create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/root-prompt-flow.js

@@ -10,7 +10,7 @@ const {
   createRootDeliveryRuntime, getRootDeliveryJobLifetime, isRootDeliveryJobLifetimeCurrent,
 } = require('./root-delivery-runtime');
 const { ROOT_PROMPT_ACTION } = require('./remote-command-purpose');
-const { selectRootDeliveryAttempt } = require('./root-delivery-selection');
+const { selectRootDeliveryAttempt, selectRootDeliveryRecovery } = require('./root-delivery-selection');
 const promptAdmissionTrace = require('./prompt-admission-trace');
 
 const TERMINAL_STATUSES = new Set([
@@ -19,6 +19,49 @@ const TERMINAL_STATUSES = new Set([
 const PREFLIGHT_RETRYABLE = new Set([
   'session_input_in_flight', 'session_resume_not_ready', 'command_deferred_until_idle',
 ]);
+const PREFLIGHT_USER_ACTION = new Set(['session_not_live', 'session_waiting_for_approval']);
+// WP-0 (queue-delivery-recovery): one wording per recovery action, so the persisted
+// row, the broadcast frame and the direct reply cannot describe the same verdict
+// differently. Both describe the preserved prompt and the action the user owns;
+// neither claims the prompt was not sent while its effect is unknown.
+const RESEND_MESSAGE = 'Your prompt is saved and was not sent. Choose Resend to try again.';
+const REVIEW_MESSAGE = 'CTM could not safely confirm this desktop delivery. Review the submission before resending.';
+const SAFE_DIAGNOSTIC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+
+function safeDiagnosticId(value) {
+  return typeof value === 'string' && SAFE_DIAGNOSTIC_ID_RE.test(value) ? value : '';
+}
+
+// WP-0: what a cached (restart-surviving) parent row plus its scoped delivery
+// receipts prove about the prompt, and the exact action the user owns. Delegates
+// the proof rules to root-delivery-selection so read evidence and classification
+// cannot drift; anything uncertified stays `unknown`/`review`.
+function classifyReplayRecovery(snapshot) {
+  const verdict = selectRootDeliveryRecovery(snapshot);
+  if (verdict.deliveryState === 'sent') {
+    const recorded = String(snapshot?.parent?.status || '');
+    return Object.freeze({
+      recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+      reason: '', // Canonical Root confirmation stores 'sent' for provider_transcript_match.
+      terminalStatus: recorded === 'sent' ? 'durable_user_message_seen' : recorded,
+    });
+  }
+  if (verdict.recoveryAction === 'resend') {
+    // The certified no-effect proof names the exact earlier blocker; keep that
+    // specific reason instead of flattening it to the generic refusal code.
+    const blocker = snapshot?.latest?.result?.result?.delivery_evidence?.blocker;
+    const specific = typeof blocker === 'string'
+      && (PREFLIGHT_RETRYABLE.has(blocker) || PREFLIGHT_USER_ACTION.has(blocker)) ? blocker : '';
+    return Object.freeze({
+      recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+      reason: specific, terminalStatus: '',
+    });
+  }
+  return Object.freeze({
+    recoveryAction: verdict.recoveryAction, deliveryState: verdict.deliveryState,
+    reason: '', terminalStatus: '',
+  });
+}
 const SAFE_DIAGNOSTIC_ERROR_KINDS = new Set(['ReferenceError', 'TypeError', 'RangeError', 'SqliteError', 'Error']);
 const SAFE_DIAGNOSTIC_SOURCE_FILES = new Set([
   'root-prompt-admission.js', 'remote-relay-store.js', 'server.js', 'main-db-census.js',
@@ -50,6 +93,7 @@ function safeResult(response, publicId, sessionId, fallbackSource = 'unknown') {
       reason: mapped.reason,
       source: mapped.source,
       retryable: mapped.retryable,
+      recoveryAction: mapped.recoveryAction,
       ...(mapped.message ? { message: mapped.message } : {}),
       ...(detail.duplicate === true || response?.duplicate === true ? { duplicate: true } : {}),
       ...(detail.retrying === true || response?.retrying === true ? { retrying: true } : {}),
@@ -69,6 +113,7 @@ function safeResult(response, publicId, sessionId, fallbackSource = 'unknown') {
     reason: mapped.reason,
     source: mapped.source,
     retryable: mapped.retryable,
+    recoveryAction: mapped.recoveryAction,
     ...(mapped.message ? { message: mapped.message } : {}),
     ...(Number.isInteger(httpStatus) && httpStatus >= 400 && httpStatus <= 599 ? { httpStatus } : {}),
   };
@@ -95,6 +140,11 @@ function createRootPromptFlow(deps = {}) {
   const observerLifetimes = new WeakMap();
   const sessionDrains = new WeakMap();
   const httpRequestScopes = new WeakMap();
+  // WP-0: the normalized session/client-message correlation for the operation
+  // currently running on a captured scope, so every diagnostic that scope emits
+  // (admission, driver, delivery stage, replay recovery) can be joined to the one
+  // user-visible submission. Both values are bounded ids, never receipt ids.
+  const scopeCorrelation = new WeakMap();
 
   function registryFor(db) {
     let registry = registries.get(db);
@@ -121,6 +171,9 @@ function createRootPromptFlow(deps = {}) {
   function reportFailure(scope, phase, code, details = {}) {
     if (!scope?.isCurrent()) return;
     const event = { category: 'root-prompt-flow', phase, code };
+    const correlation = scopeCorrelation.get(scope);
+    if (correlation?.sessionId) event.sessionId = correlation.sessionId;
+    if (correlation?.clientMessageId) event.clientMessageId = correlation.clientMessageId;
     for (const key of ['returnedRecordConfirmed', 'canonicalRecordConfirmed', 'recordFieldsMatch']) {
       if (typeof details[key] === 'boolean') event[key] = details[key];
     }
@@ -183,6 +236,11 @@ function createRootPromptFlow(deps = {}) {
       },
       isDeliveryCurrent: (_handle, metadata) => scope.isCurrent() === true && now() < metadata.expiresAt,
       now,
+      // WP-0 criterion 6: the driver reports the exact rejected handoff stage
+      // (delivery_snapshot / delivery_text / delivery_selection / delivery_dispatch /
+      // admission_metadata) with a static code. reportFailure bounds the event and
+      // swallows a throwing sink, so diagnostics can never change an outcome.
+      reportDiagnostic: (event) => reportFailure(scope, event?.phase, event?.code, {}),
     });
   }
 
@@ -231,14 +289,18 @@ function createRootPromptFlow(deps = {}) {
       {
         retire(registry, job);
         if (job.scope.isCurrent()) {
+          // WP-0 criterion 7: the certificate is gone without a completion proof,
+          // so the effect of this prompt is UNKNOWN. Say so, and keep the
+          // conservative review action rather than claiming nothing was sent.
+          const expired = code === 'root_delivery_expired';
           try {
             await storeStatus(job.sessionId, job.receiptId, 'needs_attention', {
-              reason: code === 'root_delivery_expired'
-                ? code : 'root_job_unresolved',
+              reason: expired ? code : 'root_job_unresolved',
               retryable: false,
-              message: code === 'root_delivery_expired'
-                ? 'The desktop delivery permission expired. Resend this prompt to try again.'
-                : 'CTM could not safely confirm this desktop delivery. Review the submission and resend if needed.',
+              recoveryAction: 'review',
+              message: expired
+                ? 'The desktop delivery permission expired before CTM could confirm this delivery. Review the submission before resending.'
+                : REVIEW_MESSAGE,
               source: job.source,
             });
           } catch { reportFailure(job.scope, 'publish_unresolved', 'status_write_failed'); }
@@ -322,6 +384,11 @@ function createRootPromptFlow(deps = {}) {
     const scope = operationScope || commandRuntime.captureRootPromptCoordinator();
     if (!scope || !requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
     const publicId = agentSessionKernel.normalizeClientMessageId(options.clientMessageId);
+    // WP-0: correlate every diagnostic this operation emits with its normalized
+    // session/client-message identity (bounded ids only -- never a receipt id).
+    scopeCorrelation.set(scope, {
+      sessionId: safeDiagnosticId(sessionId), clientMessageId: safeDiagnosticId(publicId),
+    });
     const authState = { auth: null, namespace: null };
     const freshContext = transportKind === 'ws'
       ? (socket, namespace) => commandRuntime.freshRootPromptContext(socket, namespace)
@@ -384,6 +451,15 @@ function createRootPromptFlow(deps = {}) {
             driver, writeActive: true, autoPending: true, inFlight: false, lastResult: null,
           };
           registry.set(receiptId, job);
+        } else {
+          // WP-0 criterion 4: a committed admission whose delivery facade cannot be
+          // registered is a typed handoff failure, never a silent acceptance. The
+          // committed historical record is left exactly as it is.
+          reportFailure(scope, 'driver_registration', 'root_driver_registration_unavailable');
+          admitted = { ...admitted, response: { ...denial('root_driver_registration_unavailable', 503),
+            recoveryAction: 'resend',
+            message: 'CTM saved your prompt but could not start delivery. Resend to try again.',
+          } };
         }
       }
       if (job) {
@@ -393,37 +469,86 @@ function createRootPromptFlow(deps = {}) {
         void firstDrive.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
       }
     } else if (admitted?.response?.ok === true) {
-      // A cached parent is not a process-local write marker. Never adopt it after restart.
+      // A cached parent is not a process-local write marker. Never adopt it after
+      // restart, and never answer with its cached acceptance: a reply is truthful
+      // only when this process holds the job, or when a scoped read proves what
+      // actually happened to the prompt.
       let context = null;
+      let contextFailed = false;
       try { context = await freshContext(client, null); }
-      catch { reportFailure(scope, 'drive', 'unexpected_failure'); }
-      if (context?.ok && requestCurrent(scope, current)) {
-        const receiptId = remoteCommandStore.remoteCommandReceiptId(context.namespace.namespaceHash, publicId);
-        const resident = registry.get(receiptId);
-        let requestedIntentHash = '';
+      catch { contextFailed = true; }
+      if (!contextFailed && (!context?.ok || !requestCurrent(scope, current))) contextFailed = true;
+      if (contextFailed) {
+        // WP-0 criterion 4: no current authority and no proof -- refuse, never
+        // fall through to the cached `received`/`accepted` response.
+        reportFailure(scope, 'replay_recovery', 'root_replay_context_unavailable');
+        return denial(context?.code || 'remote_command_auth_unavailable', context?.status || 503);
+      }
+      const receiptId = remoteCommandStore.remoteCommandReceiptId(context.namespace.namespaceHash, publicId);
+      const resident = registry.get(receiptId);
+      let requestedIntentHash = '';
+      try {
+        const intentHandle = rootPromptIntent.captureRootPromptIntent({
+          sessionId, text, source: options.source, attachments: options.attachments,
+        }, { maxPromptBytes });
+        requestedIntentHash = intentHandle.body.intent_hash;
+      } catch { requestedIntentHash = ''; reportFailure(scope, 'replay_recovery', 'root_replay_intent_unavailable'); }
+      const residentProof = resident && getCommittedRootAdmission(resident.admissionHandle);
+      if (resident?.writeActive && now() < resident.expiresAt && resident.scope.isCurrent()
+          && residentProof?.selector?.sessionId === sessionId
+          && residentProof.selector.namespaceHash === context.namespace.namespaceHash
+          && residentProof.selector.intentHash === requestedIntentHash) {
+        // A same-id manual retry with a live local job keeps the existing child
+        // selection semantics; no read evidence is consulted for it.
+        job = resident;
+        const retry = driveJob(registry, resident, false);
+        void retry.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
+      } else {
+        // WP-0 criterion 3: the delivery permission is gone (restart, lost
+        // registry). Ask the scoped store what the prompt's own receipts prove --
+        // authenticated namespace + session + command id + a freshly captured
+        // intent hash -- and recheck the request scope after every await.
+        let snapshot = null;
+        let readFailed = false;
         try {
-          const intentHandle = rootPromptIntent.captureRootPromptIntent({
-            sessionId, text, source: options.source, attachments: options.attachments,
-          }, { maxPromptBytes });
-          requestedIntentHash = intentHandle.body.intent_hash;
-        } catch { requestedIntentHash = ''; reportFailure(scope, 'drive', 'unexpected_failure'); }
-        const residentProof = resident && getCommittedRootAdmission(resident.admissionHandle);
-        if (resident?.writeActive && now() < resident.expiresAt && resident.scope.isCurrent()
-            && residentProof?.selector?.sessionId === sessionId
-            && residentProof.selector.namespaceHash === context.namespace.namespaceHash
-            && residentProof.selector.intentHash === requestedIntentHash) {
-          job = resident;
-          const retry = driveJob(registry, resident, false);
-          void retry.catch(() => reportFailure(scope, 'drive', 'unexpected_failure'));
+          snapshot = await runReadPoolOp('getLatestRootJobDeliveryReceipt', {
+            dbPath: scope.dbPath,
+            selector: {
+              namespaceHash: context.namespace.namespaceHash, commandId: publicId,
+              instanceId: scope.instanceId, sessionId, intentHash: requestedIntentHash,
+            },
+          }, { telemetryReason: 'root-prompt-replay-recovery' });
+        } catch { readFailed = true; }
+        if (!requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
+        if (readFailed) reportFailure(scope, 'replay_recovery', 'root_delivery_replay_unavailable');
+        const proof = classifyReplayRecovery(readFailed ? null : snapshot);
+        if (proof.deliveryState === 'sent') {
+          // Read evidence proves the prompt was already delivered: report the
+          // recorded sent signal as a duplicate. No new delivery, no new
+          // authority, and the preserved row is not downgraded.
+          admitted = { ...admitted, response: {
+            ok: true, status: proof.terminalStatus, duplicate: true,
+            source: options.source || 'web',
+          } };
         } else {
+          const action = proof.recoveryAction === 'resend' ? 'resend' : 'review';
+          const status = action === 'resend' ? 'needs_attention' : 'blocked';
+          const details = {
+            reason: proof.reason || 'root_job_unresolved', retryable: false,
+            recoveryAction: action,
+            message: action === 'resend' ? RESEND_MESSAGE : REVIEW_MESSAGE,
+            source: options.source || 'web',
+          };
+          reportFailure(scope, 'replay_recovery', 'root_job_unresolved');
           try {
-            await storeStatus(sessionId, receiptId, 'needs_attention', {
-              reason: 'root_job_unresolved', retryable: false,
-              message: 'The original desktop delivery permission is unavailable. Resend this prompt to try again.',
-              source: options.source || 'web',
-            });
+            await storeStatus(sessionId, receiptId, status, details);
           } catch { reportFailure(scope, 'proof_loss_status', 'status_write_failed'); }
-          admitted = { ...admitted, response: denial('root_job_unresolved', 409) };
+          if (!requestCurrent(scope, current)) return denial('remote_command_auth_unavailable');
+          admitted = { ...admitted, response: {
+            ok: false, status, code: 'root_job_unresolved', httpStatus: 409,
+            reason: details.reason, message: details.message, retryable: false,
+            recoveryAction: action, source: details.source,
+          } };
         }
       }
     }
@@ -446,6 +571,7 @@ function createRootPromptFlow(deps = {}) {
           type: 'submit-prompt-status', id: sessionId, clientMessageId: publicId,
           status: safe.status, signal: safe.signal, reason: safe.reason, source: safe.source,
           code: safe.code || '', retryable: safe.retryable === true,
+          recoveryAction: safe.recoveryAction || 'none',
           ...(safe.message ? { message: safe.message } : {}),
         };
         try { sendWsJson(client, frame); } catch { reportFailure(scope, 'status_reply', 'socket_write_failed'); }
@@ -506,6 +632,7 @@ function createRootPromptFlow(deps = {}) {
     const scope = capturedScope || commandRuntime.captureRootPromptCoordinator();
     if (!scope || (databaseHandle && scope.databaseHandle !== databaseHandle)
         || (instanceId && scope.instanceId !== instanceId) || !scope.isCurrent()) return 0;
+    scopeCorrelation.set(scope, { sessionId: safeDiagnosticId(sessionId) });
     let rows;
     try { rows = remoteRelayStore.listRemoteSubmissions(scope.databaseHandle, { sessionId, limit: 200 }); }
     catch { return 0; }
@@ -527,7 +654,12 @@ function createRootPromptFlow(deps = {}) {
       if (!scope.isCurrent()) break;
       const details = {
         reason: 'root_job_unresolved', retryable: false,
-        message: 'The original desktop delivery permission is unavailable. Resend this prompt to try again.',
+        // WP-0 criterion 7: a missing process-local marker is not proof that the
+        // prompt was never sent (a restart can lose the marker after delivery).
+        // Only a scoped no-effect certificate would justify "resend"; none is
+        // reachable from a bare durable row, so the action is review.
+        recoveryAction: 'review',
+        message: REVIEW_MESSAGE,
         source: row.result?.source || 'web',
       };
       try {
@@ -551,6 +683,7 @@ function createRootPromptFlow(deps = {}) {
     if (!id) return { driven: 0, escalated: 0 };
     const scope = commandRuntime.captureRootPromptCoordinator();
     if (!scope || !scope.isCurrent()) return { driven: 0, escalated: 0 };
+    scopeCorrelation.set(scope, { sessionId: safeDiagnosticId(id) });
     const registry = registryFor(scope.databaseHandle);
     const inFlight = sessionDrains.get(scope.databaseHandle) || new Set();
     if (!sessionDrains.has(scope.databaseHandle)) sessionDrains.set(scope.databaseHandle, inFlight);
@@ -569,7 +702,8 @@ function createRootPromptFlow(deps = {}) {
           try {
             await storeStatus(job.sessionId, job.receiptId, 'needs_attention', {
               reason: 'root_delivery_expired', retryable: false,
-              message: 'The desktop delivery permission expired. Resend this prompt to try again.',
+              recoveryAction: 'review',
+              message: 'The desktop delivery permission expired before CTM could confirm this delivery. Review the submission before resending.',
             });
           } catch { reportFailure(job.scope, 'expiry_status', 'status_write_failed'); }
           continue;

package/template/coding-task-manager/lib/scrollback-archive-store.js

@@ -103,6 +103,8 @@ function createScrollbackArchive(options = {}) {
   const flushMs = options.flushMs !== undefined && Number.isFinite(Number(options.flushMs))
     ? Number(options.flushMs)
     : ARCHIVE_FLUSH_MS;
+  // Test seam, like `now`: a test drives ticks itself instead of waiting on the wall clock.
+  const scheduleInterval = typeof options.setInterval === 'function' ? options.setInterval : setInterval;
   const pendingMaxRows = Math.max(1, Number(options.pendingMaxRows) || ARCHIVE_PENDING_MAX_ROWS);
   const pendingMaxBytes = Math.max(1, Number(options.pendingMaxBytes) || ARCHIVE_PENDING_MAX_BYTES);
   const blockBytes = Math.max(1, Number(options.blockBytes) || DEFAULT_BLOCK_BYTES);
@@ -525,12 +527,12 @@ function createScrollbackArchive(options = {}) {
 
   function _scheduleTimer() {
     if (timer || flushMs <= 0) return;
-    timer = setInterval(() => {
+    const tick = () => {
       // A slow async tick skips re-entry; the next tick resumes round-robin order.
-      if (tickInFlight) return;
+      if (tickInFlight) return null;
       tickInFlight = true;
       const ids = Array.from(sessions.keys());
-      (async () => {
+      return (async () => {
         // 1) Write buffered appends for every session -- cheap, one appendFile
         //    per session's active bucket, no gzip involved.
         for (const id of ids) {
@@ -561,7 +563,8 @@ function createScrollbackArchive(options = {}) {
       })()
         .catch(() => { /* expected: the background timer tick itself must never throw -- every step inside already catches its own failures; this is the final backstop */ })
         .finally(() => { tickInFlight = false; });
-    }, flushMs);
+    };
+    timer = scheduleInterval(tick, flushMs);
     if (typeof timer.unref === 'function') timer.unref();
   }
 

package/template/coding-task-manager/lib/session-analysis-memory.js

@@ -322,6 +322,8 @@ function loadCodingJournalOutcomes(sessionIds, options = {}) {
                  archived_at, consolidated_at, extraction_status
             FROM memories INDEXED BY idx_memories_session_summary
            WHERE archived_at IS NULL
+             AND source IN ('walle-coding', 'walle-diary')
+             AND memory_type IN ('coding_journal', 'coding_journal_segment', 'agent_diary')
              AND source = 'walle-coding'
              AND memory_type = 'coding_journal'
              AND subject IN (${placeholders})

package/template/coding-task-manager/lib/session-create/codex-native-provider-gate.js

@@ -0,0 +1,218 @@
+'use strict';
+
+// WP-1 — docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-1..D-4, §6.
+//
+// The incident this closes: a Codex LEAD is launched natively with startup args `["resume", T]` and
+// NO `session_lead_route` row. Codex 0.163's `thread/resume` injects the thread's own stored
+// provider (`$CODEX_HOME/state_5.sqlite` -> threads.model_provider, e.g. `ctm-lead`) into its config
+// load, which then fails "Model provider `ctm-lead` not found" -> exit 1 -> the 3-restart budget
+// burns 50 s and the session ends blocked with a message that says nothing about the cause.
+//
+// D-1: the provider a spawned Codex process loads is CTM's decision (the route row), never the
+// string in the thread. D-2: that string is read ONLY to decide whether a NATIVE launch can
+// succeed. So before a native spawn this gate asks: is the thread's stored provider one a native
+// `codex` config load resolves (its built-ins ∪ the user `[model_providers]` table)? If not, the
+// launch is either repaired from CTM's own transition journal (D-3, the same row the commit would
+// have written) or refused deterministically before any PTY exists (D-4) — never spawned to die.
+//
+// Nothing here is flag-gated, and nothing here spawns a process: reading the state row is a single
+// readonly SQLite lookup and the rollout fallback only reads the file's first line.
+
+const path = require('node:path');
+const { getCodexStateThreadById, readCodexRolloutMetadata } = require('../session-history');
+const codexConfigGuard = require('../codex-config-guard');
+
+// codex-rs/core/src/config/mod.rs built_in_model_providers(); `openai` is the default when unset.
+const NATIVE_BUILTIN_PROVIDERS = Object.freeze(['openai', 'ollama', 'lmstudio', 'amazon-bedrock']);
+
+// The route/model columns `session_lead_route` accepts (lib/storage/session-lead-route-store.js).
+const MAX_ROUTE_FIELD_LENGTH = 200;
+
+/**
+ * Read the provider a native `codex resume <threadId>` would load for this thread.
+ *
+ * Order is the authority order Codex itself uses (D-2 decision table): the state DB row wins — it
+ * is what `thread/resume` reads — then the rollout's own `session_meta.model_provider`, then the
+ * built-in default. `codexHome` is the CODEX_HOME directory the launch uses; the state DB lookup
+ * takes the HOME it derives `<HOME>/.codex` from, so `homeDir` may be passed explicitly and is
+ * otherwise taken to be `codexHome`'s parent.
+ *
+ * @returns {{ provider: string, source: 'state_db'|'rollout'|'default', rolloutPath: string|null }}
+ */
+function readCodexThreadProvider({ threadId, codexHome = null, homeDir, rolloutPath = null,
+  getStateThread = getCodexStateThreadById, readRolloutMeta = readCodexRolloutMetadata } = {}) {
+  const id = String(threadId || '').trim();
+  const fallbackPath = rolloutPath ? String(rolloutPath) : null;
+  if (!id) return { provider: 'openai', source: 'default', rolloutPath: fallbackPath };
+  const resolvedHome = homeDir !== undefined && homeDir !== null
+    ? homeDir
+    : (codexHome ? path.dirname(String(codexHome)) : undefined);
+  let row = null;
+  try {
+    row = getStateThread(id, resolvedHome) || null;
+  } catch {
+    row = null; /* expected: a corrupt/unreadable state DB degrades to the rollout fallback (D-2) */
+  }
+  const stateProvider = String(row?.model_provider || '').trim();
+  const stateRolloutPath = String(row?.rollout_path || '').trim();
+  if (stateProvider) {
+    return { provider: stateProvider, source: 'state_db', rolloutPath: stateRolloutPath || fallbackPath };
+  }
+  const file = stateRolloutPath || fallbackPath;
+  if (file) {
+    let meta = null;
+    try {
+      meta = readRolloutMeta(file) || null;
+    } catch {
+      meta = null; /* expected: a missing/malformed rollout is not a provider source (D-2) */
+    }
+    const rolloutProvider = String(meta?.model_provider || '').trim();
+    if (rolloutProvider) return { provider: rolloutProvider, source: 'rollout', rolloutPath: file };
+  }
+  return { provider: 'openai', source: 'default', rolloutPath: file || null };
+}
+
+/**
+ * Decide whether a NATIVE spawn can serve this thread (D-2).
+ * native === true iff provider ∈ NATIVE_BUILTIN_PROVIDERS ∪ keys(config.toml[model_providers]).
+ *
+ * @returns {{ native: boolean, provider: string, source: string, configProviders: string[] }}
+ */
+function classifyCodexThreadProvider({ provider, source = '', codexHome = null,
+  readConfigToml = codexConfigGuard.readModelProviderKeys } = {}) {
+  const id = String(provider || '').trim();
+  let configProviders = [];
+  try {
+    const listed = readConfigToml(codexHome);
+    if (Array.isArray(listed)) configProviders = listed.map((key) => String(key));
+  } catch {
+    configProviders = []; /* expected: an unreadable config.toml declares no user providers (S-5) */
+  }
+  const native = !!id && (NATIVE_BUILTIN_PROVIDERS.includes(id) || configProviders.includes(id));
+  return { native, provider: id, source, configProviders };
+}
+
+/**
+ * D-3. Find the newest `coding_model_transitions` row for `ctmSessionId` whose parsed target recipe
+ * names this thread on the Codex harness with a route, and write `session_lead_route` from it.
+ *
+ * The journal is CTM's own record of the fork it launched, so this never guesses: no matching row
+ * means no repair (`{ ok: false, reason: 'no_journal_route' }`) and D-4 refuses the launch. An
+ * EXISTING route row wins byte-for-byte: the read below short-circuits, and the store's write is
+ * INSERT … ON CONFLICT DO NOTHING through the DB-owner mutation lane (awaited), so two concurrent
+ * cold restores converge on one row (meta-test M-1).
+ *
+ * @returns {{ ok: true, route: { route_id: string, model: string, context_window: null, transition_id: string }, written: boolean }
+ *        | { ok: false, reason: 'no_journal_route' }}
+ */
+async function reconcileLeadRouteFromJournal({ ctmSessionId, threadId, dbModule, recordSessionDiagnostic } = {}) {
+  const id = String(ctmSessionId || '').trim();
+  const thread = String(threadId || '').trim();
+  if (!id || !thread) return { ok: false, reason: 'no_journal_route' };
+  let rows = [];
+  try {
+    rows = typeof dbModule?.getCodingModelTransitionsForThread === 'function'
+      ? (dbModule.getCodingModelTransitionsForThread(id, thread) || [])
+      : [];
+  } catch {
+    rows = []; /* expected: an unreadable journal is not a route source — refuse, never guess (D-3) */
+  }
+  const row = rows.find((candidate) => {
+    const recipe = candidate?.target_recipe || {};
+    return String(recipe.providerThreadId || '') === thread
+      && String(recipe.harness || '') === 'codex-cli'
+      && String(recipe.routeId || '').trim().length > 0;
+  }) || null;
+  if (!row) return { ok: false, reason: 'no_journal_route' };
+  const routeId = String(row.target_recipe.routeId || '').trim();
+  const model = String(row.target_recipe.wireModelId || '').trim();
+  const transitionId = String(row.transition_id || '').trim();
+  if (!routeId || !model || !transitionId
+      || routeId.length > MAX_ROUTE_FIELD_LENGTH || model.length > MAX_ROUTE_FIELD_LENGTH) {
+    return { ok: false, reason: 'no_journal_route' };
+  }
+  let existing = null;
+  try {
+    existing = typeof dbModule?.getSessionLeadRoute === 'function' ? dbModule.getSessionLeadRoute(id) : null;
+  } catch {
+    existing = null; /* expected: an unreadable route row is treated as absent — the store's write is idempotent */
+  }
+  let written = false;
+  let route;
+  if (existing) {
+    route = {
+      route_id: existing.route_id, model: existing.model,
+      context_window: existing.context_window == null ? null : existing.context_window,
+      transition_id: existing.transition_id || null,
+    };
+  } else {
+    let stored = null;
+    if (typeof dbModule?.setSessionLeadRoute === 'function') {
+      stored = await dbModule.setSessionLeadRoute({
+        ctmSessionId: id, agent: 'codex', routeId, model, display: model,
+        contextWindow: null, transitionId,
+      });
+    }
+    written = !!stored;
+    route = { route_id: routeId, model, context_window: null, transition_id: transitionId };
+  }
+  if (typeof recordSessionDiagnostic === 'function') {
+    recordSessionDiagnostic(id, 'lead-route-reconciled-from-journal', {
+      transition_id: route.transition_id, route_id: route.route_id, model: route.model,
+      provider_thread_id: thread, written,
+    });
+  }
+  return { ok: true, route, written };
+}
+
+/**
+ * The D-4 refusal message. ONE sentence, and the picker is the way out (server.js's
+ * RESUME_BLOCK_MESSAGES and the client's error map both render this same provider id).
+ */
+function codexProviderMissingMessage(provider) {
+  return `This Codex thread was created on gateway provider \`${String(provider || '')}\`; pick a model for this session to relaunch it.`;
+}
+
+/**
+ * The launch-time hook (§9 S-3), called by provider-process.js when a Codex lead is about to be
+ * spawned natively on a resume thread (no `_launchLeadRoute` object and no route row). Returns
+ * `{ native: true }` when the thread's stored provider is servable natively, `{ target }` when
+ * the journal repaired a route (the caller runs its routed branch unchanged), or `{ refused: true }`
+ * after the deterministic resume block was recorded and the client told (D-4).
+ */
+async function gateNativeCodexLaunch({ sessionId, threadId, env = {}, preparedLaunchPlan = null, dbModule,
+  recordSessionDiagnostic, markSessionResumeBlocked, ws = null, wsSend = null } = {}) {
+  const codexHome = env.CODEX_HOME || (env.HOME ? path.join(env.HOME, '.codex') : null);
+  const threadRead = readCodexThreadProvider({
+    threadId, codexHome, homeDir: env.HOME || null,
+    rolloutPath: preparedLaunchPlan?.resume?.rolloutInfo?.rolloutPath
+      || preparedLaunchPlan?.resume?.preflight?.transcriptPath || null,
+  });
+  const threadClass = classifyCodexThreadProvider({ ...threadRead, codexHome });
+  if (threadClass.native) return { native: true };
+  const reconciled = await reconcileLeadRouteFromJournal({ ctmSessionId: sessionId, threadId, dbModule, recordSessionDiagnostic });
+  if (reconciled.ok) {
+    return { target: { routeId: reconciled.route.route_id, model: reconciled.route.model, contextWindow: null } };
+  }
+  if (typeof recordSessionDiagnostic === 'function') {
+    recordSessionDiagnostic(sessionId, 'codex-thread-provider-unservable', {
+      provider_thread_id: threadId, provider: threadClass.provider, source: threadRead.source,
+      config_providers: threadClass.configProviders.length,
+    });
+  }
+  const message = codexProviderMissingMessage(threadClass.provider);
+  if (typeof markSessionResumeBlocked === 'function') {
+    markSessionResumeBlocked(sessionId, { code: 'codex_provider_missing', message, agentType: 'codex', deterministic: true }, 'codex-provider-gate');
+  }
+  if (ws && typeof wsSend === 'function') wsSend(ws, JSON.stringify({ type: 'error', code: 'codex_provider_missing', message }));
+  return { refused: true };
+}
+
+module.exports = {
+  NATIVE_BUILTIN_PROVIDERS,
+  readCodexThreadProvider,
+  classifyCodexThreadProvider,
+  reconcileLeadRouteFromJournal,
+  codexProviderMissingMessage,
+  gateNativeCodexLaunch,
+};

package/template/coding-task-manager/lib/session-create/codex-resume-exit-classify.js

@@ -0,0 +1,52 @@
+'use strict';
+
+// WP-2 — docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-5, §9 S-9/S-10, §8 WP-2.
+//
+// The belt to WP-1's braces. WP-1 refuses a native Codex launch *before* it spawns when the
+// thread's stored provider is not one a native config load resolves. This module covers the exits
+// that get past any such gate: a thread whose provider changes between the decision and the spawn,
+// and the D-8 paths that never consult the gate at all.
+//
+// Codex reports "Model provider `x` not found" as a plain anyhow error with exit 1 — the SAME exit
+// code as a transient startup fault — so the exit code alone cannot discriminate: only the captured
+// output text can. CTM already buffers that text per attempt (`session._resumeAttemptOutput`, 8 KiB,
+// reset at the start of every attempt), which is what this classifier reads.
+//
+// A config-load failure is a precondition failure: no amount of retrying resolves it, so the
+// caller blocks deterministically instead of spending the 3-restart budget (50 s) to reach the same
+// state with a message that names nothing. Nothing here is flag-gated and nothing here spawns a
+// process: the whole decision is one regex over the caller's string.
+
+// The one Codex phrase this classifies, pinned deliberately narrow (§11: "do not widen the exit
+// classifier beyond the one Codex phrase"; every other startup fault keeps the restart budget).
+// The provider id is the backtick-quoted run Codex echoes back from the thread's stored
+// `model_provider`.
+const CODEX_PROVIDER_MISSING_RE = /Model provider `([^`]+)` not found/;
+
+/**
+ * Classify one attempt's captured Codex output (the caller passes `session._resumeAttemptOutput`).
+ *
+ * @param {string} output the attempt buffer — never scrollback; a non-string degrades to ''
+ * @returns {{ code: 'codex_provider_missing', provider: string, line: string } | null}
+ *   `null` for any output that does not carry the phrase, and for a phrase with no usable provider
+ *   id (e.g. "Model provider `` not found"), so a malformed line can only ever fail OPEN into
+ *   today's restart budget rather than blocking a thread it cannot name.
+ */
+function classifyCodexResumeExit(output) {
+  const text = typeof output === 'string' ? output : '';
+  if (!text) return null;
+  const match = CODEX_PROVIDER_MISSING_RE.exec(text);
+  if (!match) return null;
+  const provider = String(match[1] || '').trim();
+  if (!provider) return null;
+  // `detail` is the whole line the phrase landed on (Codex wraps the anyhow error across the
+  // "thread/resume failed: ..." prefix and the "(code -32600)" suffix); the line is the unit a
+  // human reads, and the provider id alone would drop the surrounding failure context.
+  const lineStart = text.lastIndexOf('\n', Math.max(0, match.index - 1)) + 1;
+  const lineEndRaw = text.indexOf('\n', match.index);
+  const lineEnd = lineEndRaw === -1 ? text.length : lineEndRaw;
+  const line = text.slice(lineStart, lineEnd).replace(/\r$/, '').trim();
+  return { code: 'codex_provider_missing', provider, line: line || match[0] };
+}
+
+module.exports = { CODEX_PROVIDER_MISSING_RE, classifyCodexResumeExit };