolloutPath, db, assertLive);
   assertLive();
   const agentSessionId = history.codexRolloutIdFromPath(rolloutPath) || resumeId;

package/template/coding-task-manager/lib/codex-paths.js

@@ -26,6 +26,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 function homeBase(homeDir) {
   return homeDir || process.env.HOME || process.env.USERPROFILE || os.homedir() || '';
@@ -77,7 +78,7 @@ function resolveCodexSessionsRoot(options = {}) {
     out.refusalCode = 'wrong-owner';
     return out;
   }
-  if ((Number(stat.mode) & 0o022) !== 0) {
+  if (!isWritableOnlyByOwner(stat)) {
     out.validationStatus = 'refused';
     out.refusalCode = 'unsafe-permissions';
     return out;

package/template/coding-task-manager/lib/coding-agent-models.js

@@ -288,18 +288,6 @@ function isGenericCodingSessionLabel(label, agentType = 'codex') {
     || lower === 'session';
 }
 
-function shouldApplyCodexAutoTitle({ session, existingTitle } = {}) {
-  if (existingTitle && existingTitle.userRenamed) return false;
-  for (const candidate of [session?.label, existingTitle?.title]) {
-    const text = normalizeTitleText(candidate);
-    if (text && !/^Codex:\s*/i.test(text) && !isGenericCodingSessionLabel(text, 'codex')) return false;
-  }
-  const title = normalizeTitleText(existingTitle?.title || session?.label || '');
-  if (!title) return true;
-  if (/^Codex:\s*/i.test(title) && !isGenericCodingSessionLabel(title, 'codex')) return true;
-  return isGenericCodingSessionLabel(title, 'codex');
-}
-
 function resolveModelToRegistry(modelName) {
   if (!modelName) return null;
   let provider = null;
@@ -561,11 +549,23 @@ function createCodingAgentModelSync({
         if (!modelStateRuntime) _persistSessionModel(session, model);
         changed = true;
       }
-      if (agentType === 'codex' && !session._codexTitleSynced) {
+      if (agentType === 'codex') {
         const existingTitle = titlesById.get(session.id) || null;
-        if (existingTitle && existingTitle.userRenamed) {
-          session._codexTitleSynced = true;
-        } else if (!shouldApplyCodexAutoTitle({ session, existingTitle })) {
+        // WP-4/D-10: the thread's OWN name (threads.name) is read on EVERY tick — there is no
+        // one-shot `_codexTitleSynced` latch any more, and no title-vs-label precedence test that
+        // could let a CTM title block the name (S-22). applyProviderTitle owns the tier rules: it
+        // re-asserts a drifted tier-1 (user-renamed) row outward, skips a row already carrying this
+        // exact name, and writes the agent name over an older tier-2/tier-3 title.
+        const agentName = session._claudeSessionId ? getCodexThreadAgentName(session._claudeSessionId) : '';
+        if (agentName) {
+          const outcome = applyProviderTitle({ db: dbModule, sessionId: session.id, provider: 'codex', agentName }); // not a dbModule method — no dispatchOwnerMutation
+          if (outcome.applied === 'agent') {
+            session.label = `Codex: ${agentName}`;
+            changed = true;
+          }
+        } else {
+          // No thread name at all: the CTM live label is the only signal left, so it repairs a
+          // stale auto-title. Never a tier-2 (`provider_title`) row, never the user's own name.
           const liveLabel = normalizeTitleText(session.label);
           if (liveLabel
             && !isGenericCodingSessionLabel(liveLabel, 'codex')
@@ -573,16 +573,6 @@ function createCodingAgentModelSync({
             dispatchOwnerMutation(dbModule, 'setSessionTitleNew', [session.id, liveLabel, false], 'coding-agent title');
             changed = true;
           }
-          session._codexTitleSynced = true;
-        } else {
-          // Requires the exact Codex thread id — cwd/spawn-time matching is unsafe for periodic refresh.
-          const agentName = session._claudeSessionId ? getCodexThreadAgentName(session._claudeSessionId) : '';
-          if (agentName) {
-            session.label = `Codex: ${agentName}`;
-            session._codexTitleSynced = true;
-            applyProviderTitle({ db: dbModule, sessionId: session.id, provider: 'codex', agentName }); // not a dbModule method — no dispatchOwnerMutation
-            changed = true;
-          }
         }
       }
     }
@@ -688,7 +678,7 @@ function createCodingAgentModelSync({
       if (agentType === 'gemini' && !modelStateRuntime) {
         context.result = { id: session.id, modelName: _modelArgValue(session.args) };
       } else {
-        const item = { id: session.id, agentType, directory: session.cwd || (session.meta && session.meta.cwd) || '', knownSourceRevision: agentType === 'opencode' ? modelSyncState.knownSourceRevision(session.id) : '', claudeJsonlPath, codexThreadId: agentType === 'codex' ? (session._providerResumeId || session._claudeSessionId || '') : (session._claudeSessionId || session._providerResumeId || null), wantCodexTitle: agentType === 'codex' && session._codexTitleSynced !== true && !!(session._providerResumeId || session._claudeSessionId) };
+        const item = { id: session.id, agentType, directory: session.cwd || (session.meta && session.meta.cwd) || '', knownSourceRevision: agentType === 'opencode' ? modelSyncState.knownSourceRevision(session.id) : '', claudeJsonlPath, codexThreadId: agentType === 'codex' ? (session._providerResumeId || session._claudeSessionId || '') : (session._claudeSessionId || session._providerResumeId || null), wantCodexTitle: agentType === 'codex' && !!(session._providerResumeId || session._claudeSessionId) }; // WP-4/D-10: no one-shot latch gates the name read
         if (modelStateRuntime) {
           Object.assign(item, { owner: context.ownerSnapshot, providerSessionId: context.ownerSnapshot.providerSessionId, processGeneration: context.ownerSnapshot.processGeneration, providerEnv: modelProviderEnv(session), geminiTranscriptPath: session._geminiTranscriptPath || '' });
           // The pre-await half of the source binding, and the prior checkpoint this request may carry.
@@ -758,7 +748,7 @@ function createCodingAgentModelSync({
         && (session.model_id !== model.model_id || session.model_provider !== model.model_provider);
       if (agentType === 'claude' && model) claudeResolved += 1; if (modelChanged && session.model_id && String(session.model_source || '') === 'db:restore') repairedStamps += 1; // I-6: ONLY a stamp still carrying the pre-apply db:restore provenance is a repair; a mid-session /model switch on a live-sourced row is a normal change
       const truthChanged = _claudeTruthNeedsApply(session, truth);
-      const needsTitleDecision = agentType === 'codex' && session._codexTitleSynced !== true;
+      const needsTitleDecision = agentType === 'codex'; // WP-4/D-10: a title decision is taken on every probe, never once
       // Codex: the effort of the rollout's latest turn_context (observed, never requested).
       const codexEffortChanged = agentType === 'codex' && result.modelEffort !== undefined
         && String(session.model_effort || '') !== String(result.modelEffort || '');
@@ -853,7 +843,9 @@ function createCodingAgentModelSync({
               changed = true;
             }
           }
-          if (entry.titleSynced) session._codexTitleSynced = true;
+          // entry.titleSynced is the batch's "the title decision ran" receipt (the completion cache
+          // below and the durable applier's latch both consume it); the session no longer carries a
+          // one-shot `_codexTitleSynced` gate of its own.
           const complete = (!context.intent.modelId || entry.modelPersisted)
             && (agentType !== 'codex' || entry.titleSynced);
           if (complete) modelSyncState.cacheCompletedContext(context);
@@ -942,5 +934,4 @@ module.exports = {
   opencodeDataDbPath,
   isGenericCodingSessionLabel,
   resolveModelToRegistry,
-  shouldApplyCodexAutoTitle,
 };

package/template/coding-task-manager/lib/coding-session-model-adapters.js

@@ -3,9 +3,28 @@
 // Pure decoders for native provider evidence. These functions deliberately do no discovery or I/O.
 const SYNTHETIC = '<synthetic>';
 const { CLAUDE_ALIASES } = require('./claude-model-selection-vocabulary');
+const { WORKER_MODEL_ALIAS } = require('./model-proxy/lead-worker-picks');
 const ALIASES = new Set([...CLAUDE_ALIASES, 'default']);
 const GEMINI_ALIASES = new Set(['auto', 'default', 'pro', 'flash', 'flash-lite']);
 
+/*
+ * The ONE reserved delegate alias (WORKER_MODEL_ALIAS in lib/model-proxy/lead-worker-picks.js). It names
+ * what a lead's SUBAGENTS ask the proxy for -- never a model a session's own CLI runs -- so it is
+ * refused by VALUE (trimmed, case-insensitive) before any producer can hand it to the ledger as a
+ * lead fact. Normal CLI aliases and policies keep their existing behavior.
+ *
+ * The value is normalised through the SAME one marker rule `modelClass` applies below:
+ * The reserved alias with `[1m]` is wearing the session's context marker, not a different
+ * model, so it can never be a lead fact either. Exactly one marker, and no blacklist of lookalikes
+ * (lookalikes, `claude-opus-5-5[1m]` and every real id keep their existing behavior).
+ */
+function isReservedWorkerModel(value) {
+  if (typeof value !== 'string') return false;
+  const folded = value.trim().toLowerCase();
+  const base = folded.endsWith('[1m]') ? folded.slice(0, -4) : folded;
+  return base === WORKER_MODEL_ALIAS;
+}
+
 function bounded(value, required = false) {
   if (typeof value !== 'string') return null;
   const valueTrimmed = value.trim();
@@ -46,6 +65,7 @@ function emit(out, args) { const item = observation(...args); if (item) out.push
 function modelClass(raw) {
   const name = bounded(raw, true);
   if (!name) return null;
+  if (isReservedWorkerModel(name)) return null;
   const suffix = name.toLowerCase().endsWith('[1m]') ? '[1m]' : '';
   const base = suffix ? name.slice(0, -4) : name;
   const folded = base.toLowerCase();
@@ -165,7 +185,9 @@ function codexSettingsCandidate(owner, rec, index, resumeId) {
   if (rec.type !== 'event_msg' || p.type !== 'thread_settings_applied' || !p.thread_id ||
       (p.thread_id !== owner.providerSessionId && p.thread_id !== resumeId) || !p.thread_settings) return null;
   const model = bounded(p.thread_settings.model, true);
-  if (!model) return null;
+  // Codex carries the same reserved alias in its thread settings and turn contexts when a lead's
+  // subagents are routed through the proxy; neither can be the lead's own model (AC-0d).
+  if (!model || isReservedWorkerModel(model)) return null;
   const ordinal = Number.isSafeInteger(rec.ordinal) && rec.ordinal >= 0 ? String(rec.ordinal) : null;
   return { at: time(rec.timestamp), index, value: model, effort: p.thread_settings.reasoning_effort ?? null,
     sourceRevision: ordinal, source: 'codex:thread-settings' };
@@ -186,6 +208,7 @@ function codexTurnContextCandidate(owner, rec, index, resumeId) {
   if (!(rec.type === 'turn_context' || (rec.type === 'event_msg' && p.type === 'turn_context'))) return null;
   const model = bounded(p.model ?? p.model_id, true);
   const turnId = p.turn_id == null ? null : String(p.turn_id);
+  if (isReservedWorkerModel(model)) return null;
   return { at: time(rec.timestamp), index, payload: p, model, turnId };
 }
 
@@ -297,4 +320,6 @@ module.exports = { claudeModelObservations, claudeHookModelObservations, codexMo
   laterRank: later, isCodexRelatedRecord, codexThreadMatches,
   claudeIdentityCandidate, claudeTurnCandidate, claudeIdentityObservations, claudeTurnObservations,
   codexSettingsCandidate, codexSettingsObservations, codexTurnContextCandidate, codexTerminalCandidate,
-  codexTurnObservations };
+  codexTurnObservations,
+  // WP-0: the one shared "is this the reserved delegate alias?" predicate (see the doc comment above).
+  isReservedWorkerModel };

package/template/coding-task-manager/lib/coding-session-model-projection.js

@@ -1,11 +1,16 @@
 'use strict';
 
+const { isReservedWorkerModel } = require('./coding-session-model-adapters');
+
 const PRIORITY = Object.freeze({ resolved: 3, lastCompletedTurn: 2, selection: 1 });
 const MODEL_RESULT_PAGE_SIZE = 8;
 const MAX_MODEL_RESULT_BYTES = 1024 * 1024;
 
 function concrete(fact, allowNullKind) {
   return !!fact && typeof fact.value === 'string' && fact.value.trim() !== '' && Buffer.byteLength(fact.value.trim(), 'utf8') <= 256 && !fact.value.includes('<synthetic>') && Number.isFinite(fact.observedAtMs) && fact.observedAtMs >= 0 &&
+    // WP-0 (AC-0c): a historical row may still HOLD the reserved alias (it is kept for audit), but it
+    // is never a compatibility model -- the real selection/turn wins by the existing precedence below.
+    !isReservedWorkerModel(fact.value) &&
     (fact.selectionKind === 'concrete' || (allowNullKind && fact.selectionKind === null));
 }
 

package/template/coding-task-manager/lib/coding-session-model-runtime.js

@@ -1470,7 +1470,7 @@ function createDurableModelResultApplier({ modelStateRuntime, isCurrent, isOwner
       context.capturedSignature = refreshSignature(context.session, context.agentType);
       if (context.agentType === 'opencode' && context.result.sourceRevision) context.nextSourceRevision = String(context.result.sourceRevision);
       cacheCompleted(context);
-      if (context.agentType === 'codex' && context.session._codexTitleSynced !== true) {
+      if (context.agentType === 'codex') { // WP-4/D-10: the thread name is decided on every completed probe, never once
         context.needsTitleDecision = true;
         intents.push({ id: context.session.id, agentType: 'codex', generation, capturedSignature: context.capturedSignature,
           agentSessionId: context.ownerSnapshot.providerSessionId, liveLabel: normalizeTitle(context.session.label),
@@ -1488,7 +1488,6 @@ function createDurableModelResultApplier({ modelStateRuntime, isCurrent, isOwner
       const entry = byId.get(String(context.session.id));
       if (!entry || Number(entry.generation) !== generation || entry.capturedSignature !== context.capturedSignature) continue;
       if (entry.titleApplied && entry.title && entry.titleKind !== 'live') { const label = `Codex: ${entry.title}`; if (context.session.label !== label) { context.session.label = label; titleChanged = true; } }
-      if (entry.titleSynced) context.session._codexTitleSynced = true;
       if (entry.titleSynced) cacheCompleted(context);
     }
     if (titleChanged && typeof broadcastSessionList === 'function') broadcastSessionList();

package/template/coding-task-manager/lib/coding-session-model-state.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { isReservedWorkerModel } = require('./coding-session-model-adapters');
+
 const SOURCE_GROUPS = {
   claude: {
     selection: ['hook:PostModelSwitch', 'hook:SessionStart', 'transcript:identity', 'db:restore'],
@@ -54,6 +56,14 @@ function validateObservation(input) {
     if (fields.outcome !== 'completed' || fields.value === null || fields.selectionKind !== 'concrete') return null;
   }
   if (fields.kind === 'selection' && ['alias', 'policy'].includes(fields.selectionKind) && fields.value === null) return null;
+  /*
+   * WP-0 (AC-0b): the reserved delegate alias is refused by VALUE for every kind, whatever
+   * selectionKind a caller claims for it -- a lead session's own model can never be what its
+   * subagents ask the proxy for. `validFact`/`validPrior` deliberately stay permissive, so a row
+   * already persisted with the alias still loads (the projection skips the fact; history is never
+   * rewritten or dropped).
+   */
+  if (isReservedWorkerModel(fields.value)) return null;
   return { ...fields, processGeneration: input.processGeneration, observedAtMs: input.observedAtMs };
 }
 

package/template/coding-task-manager/lib/coding-session-model-sync-state.js

@@ -127,7 +127,6 @@ function createCodingSessionModelSyncState({
       String(session?.model_source || ''),
       Number(session?.model_observed_at || 0),
       String(session?.label || ''),
-      session?._codexTitleSynced === true,
       String(session?._claudeSessionId || session?.agentSessionId || ''),
       /*
        * Corrective finding 10: the PURE provider-source inputs a checkpoint's offsets are relative to.

package/template/coding-task-manager/lib/conversation-import/cursor-guard-owner.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const path = require('path');
 const { ANCHOR_PREFIX, cursorAnchorGuard } = require('./source-checkpoint');
 
 // WP-1 (design D-3/D-4): the conversation cursor is an anchor guard and nothing else.
@@ -77,13 +78,22 @@ function commitConversationBatchAndTranscriptCursor(db, options) {
        OR transcript_files.status IS NOT 'ok'
        OR transcript_files.last_error IS NOT ''
   `);
+  // A row's `ctm_session_id` changing under this upsert used to be silent -- one committed import
+  // re-keys the file to a different owner (a re-import of the same rollout under another session)
+  // with nothing in the log to say so. Read the prior owner inside the transaction, before the write.
+  const readPriorOwner = db.prepare('SELECT ctm_session_id FROM transcript_files WHERE jsonl_path = ?');
   return db.transaction(() => {
+    const priorOwner = readPriorOwner.get(options.filePath);
     const committed = options.commitBatch(db, options.batch);
     // WP-1 (S-3b): the guard is stored as-is; the manifest receipt binding is deleted with
     // the whole-prefix proof it fenced.
     upsert.run(options.filePath, options.agentSessionId, options.ctmSessionId, options.provider,
       String(options.stat.dev ?? ''), String(options.stat.ino ?? ''), Number(options.stat.size || 0),
       Number(options.stat.mtimeMs || 0), options.offset, options.parserVersion, options.guard);
+    // One line, ids only (truncated). The basename, never the full path, and never any content.
+    const prior = priorOwner ? String(priorOwner.ctm_session_id || '') : '';
+    const next = String(options.ctmSessionId || '');
+    if (priorOwner && prior !== next) console.log(`[transcript-owner] cursor commit changed owner ${path.basename(String(options.filePath || ''))}: ${prior.slice(0, 8)} -> ${next.slice(0, 8)}`);
     return committed;
   })();
 }

package/template/coding-task-manager/lib/create/resolve-launch-params.js

@@ -456,7 +456,14 @@ function resolveCreateLaunchParams(ctx) {
   // alias because startup_tasks still stores that legacy column.
   const requestedTitle = String(msg.title || msg.label || '').replace(/^Resume:\s*/i, '').trim().slice(0, 120);
   const walleResumeRequest = msg.resumeWalle === true && !msg._isRestore;
-  const hasExplicitClientTitle = !msg._isRestore && !walleResumeRequest && !!requestedTitle;
+  // D-1: every resume sender echoes the row's own DISPLAYED title back (`label`/`title`), and
+  // an echoed label is not user intent — so a resume never yields a tier-1 (user) name.
+  // D-13/WP-5: a CTM-composed label (`Shell:`, `Folder:`, `Code Review:`, a review session, a
+  // best-of attempt, the Claude Desktop fork) declares itself with `titleIntent:'default'`, so it is
+  // written at tier 3 like any other echo. An absent titleIntent keeps today's semantics (an old
+  // client causes no regression), and the New Session modal's typed label still lands tier 1.
+  const hasExplicitClientTitle = !msg._isRestore && !walleResumeRequest && !isResumeLaunch
+    && msg.titleIntent !== 'default' && !!requestedTitle;
   let title = requestedTitle;
   if (!title) {
     const agentName = cmd.includes('claude') ? 'Claude Code'

package/template/coding-task-manager/lib/ctm-boot-lifecycle.js

@@ -91,8 +91,9 @@ function ctmLifecycleJournalPath({ env = process.env, configDir = null, instance
   return path.join(resolveEffectiveDataDir({ env, configDir }), 'logs', fileName);
 }
 
-function appendCtmBootLine({ pid = process.pid, env = process.env, configDir = null, instanceTag = null, port = null } = {}) {
+function appendCtmBootLine({ pid = process.pid, env = process.env, configDir = null, instanceTag = null, port = null, enteredAtServer = false } = {}) {
   _reportLaunchdProcessTypeOnBoot(env);
+  _reportBootEntryOnBoot(env, { enteredAtServer });
   return appendLifecycleLine(ctmLifecycleJournalPath({ env, configDir, instanceTag, port }), {
     ts: new Date().toISOString(),
     event: 'ctm-boot',
@@ -127,10 +128,25 @@ function _reportLaunchdProcessTypeOnBoot(env = process.env) {
   } catch { /* expected: a boot-time advisory must never block boot; the plist may be unreadable on a hardened install */ }
 }
 
+// WP-2 (clock-free r6 OQ-6): report-only boot check for the OTHER install drift — a launchd-managed
+// CTM whose plist still points at server.js directly, so bin/ctm-service-entry.js's conversation-storage
+// boot gate never ran. Rather than diff the plist (a second source of truth, and one that can't tell a
+// wrapper that execs the entry from a real bypass — D-2), the caller reports the RUNTIME fact
+// `require.main === module`. Warns once per boot so the drift can't stay silent for a month; never blocks
+// boot, never invokes launchctl, never reads or writes the plist. Only the real launchd-managed primary
+// is checked — a /ctm-dev instance (CTM_MANAGED_BY_LAUNCHD unset/'0') or non-darwin host has no plist.
+function _reportBootEntryOnBoot(env = process.env, { enteredAtServer = false, platform = process.platform, warn = console.warn } = {}) {
+  if (!enteredAtServer || env.CTM_MANAGED_BY_LAUNCHD !== '1' || platform !== 'darwin') return;
+  try {
+    warn('[launchd] CTM was started at server.js, so the conversation-storage boot gate did not run; re-run bin/install-service.sh or npx create-walle to enter through bin/ctm-service-entry.js');
+  } catch { /* expected: a boot-time advisory must never block boot */ }
+}
+
 module.exports = {
   resolvePrimaryDataDir,
   resolveEffectiveDataDir,
   isPrimaryInstance,
   ctmLifecycleJournalPath,
   appendCtmBootLine,
+  _reportBootEntryOnBoot,
 };

package/template/coding-task-manager/lib/db-domain-tables.js

@@ -93,6 +93,13 @@ const TABLE_DOMAINS = Object.freeze({
   // WP-3 (§6.4 S-12): where a shipped transcript landed on THIS instance. Same domain as
   // agent_sessions (the identity row it is written alongside) so one handle serves the consumer.
   sync_transcript_replicas: 'core',
+  // WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1): the hub machine registry.
+  machines: 'core',
+  // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/D-6/D-11): the machine
+  // pool's own tables, same domain as `machines` — one 'core' handle serves the whole feature.
+  host_samples: 'core',
+  machine_self: 'core',
+  machine_pairing_offers: 'core',
   // Legacy pre-v1 predecessors of ctm_sessions/agent_sessions/session_index.
   // Superseded but their CREATE TABLE IF NOT EXISTS guards remain for
   // fresh-v0 / mid-migration databases. Same domain as their successors

package/template/coding-task-manager/lib/db-domains.js

@@ -193,6 +193,26 @@ const CTM_WRITE_OPS = Object.freeze([
   'deleteChain', 'deleteCtmSession', 'deleteFolder', 'deleteHook', 'deleteImage',
   'deletePermissionRule', 'deletePrompt', 'deleteReview', 'deleteReviewComment',
   'deleteSessionAnalysis', 'deleteStaleAnalyses', 'deleteTemplate',
+  // WP-2 (docs/remote-machine-hub-sessions-2026-10-22.html §6.1/§8, deferred from WP-0): the hub
+  // machine-registry writes. `machines` is domain 'core' (lib/db-domain-tables.js), and each op's
+  // OP_META row in shared/storage/contract.js carries the same tag — Gate 2c (CTM_WRITE_OPS →
+  // OP_META kind:'write' + domain) and Gate 2c-inventory (a domain-tagged write op outside this
+  // list) are exactly the two assertions that require the pair to land together.
+  'upsertMachineRow', 'recordMachineProbe', 'deleteMachineRow',
+  // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-11): the 60 s host-sample
+  // write, on the same `core` handle as the machines rows above; its OP_META row in
+  // shared/storage/contract.js carries the matching kind:'write' + domain + tables:['host_samples'].
+  'recordHostSample',
+  // WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-4/P-5/P-6): the
+  // machine-owned settings write, the P-5 roster replacement (one transaction: upsert listed,
+  // delete unlisted, never self) and the leave() sweep. Each OP_META row in shared/storage/contract.js
+  // carries the matching kind:'write' + domain:'core'.
+  'setMachineSelf', 'replaceRosterMachines', 'deleteAllMachineRows',
+  // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9): the pairing-offer
+  // writes — mint, single-use redeem, and the 5-wrong-redeem burn. `machine_pairing_offers` is
+  // classified 'core' in lib/db-domain-tables.js and each op's OP_META row in
+  // shared/storage/contract.js carries the matching kind:'write' + domain + tables.
+  'insertPairingOffer', 'markPairingOfferRedeemed', 'burnLivePairingOffers',
   'deleteWorkspace', 'detachPromotedProviderChildSessions', 'duplicatePrompt',
   'enqueueSyncOutbox', 'flushSessionDiagnostics', 'flushSessionMetadataUpdates', 'heartbeatStartupTasks', 'incrementApprovalRuleMatch',
   'markStartupTaskExited', 'markStartupTaskUserPromptInput', 'markSyncOutboxDeliveredThrough', 'recordSyncOutboxServed',
@@ -205,7 +225,7 @@ const CTM_WRITE_OPS = Object.freeze([
   'supersedeHeldApprovalDecision', 'expireStaleHeldApprovalDecision', 'resolveApprovalDecision', 'claimWallePermissionResolution', 'commitWallePermissionResolution', 'expireOpenWallePermissions', 'restorePromptVersion', 'reviveStartupTask',
   'saveApprovalAiRefinementRule', 'saveApprovalRescuePattern', 'saveImage',
   'setAlwaysAsk', 'setPermRuleExceptions', 'setPromptParent',
-  'setScrollbackIdentity', 'setSessionStar', 'setSessionTitleMirror', 'setSessionTitleStatusNew',
+  'setScrollbackIdentity', 'setSessionStar', 'setSessionTitleMirror', 'setSessionTitleStatusNew', 'applyAgentTitleBackfillRows',
   'setSetting', 'startAnalysisRun', 'toggleApprovalRule', 'toggleAutoApproval',
   'toggleHook', 'trackPromptUsage', 'transferSessionOwnership', 'updateChain',
   'updateCodingSessionModel', 'updateFolder', 'updateHarvestState',
@@ -256,7 +276,6 @@ const CTM_WRITE_OPS = Object.freeze([
   'recordSyncPeerConflict', 'updateStartupTaskTitle', 'updateStartupTaskClaudeSession',
   'updateStartupTaskAttentionDismissal', 'updateStartupTaskLifecycle',
   'markStartupTaskParked', 'prepareScrollbackForSession', 'upsertAgentSessionIdentity',
-  'promoteStartupTaskTitleIfUserNamed', 'repairSessionTitlesFromStartupTasks',
   'repairCodexRolloutAgentIdentities', 'cleanupOrphanScrollbackIdentities',
 ].concat(require('../../shared/storage/ctm-domain-operation-contract').WORKSPACE_ACTIVITY_OWNER_WRITE_OPS));
 

package/template/coding-task-manager/lib/db-owner-op-registry.js

@@ -124,6 +124,13 @@ const RAW_DB_OWNER_OPS = {
   updatePromptEffectiveness: { expectedMs: 5000, resumable: false },
   applySafeRelinkRepairs: { expectedMs: 1000, resumable: false },
   recoverSessionIntegrity: { expectedMs: 1000, resumable: false },
+  // WP-3 (worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-5): one bounded,
+  // idempotent boot pass that fills agent_sessions.jsonl_path for Claude rows whose transcript is
+  // already at the derived path. `expectedMs` is a budget HINT, not a deadline: the dispatch
+  // deadline is max(interactive floor 60s, expectedMs*8) (lib/db-owner-op-deadline.js), and the op
+  // is additionally bounded by payload.limit (<=500 rows). Not resumable: the caller is a
+  // fire-and-forget boot hook with no redrive, and a redrive could only re-run a no-op.
+  linkDerivedClaudeTranscripts: { expectedMs: 2000, resumable: false },
   backfillSessionMessagesAsync: { expectedMs: 500, resumable: false },
   runContentRowsBackfillSweep: { expectedMs: 500, resumable: false },
   deleteStaleSessionAnalysesFromArtifact: {

package/template/coding-task-manager/lib/db-schema-source-files.js

@@ -39,6 +39,7 @@ const SCHEMA_SOURCE_FILES = Object.freeze([
   'lib/migrations/v52-coding-session-launch-generations.js',
   'lib/migrations/v53-session-model-intent.js',
   'lib/migrations/v54-session-lead-model.js',
+  'lib/migrations/v56-host-samples-and-machine-pool.js',
   'lib/migrations/v29-usage-accounting.js', 'lib/migrations/v30-usage-reporting.js', 'lib/migrations/v36-conversation-projection-deletes.js',
   '../shared/usage-store.js', '../shared/usage-reporting-schema.js',
   'lib/delete-ctm-session-saga.js',

package/template/coding-task-manager/lib/feature-manifest.js

@@ -1557,7 +1557,7 @@ const FEATURES = [
   // no polarity/tunable/config pattern matched; 1 site(s); first: db.js:4416
   { id: "ctm_ctm_sqlite_synchronous", env: "CTM_SQLITE_SYNCHRONOUS", owner: "ctm-core-team", stage: "ops", defaultOn: true, since: "2026-08-24", expires: null, note: "unclassified raw read; needs manual triage" },
   // numeric-tunable suffix/read shape; 1 site(s); first: db.js:4373
-  { id: "ctm_ctm_sqlite_write_lock_stale_ms", env: "CTM_SQLITE_WRITE_LOCK_STALE_MS", owner: "ctm-core-team", stage: "ops", tunable: true, default: 0, since: "2026-08-24", expires: null, note: "numeric tunable" },
+  { id: "ctm_ctm_sqlite_write_lock_stale_ms", env: "CTM_SQLITE_WRITE_LOCK_STALE_MS", owner: "ctm-core-team", stage: "removed", defaultOn: false, since: "2026-08-24", expires: null, note: "retired 2026-10-23 (fsevents-churn WP-1, docs/fsevents-churn-kernel-write-lock-2026-10-23.html D-4): the SQLite write lock is a kernel lock on a .mutex lock DB released by the OS when its holder dies, so stale-claim recovery and its age knob were deleted; no read of this name survives." },
   // !== '0' comparison found; 1 site(s); first: server.js:448
   { id: "ctm_ctm_stale_grid_embargo", env: "CTM_STALE_GRID_EMBARGO", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
   // !== '0' comparison found; 1 site(s); first: server.js:19764

package/template/coding-task-manager/lib/fs-watcher.js

@@ -4,6 +4,7 @@ const path = require('path');
 const EventEmitter = require('events');
 const { namedInterval, runSync, wrap } = require('./perf-tracker');
 const envFlags = require('./env-flags');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 // Design doc mainloop-composer-freeze-2026-08-20.html §5 D-1, §6, §9 S-1/S-4. The 60s
 // scan tick and the attach/reattach directory walk ran completely unwrapped, so the
@@ -103,7 +104,7 @@ function resolveRoot(root) {
       result.refusalCode = 'wrong-owner';
       return result;
     }
-    if ((Number(targetStat.mode) & 0o022) !== 0) {
+    if (!isWritableOnlyByOwner(targetStat)) {
       result.validationStatus = 'refused';
       result.refusalCode = 'unsafe-permissions';
       return result;
@@ -159,7 +160,7 @@ async function resolveRootAsync(root) {
       result.refusalCode = 'wrong-owner';
       return result;
     }
-    if ((Number(targetStat.mode) & 0o022) !== 0) {
+    if (!isWritableOnlyByOwner(targetStat)) {
       result.validationStatus = 'refused';
       result.refusalCode = 'unsafe-permissions';
       return result;

package/template/coding-task-manager/lib/harness-history-transition.js

@@ -4,7 +4,7 @@ const NATIVE_ORIGINS = new Set(['native-codex', 'native-claude', 'native-opencod
 const KNOWN_ORIGINS = new Set([...NATIVE_ORIGINS, 'routed-proxy', 'portable-transcript']);
 // S-3: the adapter/schema ids and the version membership test come from the one qualified table.
 const { CODEX_CONTROL_ADAPTER, CODEX_COMPACTION_SCHEMA_RECEIPT, CODEX_PRE_TURN_COMPACTION_SCHEMA,
-  isQualifiedCodexVersion } = require('./codex-harness-qualification');
+  isQualifiedCodexVersion, isNonElevatedCyberAccessProgram } = require('./codex-harness-qualification');
 // S-4: the ONE portable-kind set. `native-media` is a message whose only non-text content parts are
 // input_image parts (D-2); it is portable only to a Codex target, which is the planner's job below.
 const PORTABLE_HISTORY_KINDS = new Set(['text', 'tool-pair', 'native-world-state', 'native-lifecycle', 'native-media']);
@@ -48,8 +48,8 @@ function inspectTransition({ sourceRecipe, targetRecipe, snapshot, signal } = {}
   if (!sourceCheckpoint) return refuse('source_checkpoint_unknown');
   if (codexHistorySource && sourceProviderId !== targetProviderId
       && (!qualifiedCodexHistorySource
-        || sourceRecipe.cyberAccessProgram !== null
-        || snapshot.previousSettings?.cyberAccessProgram !== null
+        || !isNonElevatedCyberAccessProgram(sourceRecipe.cyberAccessProgram)
+        || !isNonElevatedCyberAccessProgram(snapshot.previousSettings?.cyberAccessProgram)
         || targetRecipe.harness !== 'codex-cli' || !isQualifiedCodexVersion(targetRecipe.harnessVersion))) {
     return refuse('native_fork_adapter_unqualified', { sourceCheckpoint });
   }