create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/session-create/delegate-worker.js

@@ -23,7 +23,7 @@ const { armAt } = require('./clamped-timer');
 const admission = require('../worker-admission');
 const { createWorkerAdmissionExit } = require('./worker-admission-exit');
 const { createWorkerContinuation, validCallerToolUseId } = require('./worker-continuation');
-const { createWorkerObservability, safeToolCounts, progressForGeneration, baselineChanged, statusProgress, currentGenerationReceipts, currentReceiptState, computeExitFailure, boundedWorkerText, isColdDeferredSession, workerHideLogLine, probeCachedFileState, THROTTLED_WINDOW_MS, EVENT_RECEIPT_LIMIT } = require('./worker-observability');
+const { createWorkerObservability, safeToolCounts, progressForGeneration, baselineChanged, statusProgress, currentGenerationReceipts, currentReceiptState, computeExitFailure, boundedWorkerText, isColdDeferredSession, workerHideLogLine, probeCachedFileState, THROTTLED_WINDOW_MS, EVENT_RECEIPT_LIMIT, WORKER_REPORT_TEXT_CAP_BYTES } = require('./worker-observability');
 const { killSessionProcess } = require('../session-class'); // worker-session-tree WP-2: the one kill authority
 const { loadWorkerBrief, validateWorkerCwd, validateBriefPath, validateBriefRealpathInsideCwd, renderedBriefPathForSession, renderedBriefWithBudget, ownedPaths: parseOwnedPaths, findScopeOverlap } = require('./worker-brief');
 const { checkCallerAuthority } = require('./worker-launch-sandbox');
@@ -49,10 +49,27 @@ const EFFORT_VALUES = new Set(['low', 'medium', 'high', 'xhigh']);
 const { createProxyRouteReadiness, DelegateError, setLeadRouteReadiness, DEFAULT_ROUTE_ALIAS, DEFAULT_MODEL, READINESS_BUDGET_MS } = require('./proxy-route-readiness');
 const DEFAULT_TOKEN_TTL_MS = 24 * 60 * 60 * 1000 + 10 * 60 * 1000; // session lifetime + 10 min (D-4)
 
+// D-3 (lead-cost-routing-round2-2026-10-24.html §5 D-3, §6.1/§6.2): the ONE citation counter,
+// shared with wall-e/lib/helper-rules/label.js so the counter and the labeller cannot drift.
+const { countReportCitations } = require('../../../shared/report-citations');
+
 // Only generated UUIDs are accepted before report paths are constructed, preventing encoded
 // path traversal through GET /api/sessions/:id/worker-status?include_report=1.
 const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+// The statuses whose payload carries a citation count; every other status reports null/null
+// because no text has been selected yet (D-3's §6.2 table).
+const WORKER_TERMINAL_STATUSES = new Set(['report_ready', 'exited', 'failed']);
+
+// D-3: read at most WORKER_REPORT_TEXT_CAP_BYTES of a report/last-message file, decode as UTF-8
+// and drop a trailing U+FFFD left by a split multi-byte sequence -- byte-for-byte the semantics
+// lib/api/sessions.js:931 applies to an ?include_report=1 read. A throw (ENOENT/EACCES/EISDIR)
+// is the caller's to classify: getWorkerStatus turns it into report_read_error, never a failure.
+function _readBoundedReportText(filePath) {
+  const bytes = fs.readFileSync(filePath);
+  return bytes.subarray(0, WORKER_REPORT_TEXT_CAP_BYTES).toString('utf8').replace(/\uFFFD$/, '');
+}
+
 function _assertValidSessionId(id) {
   if (!SESSION_ID_RE.test(String(id || ''))) {
     throw new DelegateError('session_invalid', 400, 'ctm_session_id is not a valid session id');
@@ -791,6 +808,31 @@ function getWorkerStatus(ctmSessionId, { now = Date.now } = {}) {
     status = 'starting';
   }
 
+  // D-3 (lead-cost-routing-round2-2026-10-24.html §5 D-3, §6.2): CTM is the ONLY counter of a
+  // report's distinct `file:line` citations. Count whichever text the row's OWN report_source
+  // names -- the report file, the last-message fallback, or the final provider result -- on
+  // every read, independent of ?include_report=1, so the whole-set wait's nested `worker`
+  // payload (which never carries report_text) still answers with a row count. Non-terminal
+  // statuses have selected no text yet and answer null/null; a read failure degrades to 0/0
+  // plus report_read_error and never fails the status read (same posture as report_present).
+  const terminalStatus = WORKER_TERMINAL_STATUSES.has(status);
+  let citationText = '';
+  let reportReadError = null;
+  if (terminalStatus) {
+    if (reportSource === 'report' || reportSource === 'last_message') {
+      try {
+        citationText = _readBoundedReportText(reportSource === 'report' ? reportPath : lastMessagePath);
+      } catch (error) {
+        // expected: report/last-message file missing, unreadable or a directory -- the count
+        // degrades to 0 with the error code exposed, exactly like the include_report=1 reader.
+        reportReadError = (error && error.code) || 'read_failed';
+        citationText = '';
+      }
+    } else if (reportSource === 'final_result') {
+      citationText = typeof successfulFinalText === 'string' ? successfulFinalText : '';
+    }
+  }
+
   const identity = workerRow ? 'marked' : 'unmarked';
 
   return {
@@ -799,6 +841,12 @@ function getWorkerStatus(ctmSessionId, { now = Date.now } = {}) {
     report_present: reportPresent,
     report_source: reportSource,
     report_text: reportText,
+    // D-3 (§6.2): the citation count and the character count of the text report_source names,
+    // never gated by include_report. report_read_error rides along ONLY when the file read
+    // threw (its error code, or 'read_failed'), in which case both counts are 0.
+    report_citation_rows: terminalStatus ? countReportCitations(citationText) : null,
+    report_chars: terminalStatus ? citationText.length : null,
+    ...(reportReadError ? { report_read_error: reportReadError } : {}),
     report_provisional: !!reportPresent && alive,
     last_message_path: lastMessagePath,
     turns: observer ? Number(observer.count || 0) : (Number.isInteger(runtime?.turns) ? runtime.turns : (Number.isInteger(session?._workerTurnCount) ? session._workerTurnCount : null)),
@@ -961,6 +1009,13 @@ function cancelRetirement(ctmSessionId) {
 // that never exits doesn't spam the log every 60s forever.
 const HIDE_LIVE_PROCESS_RETRY_MS = 60_000;
 
+// WP-1 (durable terminal stamp, worker-terminal-stamp-durable-2026-10-26): the ceiling for
+// markWorkerTerminal's transient-lock retry backoff. The write lock is held by the db-owner core
+// writer's transactions (observed 259-1210 ms back-to-back for 19 s on 2026-10-26), so
+// the retry has NO attempt ceiling -- it re-arms until the stamp lands or the row is already
+// terminal / hidden / gone -- and the geometric backoff stops growing here.
+const TERMINAL_STAMP_RETRY_CAP_MS = 5000;
+
 async function _hideWorker(ctmSessionId, { now = Date.now } = {}) {
   const deps = _requireDeps();
   _retentionTimers.delete(ctmSessionId);
@@ -1074,11 +1129,13 @@ function _invalidateWorkerFailureCache(deps, ctmSessionId) {
   session._workerFailure = null;
 }
 
-function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runtime = null, now = Date.now, retry = 0 } = {}) {
+function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runtime = null, now = Date.now, retry = 0, firstAttemptMs = null } = {}) {
   const deps = _requireDeps();
   let row;
   try { row = deps.dbModule.getWorkerSession(ctmSessionId); } catch { row = null; /* expected: an unreadable row is treated as no worker row, so nothing is stamped or scheduled -- a later exit-path call or the boot reload retries */ }
-  if (!row) return;
+  // WP-1: a row that no longer exists, or that another path already hid (hidden_at stamped =
+  // the worker is retired and its row is out of every listing), ends the retry chain here.
+  if (!row || row.hidden_at) return;
   const nowMs = typeof now === 'function' ? now() : Number(now);
   const nowIso = new Date(nowMs).toISOString();
   const patch = {};
@@ -1113,12 +1170,23 @@ function markWorkerTerminal(ctmSessionId, { terminalStatus, failure = null, runt
     try {
       deps.dbModule.updateWorkerSession(ctmSessionId, patch);
     } catch (err) {
-      // WP-7 live finding: a busy write lock fails FAST and the old early return also dropped the wait wake + terminal sentinel -- disposition is now REPORT + bounded retry of the whole stamp.
+      // WP-7 live finding: a busy write lock fails FAST and the old early return also dropped the wait wake + terminal sentinel -- disposition is now REPORT + retry of the whole stamp.
+      // WP-1: that retry has NO attempt ceiling -- a transient lock error is not the stamp's
+      // failure, it is contention on the main-thread writer (2026-10-26: 19 s of back-to-back
+      // 259-1210 ms transactions outlived the old 5-attempt / 1.5 s budget and two finished
+      // workers stayed listed as live for 9 h and 6 h). The chain ends at the top of the
+      // re-entered call: row gone / hidden_at set, or the patch finding terminal_at already
+      // written -- and, of course, when this write lands.
       // The retry's terminal writes start only when it fires, so the pending retry is tracked by the terminal settle.
-      if (['SQLITE_WRITE_LOCK_BUSY', 'SQLITE_BUSY', 'SQLITE_LOCKED'].includes(err && err.code) && retry < 5) return void workerLedger.trackTerminalWork(new Promise((resolve) => setTimeout(() => { try { markWorkerTerminal(ctmSessionId, { terminalStatus, failure, runtime, now, retry: retry + 1 }); } finally { resolve(); } }, 100 * (retry + 1)).unref?.()));
+      if (['SQLITE_WRITE_LOCK_BUSY', 'SQLITE_BUSY', 'SQLITE_LOCKED'].includes(err && err.code)) {
+        const firstAtMs = firstAttemptMs ?? nowMs;
+        if (retry === 5) console.warn(`[delegate-worker] terminal stamp still busy after 6 attempts (${String((err && err.code) || 'write_failed').slice(0, 48)}); retrying every ${TERMINAL_STAMP_RETRY_CAP_MS} ms`);
+        return void workerLedger.trackTerminalWork(new Promise((resolve) => setTimeout(() => { try { markWorkerTerminal(ctmSessionId, { terminalStatus, failure, runtime, now, retry: retry + 1, firstAttemptMs: firstAtMs }); } finally { resolve(); } }, Math.min(100 * (retry + 1), TERMINAL_STAMP_RETRY_CAP_MS)).unref?.()));
+      }
       console.warn(`[delegate-worker] terminal stamp failed (${String((err && err.code) || "write_failed").slice(0, 48)})`); return;
     }
     row = { ...row, ...patch };
+    if (retry > 0) console.log(`[delegate-worker] terminal stamp landed for ${ctmSessionId} after ${retry + 1} attempts in ${nowMs - (firstAttemptMs ?? nowMs)} ms`);
     _invalidateWorkerFailureCache(deps, ctmSessionId);
   }
   const hideAtMs = _computeHideAtMs(row, _retainMsForSession(deps, ctmSessionId));
@@ -1195,6 +1263,25 @@ function retireNow(session, now) {
   markWorkerTerminal(session.id, { terminalStatus: result.status, failure: result.failure, runtime, now });
 }
 
+// WP-2 (worker-terminal-stamp-durable-2026-10-26 D-2/D-3): one idempotent read repair for a
+// worker that EXITED but whose row never got its exit-time stamp (the write-lock loss WP-1 now
+// retries). Every lead-facing reader calls this FIRST, so a dead-but-unstamped worker is never
+// listed live and the stop verb never answers 'stopping' on a process that no longer exists.
+// Returns 'retired' | 'lost' | null. Idempotent: a stamped or hidden row is a no-op.
+// retireWorkerOnExit is deliberately NOT awaited -- a proxied worker's stamp is deferred by one
+// async read and tracked by workerLedger.trackTerminalWork, so callers must not assume the
+// stamp is synchronous (the next read retries anyway).
+function repairExitedWorkerRow(ctmSessionId, { now = Date.now } = {}) {
+  const deps = _requireDeps();
+  let row = null;
+  try { row = deps.dbModule.getWorkerSession(ctmSessionId); } catch { row = null; /* expected: an unreadable row cannot be repaired now; the next read retries */ }
+  if (!row || row.terminal_at || row.hidden_at) return null;
+  const session = typeof deps.getSession === 'function' ? deps.getSession(ctmSessionId) : null;
+  if (session && session.agentRole === 'worker' && (session._exitCode != null || session._exited)) { retireWorkerOnExit(session, { now }); return 'retired'; }
+  if (!session) { retireLostWorker(row, { now }); return 'lost'; }
+  return null; // a live process: nothing to repair
+}
+
 // Lifecycle WP-5 (§5 D-10, R-3, §9 S-8, AC-5c): boot re-arm -- every live (hidden_at === '')
 // worker_sessions row that already has a persisted hide_at gets its retirement timer
 // re-armed at that EXACT value (never recomputed off the current retainMs, so a config
@@ -1263,7 +1350,7 @@ const retireLostWorker = bootRetire.retireLostWorker, retireSurvivingWorker = bo
 module.exports = {
   configure, _terminalJournalSettled: workerLedger.terminalJournalSettled,
   resumeWorkerSession: workerContinuation.resumeWorkerSession,
-  stopWorkerSession: (id, opts) => require('./worker-stop').stopWorkerSession(id, opts, _requireDeps(), { resolveParent: resolveParentCtmSessionId }),
+  stopWorkerSession: (id, opts) => require('./worker-stop').stopWorkerSession(id, opts, _requireDeps(), { resolveParent: resolveParentCtmSessionId, repairExitedWorkerRow }),
   probeWorkerRoute: workerContinuation.probeWorkerRoute,
   restoreQuotaHoldsAtBoot: workerContinuation.restoreQuotaHoldsAtBoot,
   markAgentConsumed: workerContinuation.markAgentConsumed,
@@ -1290,6 +1377,8 @@ module.exports = {
   markAcknowledged,
   markWorkerTerminal,
   retireWorkerOnExit,
+  // WP-2 (D-2): the idempotent read repair both lead-facing readers call before answering.
+  repairExitedWorkerRow,
   reloadRetirementsAtBoot,
   listPendingRetirements,
   _resetRetentionTimersForTest,

package/template/coding-task-manager/lib/session-create/identity.js

@@ -7,6 +7,25 @@ function configure(getDeps) {
   _getDeps = getDeps;
 }
 
+// WP-4 (docs/remote-hub-followups-credential-projects-rows-idempotency-2026-10-23.html §5 D-11):
+// the create fingerprint an Idempotency-Key retry is compared against -- the JSON of these nine
+// launch-shaping fields, IN THIS ORDER, with a missing field read as ''. Geometry (cols/rows) and
+// label/title are deliberately EXCLUDED: a retry may differ in window size or naming and is still
+// the same create. Pure: reads nothing but `msg`, allocates nothing, touches no socket.
+const CREATE_FINGERPRINT_FIELDS = Object.freeze([
+  'cmd', 'args', 'cwd', 'createCwd', 'model_id', 'model_provider', 'mcp_profile', 'agentType', 'chatSessionId',
+]);
+
+function createFingerprint(msg) {
+  const source = msg && typeof msg === 'object' ? msg : {};
+  return JSON.stringify(CREATE_FINGERPRINT_FIELDS.map((field) => {
+    const value = source[field];
+    // `args` is compared AS GIVEN (an argv array serializes element by element); every other
+    // field is a scalar. Absent and null both read as ''.
+    return value === undefined || value === null ? '' : value;
+  }));
+}
+
 function prepareCreate(ws, msg) {
   const deps = _getDeps();
   const handleCreateStartedAt = deps.now();
@@ -67,4 +86,4 @@ function prepareCreate(ws, msg) {
   };
 }
 
-module.exports = { configure, prepareCreate };
+module.exports = { configure, prepareCreate, createFingerprint };

package/template/coding-task-manager/lib/session-create/prepared.js

@@ -1,5 +1,10 @@
 'use strict';
 
+// WP-4 (docs/remote-hub-followups-credential-projects-rows-idempotency-2026-10-23.html §5 D-11):
+// the ONE fingerprint definition lives in lib/session-create/identity.js; this module stamps it on a
+// session it fully owned and compares it on the next same-id create.
+const { createFingerprint } = require('./identity');
+
 // WP-2b (docs/session-model-authority-and-display-2026-10-15.html §9): the COMPLETE prepared-create
 // orchestration, moved verbatim out of server.js's `handleCreatePrepared`. It owns one whole
 // responsibility -- admitted request -> durable generation -> prepared current plan -> trusted
@@ -26,11 +31,23 @@
 //      argv, token or raw send-error text is ever echoed into the report. Every other `_wsSend` in
 //      the handler (mcp_profile_invalid, launch-generation-refused, cwd-create-failed,
 //      launch_transcript_restore_failed, the folder toast) keeps its original throwing behavior.
+// WP-4 (docs/remote-hub-followups-credential-projects-rows-idempotency-2026-10-23.html §5 D-13):
+// the per-id IN-FLIGHT create ledger -- id -> { fingerprint } (D-11). One entry per create that has
+// passed owner/MCP admission and has not yet left handleCreatePrepared; a second create with the
+// SAME id AND the same fingerprint while the first is in flight is refused `create_in_progress`
+// before it reserves a generation, plans, or spawns anything. The entry is deleted in the handler's
+// `finally`, which covers every exit (success, typed refusal, early null return, throw). A DIFFERENT
+// fingerprint never refuses and never overwrites the first entry (D-14: a model-switch relaunch
+// stays the generation runtime's business).
+const _inflightCreates = new Map();
+
 function createPreparedSessionCreate(host) {
   const {
     // Admission / identity
     crypto, _sessionMcpProfileSetting, _wsSend, _codingSessionGenerationRuntime,
     recordSessionDiagnostic, isSessionResumeBlocked, clearSessionResumeBlocked, getSession,
+    // WP-4 (§5 D-12): the one `created` frame a duplicate create is re-answered with.
+    sendNativeSessionCreated,
     // Input / local path
     serverConfig, path, fs, detectAgentType, extractResumeTarget,
     // Metadata / planning
@@ -61,6 +78,9 @@ function createPreparedSessionCreate(host) {
     }
   }
 
+  // WP-4 (§5 D-13): admission, then the in-flight claim, then the unchanged orchestration. The
+  // claim's `finally` wraps the WHOLE body, so every exit of the orchestration releases it -- and no
+  // line of the orchestration itself had to move to make that true.
   async function handleCreatePrepared(ws, msg) {
     if (host._ownerRecovery.rejectRequest(ws, msg)) return null; const id = msg?.id || crypto.randomUUID();
     const preparedMsg = { ...(msg || {}), id };
@@ -70,6 +90,44 @@ function createPreparedSessionCreate(host) {
       if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: 'mcp_profile_invalid', message: `Unknown mcp_profile: ${JSON.stringify(_rawMcpProfile)}` }));
       return null;
     }
+    // WP-4 (§5 D-12/D-13): a client-supplied id is the Idempotency-Key, and both duplicate answers
+    // are decided HERE, before any generation reservation, plan, markSpawning or markLive:
+    //   - the id names a LIVE session spawned by an identical create => re-answer ONE `created`
+    //     frame (same builder a fresh create uses) and return it; nothing is attached or rolled back;
+    //   - an identical create is still in flight => one typed `create_in_progress` refusal.
+    // A DIFFERENT fingerprint is NOT a duplicate (D-14): it walks today's path (attach, or the
+    // generation runtime's model-switch relaunch) and leaves the other fingerprint's entry alone.
+    let _claimedInflight = false;
+    const fingerprint = msg?.id ? createFingerprint(preparedMsg) : '';
+    if (fingerprint) {
+      const live = getSession(id);
+      if (ws && live?.ptyProcess && live._createFingerprint === fingerprint) {
+        sendNativeSessionCreated(ws, live);
+        return live;
+      }
+      const inFlight = _inflightCreates.get(id);
+      if (inFlight && inFlight.fingerprint === fingerprint) {
+        sendPreparedError(ws, {
+          type: 'error',
+          code: 'create_in_progress',
+          id,
+          message: 'A create for this session is already in progress',
+        });
+        return null;
+      }
+      if (!inFlight) { _inflightCreates.set(id, { fingerprint }); _claimedInflight = true; }
+    }
+    try {
+      return await _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint);
+    } finally {
+      if (_claimedInflight) _inflightCreates.delete(id);
+    }
+  }
+
+  // The orchestration itself: byte-for-byte the body that used to be handleCreatePrepared's, from
+  // the generation reservation on, plus the one D-11 fingerprint stamp on the owned success path.
+  // Split out ONLY so the D-13 claim above can wrap every exit.
+  async function _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint) {
     const reserved = _codingSessionGenerationRuntime.revalidateReservation(await _codingSessionGenerationRuntime.reserveSessionGeneration(id));
     if (!reserved.ok) { recordSessionDiagnostic(id, 'launch-generation-refused', { code: reserved.code, message: reserved.message }); if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: reserved.code, message: `Launch refused: ${reserved.message}` })); return null; }
     const generation = reserved.generation;
@@ -274,6 +332,10 @@ function createPreparedSessionCreate(host) {
       });
       return null;
     }
+    // WP-4 (§5 D-11): only a create this handler fully owned, keyed by a client id, can be re-answered
+    // later. A retry landing between the `created` frame and this line still finds the in-flight
+    // entry above and gets `create_in_progress`.
+    if (fingerprint && created && created.type !== 'walle') created._createFingerprint = fingerprint;
     _launchPlanCoordinator.markLive(id, generation, result.plan);
     return created || null;
   }
@@ -281,4 +343,10 @@ function createPreparedSessionCreate(host) {
   return handleCreatePrepared;
 }
 
-module.exports = { createPreparedSessionCreate };
+module.exports = {
+  createPreparedSessionCreate,
+  // WP-4 test seam (AC-4a/§10 abuse case): the in-flight ledger is process-local, so a test that
+  // drives the real factory in-process asserts it drains through this accessor rather than reaching
+  // into the module's internals.
+  inflightCreateCount: () => _inflightCreates.size,
+};

package/template/coding-task-manager/lib/session-create/provider-launch-context.js

@@ -0,0 +1,77 @@
+'use strict';
+
+// native-same-thread-model-switch / §6.5: the PRIVATE launch capture a rollback recovery replays.
+// It is recorded for EVERY native harness whose `recoverSource` can resume the same canonical
+// thread -- Codex AND Claude -- because this capture is the only proof of THIS spawn's
+// executable/argv/cwd/home/generation. It is taken from the prepared launch plan at the REAL
+// spawn (never synthesized later from mutable session fields), and every field is a copy: the
+// argv array is cloned, so a later `session.args` rewrite cannot edit the receipt.
+// WP-0b: extracted verbatim from provider-process.js (same spawn point) so that file stays under
+// the file-size ceiling; behavior is unchanged. The existing Codex receipt dependency is called
+// once as before; this adds no reader, state, or credential copy.
+
+const path = require('node:path');
+const { strFlag } = require('../env-flags');
+
+// Explicit launch inputs (never the whole process env): the prepared plan, the caller's argv/cwd,
+// the ACTUAL spawn env, the recipe/generation the launch was prepared with, the Codex config
+// receipt already read for this spawn, and the existing codex-paths dependency (no extra read).
+// Returns `null` for a harness with no same-canonical-thread rollout to resume.
+function buildModelTransitionLaunchContext({ agentType, preparedLaunchPlan, cmd, args, cwd, spawnEnv,
+  serverHome, executionRecipe, processGeneration, nativeConfigReceipt = null, codexPaths = null }) {
+  if (agentType !== 'codex' && agentType !== 'claude') return null;
+  const capturedHome = spawnEnv.HOME || serverHome || null;
+  const capturedTmpDir = typeof spawnEnv.TMPDIR === 'string' && path.isAbsolute(spawnEnv.TMPDIR)
+    ? spawnEnv.TMPDIR : null;
+  if (agentType === 'claude') {
+    // A native Claude launch claims NO Codex receipt/config: `codexHome`, `nativeStorageRootReceipt`
+    // and `nativeConfigReceipt` (read from the Codex `config.toml`) are explicitly null, so a
+    // rollback can never mistake this capture for a Codex one. The configured storage root is the
+    // Claude `projects/` dir under the ACTUAL `CLAUDE_CONFIG_DIR` (else `HOME/.claude`) and stays
+    // null when neither is known. The canonical thread is this launch's OWN recipe thread --
+    // computed by `launchProviderThreadId` from the resume plan, an injected/explicit
+    // `--session-id` and the caller's argv -- never inferred from the CTM session id, and left
+    // null (a fail-closed refusal in `recoverSource`) when the identity is unknown.
+    // A blank child CLAUDE_CONFIG_DIR falls back to that child's HOME/.claude, never the parent's
+    // config root. Codex keeps its CTM_CODEX_SESSIONS_DIR fallback below, unchanged.
+    const claudeConfigDir = spawnEnv.CLAUDE_CONFIG_DIR
+      || (capturedHome ? path.join(capturedHome, '.claude') : null);
+    return {
+      executablePath: preparedLaunchPlan?.cmd || cmd,
+      args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
+      workingDirectory: preparedLaunchPlan?.cwd || cwd,
+      providerThreadId: executionRecipe?.providerThreadId || null,
+      processGeneration,
+      homeDir: capturedHome,
+      codexHome: null,
+      nativeStorageRootConfiguredPath: claudeConfigDir ? path.join(claudeConfigDir, 'projects') : null,
+      nativeStorageRootReceipt: null,
+      tmpDir: capturedTmpDir,
+      nativeConfigReceipt: null,
+    };
+  }
+  const sessionsDir = spawnEnv.CTM_CODEX_SESSIONS_DIR || strFlag('CTM_CODEX_SESSIONS_DIR', '');
+  return {
+    executablePath: preparedLaunchPlan?.cmd || cmd,
+    args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
+    workingDirectory: preparedLaunchPlan?.cwd || cwd,
+    providerThreadId: preparedLaunchPlan?.resume?.providerResumeId || preparedLaunchPlan?.resume?.sessionId
+      || preparedLaunchPlan?.resume?.agentSessionId || null,
+    processGeneration,
+    homeDir: capturedHome,
+    codexHome: spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
+    nativeStorageRootConfiguredPath: spawnEnv.CTM_CODEX_SESSIONS_DIR
+      || sessionsDir
+      || ((spawnEnv.CODEX_HOME || capturedHome)
+        ? path.join(spawnEnv.CODEX_HOME || path.join(capturedHome, '.codex'), 'sessions') : null),
+    nativeStorageRootReceipt: codexPaths?.codexSessionsRootReceipt?.({
+      homeDir: capturedHome,
+      codexHomePath: spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
+      sessionsDir: sessionsDir || undefined,
+    }) || null,
+    tmpDir: capturedTmpDir,
+    nativeConfigReceipt: nativeConfigReceipt || { state: 'unknown' },
+  };
+}
+
+module.exports = { buildModelTransitionLaunchContext };

package/template/coding-task-manager/lib/session-create/provider-process.js

@@ -20,8 +20,11 @@ const { RECIPE_ENV_KEY, MAX_RECIPE_BYTES, modelExecutionRecipeMetadata } = requi
 const { validateDeferredRestoreAttempt } = require('../deferred-restore-attempt');
 const { getPrivateSourceRecoveryEnvironment, capturePrivateSourceEnvironment,
   hasCapturedEmptySourceEnvironmentRestore } = require('../lead-model-restore-reconciliation');
-const { modelStorageRootsFromEnv } = require('../host-handoff');
-const { strFlag } = require('../env-flags');
+const { modelStorageRootsFromEnv, privateOverridesFromEnv } = require('../host-handoff');
+// WP-0b: the rollback launch capture (moved out of this file, same spawn point) -- see
+// lib/session-create/provider-launch-context.js for the field-by-field contract.
+const { buildModelTransitionLaunchContext } = require('./provider-launch-context');
+const codexNativeProviderGate = require('./codex-native-provider-gate');
 const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 
 async function readCodexConfigReceipt(codexHome, onCleanupError = () => {}) {
@@ -195,6 +198,7 @@ async function prepareProviderSession(state) {
     _wsSend,
     recordSessionDiagnostic,
     harnessModelProfileLoader,
+    markSessionResumeBlocked, // WP-1: the deterministic refusal hook (server.js)
   } = _getDeps();
   const { args, cmd, createAgentType, cwd, env, id, msg, preparedLaunchPlan, restoreSeedSnapshot, ws, signal,
     claudeResumeId, _injectedSessionId } = state;
@@ -324,6 +328,14 @@ async function prepareProviderSession(state) {
         if (typeof recordSessionDiagnostic === 'function') recordSessionDiagnostic(id, 'lead-route-read-failed', { message: String(error && error.message || error).slice(0, 200) });
       }
     }
+    // WP-1 (codex-routed-fork-cold-restore-guard §5 D-2..D-4): a native `codex resume T` loads the provider
+    // STORED IN T; the gate refuses (D-4) or repairs the route from the journal (D-3) before any spawn.
+    if (!target && !readFailed && createAgentType === 'codex' && resolvedProviderThreadId) {
+      const gated = await codexNativeProviderGate.gateNativeCodexLaunch({ sessionId: id, threadId: resolvedProviderThreadId,
+        env, preparedLaunchPlan, dbModule, recordSessionDiagnostic, markSessionResumeBlocked, ws, wsSend: _wsSend });
+      if (gated.refused) { if (runtime) await runtime.close(); return { handled: true, providerState: null }; }
+      if (gated.target) target = gated.target;
+    }
     if (target && !readFailed) {
       let lr;
       if (target.preparedPlan) {
@@ -863,13 +875,17 @@ function createProviderSession(state) {
     const leadApplied = _applyLeadRouteToSpawn({ launchArgs, env, leadRoute });
     launchArgs = leadApplied.launchArgs;
     // The host receipt carries only whether the original per-session overrides were empty or
-    // require a surviving private owner. Storage roots projected for this restore remain in the
-    // launch context and do not turn an otherwise empty override set into a private environment.
+    // require a surviving private owner. Storage roots and TMPDIR projected into the launch context
+    // (`launchEnvironmentOverrides`) are launch context, not private overrides: for EVERY spawn, not
+    // only a host restore, they are dropped before the receipt is computed, so a projected HOME/TMPDIR
+    // never turns an otherwise empty override set into a private environment. The spawned child still
+    // receives them (`launchEnvOverrides` below).
     const trustedCapturedEmptySourceEnvironment = msg._isRestore === true
       && hasCapturedEmptySourceEnvironmentRestore(msg);
     const sourceOverrideCapture = capturePrivateSourceEnvironment(sourceRecoveryEnvironment
-      ? sourceRecoveryEnvironment.environment : trustedCapturedEmptySourceEnvironment ? {}
-        : (msg.env && typeof msg.env === 'object' ? msg.env : {}));
+      ? privateOverridesFromEnv(sourceRecoveryEnvironment.environment)
+      : trustedCapturedEmptySourceEnvironment ? {}
+        : privateOverridesFromEnv(msg.env && typeof msg.env === 'object' ? msg.env : {}));
     const sourceEnvironmentReference = trustedCapturedEmptySourceEnvironment ? 'captured-empty'
       : sourceOverrideCapture.state === 'captured'
         ? (Object.keys(sourceOverrideCapture.values || {}).length === 0 ? 'captured-empty' : 'private-owner-required')
@@ -1065,32 +1081,14 @@ function createProviderSession(state) {
       _modelProcessGeneration: modelProcessGeneration,
       _modelExecutionRecipe: modelExecutionRecipeMetadata(executionRecipe,
         { sessionId: id, processGeneration: modelProcessGeneration }).modelExecutionRecipe || null,
-      ...(createAgentType === 'codex' ? { _modelTransitionLaunchContext: (() => {
-        const capturedHome = leadApplied.spawnEnv.HOME || serverConfig.HOME || null;
-        const sessionsDir = leadApplied.spawnEnv.CTM_CODEX_SESSIONS_DIR || strFlag('CTM_CODEX_SESSIONS_DIR', '');
-        return {
-          executablePath: preparedLaunchPlan?.cmd || cmd,
-          args: Array.isArray(preparedLaunchPlan?.args) ? [...preparedLaunchPlan.args] : [...args],
-          workingDirectory: preparedLaunchPlan?.cwd || cwd,
-          providerThreadId: preparedLaunchPlan?.resume?.providerResumeId || preparedLaunchPlan?.resume?.sessionId
-            || preparedLaunchPlan?.resume?.agentSessionId || null,
-          processGeneration: modelProcessGeneration,
-          homeDir: capturedHome,
-          codexHome: leadApplied.spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
-          nativeStorageRootConfiguredPath: leadApplied.spawnEnv.CTM_CODEX_SESSIONS_DIR
-            || sessionsDir
-            || ((leadApplied.spawnEnv.CODEX_HOME || capturedHome)
-              ? path.join(leadApplied.spawnEnv.CODEX_HOME || path.join(capturedHome, '.codex'), 'sessions') : null),
-          nativeStorageRootReceipt: codexPaths?.codexSessionsRootReceipt?.({
-            homeDir: capturedHome,
-            codexHomePath: leadApplied.spawnEnv.CODEX_HOME || (capturedHome ? path.join(capturedHome, '.codex') : null),
-            sessionsDir: sessionsDir || undefined,
-          }) || null,
-          tmpDir: typeof leadApplied.spawnEnv.TMPDIR === 'string' && path.isAbsolute(leadApplied.spawnEnv.TMPDIR)
-            ? leadApplied.spawnEnv.TMPDIR : null,
-          nativeConfigReceipt: nativeConfigReceipt || { state: 'unknown' },
-        };
-      })() } : {}),
+      // native-same-thread-model-switch / §6.5, WP-0b: the PRIVATE launch capture a rollback recovery
+      // replays, built at THIS REAL spawn point by the sibling module (see
+      // lib/session-create/provider-launch-context.js for the field-by-field contract).
+      ...((createAgentType === 'codex' || createAgentType === 'claude') ? { _modelTransitionLaunchContext: buildModelTransitionLaunchContext({
+        agentType: createAgentType, preparedLaunchPlan, cmd, args, cwd,
+        spawnEnv: leadApplied.spawnEnv, serverHome: serverConfig.HOME,
+        executionRecipe, processGeneration: modelProcessGeneration, nativeConfigReceipt, codexPaths,
+      }) } : {}),
       clients: sessionClients,
       _primaryWs: null,
       // scrollback removed — headless terminal is source of truth (Phase 3D)
@@ -1455,11 +1453,10 @@ function createProviderSession(state) {
           provider: sessionAgentType,
           providerResumeId: sessionAgentType === 'codex' ? (claudeResumeId || '') : '',
           cwd,
-          title: session.title || session.label,
-          userRenamed: !!session.userRenamed,
-          titleSource: session.userRenamed ? 'user' : '',
-          titleStatus: session.userRenamed ? 'user_named' : '',
-          titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+          // D-2 (session-name design 2026-10-23): a resume of a titled row keeps its title + provenance (upsertSession keeps omitted keys).
+          ...(isResumeLaunch && existingTitle?.title ? {} : { title: session.title || session.label, userRenamed: !!session.userRenamed,
+            titleSource: session.userRenamed ? 'user' : '', titleStatus: session.userRenamed ? 'user_named' : '',
+            titleStatusReason: session.userRenamed ? 'new_session_title' : '' }),
           projectEntry: sessionAgentType === 'claude' ? encodeClaudeProjectEntry(cwd) : encodeProjectEntry(cwd),
           projectPath: cwd,
         },

package/template/coding-task-manager/lib/session-create/response.js

@@ -9,6 +9,12 @@ const { releaseAdmissionOnExit, retireWorkerOnExit, scheduleWorkerObservation }
 // whole frame is built by the SAME bounded pure transport leaf (it copies the fixed typed whitelist out
 // of the payload `_sessionPayload` already produced).
 const { buildCreatedSessionPayload } = require('../coding-session-model-public');
+// WP-2 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-5): the module carries the
+// rationale — a Codex config-load failure is a precondition failure, never a restart-budget consumer.
+const { classifyCodexResumeExit } = require('./codex-resume-exit-classify');
+const { codexProviderMissingMessage } = require('./codex-native-provider-gate'); // WP-1 owns the one block sentence
+// WP-1 (D-1/D-2, S-11): the pure chooser for the block a deferred exit carries (a direct require, like the two leaves above: the injected `runtime` is built in server.js, which this WP does not own).
+const { deferBlockForExit } = require('../resume-blocked-wire');
 
 // D-9 (delegated-worker-lifecycle-identity-observability-2026-09-27.html §5 D-9, §9 S-15):
 // best-effort proxy-token revoke for a worker session exiting on the CREATE path (never
@@ -887,7 +893,7 @@ function installResponseRuntime(runtime) {
   // classification BEFORE this handler is installed; the handler then passes its FULL event through it.
   const leadRouteCleanup = runtime.session.agentRole === 'worker' ? null : require('./lead-route-launch').createLeadRouteLifetimeCleanup({ sessionId: runtime.session.id, ownership: runtime.session._leadRouteTokenOwnership, hosted: _useSessionHostProcessForPty() === true });
   const onPtyExit = async (exitEvent) => {
-      const { exitCode, signal } = exitEvent || {};
+      const { exitCode, signal, exitSource } = exitEvent || {};
       runtime.sessionInputAuthority.observeProvider({ sessionId: runtime.id, status: 'exited' });
       runtime.session._ptyExitLifecycle = {
         stage: 'capturing-viewport',
@@ -1064,6 +1070,20 @@ function installResponseRuntime(runtime) {
       // retry path as an exit 1 rather than being mistaken for a completed terminal lifecycle.
       const maxAutoRestarts = 3;
       const restartCount = runtime.session._autoRestartCount || 0;
+      // WP-2 (§5 D-5, §9 S-9/S-10): classify THIS attempt's buffer — never scrollback — before the
+      // auto-restart decision, and block a Codex config-load failure instead of spending the budget.
+      const codexProviderMissingExit = (agentType === 'codex' && exitedBeforeResumeReady) ? classifyCodexResumeExit(runtime.session._resumeAttemptOutput || '') : null;
+      if (codexProviderMissingExit) {
+        runtime.recordSessionDiagnostic(runtime.id, 'codex-provider-missing-exit', { provider: codexProviderMissingExit.provider, exitCode });
+        // Marked ONCE. This is what makes the auto-restart decision below false
+        // (`resumeBlocked: isSessionResumeBlocked(runtime.id)`), so `handleCreatePrepared` is never
+        // scheduled for this exit; the flow then falls through to the ordinary exit-persistence path,
+        // which sees the session already blocked and keeps the placeholder + startup recipe as is.
+        markSessionResumeBlocked(runtime.id, {
+          code: 'codex_provider_missing', detail: codexProviderMissingExit.line, agentType: 'codex', deterministic: true,
+          message: codexProviderMissingMessage(codexProviderMissingExit.provider),
+        }, 'codex-provider-exit');
+      }
       // A worker continuation does launch `-p --resume` / `exec resume`, but its exit is terminal and
       // never an interactive auto-restart (that would relaunch it as a TUI under the worker's identity,
       // stuck at worker-status 'starting'). lib/session-class.js declares that: relaunchFromRestore=false.
@@ -1208,25 +1228,22 @@ function installResponseRuntime(runtime) {
       const exitPersistence = sessionExitPersistenceDecision({
         intentionalKill: !!runtime.session._intentionalKill,
         exitCode,
-        signal,
+        signal, exitSource,
         isResumable,
         resumeContext: resumeExitContext(runtime.session), deferOnAbnormalExit: sessionPolicy(runtime.session).deferOnAbnormalExit,
       });
       runtime.session._ptyExitLifecycle.stage = `persistence-${String(exitPersistence.action || 'unknown')}`;
       if (exitPersistence.action === 'defer') {
         const latestResumeExit = resumeExitContext(runtime.session);
-        if (!isSessionResumeBlocked(runtime.id)) {
-          const label = getAgentCapabilities(agentType).label || 'The agent';
+        const label = getAgentCapabilities(agentType).label || 'The agent';
+        // WP-1 (D-1/D-2): the block comes from the exit EVIDENCE -- an unknown exit yields null (defer with no block: exited, and the next input resumes it).
+        const block = deferBlockForExit({ exitPersistence, latestResumeExit, exitCode, signal, autoRestartCount: runtime.session._autoRestartCount || 0, label });
+        if (block && !isSessionResumeBlocked(runtime.id)) {
           markSessionResumeBlocked(runtime.id, {
-            code: latestResumeExit.failedBeforeReady
-              ? (latestResumeExit.code || 'resume_failed')
-              : 'session_crash_loop',
-            message: latestResumeExit.failedBeforeReady
-              ? `${label} did not become ready while resuming.`
-              : `${label} exited unexpectedly and automatic recovery was exhausted.`,
+            ...block,
             detail: resumeFailureDetail(agentType, runtime.session._resumeAttemptOutput || ''),
             agentType,
-          });
+          }, 'response-defer');
         }
         // Keep the CTM identity and startup recipe as a deferred placeholder. Retiring the startup
         // task here would make retry impossible. Failed resume mirrors also stay provisional so they
@@ -1243,7 +1260,8 @@ function installResponseRuntime(runtime) {
           runtime.session._restoreStarting = false;
           runtime.session._lifecycleState = 'deferred';
           runtime._markServerSessionTurnClosed(runtime.session, Date.now(), 'session-exit'); // R-15: PROCESS_EXIT, never a dead wait
-          runtime.session._resumeBlocked = true;
+          // WP-1 (D-1): read the flag, never assert it -- a defer with no block is "exited, resumes on input", not "resuming".
+          runtime.session._resumeBlocked = isSessionResumeBlocked(runtime.id);
           runtime.session._exitPersistenceReason = exitPersistence.reason;
           runtime.session._restoreTask = {
             session_id: runtime.id,

package/template/coding-task-manager/lib/session-create/transcript.js

@@ -120,12 +120,21 @@ async function createWalleSession(state) {
   if (createResult) deps.recordWalleTranscriptAppend(session, createResult);
   for (const record of seeded.records) deps.recordWalleTranscriptAppend(session, record);
   try {
+    // WP-0 (session-name-agent-title-precedence-2026-10-23.html §5 D-2): reusing an existing
+    // Wall-E transcript must not rewrite the row's title or its provenance — the client echoes
+    // the displayed name back (D-1), and upsertSession keeps the stored value for any omitted
+    // title key (or empty titleSource/titleStatus/titleStatusReason), so omit them on a resume
+    // of a row that already has a title.
+    const preserveTitleProvenance = !msg._isRestore
+      && (launch.walleResumeRequest || launch.isResumeLaunch) && !!existingTitle?.title;
     void deps.detachOwnerMutation('walle-session-created', () => deps.dbModule.upsertSession(id, {
       agentSessionId: chatSessionId, provider: 'walle', cwd, projectPath: cwd,
-      title: session.title, userRenamed: !!session.userRenamed,
-      titleSource: session.userRenamed ? 'user' : '',
-      titleStatus: session.userRenamed ? 'user_named' : '',
-      titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+      ...(preserveTitleProvenance ? {} : {
+        title: session.title, userRenamed: !!session.userRenamed,
+        titleSource: session.userRenamed ? 'user' : '',
+        titleStatus: session.userRenamed ? 'user_named' : '',
+        titleStatusReason: session.userRenamed ? 'new_session_title' : '',
+      }),
       jsonlPath, fileSize: 0, modifiedAt: '', model: modelId || '', hostname: deps.hostname,
     }));
   } catch (error) {