create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/session-model-action-preconditions.js

@@ -427,6 +427,15 @@ function reconstructSessionModelTransitionSource({ sessionId, source, sourceLaun
       const rebound = require('./launch-model-override').ensureCodexResumeTarget(args, source.providerThreadId);
       if (!rebound.ok) return null;
       args = rebound.args;
+    } else if (agent === 'claude') {
+      // The SAME canonical normalization for a native Claude source: the recorded capture may name its
+      // own thread through an explicit `--session-id` (the identity CTM injected at startup) and may
+      // still carry that launch's original positional prompt. Only the canonical owner's own
+      // `--resume <source thread>` is the source recipe, so the existing extractor below reads a
+      // rebound argv instead of rejecting the capture outright.
+      const rebound = require('./launch-model-override').ensureClaudeResumeTarget(args, source.providerThreadId);
+      if (!rebound.ok) return null;
+      args = rebound.args;
     }
     if ((require('./session-history').extractResumeTarget(agent, args)?.sessionId || '') !== String(source.providerThreadId)) return null;
     return { ...context, args };

package/template/coding-task-manager/lib/session-resource-sampler.js

@@ -79,14 +79,14 @@ function splitAgentDescendantRows(rows, agentPid) {
   const agentRssMB = agentRow ? Math.round(((Number(agentRow.rssKB) || 0) / 1024) * 100) / 100 : 0;
   const pending = [...(byParent.get(agentPid) || [])];
   const seen = new Set();
-  let descendantRssKB = 0, descendantGroupLeaderCount = 0; // D-10: a descendant leading its own process group (a background shell's wrapper)
+  let descendantRssKB = 0, descendantCpuTimeMs = 0, descendantGroupLeaderCount = 0; // D-10: a descendant leading its own process group (a background shell's wrapper)
   while (pending.length) {
     const pid = pending.pop();
     if (seen.has(pid)) continue;
     seen.add(pid);
     const row = byPid.get(pid);
     if (!row) continue;
-    descendantRssKB += Number(row.rssKB) || 0; if (row.pgid === row.pid) descendantGroupLeaderCount += 1;
+    descendantRssKB += Number(row.rssKB) || 0; descendantCpuTimeMs += Number(row.cpuTimeMs) || 0; if (row.pgid === row.pid) descendantGroupLeaderCount += 1;
     pending.push(...(byParent.get(pid) || []));
   }
   return {
@@ -99,7 +99,7 @@ function splitAgentDescendantRows(rows, agentPid) {
     // invisible to a pgid-only rollup).
     descendantPids: [...seen],
     descendantGroupLeaderCount,
-    descendantRssMB: Math.round((descendantRssKB / 1024) * 100) / 100,
+    descendantRssMB: Math.round((descendantRssKB / 1024) * 100) / 100, descendantCpuTimeMs, // WP-0 (bg-shell-liveness): Σ cpuTimeMs of every visited descendant
   };
 }
 
@@ -468,18 +468,28 @@ class SessionResourceSampler {
     return { agentPid: Number(agentPid), descendantPids: split.descendantPids, descendantGroupLeaderCount: split.descendantGroupLeaderCount };
   }
 
+  // D-9 (WP-6, clock-free-tests-followups-2026-10-23 §5 D-9/§8 WP-6): ONE whole-table read a caller
+  // can share across every rollup in one sweep. Same command/args/limits as sampleProcessGroup's own
+  // read, and the same maxBuffer: `ps -axo …` prints ~1.37 MB on this host, above Node's 1 MiB default.
+  async sampleProcessTable() {
+    const psCommand = this.platform === 'darwin' ? '/bin/ps' : 'ps';
+    const { stdout } = await this.exec(psCommand, PS_ARGS, { timeout: 10_000, maxBuffer: 8 * 1024 * 1024 });
+    return parseProcessTable(stdout);
+  }
+
   // D-4: the post-kill census. One ps read; the pgid rollup as before, plus every row whose pid is in
   // `descendantPidsBefore` (and not already in the group). Survivors are merged into pids/procCount/rssMB/cpuPct.
   // A call with no second argument (every pre-existing caller) behaves exactly as before.
-  async sampleProcessGroup(pgid, descendantPidsBefore = []) {
-    const psCommand = this.platform === 'darwin' ? '/bin/ps' : 'ps';
-    const { stdout } = await this.exec(psCommand, PS_ARGS, { timeout: 10_000, maxBuffer: 8 * 1024 * 1024 });
-    const rows = parseProcessTable(stdout);
-    const group = rollupProcessGroup(rows, pgid);
+  // D-9: `{ rows }` lets a sweep hand in the ONE table it already read (sampleProcessTable above) —
+  // then this call execs nothing. The rollup/survivor logic below is shared verbatim by both paths,
+  // so a caller that supplies rows cannot diverge from one that does not.
+  async sampleProcessGroup(pgid, descendantPidsBefore = [], { rows = null } = {}) {
+    const table = Array.isArray(rows) ? rows : await this.sampleProcessTable();
+    const group = rollupProcessGroup(table, pgid);
     const before = new Set((descendantPidsBefore || []).map(Number));
     if (!before.size) return group;
     const have = new Set(group.pids);
-    const survivors = rows.filter(row => before.has(Number(row.pid)) && !have.has(row.pid)).sort((a, b) => a.pid - b.pid);
+    const survivors = table.filter(row => before.has(Number(row.pid)) && !have.has(row.pid)).sort((a, b) => a.pid - b.pid);
     if (!survivors.length) return group;
     const rssKB = survivors.reduce((sum, row) => sum + (Number(row.rssKB) || 0), 0);
     const cpuPct = survivors.reduce((sum, row) => sum + (Number(row.cpuPct) || 0), 0);

package/template/coding-task-manager/lib/session-standup.js

@@ -882,6 +882,15 @@ function classifySessionStandup(session, signals = {}, now = Date.now()) {
     resume: session?.resume?.schemaVersion === 2 ? session.resume : null,
     priority: LANE_ORDER.get(lane) ?? 99, backgroundWork: session?.backgroundWork || null, statusReason: session?.statusReason || '',
     verdictAt: Number(session?.verdictAt) || Number(session?.liveStatusAt) || 0,
+    // WP-3 (remote-hub-followups D-9): the machine tag rides the card IFF the input session carries
+    // it. `_buildStandupSnapshot` stamps local standup sessions EMPTY and remote (box) sessions with
+    // the registry values, but ONLY when at least one machine is registered — so a zero-machine hub
+    // adds no key here and its snapshot stays byte-identical to the pre-WP-3 output (AC-3a).
+    ...(session && Object.prototype.hasOwnProperty.call(session, 'machine') ? {
+      machine: String(session.machine == null ? '' : session.machine).trim(),
+      machineName: String(session.machineName == null ? '' : session.machineName).trim(),
+      machineHealth: String(session.machineHealth == null ? '' : session.machineHealth).trim(),
+    } : {}),
   };
   // WP1C: the card's bounded own/null authority fields and its shared model label, applied to THIS card
   // object after it is built (see applyStandupModelAuthority in ./coding-session-model-public).
@@ -970,13 +979,13 @@ function isStandupStartupTaskSeedEnabled(env = process.env) {
 // existing classifier can run through unmodified, so a "seeded" card gets exactly the same
 // lane/priority logic as a live one — just starting from persisted metadata instead of a
 // live stream.
-function startupTaskPlaceholderSession(task) {
+function startupTaskPlaceholderSession(task, titleInfo) {
   if (!task) return null;
   const id = String(task.session_id || task.ctm_session_id || '').trim();
   if (!id) return null;
   const placeholder = {
     id,
-    label: task.label || '',
+    label: String(titleInfo?.title || '').trim() || task.label || '', // D-13/S-26: durable ctm_sessions title; echo only if no row
     cmd: task.cmd || '',
     cwd: task.cwd || '',
     project: task.cwd || '',
@@ -1015,15 +1024,16 @@ function startupTaskPlaceholderSession(task) {
 // a startup task appearing more than once). Callers union the result onto their live session
 // list; kept separate (rather than mutating/returning a merged array) so the server can push
 // each placeholder through the same standupPairs/attention wiring live sessions use.
-function selectUnmatchedStartupTaskPlaceholders(existingSessions, startupTasks) {
+function selectUnmatchedStartupTaskPlaceholders(existingSessions, startupTasks, titlesForIds) {
   const seen = new Set();
   for (const session of existingSessions || []) {
     const id = String(session?.id || session?.sessionId || '').trim();
     if (id) seen.add(id);
   }
+  const titlesById = typeof titlesForIds === 'function' ? titlesForIds((startupTasks || []).map((t) => t?.session_id || t?.ctm_session_id).filter(Boolean)) : null; // D-13/S-26: ONE batched read, never per row
   const placeholders = [];
   for (const task of startupTasks || []) {
-    const placeholder = startupTaskPlaceholderSession(task);
+    const placeholder = startupTaskPlaceholderSession(task, titlesById?.get?.(task?.session_id || task?.ctm_session_id));
     if (!placeholder || seen.has(placeholder.id)) continue;
     seen.add(placeholder.id);
     placeholders.push(placeholder);
@@ -1031,6 +1041,57 @@ function selectUnmatchedStartupTaskPlaceholders(existingSessions, startupTasks)
   return placeholders;
 }
 
+// WP-3 (D-9): the statuses a REMOTE (box) session row can carry that mean its PTY is live. A row
+// whose box reports a parked/exited/stopped look (the sync-mirror or last-good degradation) is not
+// live. The hub never consults a LOCAL PTY helper for these rows — they are not on this host.
+const REMOTE_ROW_LIVE_STATUSES = new Set([
+  'running', 'busy', 'active', 'working', 'thinking',
+  'waiting_input', 'waiting_for_input', 'waiting',
+  'resuming', 'restoring', 'restarting',
+]);
+
+/** The box's own liveness for a remote catalog row (never a local PTY check). */
+function remoteRowTerminalLive(row) {
+  // The row's OWN status decides when it carries one (a live reachable box row, or the at-rest
+  // mirror's 'parked'); the boolean flags are only a fallback for a row that has no status.
+  const status = String(row?.standupStatus || row?.liveStatus || row?.status || row?.lifecycleState || '')
+    .trim().toLowerCase().replace(/[-\s]+/g, '_');
+  if (status) return REMOTE_ROW_LIVE_STATUSES.has(status);
+  return row?.terminalLive === true || row?.terminal_live === true
+    || row?.activeCtmSession === true || row?.active_ctm_session === true
+    || row?.runtimeActive === true || row?.runtime_active === true;
+}
+
+/**
+ * WP-3 (D-9): a session-shaped object for one row of `remoteMachineCatalog.remoteRows()`, ready for
+ * the same `classifySessionStandup` the local sessions map goes through (`summary: null` — a box row
+ * has no local stream summary). Liveness comes from the row's OWN status; no local PTY helper runs.
+ *
+ * @param {object} row a remote catalog row (already machine-tagged by remoteRows())
+ * @param {{instanceId?: string, displayName?: string, health?: string}} [machineFacts] fallback tag
+ */
+function remoteStandupSession(row, machineFacts = {}) {
+  const source = row && typeof row === 'object' ? row : {};
+  const terminalLive = remoteRowTerminalLive(source);
+  const rawStatus = String(source.standupStatus || source.liveStatus || source.status || '').trim();
+  const standupStatus = rawStatus
+    ? rawStatus.toLowerCase().replace(/[-\s]+/g, '_')
+    : (terminalLive ? 'running' : 'parked');
+  return {
+    ...source,
+    machine: String(source.machine || machineFacts.instanceId || '').trim(),
+    machineName: String(source.machineName || machineFacts.displayName || '').trim(),
+    machineHealth: String(source.machineHealth || machineFacts.health || '').trim(),
+    terminalLive,
+    terminal_live: terminalLive,
+    activeCtmSession: terminalLive,
+    active_ctm_session: terminalLive,
+    runtimeActive: terminalLive,
+    runtime_active: terminalLive,
+    standupStatus,
+  };
+}
+
 function buildSessionStandupSnapshot({ sessions = [], summaries = [], statuses = [], now = Date.now() } = {}) {
   const summaryIndex = buildIndex(summaries);
   const statusIndex = buildIndex(statuses);
@@ -1070,6 +1131,8 @@ module.exports = {
   startupTaskPlaceholderSession,
   selectUnmatchedStartupTaskPlaceholders,
   isStandupStartupTaskSeedEnabled,
+  remoteRowTerminalLive,
+  remoteStandupSession,
   _private: {
     normalizeStatus,
     normalizeProvider,

package/template/coding-task-manager/lib/session-status-ledger.js

@@ -72,6 +72,7 @@ const BOUNDARY_CLOSERS = new Set(['end_turn', 'interrupt']);
 const BG_END_STATUSES = new Set(['completed', 'failed', 'killed', 'stopped']);
 // renewal span, and the backstop expiry when no process sample arrives (busy-background-shell design D-3); the CLI has no local cap since 2.1.288
 const BG_SHELL_MAX_MS = 2 * 3600_000 + 5 * 60_000;
+const BG_QUIET_MS = 30 * 60_000;
 const BG_DECLARED_MAX_MS = 6 * 3600_000;
 const BG_LABEL_MAX = 160;
 const BG_VIEW_TASKS_MAX = 8;
@@ -189,6 +190,7 @@ class SessionStatusLedger {
       next.set(n.id, {
         ...n, firstSeenAt, expiresAt: keep ? Math.max(Number(prev.expiresAt) || 0, cap) : cap, source: 'hook', count: 1,
         renewedAt: keep ? (prev.renewedAt || 0) : 0, renewals: keep ? (prev.renewals || 0) : 0, capCrossedAt: keep ? (prev.capCrossedAt || 0) : 0,
+        activeAt: keep ? (prev.activeAt || firstSeenAt) : firstSeenAt, outSize: keep ? (prev.outSize || 0) : 0, outMtimeMs: keep ? (prev.outMtimeMs || 0) : 0,
       });
     }
     let changed = next.size !== before || !this.backgroundDeclared;
@@ -222,6 +224,7 @@ class SessionStatusLedger {
       expiresAt: keep ? Math.max(Number(prev.expiresAt) || 0, computed) : computed,
       source: src, count,
       renewedAt: keep ? (prev.renewedAt || 0) : 0, renewals: keep ? (prev.renewals || 0) : 0, capCrossedAt: keep ? (prev.capCrossedAt || 0) : 0,
+      activeAt: keep ? (prev.activeAt || firstSeenAt) : firstSeenAt, outSize: keep ? (prev.outSize || 0) : 0, outMtimeMs: keep ? (prev.outMtimeMs || 0) : 0,
     };
     if (leaseMs) entry.leased = true;
     this.background.set(n.id, entry);
@@ -234,16 +237,28 @@ class SessionStatusLedger {
     return this.background.size > 0;
   }
 
+  // D-1: quiet = a hook-declared shell with no activity evidence for BG_QUIET_MS. Never kills; only drops park protection.
+  backgroundQuiet(entry, now) {
+    return entry.type === 'shell' && entry.source === 'hook' && now - (entry.activeAt || 0) >= BG_QUIET_MS;
+  }
+
+  backgroundActive(now = Date.now()) {
+    this._bgExpire(now);
+    return [...this.background.values()].some(e => !this.backgroundQuiet(e, now));
+  }
+
   backgroundView(now = Date.now()) {
     this._bgExpire(now);
     if (!this.background.size) return null;
     const live = [...this.background.values()].sort((a, b) => a.firstSeenAt - b.firstSeenAt);
     const types = {};
     let count = 0;
+    let quiet = 0;
+    for (const e of live) { if (this.backgroundQuiet(e, now)) quiet += 1; }
     for (const e of live) { types[e.type] = (types[e.type] || 0) + e.count; count += e.count; }
     return {
-      count, types,
-      tasks: live.slice(0, BG_VIEW_TASKS_MAX).map(e => ({ id: e.id, type: e.type, label: e.label, since: e.firstSeenAt })),
+      count, types, quiet,
+      tasks: live.slice(0, BG_VIEW_TASKS_MAX).map(e => ({ id: e.id, type: e.type, label: e.label, since: e.firstSeenAt, activeAt: e.activeAt || 0, quiet: this.backgroundQuiet(e, now) })),
       observedAt: this.backgroundObservedAt, declared: this.backgroundDeclared,
     };
   }
@@ -257,6 +272,7 @@ class SessionStatusLedger {
       entries.push({
         id: e.id, type: e.type, label: e.label, firstSeenAt: e.firstSeenAt, expiresAt: e.expiresAt, source: e.source, count: e.count,
         renewedAt: e.renewedAt || 0, renewals: e.renewals || 0, capCrossedAt: e.capCrossedAt || 0,
+        activeAt: e.activeAt || 0, outSize: e.outSize || 0, outMtimeMs: e.outMtimeMs || 0,
       });
     }
     return { declared: this.backgroundDeclared, observedAt: this.backgroundObservedAt, entries };
@@ -279,6 +295,7 @@ class SessionStatusLedger {
         firstSeenAt, expiresAt: Math.min(Number(raw.expiresAt), now + bgCapFor(type)),
         source: String(raw.source || 'hook'), count: Math.max(1, Number(raw.count) || 1),
         renewedAt: Number(raw.renewedAt) || 0, renewals: Math.max(0, Number(raw.renewals) || 0), capCrossedAt: Number(raw.capCrossedAt) || 0,
+        activeAt: Number(raw.activeAt) > 0 ? Number(raw.activeAt) : now, outSize: Number(raw.outSize) || 0, outMtimeMs: Number(raw.outMtimeMs) || 0,
       });
       n += 1;
     }
@@ -325,6 +342,28 @@ class SessionStatusLedger {
     return renewed;
   }
 
+  // D-4: silent activity evidence (a process-sample CPU delta). Returns the number of entries whose activeAt moved.
+  markBackgroundActive(predicate, at = Date.now()) {
+    let moved = 0;
+    for (const e of this.background.values()) {
+      if (!predicate(e)) continue;
+      if (at > (e.activeAt || 0)) { e.activeAt = at; moved += 1; }
+    }
+    return moved;
+  }
+
+  // D-4: output-file growth evidence; a never-seen entry counts as growth only when size > 0.
+  observeBackgroundOutput(id, { size = 0, mtimeMs = 0 } = {}, at = Date.now()) {
+    const e = this.background.get(id);
+    if (!e) return false;
+    const seen = (e.outSize || 0) > 0 || (e.outMtimeMs || 0) > 0;
+    const grew = seen ? (size > (e.outSize || 0) || mtimeMs > (e.outMtimeMs || 0)) : size > 0;
+    if (!grew) return false;
+    e.activeAt = Math.max(e.activeAt || 0, at);
+    e.outSize = size; e.outMtimeMs = mtimeMs;
+    return true;
+  }
+
   record(kind, { at = Date.now(), source = '', meta = {} } = {}) {
     const prev = this.verdict(at);
     const bgBefore = this._bgPending.length;
@@ -579,4 +618,4 @@ class SessionStatusLedger {
   }
 }
 
-module.exports = { SessionStatusLedger, EVIDENCE, AGENT_OUTPUT, PROVIDER_STATUS_POLICY, BG_END_STATUSES, BG_SHELL_MAX_MS, BG_DECLARED_MAX_MS, BG_LABEL_MAX, normalizeBackgroundTask };
+module.exports = { SessionStatusLedger, EVIDENCE, AGENT_OUTPUT, PROVIDER_STATUS_POLICY, BG_END_STATUSES, BG_SHELL_MAX_MS, BG_QUIET_MS, BG_DECLARED_MAX_MS, BG_LABEL_MAX, normalizeBackgroundTask };

package/template/coding-task-manager/lib/session-status-runtime.js

@@ -34,6 +34,7 @@ const UNKNOWN_IDLE_BACKOFF_MS = 60000;
 const OPEN_TURN_IDLE_PROBE_AFTER_MS = 15000;
 // D-6: a session tree's CPU-time delta is process evidence at or above this floor AND at or above 5 % of one core
 // over the sample interval (the park predicate's cpuPct >= 5); the rate keeps a 60 s sample from firing on 0.8 %.
+const BG_OUTPUT_UNREADABLE_DIAG_MS = 10 * 60 * 1000;
 const CPU_ACTIVE_MIN_DELTA_MS = 500;
 const CPU_ACTIVE_MIN_CORE_FRACTION = 0.05;
 // The fast tick fires on a 10 s timer whose jitter must not skip a due sample.
@@ -886,6 +887,17 @@ function createBindings(d) {
       shape.zeros = 0; // a newer snapshot (or no shell to check) restarts the count
       shape.observedAt = ledger.backgroundObservedAt;
     }
+    // D-2: a descendant CPU-time delta is silent-activity evidence; the baseline is independent of snapshots.
+    const cpuNow = Number(sample.descendantCpuTimeMs);
+    if (Number.isFinite(cpuNow)) {
+      if (Number.isFinite(shape.cpuTimeMs)) {
+        const delta = cpuNow - shape.cpuTimeMs;
+        const intervalMs = Number(sample.intervalMs) > 0 ? Number(sample.intervalMs) : (sampledAt - (Number(shape.cpuSampledAt) || 0));
+        if (delta >= Math.max(CPU_ACTIVE_MIN_DELTA_MS, CPU_ACTIVE_MIN_CORE_FRACTION * intervalMs)) ledger.markBackgroundActive(isHookShell, sampledAt);
+      }
+      shape.cpuTimeMs = cpuNow;
+      shape.cpuSampledAt = sampledAt;
+    }
     const leaders = Number(sample.descendantGroupLeaderCount);
     if (leaders > 0 && sampledAt > ledger.backgroundObservedAt && [...ledger.background.values()].some(isHookShell)) {
       const renewed = ledger.renewBackground(isHookShell, sampledAt); // D-1
@@ -915,6 +927,29 @@ function createBindings(d) {
     d.markHeartbeatDirty(session);
   }
 
+  // D-3: the output file of each live hook shell is a second silent-activity signal. Never throws.
+  async function observeTaskOutputs(session, sampledAt) {
+    try {
+      const ledger = session && session._statusLedger;
+      if (!ledger || !d.fsp) return;
+      const entries = [...ledger.background.values()].filter((e) => e.type === 'shell' && e.source === 'hook');
+      for (const e of entries) {
+        const p = typeof d.taskOutputPathFor === 'function' ? d.taskOutputPathFor(session, e.id) : '';
+        if (!p) continue;
+        try {
+          const st = await d.fsp.stat(p);
+          ledger.observeBackgroundOutput(e.id, { size: st.size, mtimeMs: st.mtimeMs }, sampledAt);
+        } catch (err) {
+          const at = Number(sampledAt) || Date.now();
+          if (!(at - (Number(ledger._bgOutputUnreadableAt) || 0) < BG_OUTPUT_UNREADABLE_DIAG_MS)) {
+            ledger._bgOutputUnreadableAt = at;
+            d.recordDiagnostic(session.id, 'status-background-output-unreadable', { id: e.id, code: (err && err.code) || '' });
+          }
+        }
+      }
+    } catch { /* expected: evidence-only observer must never throw into the sampler */ }
+  }
+
   // D-6 cadence: 60 s baseline is the lifecycle sweep's own ps; while any ledger is probable/unknown/near-stall
   // (or a session was just CPU-active) this tick takes ONE cheap ps at STATUS_FAST_SAMPLE_MS. At baseline it is a no-op.
   let cpuTickRunning = false;
@@ -979,7 +1014,7 @@ function createBindings(d) {
     }
   }
 
-  return { timeDrivenTick, inputWaitIsIdle, markHookObserved, ledgerFor, verdictFor, recordEvidence, recordWaitCleared, syncWaitFields, composerMayClose, composerRetryMs, keepBlockingWait, cardGoneTwice, cardSeenTwice, cardKeyFor, scheduleWaitEvaluation, cancelWaitEvaluations, recordPtyChunk, fireStallBackstop, observeTranscriptBoundary, observeTranscriptGrowth, observeCodexRollout, liveStatus, tick, applyCpuSample, applyProcessShape, processSampleTick };
+  return { timeDrivenTick, inputWaitIsIdle, markHookObserved, ledgerFor, verdictFor, recordEvidence, recordWaitCleared, syncWaitFields, composerMayClose, composerRetryMs, keepBlockingWait, cardGoneTwice, cardSeenTwice, cardKeyFor, scheduleWaitEvaluation, cancelWaitEvaluations, recordPtyChunk, fireStallBackstop, observeTranscriptBoundary, observeTranscriptGrowth, observeCodexRollout, liveStatus, tick, applyCpuSample, applyProcessShape, observeTaskOutputs, processSampleTick };
 }
 
 // W-1: under host load shedding the wait-state sweep still owes the sessions whose status truth is at stake: wait fields set,
@@ -998,6 +1033,14 @@ function shedSweepIds(sessionMap, approverBuffers, cap = 4, now = Date.now()) {
   return due.slice(0, cap).map(({ id, s }) => { s._reconcileVisitedAt = now; return id; });
 }
 
+// D-3: Claude Code's background-shell output file. Pure; the server passes uid and its canonical project-entry encoder.
+function claudeTaskOutputPathFor(session, taskId, { uid, encodeClaudeProjectEntry } = {}) {
+  const sid = String((session && session.agentSessionId) || '').trim();
+  const cwd = String((session && session.cwd) || '');
+  if (!sid || !cwd || !/^[\w.-]{1,80}$/.test(String(taskId)) || String(taskId) === '..' || String(taskId) === '.') return '';
+  return require('path').join('/tmp', 'claude-' + uid, encodeClaudeProjectEntry(cwd), sid, 'tasks', taskId + '.output');
+}
+
 // R-10: the constant-size empty keepalive frame, built on the main thread (never behind a read-pool op that can time out).
 function keepaliveFrame(now) {
   return JSON.stringify({ type: 'session-activity', sessions: [], keepalive: true, statusTimestamp: Number(now) || 0, serverNow: Number(now) || 0 });
@@ -1015,6 +1058,7 @@ function rowFields(v, reason) {
 
 module.exports = {
   createBindings,
+  claudeTaskOutputPathFor,
   movingCardKey,
   shedSweepIds,
   keepaliveFrame,

package/template/coding-task-manager/lib/session-title-mirror.js

@@ -76,14 +76,14 @@ async function _mirrorSessionTitleAttempt(o) {
     const message = (error && error.message) || String(error);
     try {
       if (db && typeof db.setSessionTitleMirror === 'function') {
-        db.setSessionTitleMirror(sessionId, { state: 'failed', error: message, value: '' });
+        db.setSessionTitleMirror(sessionId, { state: 'failed', reason: 'exception', error: message, value: '' });
       }
     } catch (persistError) {
       // expected: a persist failure on this catch-all path must not turn a resolved
       // outcome into a throw either.
       void persistError;
     }
-    return { state: 'failed', reason: '', error: message };
+    return { state: 'failed', reason: 'exception', error: message };
   }
 }
 
@@ -91,7 +91,10 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
   const logger = typeof log === 'function' ? log : () => {};
   const persist = (state, reason, error, value) => {
     try {
-      db.setSessionTitleMirror(sessionId, { state, error: error || '', value: value || '' });
+      // D-12: the REASON travels with the outcome — db.setSessionTitleMirror composes
+      // title_mirror_error = reason + (error ? ': ' + error : ''), so an `unsupported` row can no
+      // longer sit there with an empty error and no recorded cause (S-24).
+      db.setSessionTitleMirror(sessionId, { state, reason: reason || '', error: error || '', value: value || '' });
     } catch (persistError) {
       // expected: a persist failure must not turn a resolved outcome into a throw —
       // the caller still gets the real state/reason/error, just unrecorded in the DB.
@@ -147,10 +150,11 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
     outcome = { state: 'unsupported', reason: 'unknown_title_spec_kind', error: '' };
   }
 
-  // Step 7: persist + return.
+  // Step 7: persist + return. D-12: a failure that reports no reason of its own still gets one, so
+  // `failed`/`unsupported` never lands with an empty reason to compose from.
   return persist(
     outcome.state,
-    outcome.reason || '',
+    outcome.reason || (outcome.state === 'failed' ? 'adapter_failed' : ''),
     outcome.error || '',
     outcome.state === 'mirrored' ? name : row.value
   );
@@ -166,6 +170,14 @@ async function _mirrorSessionTitleInner({ db, sessionId, adapters, getTitleSpec
 // Synchronous by design (setSessionTitleNew is a plain DB write, not provider I/O) — callers on
 // a live-session sync tick (lib/coding-agent-models.js, workers/db-owner-worker.js) never await
 // this; a rejection would have nothing to propagate to, so it's log-and-drop and retried next tick.
+// D-9/AC-4c: the LAST agent name a re-assert was fired for, per CTM session. The observed name is
+// re-read on every sync tick (D-10) while the agent's own name only changes when the AGENT renames
+// itself, so a plain per-session memo is what turns "observed on every tick" into "mirrored once per
+// observed name". Convergence clears the entry (the agent's name equals the CTM title again), so a
+// later drift fires again. In-memory by design: it is a coalescing memo for a live process, never a
+// durable state machine — a restart simply re-observes.
+const _lastReassertedName = new Map();
+
 function applyProviderTitle(o = {}) {
   const { db, sessionId, provider, mirror = mirrorSessionTitle } = o;
   const agentName = normalizeSessionTitle(o.agentName);
@@ -175,13 +187,20 @@ function applyProviderTitle(o = {}) {
     if (agentName && agentName !== normalizeSessionTitle(row.title)) {
       // Fire-and-forget re-assert: the agent has drifted from the user's CTM name: push the
       // CTM name back out. NEVER write the agent's name over a user rename.
+      const key = String(sessionId || '');
+      if (_lastReassertedName.get(key) === agentName) return { applied: 'none', reason: 'already_reasserted' };
+      _lastReassertedName.set(key, agentName);
       void mirror({ db, sessionId });
       return { applied: 'reasserted' };
     }
+    if (agentName) _lastReassertedName.delete(String(sessionId || ''));
     return { applied: 'none' };
   }
 
   if (agentName) {
+    // No write churn: a row already carrying this exact name (tier 2 or a tier-3 title that
+    // happens to match) is left alone — no setSessionTitleNew, no updated_at bump.
+    if (row && normalizeSessionTitle(row.title) === agentName) return { applied: 'none', reason: 'unchanged' };
     try {
       // Explicitly detached: the write is best-effort off a live-session sync tick and this
       // function is synchronous, so a rejection has no caller to propagate to — the next tick
@@ -202,57 +221,6 @@ function applyProviderTitle(o = {}) {
   return { applied: 'none' };
 }
 
-// WP-3 (session-rename-mirror §5 D-1, D-4; AC-3d/AC-3e): resolves the Claude agent's OWN
-// session name for feeding applyProviderTitle, on demand for ONE session — never call this from
-// a full-catalog scan loop (see AC-3f's "no process spawn" sibling concern for Codex; this one's
-// hazard is the SDK round-trip, not a spawn). Guarded by getTitleSpec('claude')?.readsUserName:
-// an absent/false spec (the kill switch is `titleSpec: null`) falls straight back to the
-// caller-supplied parser result (parsedTitle, e.g. parseSessionFile's tail/head-scan title)
-// WITHOUT ever touching the SDK adapter (AC-3e). `customTitle` (info.userName) outranks the
-// derived `aiTitle` (info.summary when it differs from the first prompt) — same precedence
-// lib/claude-session-title.js's readClaudeSessionTitle already encodes into its own return shape.
-async function resolveClaudeAgentName(o = {}) {
-  const { sessionId, dir, sdk, parsedTitle = '', getTitleSpec = defaultGetTitleSpec, adapter } = o;
-  const spec = getTitleSpec('claude');
-  if (!spec || !spec.readsUserName) return normalizeSessionTitle(parsedTitle);
-  const claude = adapter || _defaultClaudeAdapter();
-  const info = await claude.readClaudeSessionTitle({ sessionId, dir, sdk });
-  if (!info) return normalizeSessionTitle(parsedTitle);
-  const name = info.userName || info.aiTitle || '';
-  return normalizeSessionTitle(name || parsedTitle);
-}
-
-// Fix round 1 (Finding 1): production wiring for resolveClaudeAgentName — one call per Claude
-// session becoming known/linked to CTM (never a scan/batch loop; the SDK round-trip is the
-// per-session hazard, matching AC-3f's spawn concern for Codex's sibling). Callers use
-// `void fillClaudeAgentTitle(...)` — async, fire-and-forget, never awaited on a hot sync path.
-// Cheap guard BEFORE the SDK read: a tier-1 (user_renamed) row never triggers the round-trip.
-// Never throws into the caller — any error (a throwing db read, a rejecting resolve/apply) is
-// reported via recordSessionDiagnostic (HANDLE) and swallowed; `unsupported`/`sdk_absent` from
-// resolveClaudeAgentName is a normal, silent `{applied:'none'}`, not an error.
-async function fillClaudeAgentTitle(o = {}) {
-  const { db, sessionId, provider = 'claude', claudeSessionId, dir, sdk, getTitleSpec, adapter, recordSessionDiagnostic, log } = o;
-  try {
-    const row = db.getSessionTitleMirror(sessionId);
-    if (row && row.userRenamed && row.title) return { applied: 'none' };
-    const agentName = await resolveClaudeAgentName({ sessionId: claudeSessionId, dir, sdk, getTitleSpec, adapter });
-    if (!agentName) return { applied: 'none' };
-    return applyProviderTitle({ db, sessionId, provider, agentName });
-  } catch (error) {
-    const message = (error && error.message) || String(error);
-    try {
-      if (typeof recordSessionDiagnostic === 'function') {
-        recordSessionDiagnostic(sessionId, 'claude-agent-title-fill-error', { error: message });
-      }
-    } catch (diagError) {
-      // expected: diagnostics must never turn a swallowed error into a throw.
-      void diagError;
-    }
-    if (typeof log === 'function') log('fillClaudeAgentTitle failed', message);
-    return { applied: 'none' };
-  }
-}
-
 // F1 (final review, AC-3g): shared guard for the tier-3 "live label" writer — the ONLY
 // question this answers is "does `existing` already carry a tier that a tier-3 write must
 // never clobber", NEVER a db access itself (pure, so both an on-thread caller with a
@@ -269,4 +237,4 @@ function canWriteTier3Title(existing) {
   return true;
 }
 
-module.exports = { mirrorSessionTitle, isUuidLike, applyProviderTitle, resolveClaudeAgentName, fillClaudeAgentTitle, canWriteTier3Title };
+module.exports = { mirrorSessionTitle, isUuidLike, applyProviderTitle, canWriteTier3Title };

package/template/coding-task-manager/lib/session-transcript-trash.js

@@ -196,7 +196,14 @@ async function findTrashedTranscript({ trashRoot, fileName, fs: fsImpl = fsPromi
     } catch { continue; /* expected: missing/corrupt manifest in this trash dir */ }
     for (const entry of manifest.entries || []) {
       if (path.basename(entry.originalPath) === fileName) {
-        return { trashPath: entry.trashPath, originalPath: entry.originalPath, trashedAt: manifest.trashedAt };
+        // WP-3 (D-13): the manifest already carries WHY it was trashed and when; the card's "why"
+        // sentence is built from these two facts alone, so they travel with the lookup result.
+        return {
+          trashPath: entry.trashPath,
+          originalPath: entry.originalPath,
+          trashedAt: manifest.trashedAt,
+          reason: String(manifest.reason || ''),
+        };
       }
     }
   }

package/template/coding-task-manager/lib/startup-pointer-write.js

@@ -0,0 +1,57 @@
+'use strict';
+// WP-3 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §9 S-11, §10 AC-3a/3b): the
+// startup pointer is written ONLY through db.updateStartupTaskAgentSession, whose
+// `resumesCandidateFork` guard (lib/lead-model-transition-store.js, commit 77b9b3c0e3) keeps the
+// source pointer while a lead-model transition is still active. session-integrity.js used to
+// re-point it with a raw `UPDATE startup_tasks SET args …` that bypassed the guard: the 30-min pass
+// picks the newest transcript row — exactly the uncommitted fork of a half-switched Codex session.
+//
+// Callers hand this the raw better-sqlite3 core handle (workers/db-owner-worker.js
+// 'recoverSessionIntegrity' → db.getDomainDb('core')) or the db module; either way the write goes
+// through the module's guarded writer against the same core table. The writer returns nothing, so
+// `args` is compared before/after to keep the fixed/skipped accounting a raw UPDATE's `.changes` gave.
+
+function readStartupPointerArgs(handle, sessionId) {
+  try {
+    return handle.prepare('SELECT args FROM startup_tasks WHERE ctm_session_id = ?').get(sessionId)?.args;
+  } catch {
+    /* expected: no startup_tasks/args column in a partial fixture schema — the write below reports the real failure */
+    return undefined;
+  }
+}
+
+// Lazy require: db.js is loaded by the owner process already; nothing in its graph requires this file.
+function startupPointerWriter(handle) {
+  if (handle && typeof handle.updateStartupTaskAgentSession === 'function') {
+    return handle.updateStartupTaskAgentSession.bind(handle);
+  }
+  const dbModule = require('../db.js');
+  if (typeof dbModule.updateStartupTaskAgentSession !== 'function') {
+    throw new Error('db.updateStartupTaskAgentSession is unavailable; refusing a raw startup_tasks pointer write');
+  }
+  return dbModule.updateStartupTaskAgentSession;
+}
+
+// The `agent_project_dir`/`claude_project_dir` value currently on the row — the guarded writer
+// rewrites BOTH columns from one argument, so a caller that only means to move `args` hands back
+// what is already stored instead of clearing the dirs.
+function readStartupTaskProjectDir(handle, sessionId) {
+  for (const column of ['agent_project_dir', 'claude_project_dir']) {
+    try {
+      return handle.prepare(`SELECT ${column} AS dir FROM startup_tasks WHERE ctm_session_id = ?`).get(sessionId)?.dir || '';
+    } catch {
+      /* expected: column absent on this schema — try the sibling column */
+    }
+  }
+  return '';
+}
+
+// Move the startup pointer through the guarded writer; returns 1 when the row changed, else 0.
+function writeStartupPointerGuarded(handle, sessionId, resumeArgs, projectDir) {
+  const write = startupPointerWriter(handle);
+  const before = readStartupPointerArgs(handle, sessionId);
+  write(sessionId, Array.isArray(resumeArgs) ? resumeArgs[1] : '', projectDir, resumeArgs);
+  return readStartupPointerArgs(handle, sessionId) === before ? 0 : 1;
+}
+
+module.exports = { writeStartupPointerGuarded, readStartupTaskProjectDir };

package/template/coding-task-manager/lib/state-sync/painted-frame-field.js

@@ -27,12 +27,23 @@ function nearestBreaks(breaks, top) {
   return list.slice().sort((a, b) => Math.abs(top - a.at) - Math.abs(top - b.at)).slice(0, BREAKS_MAX).sort((a, b) => a.at - b.at);
 }
 
+function holdOf(h) {
+  if (!h || typeof h !== 'object') return null;
+  return { kind: typeof h.kind === 'string' ? h.kind : null, rows: isInt(h.rows) && h.rows >= 0 ? h.rows : 0, top: isInt(h.top) ? h.top : null };
+}
+
 // `deps` = { readPainted(id, epoch, from, count), paintedRevisedSince(id, seq) }.
 // -> an object to spread into the frame: {} or { painted: { epoch, top, pinned, floor, revision, breaks, below[, revisedFrom][, from, rows] } }
 function paintedFrameField(deps, id, keyframe, ackedGrid, grid) {
   const now = grid && grid.painted;
   if (!now || typeof now !== 'object') return {};
   const state = { epoch: now.epoch, top: now.top, pinned: now.pinned, floor: now.floor, revision: isInt(now.revision) ? now.revision : 0, breaks: nearestBreaks(now.breaks, now.top), below: isInt(now.below) && now.below > 0 ? now.below : 0 }; // R-F2 (reader-seam-proof-followups): rows the app holds below its screen; a host that never measured it (or an at-rest app) sends 0
+  // Clock-free tests (WP-6): `samples` (the recorder's monotone observe count) and `hold` (the rejected, uncommitted samples) ride
+  // the field so a reader waits on "this write was sampled" instead of a window; neither one decides whether a frame is sent.
+  // Each is present only when the recorder published it, so an older recorder's field is unchanged.
+  if (isInt(now.samples) && now.samples >= 0) state.samples = now.samples;
+  const hold = holdOf(now.hold);
+  if (hold) state.hold = hold;
   const before = ackedGrid && ackedGrid.painted;
   if (keyframe || !before || before.epoch !== now.epoch) return { painted: state };
   const beforeRevision = isInt(before.revision) ? before.revision : 0;