create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/launch-plan-worker.js

@@ -16,10 +16,11 @@ const {
 } = require('./lifecycle-wake-experiment');
 const projectConfig = require('./project-config');
 const { resolveResumeCwdFallback } = require('./resume-cwd');
-const { validateResumeTarget, withTrashLocation } = require('./resume-preflight');
+const { validateResumeTarget, withTrashLocation, findClaudeResumeTranscript, transcriptHasConversation } = require('./resume-preflight');
 const { findTrashedTranscript } = require('./session-transcript-trash');
 const sessionHistory = require('./session-history');
 const { extractResumeTarget, getCodexThreadResumeCwdInfo, locateCodexRollout } = sessionHistory;
+const { ensureClaudeResumeTarget } = require('./launch-model-override');
 const walleMcpAutoConfig = require('./walle-mcp-auto-config');
 const { ensureWalleMcpForAgentSession } = walleMcpAutoConfig;
 const {
@@ -228,7 +229,15 @@ async function prepareLaunchPlan(spec = {}, progressPort = parentPort) {
   cwd = fallback.cwd || cwd;
 
   let agentType = agentTypeForCommand(cmd);
-  let resumeResolution = resolveResumeAlias(agentType, args, metadata);
+  // WP-0 D-2: for the PRIVATE Claude model-target operation below, the recorded source argv must reach
+  // the native-history classification UNTOUCHED. resolveResumeAlias is a naive
+  // `indexOf('--resume')` + metadata rewrite, and an argument that merely SPELLS `--resume` while being
+  // another option's operand (e.g. `--append-system-prompt --resume`) would be rewritten before the
+  // canonical normalizer ever sees it. Ordinary create/restore callers and Codex keep today's order.
+  const defersClaudeResumeAlias = agentType === 'claude' && spec.claudeResumeThreadId !== undefined;
+  let resumeResolution = defersClaudeResumeAlias
+    ? { args, resume: extractResumeTarget(agentType, args) }
+    : resolveResumeAlias(agentType, args, metadata);
   args = resumeResolution.args;
   let resume = resumeResolution.resume;
 
@@ -283,6 +292,54 @@ async function prepareLaunchPlan(spec = {}, progressPort = parentPort) {
   const cliResolution = resolvePublishedCliCommand(cmd, spec, env);
   cmd = cliResolution.cmd;
   agentType = agentTypeForCommand(cmd);
+  // WP-0 D-2 (same-harness, early): the project config above may have just rewritten this launch to a
+  // DIFFERENT harness, and the Codex-specific MCP/profile rewrites and prepareCodexLaunch() run long
+  // before a plan is returned. The private Claude model-target field names a Claude thread, so a launch
+  // that resolved to another harness is refused HERE -- before any of that preparation -- instead of
+  // executing Codex preparation and only then refusing the produced plan.
+  // Ordinary callers never set the private field, and Codex callers never set it either, so their
+  // behavior is unchanged. The planner's post-plan same-harness guard remains as the outer defence.
+  if (spec.claudeResumeThreadId !== undefined && agentType !== 'claude') {
+    const error = new TypeError('spec.claudeResumeThreadId names a Claude thread but the launch resolved to another harness');
+    error.code = 'launch_claude_target_harness_changed';
+    throw error;
+  }
+  // WP-0 (docs/claude-routed-native-history-resume-2026-10-24.html §5 D-2, §6): a Claude
+  // MODEL-TARGET preparation names the canonical source thread through the PRIVATE spec field
+  // `claudeResumeThreadId`, which only the lead-transition target planner sets after its canonical
+  // source proof. Claude keeps its own native transcript, so the launch must RESUME that exact
+  // thread instead of starting the recorded `--session-id` again (which would collide with the
+  // conversation already on disk). The classification below is the EXISTING native preflight --
+  // findClaudeResumeTranscript + transcriptHasConversation -- never a second reader, and nothing is
+  // written, moved, deleted or materialized here.
+  //
+  // A source with no recorded conversation is left EXACTLY as it is (today's fresh-launch
+  // behavior): forcing `--resume` onto a metadata-only stub is what the CLI answers with
+  // "No conversation found". The field is private to this worker spec, so an ordinary
+  // create/restore caller -- which never sets it -- cannot reach this block at all.
+  if (agentType === 'claude' && spec.claudeResumeThreadId !== undefined) {
+    const canonicalThreadId = String(spec.claudeResumeThreadId || '').trim();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(canonicalThreadId)) {
+      const error = new TypeError('spec.claudeResumeThreadId must be the canonical Claude thread id');
+      error.code = 'launch_claude_resume_target_invalid';
+      throw error;
+    }
+    const canonicalTranscript = findClaudeResumeTranscript({
+      resumeId: canonicalThreadId,
+      jsonlPath: metadata.resumeAgent?.jsonl_path || metadata.resolved?.jsonl_path || '',
+      homeDir,
+      claudeConfigDir: env.CLAUDE_CONFIG_DIR || spec.claudeConfigDir,
+    });
+    if (canonicalTranscript && transcriptHasConversation(canonicalTranscript.path)) {
+      const normalized = ensureClaudeResumeTarget(args, canonicalThreadId);
+      if (!normalized.ok) {
+        const error = new TypeError(`the recorded Claude launch arguments cannot name the canonical thread: ${normalized.reason}`);
+        error.code = normalized.reason;
+        throw error;
+      }
+      args = normalized.args;
+    }
+  }
   resumeResolution = resolveResumeAlias(agentType, args, metadata);
   args = resumeResolution.args;
   resume = resumeResolution.resume;

package/template/coding-task-manager/lib/lead-model-switch-runtime.js

@@ -217,6 +217,13 @@ function createLeadTransitionTargetPlanner(deps = {}) {
     const cwd = task.cwd || session.cwd || '';
     const agentType = detectAgentType(cmd);
     const resume = extractResumeTarget(agentType, args);
+    // D-2 (docs/claude-routed-native-history-resume-2026-10-24.html §5 D-2, §6): a Claude target
+    // launch must name the canonical SOURCE thread -- never an old startup/parent selector still
+    // sitting in the recorded argv -- so the canonical owner's own provider thread is what the
+    // metadata read is keyed by, and the private spec field below is what the launch-plan worker
+    // classifies/normalizes against. Both are derived ONLY here, after the canonical source proof
+    // below; no client/API caller and no ordinary create/restore caller sets either.
+    const canonicalThreadId = String(source?.providerThreadId || '');
     // The canonical SOURCE proof: the injected model runtime's owner must name THIS session, agent and
     // provider thread at exactly the submitted generation — generation 0 included. A missing owner is
     // refused here, BEFORE any reservation, metadata read or plan.
@@ -241,12 +248,19 @@ function createLeadTransitionTargetPlanner(deps = {}) {
     const generation = reserved.generation;
     const launchMetadata = await runReadPoolOp('readLaunchMetadata', {
       dbPath: dbModule.getDbPath(), baseDbPath: dbModule.getDbPath(), sessionId,
-      resumeId: resume?.sessionId || '', telemetryReason: 'lead-transition-target-preflight',
+      resumeId: agentType === 'claude' ? canonicalThreadId : (resume?.sessionId || ''),
+      telemetryReason: 'lead-transition-target-preflight',
     }, { timeoutMs: 10_000, signal });
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     cacheSessionOwnershipProjection(sessionId, launchMetadata?.resolved || launchMetadata || null);
     const mcpProfile = sessionMcpProfileSetting(task);
-    const warmPlanInputs = await launchPlanWarmInputs({ agentType, cwd, launchMetadata, mcpProfile });
+    // Only Codex gathers warm-plan inputs. A Claude model-target preparation opts out of that cache
+    // entirely, because its key (transcript freshness, cwd, codex config, CLI stamp) cannot describe
+    // the same-thread resume operation below -- and a value that is computed only to be discarded
+    // would still cost the read.
+    const warmPlanInputs = agentType === 'codex'
+      ? await launchPlanWarmInputs({ agentType, cwd, launchMetadata, mcpProfile })
+      : null;
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     const capturedLaunch = session._modelTransitionLaunchContext || {};
     const launchHomeDir = session._launchEnvOverrides?.HOME || capturedLaunch.homeDir || serverConfig.HOME;
@@ -262,11 +276,36 @@ function createLeadTransitionTargetPlanner(deps = {}) {
       env: targetPlanEnv,
       homeDir: launchHomeDir, cliCacheFile: agentCliCacheFile, codexHome: launchCodexHome,
       codexTransportGuard: serverConfig.CTM_CODEX_MCP_TRANSPORT_GUARD !== '0', wallePort,
-      isRestore: true, launchMetadata, mcpProfile, warmPlanInputs, lane: 'interactive',
+      isRestore: true, launchMetadata, mcpProfile,
+      warmPlanInputs,
+      lane: 'interactive',
       transcriptTrashRoot: sessionTranscriptTrashRoot,
+      // PRIVATE internal argument (never persisted, never published, never accepted from a client):
+      // the canonical source thread the produced plan must resume. Only this planner sets it.
+      ...(agentType === 'claude' ? { claudeResumeThreadId: canonicalThreadId } : {}),
     });
     if (identityGone()) return { ok: false, reason: 'lead_source_generation_changed' };
     if (!result?.plan || Number(result.plan.generation) !== generation) return { ok: false, reason: 'lead_target_plan_unavailable' };
+    // D-2/D-3: the produced plan must still name the canonical thread in its argv AND in its resume
+    // metadata, and the two must AGREE about whether there is a resume target at all.
+    // `resolveResumeAlias` may re-resolve a Claude resume id out of the metadata row, so a plan that
+    // ends up on ANOTHER thread is refused here -- before the controller ever parks the source. Both
+    // absent is the legitimate native no-history fresh launch; exactly one absent is an inconsistent
+    // plan (an argv the launcher will act on that the metadata denies, or the reverse).
+    if (agentType === 'claude') {
+      // Same-harness guard: project config's applyToSpec may substitute the live Claude `cmd`, so a
+      // plan for ANOTHER harness (or a plan that does not name its harness at all) is refused here
+      // rather than being accepted as this planner's fresh/both-absent result.
+      if (result.plan.agentType !== 'claude') return { ok: false, reason: 'lead_target_harness_changed' };
+      const planArgs = Array.isArray(result.plan.args) ? result.plan.args : [];
+      const argvResume = extractResumeTarget('claude', planArgs);
+      const argvId = argvResume ? String(argvResume.sessionId || '') : '';
+      const metadataId = String(result.plan.resume?.sessionId || '');
+      if (!!argvId !== !!metadataId) return { ok: false, reason: 'lead_target_resume_inconsistent' };
+      if (argvId && (argvId !== canonicalThreadId || metadataId !== canonicalThreadId)) {
+        return { ok: false, reason: 'lead_target_resume_changed' };
+      }
+    }
     noteLaunchPlanReadinessGeneration(result.plan);
     return { ok: true, generation, launchPlan: result.plan, sourceGeneration };
   };
@@ -670,7 +709,10 @@ function createLeadModelSwitchRuntime(host) {
       const targetRecipe = {
         id: targetRecipeId, sessionId, providerThreadId: source.providerThreadId, harness,
         providerId: target.routeId || 'unknown', origin: target.routeId ? 'routed-proxy' : 'unknown',
-        controlAdapterVersion: target.routeId ? CODEX_CONTROL_ADAPTER : null,
+        // The marker names the Codex app-server conversion adapter. A Claude target -- routed or
+        // native -- has no conversion adapter at all, so recording the Codex one there would claim a
+        // conversion this operation never performs (same-harness native resume).
+        controlAdapterVersion: harness === 'codex-cli' && target.routeId ? CODEX_CONTROL_ADAPTER : null,
         programVersion: null, cyberAccessProgram: null,
         routeId: target.routeId || null,
         wireModelId: target.routeId ? (target.modelId || null) : null, processGeneration: targetPlan.generation,
@@ -758,6 +800,17 @@ function createLeadModelSwitchRuntime(host) {
         const rebound = require('./launch-model-override').ensureCodexResumeTarget(recoveryArgs, source.providerThreadId);
         if (!rebound.ok) return { ok: false, reason: rebound.reason };
         recoveryArgs = rebound.args;
+      } else if (source.agent === 'claude') {
+        // The SAME normalization for a native Claude source. A captured Claude argv may select its
+        // thread through `--resume` OR through an explicit `--session-id` (a fresh identity CTM
+        // injected at startup), and it may still carry that launch's own initial positional prompt.
+        // The existing pure normalizer produces exactly one canonical `--resume <source thread>`
+        // prefix: every permission/settings operand survives, while the selector that named the
+        // thread and the one-shot startup prompt do not -- so a rollback resumes the SAME
+        // conversation instead of replaying the original task as a new turn.
+        const rebound = require('./launch-model-override').ensureClaudeResumeTarget(recoveryArgs, source.providerThreadId);
+        if (!rebound.ok) return { ok: false, reason: rebound.reason };
+        recoveryArgs = rebound.args;
       }
       const selectedSourceThread = extractResumeTarget(source.agent, recoveryArgs)?.sessionId || '';
       if (selectedSourceThread !== sourceThreadId) return { ok: false, reason: 'source_launch_context_unavailable' };

package/template/coding-task-manager/lib/lead-model-switch.js

@@ -393,6 +393,7 @@ function createLeadModelSwitch(deps) {
       entry.recovered = !!result?.ok;
       if (!entry.recovered) {
         entry.req.recovery_reason = 'source_recovery_failed';
+        diagnostic(entry.req.ctm_session_id, 'lead-transition-source-recovery-failed', { reason: String(result?.reason || 'unknown').slice(0, 120) });
         const cause = entry.failureOutcome?.detail || 'The requested target was not applied.';
         entry.req.detail = `${cause} The captured source provider could not be restored.`;
       } else {
@@ -480,7 +481,7 @@ function createLeadModelSwitch(deps) {
       return refuse(409, 'client_request_conflict');
     }
     if (existing?.confirmationPromise) return refuse(409, 'lead_transition_committing', { request: publicRequest(existing.req) });
-    if (existing?.handoffStarted && !existing.recovered && ['cancelled', 'failed'].includes(existing.req.state)) {
+    if (existing?.handoffStarted && (existing.sourceParked || existing.targetStarted) && !existing.recovered && ['cancelled', 'failed'].includes(existing.req.state)) {
       return refuse(409, 'lead_switch_recovery_in_flight', { request: publicRequest(existing.req) });
     }
     if (existing?.req.state === 'awaiting_turn' && existing.handoffStarted && !existing.recovered) {
@@ -767,7 +768,7 @@ function createLeadModelSwitch(deps) {
         return refuse(500, 'lead_transition_persist_failed', { message: String(error?.message || error).slice(0, 200) });
       }
     }
-    if (providerTransition) {
+    if (providerTransition && info.agent !== 'claude') {
       if (!entry.transition) { requestControllers.delete(id); fail(entry, 'lead_transition_owner_unavailable', 'The transition owner is not available.'); return refuse(409, 'lead_transition_owner_unavailable'); }
       try {
         historyPreparation = await prepareHistory({

package/template/coding-task-manager/lib/lead-model-transition-store.js

@@ -261,11 +261,41 @@ function createLeadModelTransitionStore({
   const getActiveForSession = (ctmSessionId) => {
     const sessionId = String(ctmSessionId || '').trim();
     if (!sessionId || sessionId.length > 128) return null;
-    const row = getCoreDb().prepare(`SELECT transition_id FROM coding_model_transitions
+    const db = getCoreDb();
+    // An explicit CTM_DB_DOMAIN_SPLIT=0 boot never stamps v18, so the v49 journal is never
+    // created there. A journal that does not exist holds no active transition: answer that
+    // truthfully instead of throwing, which made every deferred restore on such a boot refuse
+    // with lead-transition-reconciliation-unavailable.
+    if (!db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type='table' AND name='coding_model_transitions'").get()) return null;
+    const row = db.prepare(`SELECT transition_id FROM coding_model_transitions
       WHERE ctm_session_id=? AND state IN ('queued','preparing','compacting','verified','handing_off','awaiting_turn')
       ORDER BY updated_at DESC, transition_id DESC LIMIT 1`).get(sessionId);
     return row ? get(row.transition_id) : null;
   };
+  // WP-1 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-3, §9 S-6): the journal
+  // reader the launch-time route reconciliation needs. `getActiveForSession` excludes terminal
+  // states, but the repair must find the fork a transition ACTUALLY launched even after it failed, so
+  // this reads ANY state, newest revision first, with the parsed target recipe beside the row
+  // identity. Read-only and bounded; a malformed recipe JSON is skipped, never surfaced.
+  const listForThread = (ctmSessionId, providerThreadId) => {
+    const sessionId = String(ctmSessionId || '').trim();
+    const threadId = String(providerThreadId || '').trim();
+    if (!sessionId || sessionId.length > 128 || !threadId || threadId.length > 512) return [];
+    const rows = getCoreDb().prepare(`SELECT transition_id, revision, state, target_recipe_json
+      FROM coding_model_transitions WHERE ctm_session_id = ? ORDER BY revision DESC, updated_at DESC, transition_id DESC`)
+      .all(sessionId);
+    const out = [];
+    for (const row of rows) {
+      let targetRecipe;
+      try { targetRecipe = JSON.parse(row.target_recipe_json); } catch { continue; /* expected: a corrupt recipe is not a route source */ }
+      out.push({
+        transition_id: row.transition_id, revision: Number(row.revision), state: row.state, target_recipe: targetRecipe,
+        provider_thread_id: targetRecipe?.providerThreadId || null, route_id: targetRecipe?.routeId || null,
+        model: targetRecipe?.wireModelId || null, harness: targetRecipe?.harness || null,
+      });
+    }
+    return out;
+  };
   function saveProfile(profile = {}) {
     const allowed = new Set(['fingerprint', 'harness', 'cliVersion', 'adapterVersion', 'deployment', 'artifactPath', 'evidenceReceipt']);
     if (Object.keys(profile).some((key) => !allowed.has(key))) throw new TypeError('profile contains an unapproved field');
@@ -690,11 +720,39 @@ function createLeadModelTransitionStore({
     if (!row) return null;
     try { return { ...row, bindings: JSON.parse(row.bindings_json) }; } catch { return null; }
   }
-  return { get, getActiveForSession, getStagedToken, saveProfile, begin, advance, commit, stageToken, recordFork, clearStagedToken };
+  return { get, getActiveForSession, listForThread, getStagedToken, saveProfile, begin, advance, commit, stageToken, recordFork, clearStagedToken };
 }
 
 // `validateRecipe` is exported so the approved-intent store can reuse the ONE complete bounded
 // journal recipe validation instead of keeping a parallel whitelist that silently drops (or refuses)
 // the real producer's provider/context metadata. This module imports only the PURE intent contract,
 // so the store importing this export introduces no construction cycle.
-module.exports = { ACTIVE_STATES, createLeadModelTransitionStore, validateRecipe };
+// The provider thread of a FORK the session's active transition is still trying, or null. Until
+// commit() moves the startup pointer, that thread is a candidate: the startup row keeps the source so
+// a cold start before the first confirmed target turn resumes the source. Every startup-pointer writer
+// (db.js updateStartupTaskAgentSession) asks this on the same handle, inside its own transaction.
+function activeCandidateForkThread(db, ctmSessionId) {
+  // A core schema without the journal (pre-migration fixtures) has no transitions, so no candidate.
+  if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='coding_model_transitions'").get()) return null;
+  const row = db.prepare(`SELECT source_recipe_json, target_recipe_json FROM coding_model_transitions
+    WHERE ctm_session_id=? AND state IN (${[...ACTIVE_STATES].map(() => '?').join(',')})
+    ORDER BY updated_at DESC, transition_id DESC LIMIT 1`).get(String(ctmSessionId || ''), ...ACTIVE_STATES);
+  if (!row) return null;
+  let source, target;
+  try { source = JSON.parse(row.source_recipe_json); target = JSON.parse(row.target_recipe_json); }
+  catch { return null; } // expected: a malformed journal row is refused by every transition reader; it names no candidate
+  const thread = String(target?.providerThreadId || '');
+  return thread && thread !== String(source?.providerThreadId || '') ? thread : null;
+}
+
+// The startup-pointer writers' guard (db.js updateStartupTaskAgentSession). Live: a fork relaunch wrote
+// `resume <target>` and the commit then refused "startup task does not point at the captured source
+// provider thread".
+function resumesCandidateFork(db, ctmSessionId, resumeArgs) {
+  const candidate = Array.isArray(resumeArgs) ? activeCandidateForkThread(db, ctmSessionId) : null;
+  if (!candidate || !resumeArgs.some((arg) => String(arg) === candidate)) return false;
+  console.warn(`[startup-task] kept the source pointer for ${String(ctmSessionId).slice(0, 8)}: ${candidate.slice(0, 8)} is an uncommitted fork`);
+  return true;
+}
+
+module.exports = { ACTIVE_STATES, createLeadModelTransitionStore, validateRecipe, activeCandidateForkThread, resumesCandidateFork };

package/template/coding-task-manager/lib/legacy-draft-cancellation-recovery.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const path = require('node:path');
+const { createMediaJournalControlReader } = require('./media-journal-control-reader');
+
+function unavailable(cause) {
+  return Object.assign(new Error('Pending image cancellation recovery is unavailable', { cause }), {
+    code: 'CTM_MEDIA_JOURNAL_UNAVAILABLE',
+  });
+}
+
+// One recovery scope per logical DB handle and journal directory. No new SQL owner: the caller
+// supplies the same worker projector used by the write-behind store. Neither journal nor cursor
+// is advanced, because unrelated content must remain available to its ordinary replay owner.
+function createLegacyDraftCancellationRecovery({ getDirectory, getContext, projectEntry }) {
+  for (const callback of [getDirectory, getContext, projectEntry]) {
+    if (typeof callback !== 'function') throw new TypeError('Cancellation recovery requires callbacks');
+  }
+  let scope = null;
+  let operation = null;
+  let retired = false;
+  let closing = null;
+
+  function binding() {
+    const context = getContext();
+    const directory = getDirectory();
+    if (!context || !directory) throw new Error('Cancellation recovery has no open storage context');
+    return { context, directory: path.resolve(directory) };
+  }
+
+  function assertCurrent(owner) {
+    if (retired || owner !== scope) throw new Error('Cancellation recovery scope is retired');
+    const current = binding();
+    if (current.context !== owner.context || current.directory !== owner.directory) {
+      throw new Error('Cancellation recovery storage context changed');
+    }
+  }
+
+  async function closeReader(owner) {
+    if (!owner?.reader) return;
+    await owner.reader.close();
+    owner.reader = null; // Retain an unconfirmed resource owner on failure, not just its descriptor.
+  }
+
+  async function recover(current) {
+    await closeReader(scope);
+    const owner = scope = { ...current, reader: null, ready: false };
+    assertCurrent(owner);
+    const reader = owner.reader = createMediaJournalControlReader({
+      directory: owner.directory, assertCurrent: () => assertCurrent(owner),
+    });
+    let records;
+    let failed = false;
+    let failure;
+    try { records = await reader.read(); }
+    catch (error) { failed = true; failure = error; }
+    try { await closeReader(owner); }
+    catch (error) {
+      throw failed
+        ? new AggregateError([failure, error], 'Cancellation recovery and reader cleanup failed', { cause: failure })
+        : error;
+    }
+    if (failed) throw failure;
+    // Close every read handle BEFORE the first SQL projection. A partial projection remains
+    // idempotently retryable through applyMediaJournalEntry; it is never a completed recovery.
+    for (const { entry } of records) {
+      assertCurrent(owner);
+      const result = await projectEntry(entry, { urgent: true });
+      assertCurrent(owner);
+      if (typeof result?.cancelled !== 'boolean' || typeof result?.sessionEnded !== 'boolean'
+          || result.cancelled === result.sessionEnded) {
+        throw new TypeError('Cancellation projection did not confirm a durable cancellation or ended session');
+      }
+    }
+    assertCurrent(owner);
+    owner.ready = true;
+  }
+
+  function prepare() {
+    try {
+      if (retired) throw new Error('Cancellation recovery is closed');
+      const current = binding();
+      if (operation) return operation;
+      if (scope?.ready && scope.context === current.context && scope.directory === current.directory) {
+        return Promise.resolve();
+      }
+      operation = recover(current).catch(error => { throw unavailable(error); })
+        .finally(() => { operation = null; });
+      return operation;
+    } catch (error) {
+      return Promise.reject(unavailable(error));
+    }
+  }
+
+  function close() {
+    retired = true;
+    if (closing) return closing;
+    closing = (async () => {
+      // Already delivered operational errors are not shutdown failures. Unconfirmed handles
+      // remain owned and closeReader must still report them. No race against a timeout here.
+      if (operation) await operation.catch(() => { /* expected: admitted caller receives the failure */ });
+      await closeReader(scope);
+      scope = null;
+    })().finally(() => { closing = null; });
+    return closing;
+  }
+
+  return { prepare, close };
+}
+
+module.exports = { createLegacyDraftCancellationRecovery };

package/template/coding-task-manager/lib/login-tripwire.js

@@ -187,6 +187,7 @@ function armSessionLoginTripwire({ proc, env, onBlocked } = {}) {
 module.exports = {
   LOGIN_PATTERNS,
   WINDOW_CHARS,
+  stripAnsi,
   createLoginTripwire,
   attachToPty,
   armSessionLoginTripwire,