create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/server.js

@@ -36,7 +36,8 @@ process.env.CTM_PROCESS_ROLE = process.env.CTM_PROCESS_ROLE || 'ctm-server';
 // get a second tick to retry (see shared/storage/PERF_SPEC_R6.md V2).
 process.env.CTM_DB_SHADOW_REPLAY = process.env.CTM_DB_SHADOW_REPLAY || '1';
 const serverConfig = require('./lib/server-config');
-const { buildMediaStoreOptions } = require('./lib/media-store-options');
+const { prepareMainMediaStore, createMediaJournalProjector } = require('./lib/media-store-options');
+const { createLegacyDraftCancellationRecovery } = require('./lib/legacy-draft-cancellation-recovery');
 const { runLegacyDraftRequestCancellation } = require('./lib/terminal-draft-request-cancellations');
 try { require('./lib/timestamped-output').installTimestampedOutput(); } catch {}
 
@@ -66,7 +67,7 @@ const { DURABLE_KINDS } = require('../shared/conversation-admission');
 const { scanTuiInputModes, tuiModesChanged } = require('./lib/tui-input-modes');
 const { resumeFirstFrameWatchdogDecision } = require('./lib/resume-firstframe-watchdog');
 const { waitProjection } = require('./lib/session-wait-projection');
-const { normalizeStoreTurns, resumeBlockedWire, sendResumeBlockedToClients } = require('./lib/resume-blocked-wire');
+const { normalizeStoreTurns, resumeBlockedRungWire, resumeBlockSetDetails, resumeBlockedWire, sendResumeBlockedToClients } = require('./lib/resume-blocked-wire');
 const { persistCodexStartupResumeFromLink } = require('./lib/session-create/codex-startup-pointer');
 const {
   resumeHardCeilingEnabled,
@@ -102,6 +103,7 @@ const {
   stripRepliesStateful,
   writeWithDeviceReplyFirewall,
 } = require('./lib/terminal-query-protocol');
+const { observePtyWrite: _observePtyWrite } = require('./lib/hosted-input-dispatch');
 const {
   classifyPtyChunk,
   ptyRuntimeActivityDecision,
@@ -453,7 +455,7 @@ if (_shadowBootSafetyMs > 0) {
   if (t && typeof t.unref === 'function') t.unref();
 }
 
-const { mirrorSessionTitle, fillClaudeAgentTitle } = require('./lib/session-title-mirror');
+const { mirrorSessionTitle, applyProviderTitle } = require('./lib/session-title-mirror');
 const streamResizePolicy = require('./public/js/stream-resize-policy');
 const { turnSettleQuietResizeAction, deferredResizeReleaseDecision } = require('./lib/deferred-resize-quiet-policy');
 const { rowsFlapResizeDecision, DEBOUNCE_MS: ROWS_FLAP_DEBOUNCE_MS, MAX_HOLD_MS: ROWS_FLAP_MAX_HOLD_MS } = require('./lib/rows-flap-debounce');
@@ -649,6 +651,8 @@ const { isCrashCapTripped: _isHostCrashCapTripped } = require('./lib/host-crash-
 // _shutdownOrphanHost below).
 const { createHostHealthLedger, readStallFromDataDir } = require('./lib/host-health-ledger');
 const { createReviveUnresponsiveHost } = require('./lib/host-health-revive');
+// WP-3 (stale-pty-host-evacuation design doc, §6): evacuate first, revive second.
+const { createEvacuateStalledHost, evacuateStalledAdoptedHosts } = require('./lib/host-threadpool-evacuation');
 const {
   createPtyStartupReservation,
   ptyStartupCommitComplete,
@@ -697,6 +701,7 @@ const _typingInteractionTraces = createTypingInteractionTraceStore({
   publicLimit: 128,
   ttlMs: 60_000,
   getRollupExtras: () => buildRollupExtras(_loadPressure.getStatus()), // WP-0 D-4/D-5: report-only
+  mainSpansForWindow: (startMs, endMs) => _mainSpansForWindow(startMs, endMs), // WP-4 r4 R-8: report-only
   // D-1 (composer-typing-freeze-keystroke-slo-2026-09-11.html §5 D-1, §8 WP-0): persist the
   // keystroke-to-paint distribution past the 60s in-memory ring. _eventLoopIncidents is
   // resolved lazily here (this callback only ever runs later, on the flush timer below) even
@@ -1505,17 +1510,7 @@ _perfTracker.namedInterval('timer:visible-revision-watchdog', () => {
       recordDiagnostic: recordSessionDiagnostic,
       coalescer: _visibleRevisionMarginalCoalescer,
     });
-    const session = sessions.get(incident.sessionId);
-    const target = (session?.clients || []).find((client) => (
-      client.clientId === incident.clientId
-      && Number(client.socketGeneration || 0) === Number(incident.socketGeneration || 0)
-    ));
-    if (target?.readyState !== 1 || incident.recoveryAction === 'report-only') continue;
-    // WP-3b (delivery-path reset): the 'fence-generation' recovery action used to fence the
-    // client here (server-side belief the client's baseline generation is invalid); the client
-    // fence is deleted, so this incident now only ever asks for a keyframe, same as any other
-    // recovery action.
-    _requestKeyframeGrant(target, incident.sessionId, { priority: true });
+    // Report-only (lib/visible-revision-watchdog.js): a late boundary never forces a keyframe.
   }
 }, 25).unref?.();
 // WP-3b (delivery-path reset): the fence-breaker sweep (lib/state-sync/fence-breaker.js) existed
@@ -1996,6 +1991,7 @@ const { splitMirrorAndBrowserChunks } = require('./lib/mirror-feed-sanitize');
 const {
   buildSessionStandupSnapshot,
   isWalleOwnedSession,
+  remoteStandupSession,
   selectUnmatchedStartupTaskPlaceholders,
   isStandupStartupTaskSeedEnabled,
 } = require('./lib/session-standup');
@@ -2084,7 +2080,7 @@ const {
 const {
   createCodingAgentModelSync,
   resolveModelToRegistry,
-  shouldApplyCodexAutoTitle,
+  getCodexThreadAgentName,
 } = require('./lib/coding-agent-models');
 const { MODEL_RESULT_PAGE_SIZE, MAX_MODEL_RESULT_BYTES } = require('./lib/coding-session-model-projection'); const { createCodingSessionModelRuntime } = require('./lib/coding-session-model-runtime');
 const { createCodingSessionGenerationRuntime } = require('./lib/coding-session-generation-runtime');
@@ -2141,6 +2137,10 @@ const { evaluateWaitState, shouldClearWaitCard, deriveChoiceLabel, shouldSuperse
 const { selectionCardForViewport } = require('./lib/terminal-interaction-policy');
 const promptIntent = require('./lib/prompt-intent');
 const { canResumeAgent, getAgentCapabilities, getAgentSurfaceIds, normalizeAgentType } = require('./lib/agent-capabilities');
+// WP-4 (docs/remote-hub-followups-credential-projects-rows-idempotency-2026-10-23.html §5 D-12): the
+// SAME `created`-frame builder a fresh spawn uses, so a duplicate create is re-answered with one
+// frame shape, never a second one hand-rolled here.
+const { buildCreatedSessionPayload } = require('./lib/coding-session-model-public');
 const { classifyResumeNoise, resumeFailureDetail } = require('./lib/resume-noise');
 const { createResumeAttemptTracker } = require('./lib/resume-attempts');
 const {
@@ -2190,6 +2190,60 @@ const resumeFromStoreApi = require('./lib/api/resume-from-store');
 const servicesApi = require('./lib/api/services'); const devFaultApi = require('./lib/api/dev-fault');
 const setupNetworkApi = require('./lib/api/setup-network'); const runtimeApprovalsApi = require('./lib/api/runtime-approvals');
 const approvalDeliveryActionApi = require('./lib/api/approval-delivery-action');
+// WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1): the machine registry — routes in
+// lib/api/machines.js, policy/probe loop in lib/machine-registry.js.
+const machinesApi = require('./lib/api/machines');
+const machineRegistry = require('./lib/machine-registry');
+// WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1): this machine's own host
+// stats. The sampler is ONE per process and is fed by the existing 60s resource tick (no new
+// timer); lib/api/host-stats.js is the read surface the picker and the hub's ?machine= proxy use.
+const { createHostStats } = require('./lib/host-stats');
+const hostStatsApi = require('./lib/api/host-stats');
+// WP-6 (remote-machine-hub-sessions-2026-10-22.html §6.6/S-3/S-4): the remote catalog. It is the
+// thin seam behind the two session-list projections below and the resume-on-origin branch; the
+// lookup, the merge and the wire fields all live in lib/remote-machine-catalog.js.
+const remoteMachineCatalog = require('./lib/remote-machine-catalog');
+// WP-6: the catalog's peers are wired HERE. Each of them transitively requires the catalog (the
+// link's relay hook, the create post-hook, the sync worker's probe hook all call into it), so the
+// catalog cannot `require` them without closing a lib/** dependency cycle (lint ceiling: 0). The
+// getters keep them lazy, so this changes no load order — the modules load on the catalog's first
+// use exactly as they did through the removed requires.
+// WP-3 (remote-hub-followups D-9/D-10): the catalog's change signal (lib/remote-machine-catalog.js
+// `_notifyChanged` — a box session-list change, or a sweep that flipped a machine's health). The
+// WS re-broadcast already rides it (`onChange` below); these two additions invalidate the HTTP
+// projections that never call `mergeSessionRows`: the materialized STANDUP snapshot (the phone home
+// list is built ONLY from /api/sessions/standup, so a box card would otherwise never appear or
+// disappear for the phone) and the published recent catalog (whose next build reads a fresh
+// `machineTagInputs()`). Recent rows come from the LOCAL DB and their tags depend only on the
+// registry, so the recent catalog is rebuilt only when the tag inputs change — never on every
+// probe sweep's box session-list refresh (a full read-pool rebuild per sweep).
+let _lastRecentMachineTagSignature = null;
+function _onRemoteMachineCatalogChanged() {
+  _markStandupMaterializedDirty('remote-catalog');
+  const signature = JSON.stringify(remoteMachineCatalog.machineTagInputs());
+  if (signature === _lastRecentMachineTagSignature) return;
+  _lastRecentMachineTagSignature = signature;
+  _advanceRecentCatalogGeneration();
+}
+
+remoteMachineCatalog.configureProduction({
+  link: () => require('./lib/remote-machine-link'),
+  create: () => require('./lib/remote-machine-create'),
+  proxy: () => require('./lib/remote-machine-proxy'),
+  originFacts: () => require('./lib/resume-origin-facts'),
+  db: () => require('./db-owner-client'),
+  // debounced; an unchanged merge is elided by its signature. The getter is called exactly once per
+  // _notifyChanged, so marking the standup snapshot and the recent catalog dirty here changes no
+  // catalog notify semantics.
+  onChange: () => { _onRemoteMachineCatalogChanged(); return broadcastSessionList; },
+  // 2026-10-23 relay-hijack guard (lib/remote-machine-catalog.js _localSessionLookup): a session this
+  // instance holds locally — live or a deferred boot placeholder — is never a box mirror.
+  localSession: () => (ctmSessionId) => !!getSession(ctmSessionId),
+  // WP-1 ingest fence (D-1/D-2): the HUB's own ownership truth — its instance id and its lineage
+  // closure — which no row a box sends can forge. A missing/throwing peer fails OPEN.
+  localInstanceId: () => () => dbModule.getCurrentHostedInstanceId?.() || '',
+  ownerLineage: () => (instanceId) => dbModule.isSameOwnerLineage?.(instanceId) === true,
+});
 const { sendConditionalJson } = require('./lib/api/conditional-json'), { manifestEtagBody: _manifestEtagBody } = require('./lib/instance-manifest-runtime'); // devtunnel-egress D-7: ETag/304 for the identity reads
 const wsRouter = require('./lib/ws-router');
 const { runWsMessageWithTrace } = require('./lib/ws-causal-context');
@@ -2490,7 +2544,7 @@ const {
   loadConfig,
   ensureWalleToken,
 } = serverConfig;
-const providerLoginBroker = new ProviderLoginBroker({ configDir: CONFIG_DIR, createSession: (m) => handleCreatePrepared(null, m), getSession: (id) => getSession(id), resolveCli: (bin) => resolveAgentCliCommand(bin) }); // WP-1: sign-in opens a real terminal tab via the prepared-create entry point; all three args are hoisted functions, resolved at call time
+const providerLoginBroker = new ProviderLoginBroker({ configDir: CONFIG_DIR, createSession: (m) => handleCreatePrepared(null, m), getSession: (id) => getSession(id), resolveCli: (bin) => resolveAgentCliCommand(bin), writeToLoginTab: (s, d) => _writeLifecyclePty(s, d, 'provider-login-code') }); // WP-1: sign-in opens a real terminal tab via the prepared-create entry point; all args are hoisted functions, resolved at call time. The code-return write uses source 'provider-login-code', so it is CTM-generated (never 'input') and cannot move the user-recency clocks
 const bestOfAttempts = createBestOfAttemptService({
   statePath: path.join(CONFIG_DIR, 'best-of-attempts.json'),
   launchAttempt: _launchBestOfAttempt,
@@ -2664,9 +2718,9 @@ const _diagBatcher = createSessionDiagnosticBatcher({
   },
   flush: (batch) => {
     // Off-thread: route the durable batch write through the db-owner worker (the designated
-    // serial writer) so the cross-process SQLite write-lock claim (_writeLockClaim's sync
-    // writeFileSync/linkSync) never blocks the main event loop — it was a ~110ms main-thread
-    // block under multi-session contention. Best-effort: the in-memory ring still serves the UI.
+    // serial writer) so the cross-process SQLite write lock (and any wait for it) never blocks
+    // the main event loop — the old link-claim lock was a ~110ms main-thread block under
+    // multi-session contention. Best-effort: the in-memory ring still serves the UI.
     _runCtmDbWorkerOp('flushSessionDiagnostics', { entries: batch }, { bestEffort: true })
       .catch(() => {});
   },
@@ -4886,7 +4940,7 @@ async function _launchBestOfAttempt(spec) {
     const created = await handleCreatePrepared(null, {
       id: sessionId,
       title,
-      label: title,
+      label: title, titleIntent: 'default', // D-13: `_bestOfAttemptTitle` is CTM-composed (tier 3), never a user name
       cmd: source.cmd || agentType,
       args: bestOfFreshAgentArgs(agentType, source.args, { approvalHookToken: source._approvalHookToken || '' }),
       cwd: workspace.cwd,
@@ -7474,19 +7528,11 @@ function _applyBootRepairsResult(repairs) {
     const timer = setTimeout(continueWalleIdentityRekey, 250);
     timer.unref?.();
   }
-  const repairedTitles = repairs?.titleRepair;
-  if (repairedTitles?.promoted) {
-    console.log(`[session-title] promoted ${repairedTitles.promoted} active startup title(s) into ctm_sessions.title`);
-    telemetry.track('session_title_startup_repair', {
-      promoted: repairedTitles.promoted,
-      scanned: repairedTitles.scanned || 0,
-    });
-  }
   return _refreshControlSnapshot({ reason: 'db-owner-ready' });
 }
 
 // WP-B / B1 (2026-07-31 boot-wedge outage): runBootRepairs performs REPAIRS
-// (session-title repair, codex identity/metadata repair, conversation-source
+// (codex identity/metadata repair, conversation-source
 // migration, order-key backfill, Wall-E identity rekey) — none of it is
 // load-bearing for serving HTTP. The old code awaited this with no
 // try/catch, so a single rejection (that night: a worker-request timeout)
@@ -7853,7 +7899,10 @@ const sessionHostManager = createSessionHostManager({
   // WP-0 (pty-host-threadpool-stranded-waiters-2026-09-25.html, D-3/D-6): report-only
   // seam for the pool/dedicated-host threadpool monitor's frames -- see
   // _recordThreadpoolDiagnostic above and apiServicesStatus's golden-signals feed below.
-  onThreadpoolReport: (snapshot) => _recordThreadpoolDiagnostic(snapshot),
+  // WP-3 (§9 S-7): the record-only sink becomes the escalation's ingress too. `hostHealth` and
+  // `_evacuateStalledHostSafe` are declared later in module evaluation -- this callback only ever
+  // runs after it completes, and the function declaration below hoists.
+  onThreadpoolReport: (snapshot) => { _recordThreadpoolDiagnostic(snapshot); const v = hostHealth.recordThreadpool(snapshot && snapshot.hostId, snapshot); if (v) _evacuateStalledHostSafe(v); },
   // WP-1 (pty-host-threadpool-stranded-waiters-2026-09-25.html, D-2): the manager has no
   // DB/session access of its own -- forward every input-ack frame to the one function
   // that turns it into typing-trace/durable-phase truth.
@@ -7861,7 +7910,7 @@ const sessionHostManager = createSessionHostManager({
   // Probe (mouse-mode handoff): host-reported per-session diagnostic rows (host-handoff-mirror-seed/-restored).
   onSessionDiagnostic: (sessionId, event, details) => recordSessionDiagnostic(sessionId, event, details),
 });
-_ownerRecovery = require('./lib/surviving-owner-bootstrap').createSurvivingOwnerBootstrap({ dataDir: require('./lib/data-dir').getDataDir(), bootId: _serverBootId, manager: sessionHostManager, getTasks: () => dbModule.listStartupTasks(), getSession: (id) => sessions.get(id), send: (ws, reply) => _wsSend(ws, JSON.stringify(reply)) });
+_ownerRecovery = require('./lib/surviving-owner-bootstrap').createSurvivingOwnerBootstrap({ dataDir: require('./lib/data-dir').getDataDir(), bootId: _serverBootId, manager: sessionHostManager, getTasks: () => dbModule.listStartupTasks(), getSession: (id) => sessions.get(id), send: (ws, reply) => _wsSend(ws, JSON.stringify(reply)), onSkip: _restoreWakeSkipSink }); // WP-3 (§9 S-20): wakeSkips('OwnerRecoveryFence'); the fence verdict is untouched
 if (serverConfig.CTM_SESSION_HOST_PROCESS !== '0' && process.env.CTM_SESSION_HOST_POOL_PREWARM !== '0') {
   try { sessionHostManager.prewarmPool?.(); }
   catch (e) { console.error('[session-host-pool] prewarm error:', e.message); }
@@ -7872,8 +7921,16 @@ if (serverConfig.CTM_SESSION_HOST_PROCESS !== '0' && process.env.CTM_SESSION_HOS
 // process globals inside lib/host-health-ledger.js itself); its default
 // D-2(b) input is the WP-0 stall file a stalled pool host writes for its
 // own hostId.
+// WP-3 (session-stops-mid-job-2026-10-24.html, §5 D-10/D-11): liveness is "the
+// host sent any frame". The manager's own per-host frame clock is this ledger's
+// one liveness input: a hard serialize miss on a host whose last frame is newer
+// than the request was issued is 'degraded' (readiness -- reported, never
+// killed), and only a host silent since the first missed request reaches
+// 'unresponsive'.
 const hostHealth = createHostHealthLedger({
   readStall: (hostId) => readStallFromDataDir(require('./lib/data-dir').getDataDir(), hostId),
+  onEvacuate: (v) => _evacuateStalledHostSafe(v), // WP-3 (§9 S-7): the armed-timer half of the same escalation
+  lastFrameAt: (hostId) => sessionHostManager.lastFrameAt(hostId),
 });
 // Final-review fix I6: a host that exits (normally OR by crash) must leave the
 // ledger, or its miss history outlives it -- and a later host reusing the same
@@ -10456,41 +10513,25 @@ setDbMaintenanceRunner(runOnlineDbBackup);
 setImageMetricsRecorder(event => _uploadMetrics.recordUpload(event));
 // WP-0 §6.3/S-8: tpOldestMs on the [img-upload] line comes from the main-process monitor above.
 setThreadpoolStatusReader(() => _mainThreadpoolMonitor.snapshot());
+const _legacyDraftCancellationRecovery = createLegacyDraftCancellationRecovery({
+  getDirectory: () => path.join(serverConfig.CTM_DATA_DIR || path.dirname(dbModule.getDbPath()), 'media-journal'),
+  getContext: () => _ctmDbClosingForProcessExit ? null : dbModule.getDb(),
+  projectEntry: createMediaJournalProjector(_runCtmDbWorkerOp),
+});
 async function _prepareMediaStore() {
-  if (!_mediaWriteBehindEnabled) return null;
+  if (!_mediaWriteBehindEnabled) { await _legacyDraftCancellationRecovery.prepare(); return null; }
   if (_mediaStore) return _mediaStore;
   if (_mediaStorePromise) return _mediaStorePromise;
-  _mediaStorePromise = (async () => {
-    const registry = await _runCtmDbWorkerOp('loadMediaStoreRegistry', {}, {
-      // Listener activation depends on this registry. It is boot-critical
-      // maintenance, while the journal projections below remain background work.
-      priority: 'high',
-      requestClass: 'maintenance',
-      timeoutMs: 30_000,
-    });
-    return createMediaStore(buildMediaStoreOptions({
-      dataDir: serverConfig.CTM_DATA_DIR || path.dirname(dbModule.getDbPath()),
-      bootId: _serverBootId, registry, assertDraftOwner: _assertTerminalDraftOwnerAsync,
+  _mediaStorePromise = prepareMainMediaStore({
+      createStore: createMediaStore, getDataDir: () => serverConfig.CTM_DATA_DIR || path.dirname(dbModule.getDbPath()),
+      bootId: _serverBootId, assertDraftOwner: _assertTerminalDraftOwnerAsync,
       runDbWorkerOp: _runCtmDbWorkerOp,
       onDrainProgress: () => { try { _loadPressure.recordProducerProgress('media-journal'); } catch {} },
-      // WP-1 (docs/image-draft-event-ordering-and-verified-adoption-2026-10-14.html §6.4): the store
-      // is the single draft version allocator. It recovers the highest pending journal version and
-      // then applies verified owner-lineage normalization as one journaled mutation — the draft
-      // restamp was removed from db.js restampOwnerLineage so the two can never allocate
-      // concurrently.
-      //
-      // Review finding 9: the identity source is the LAZY, MEMOIZED accessor
-      // (lib/instance-identity-access.js), not a synchronous main-thread `dbModule.…()` read on the
-      // store-preparation path. getInstanceIdentity() derives at most once per process, only after
-      // the DB is open, and returns null instead of ever inventing a hostname/port-derived default;
-      // isSameOwnerLineage is the existing dbModule-free lineage snapshot used by the session-owner
-      // hot path. Neither is a new DB boundary — both are already the reviewed identity seams.
-      currentOwnerId: _instanceIdentityAccess.getInstanceIdentity({ required: false })?.instanceId
+      getCurrentOwnerId: () => _instanceIdentityAccess.getInstanceIdentity({ required: false })?.instanceId
         || _instanceIdentityAccess.getCachedInstanceId()
         || serverConfig.CTM_INSTANCE_ID || '',
       isSameOwnerLineage: _isSameOwnerLineageSnapshot,
-    }));
-  })().then(store => {
+  }).then(store => {
     // Review finding 6: permanent-delete receipts observed while this store was preparing are
     // applied FIRST — before `_mediaStore` is assigned and therefore before any reader (or the boot
     // reconciler below) can observe the registry.
@@ -10513,6 +10554,7 @@ async function _prepareMediaStore() {
 }
 
 async function _closeMediaStore(timeoutMs = 2_000) {
+  await _legacyDraftCancellationRecovery.close();
   const store = _mediaStore;
   if (!store) return;
   _mediaStore = null;
@@ -10534,7 +10576,8 @@ setImageSaveRunner(async ({ promptId, buffer, filename, mimeType, deferRow, requ
     dbModule.saveImageDecoupled(promptId, buffer, filename, mimeType, { deferRow: !!deferRow }));
 });
 
-function _runLegacyTerminalDraftDbAction(action, args) {
+async function _runLegacyTerminalDraftDbAction(action, args) {
+  await _legacyDraftCancellationRecovery.prepare();
   return _runCtmDbWorkerOp('runDbMutation', { action, args }, {
     priority: 'urgent',
     requestClass: 'user-blocking',
@@ -11749,7 +11792,11 @@ function _auditAuthDecision({ req, auth, rule, decision, route, wsType, action,
 function _rateLimitDecision(auth, rule, keyPath) {
   if (auth?.isLoopback) return { ok: true };
   const key = auth?.deviceId || auth?.tokenHashPrefix || 'anonymous';
-  const kind = rateKindForRule(rule, keyPath);
+  // WP-3 (docs/remote-machine-hub-sessions-2026-10-22.html §6.4): the authenticated principal is
+  // handed to the bucket selector so a `peer-control` hub relay is charged to the wide `peer`
+  // bucket instead of `admin`/`mutation`. Every other caller's bucket is unchanged (rateKindForRule
+  // ignores the argument without that scope).
+  const kind = rateKindForRule(rule, keyPath, auth);
   const decision = authRateLimiter.check(kind, key);
   return decision.ok ? decision : { status: 429, ...decision };
 }
@@ -17204,22 +17251,30 @@ async function handleApi(req, res, url) {
 
 function apiGetProjects(req, res) {
   const claudeProjectsDir = path.join(serverConfig.HOME, '.claude', 'projects');
-  const projects = [];
+
+  const send = (projects) => {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(projects));
+  };
 
   if (fs.existsSync(claudeProjectsDir)) {
-    for (const entry of readClaudeProjectEntries(claudeProjectsDir)) {
-      // Claude encodes paths by replacing / with -
-      const projectPath = entry.startsWith('-') ? entry.replace(/-/g, '/') : entry;
-      projects.push({
-        id: entry,
-        path: projectPath,
-        exists: fs.existsSync(projectPath),
+    // Remote hub follow-ups WP-2 (D-5..D-8, §9 S-8/S-9): the naive `entry.replace(/-/g, '/')`
+    // decode used to name a path that does not exist for most entries (Claude encodes EVERY
+    // non-alphanumeric character as '-'), and every row was listed regardless. The lossless decode,
+    // the existence stat, the gate-scratch filter and the normalized origin key all run in ONE
+    // worktree-worker op now (214 ms cold for 540 entries — never on main). Row shape is unchanged:
+    // {id, path, exists, gitRemoteKey}, with `exists` always true because a missing path is dropped.
+    _runWorktreeWorkerOp('projectRows', { entries: readClaudeProjectEntries(claudeProjectsDir) })
+      .then(({ rows } = {}) => send(Array.isArray(rows) ? rows : []), (error) => {
+        console.warn('[api/projects] project row decode failed:', error?.message || error);
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'projects_unavailable' }));
       });
-    }
+    return;
   }
 
-  res.writeHead(200, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify(projects));
+  // No ~/.claude/projects at all: today's empty answer, no worker round trip.
+  send([]);
 }
 
 async function apiPathStatus(req, res) {
@@ -17335,6 +17390,22 @@ async function _handleClaudeWatcherNew(evt) {
     const db = dbModule.getDomainDb('core');
     const indexedOwner = (agentId) => db.prepare('SELECT agent_session_id, ctm_session_id FROM agent_sessions WHERE agent_session_id = ?').get(agentId)?.ctm_session_id || '';
     const owner = indexedOwner(sessionId);
+    // WP-0 (D-6): every early return between here and the owner's upsert drops that row's
+    // transcript link silently. Name each skip so a missing link is diagnosable.
+    const linkSkipped = (reason) => {
+      if (!owner) return;   // only an owner (claimed) row has a link to lose
+      console.log(`[jsonl-watcher] link-skipped id=${String(sessionId).slice(0, 8)} reason=${reason}`);
+      recordSessionDiagnostic(owner, 'transcript-link-skipped', { reason, filePath: String(filePath || '') });
+    };
+    // WP-1 (D-2): the link is an identity fact known before the observation — filePath + owner.
+    // Write it first so an early return below (superseded / owner-changed / observation-null)
+    // can no longer drop the row's transcript link. projectPath is deliberately omitted here:
+    // upsertSession COALESCEs an empty project_path, so the metadata write below still owns it
+    // (and this stays free of the decode path).
+    if (owner) {
+      await dbModule.upsertSession(owner, { agentSessionId: sessionId, provider: 'claude',
+        jsonlPath: filePath, hostname: HOSTNAME });
+    }
     const collect = () => {
       const candidates = [];
       for (const [id, session] of sessions) {
@@ -17362,8 +17433,8 @@ async function _handleClaudeWatcherNew(evt) {
         ctmSessionId: id, cwd: session.cwd || '', createdAt: session.createdAt,
       })) },
     });
-    if (!prepared) return;
-    if (indexedOwner(sessionId) !== owner) return;
+    if (!prepared) { linkSkipped('observation-null'); return; }
+    if (indexedOwner(sessionId) !== owner) { linkSkipped('owner-changed'); return; }
     const { observation, projectPath, parsed } = prepared;
     const metadata = () => currentMetadata() ? {
       fileSize: observation.fileSize, compactBakSize: observation.compactBakSize, modifiedAt: observation.modifiedAt,
@@ -17372,7 +17443,7 @@ async function _handleClaudeWatcherNew(evt) {
       if (currentMetadata()) _serverCompactBakSizeCache.seed(new Map([[observation.bak.path, observation.bak]]));
     };
     if (owner) {
-      if (!currentMetadata()) return;
+      if (!currentMetadata()) { linkSkipped('superseded'); return; }
       await dbModule.upsertSession(owner, { agentSessionId: sessionId, provider: 'claude', projectPath,
         jsonlPath: filePath, ...metadata(), hostname: HOSTNAME });
       seedBak();
@@ -17404,8 +17475,7 @@ async function _handleClaudeWatcherNew(evt) {
       seedBak();
       broadcastToAll({ type: 'agent-linked', ctmSessionId: chosen.id, agentSessionId: sessionId });
       if (_sessionStream) _sessionStream.linkSession(chosen.id, sessionId, filePath);
-      void fillClaudeAgentTitle({ db: dbModule, sessionId: chosen.id, provider: 'claude', claudeSessionId: sessionId,
-        dir: projectPath, recordSessionDiagnostic });
+      // WP-2 (D-6): the one-shot SDK title fill is deleted — the agent's own name arrives with the transcript ingest.
       return;
     }
     if (!parsed) return;
@@ -17431,10 +17501,8 @@ async function _handleClaudeWatcherNew(evt) {
       console.log(`[jsonl-watcher] Stitched compact-continuation ${sessionId.slice(0,8)} → ctm ${stitchedToCtmId.slice(0,8)}`);
       broadcastToAll({ type: 'agent-linked', ctmSessionId: stitchedToCtmId, agentSessionId: sessionId, stitched: true });
       if (_sessionStream) _sessionStream.linkSession(stitchedToCtmId, sessionId, filePath);
-    } else {
-      void fillClaudeAgentTitle({ db: dbModule, sessionId, provider: parsed.agent || 'claude', claudeSessionId: sessionId,
-        dir: parsed.cwd || projectPath, recordSessionDiagnostic });
     }
+    // WP-2 (D-6/C-9): no title fill here — the continuation's own ingest resolves the predecessor's row as owner.
   } catch (error) {
     console.error('[jsonl-watcher] Error handling new file:', error.message);
   } finally {
@@ -17460,11 +17528,15 @@ async function _handleClaudeWatcherChange(evt, transcriptDeltaCoalescer) {
     const mtime = new Date(mtimeMs).toISOString();
     const db = dbModule.getDomainDb('core');
     let didShrink = false;
+    let previous = null;
     try {
-      const previous = db.prepare('SELECT file_size, compact_bak_size FROM agent_sessions WHERE agent_session_id = ?').get(sessionId);
+      previous = db.prepare('SELECT file_size, compact_bak_size, jsonl_path FROM agent_sessions WHERE agent_session_id = ?').get(sessionId);
       const priorSize = previousJsonlSizeForShrink(previous);
       didShrink = !!(previous && priorSize && size < priorSize);
     } catch { /* metadata lookup failure retains the existing non-shrink policy */ }
+    // WP-1 (D-3): re-link on every file-change while the row has no link. A file-change is proof
+    // the transcript exists, so an unlinked row is repaired here even if its file-new was dropped.
+    const relink = previous && !String(previous.jsonl_path || '').trim() ? filePath : '';
     const statPath = claudeDesktopSessions.sourcePathForStat(filePath);
     if (didShrink) _serverCompactBakSizeCache.clear(filePath, statPath);
     if (_serverCompactBakSizeCache.peekFresh(filePath, statPath) === undefined) {
@@ -17479,9 +17551,14 @@ async function _handleClaudeWatcherChange(evt, transcriptDeltaCoalescer) {
     if (!currentMetadata()) return;
     const fileMeta = _claudeEffectiveFileMeta(filePath, size || 0);
     await _runCtmDbWorkerOp('updateAgentSessionFileMetadata', {
-      sessionId, fileSize: fileMeta.fileSize, compactBakSize: fileMeta.compactBakSize, modifiedAt: mtime,
+      sessionId, fileSize: fileMeta.fileSize, compactBakSize: fileMeta.compactBakSize, modifiedAt: mtime, jsonlPath: relink,
     });
     if (!currentMetadata()) return;
+    // WP-1 (D-3b): a no-jsonl-path park is the exact debt this write resolves — but only when the
+    // row now has a link (just written, or already present). Other park causes stay parked.
+    const debt = _conversationFreshnessDebt.get(sessionId);
+    if (debt && debt.parked === true && /no-jsonl-path|E_NO_JSONL_PATH/.test(String(debt.cause || ''))
+        && (relink || String(previous?.jsonl_path || '').trim())) _clearConversationFreshnessDebt(sessionId);
     publishWatcherFileChange({ sourceId: sessionId, ctmSessionId: sessionId, fileSize: fileMeta.fileSize,
       mtimeMs: Number(mtimeMs || 0) });
     if (didShrink && filePath && fileMeta.compactBakSize > 0) {
@@ -17781,6 +17858,10 @@ function _primaryApiAgentSession(row, agentSessions) {
   return agentSessions.find(agent => agent.agentSessionId === primaryId) || agentSessions[0];
 }
 
+// WP-3 (D-10): the ONE machine-tag rule for a recent row, shared with the CPU/worker projection
+// (lib/recent-catalog-query.js) so the legacy and worker outputs can never disagree.
+const { machineFactsForRecentRow: _machineFactsForRecentRow } = require('./lib/recent-catalog-query');
+
 function _recentSessionFromDbRow(row, options = {}) {
   const agentSessions = _apiAgentSessionsFromDbRow(row, options);
   const primaryAgent = _primaryApiAgentSession(row, agentSessions);
@@ -17833,6 +17914,9 @@ function _recentSessionFromDbRow(row, options = {}) {
     parentAgentSessionId: row.parent_agent_session_id || primaryAgent?.parentAgentSessionId || '',
     agentNickname: row.agent_nickname || primaryAgent?.agentNickname || '',
     agentRole: row.agent_role || primaryAgent?.agentRole || '',
+    // WP-3 (D-10): the machine tag, only when this row's execution host is a registered box — no
+    // machines registered ⇒ no key ⇒ byte-identical to the pre-WP-3 projection (AC-3a).
+    ...(_machineFactsForRecentRow(row, options) || {}),
   };
   return sessionEmpty.applyRecentSessionEmptyState(session, row);
 }
@@ -18175,6 +18259,9 @@ function _scheduleRecentCatalogBuild() {
         hostname: HOSTNAME,
         dbPath: dbModule.getDbPath(),
         liveSessionIds: [...sessions.keys()],
+        // WP-3 (D-10): main's cheap registry snapshot, so the worker can stamp machine/machineName
+        // without any registry read of its own (the read-pool worker has no registry).
+        machineTags: remoteMachineCatalog.machineTagInputs(),
       }, {
         timeoutMs: Math.max(5000, Number(process.env.CTM_RECENT_CATALOG_BUILD_TIMEOUT_MS) || 30_000),
         telemetryReason: 'recent-catalog-publish',
@@ -18363,6 +18450,9 @@ async function _mapRecentSessionRows(rows) {
     hostname: HOSTNAME,
     sliceMs: _SESSION_CATALOG_SLICE_MS,
     liveSessionIds: new Set(sessions.keys()),
+    // WP-3 (D-10): this is the CPU projection the legacy path serves and persists from, so it
+    // stamps the same machine tag the read-pool worker does (both from main's registry snapshot).
+    machineTags: remoteMachineCatalog.machineTagInputs(),
   });
 }
 // Shared read-pool boundary. onFail must serve cache/empty/degraded state; it must never run a
@@ -19941,6 +20031,7 @@ const _statusBindings = statusRuntime.createBindings({
   restoreStarting: (session, now) => restoreRuntime.restoreStartingActive(session, now) || (_restoreInProgress && session._restoredFromStartup),
   isLiveTerminal: (session) => _isLiveTerminalSession(session),
   hasPendingWake: (session, now) => _sessionHasPendingScheduledWake(session, now),
+  taskOutputPathFor: (s, id) => statusRuntime.claudeTaskOutputPathFor(s, id, { uid: process.getuid(), encodeClaudeProjectEntry }),
   fsp: fs.promises, backgroundStore: require('./lib/status-background-store').createStore({ dir: path.join(require('./lib/data-dir').getDataDir(), 'status-background') }), isAdopted: (s) => s.ptyProcess?._adopted === true, pidOf: (s) => s.pid,
   processEvidence: require('./lib/env-flags').boolFlag('CTM_STATUS_PROCESS_EVIDENCE', true), sampler: _sessionResourceSampler, resourceRoots: _lifecycleResourceRoots, liveSessions: _liveLifecycleSessions, getSession: (id) => sessions.get(id), baselineMs: () => _lifecycleConfig.resourceSampleMs,
   dropWaitFingerprint: (s) => _waitStateDelete(s.id, s), probeIdle: (s) => checkIdleNotify(s.id, s, '', 250), clearWaitFields: (s) => _clearServerWaitingForInput(s.id, s), isBlockingWaitReason: (r) => _standupIsBlockingWaitingReason(r), evaluateWait: (id, opts) => reconcileSessionWaitState(id, opts).catch((error) => { errorSink.report('wait-reconcile:evaluate', error, { sessionId: id }); return { read: 'failed', kind: '', raised: false, cleared: false }; }), reconcileQuietMs: () => RECONCILE_QUIET_MS, pressureLevel: () => _lifecyclePressure.level, broadcastPressure: () => _broadcastLifecyclePressureStatus(),
@@ -19952,6 +20043,47 @@ const {
   recordWaitCleared: _recordWaitCleared, syncWaitFields: _syncWaitFields, composerMayClose: _composerMayClose,
 } = _statusBindings;
 
+// WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1, D-15/D-16): the process's ONE
+// host-stats sampler. It is constructed HERE rather than beside _sessionResourceSampler because its
+// two injected readers close over the status bindings directly above and over _liveLifecycleSessions
+// (the accessor that owns the raw session map — session-access lint), so building it after them
+// removes any TDZ window rather than relying on record() only ever running post-boot.
+//   countTasks (D-15): the SAME wire status the sidebar shows (liveStatus/verdictFor), never a new
+//   heuristic — running ∪ stalled ∪ resuming → running, waiting_input → needsYou, idle → idle; plus
+//   the worker count. A session with no status row ('' — non-live PTY, nothing running) lands in no
+//   bucket, matching the pill it renders.
+//   lastCreateAt (D-16): the newest create among LIVE sessions, 0 when none. Live-only is deliberate:
+//   D-16's "use" is a session the machine is actually holding, so an exited tab cannot make the row
+//   look freshly used.
+const _hostStats = createHostStats({
+  db: dbModule,
+  countTasks: () => {
+    const now = Date.now();
+    const tasks = { running: 0, needsYou: 0, idle: 0, workers: 0 };
+    for (const session of _liveLifecycleSessions()) {
+      if (isWorkerSessionObj(session)) tasks.workers += 1;
+      let status = '';
+      try {
+        status = (_ledgerLiveStatus(session, _statusLedgerVerdict(session, now), now) || {}).status || '';
+      } catch {
+        status = ''; // REPORT-lite: a session mid-teardown has no status row; it counts in no bucket
+      }
+      if (status === 'running' || status === 'stalled' || status === 'resuming') tasks.running += 1;
+      else if (status === 'waiting_input') tasks.needsYou += 1;
+      else if (status === 'idle') tasks.idle += 1;
+    }
+    return tasks;
+  },
+  lastCreateAt: () => {
+    let newest = 0;
+    for (const session of _liveLifecycleSessions()) {
+      const createdAt = Number(session.createdAt) || 0;
+      if (createdAt > newest) newest = createdAt;
+    }
+    return newest;
+  },
+});
+
 // A wheel-forwarded repaint is not agent output (the classifier's mouse veto, term-scroll-lag D-5).
 function _mouseProvokedNow(session, now) {
   return outputIsMouseProvoked({ lastMouseInputAtMs: session._lastMouseInputAt || 0, lastNonMouseInputAtMs: session._lastNonMouseInputAt || 0, nowMs: now });
@@ -20469,6 +20601,11 @@ async function _buildStandupSnapshot(options = {}) {
   const standupPairs = [];
   const now = Date.now();
   const activeSessions = [];
+  // WP-3 (D-9): the machine tag inputs, computed ONCE per rebuild (cheap: the registry's TTL
+  // snapshot). With ZERO registered machines nothing below changes a byte — no key is stamped on a
+  // local card and no remote card is appended — mirroring mergeSessionRows' byte-identity rule.
+  const machineTags = remoteMachineCatalog.machineTagInputs();
+  const machinesRegistered = machineTags.machines.length > 0;
 
   // WP-A6: split the per-session work into a cheap synchronous pass (everything below is
   // in-memory/sync) and the one slow await — the timeline-summary lookup. Sequentially
@@ -20544,6 +20681,9 @@ async function _buildStandupSnapshot(options = {}) {
       waitingForInput: wallePendingPermission ? true : _isServerWaitingForInput(session.id, session),
       waitingForInputAt: wallePendingPermission?.waitingForInputAt || session._waitingForInputAt || null,
       waitingReason: wallePendingPermission?.waitingReason || session._waitingForInputReason || '',
+      // WP-3 (D-9): a LOCAL card carries the three routing fields EMPTY — but only once a machine is
+      // registered, so a single-machine hub's card keeps its exact pre-WP-3 key set (AC-3a).
+      ...(machinesRegistered ? { machine: '', machineName: '', machineHealth: '' } : {}),
     };
     activeSessions.push(standupSession);
     standupPairs.push({ session: standupSession, summary });
@@ -20553,13 +20693,13 @@ async function _buildStandupSnapshot(options = {}) {
   // matches the sidebar's (DB-backed, /api/recent-sessions) from the very first snapshot after
   // boot, instead of only catching up ~13s later as the in-memory map fills (R1/R5). Read
   // dynamically (not cached at module load) so the kill switch takes effect without a
-  // restart. This is the ONE synchronous DB read in the whole rebuild — it runs here, inside
-  // the materialized rebuild (already off the hot per-request path; see
-  // _standupSnapshotForRequest), never per-request.
+  // restart. These are the only synchronous DB reads in the whole rebuild — the task list plus ONE
+  // batched durable-title read (WP-5/D-13: the sidebar's ctm_sessions title) — inside the
+  // materialized rebuild (already off the hot per-request path; see _standupSnapshotForRequest).
   if (isStandupStartupTaskSeedEnabled(process.env)) {
     try {
       const startupTasks = dbModule.listStartupTasks();
-      for (const placeholder of selectUnmatchedStartupTaskPlaceholders(activeSessions, startupTasks)) {
+      for (const placeholder of selectUnmatchedStartupTaskPlaceholders(activeSessions, startupTasks, dbModule.getSessionTitlesByIds)) {
         activeSessions.push(placeholder);
         standupPairs.push({ session: placeholder, summary: null });
       }
@@ -20568,6 +20708,26 @@ async function _buildStandupSnapshot(options = {}) {
     }
   }
 
+  // WP-3 (D-9): the box sessions. A LOCAL id always wins (the same rule mergeSessionRows enforces):
+  // an id already present — a live session or a startup-task placeholder — is never re-added. A
+  // remote card is classified from the box row's OWN status fields (lib/session-standup.js
+  // remoteStandupSession); no local PTY helper is ever consulted for a session this host does not
+  // own, and it carries no local stream summary (summary: null). Deliberately NOT pushed into
+  // standupPairs: attention classification reads local scrollback/terminal state by session id.
+  if (machinesRegistered) {
+    const seenIds = new Set();
+    for (const session of activeSessions) {
+      const id = String(session?.id || session?.sessionId || '').trim();
+      if (id) seenIds.add(id);
+    }
+    for (const row of remoteMachineCatalog.remoteRows()) {
+      const id = String(row?.id || row?.sessionId || '').trim();
+      if (!id || seenIds.has(id)) continue;
+      seenIds.add(id);
+      activeSessions.push(remoteStandupSession(row));
+    }
+  }
+
   if (includeAttention) await _applyStandupAttention(standupPairs, now);
 
   const snapshot = buildSessionStandupSnapshot({
@@ -20949,6 +21109,11 @@ async function apiRecentSessions(req, res, url) {
 async function _apiRecentSessionsLegacy(req, res, url, options = {}) {
   const limit = parseInt(url.searchParams.get('limit') || '50', 10);
   const forceRescan = url.searchParams.get('rescan') === '1';
+  // WP-3 (D-10): main's cheap registry snapshot for the DB-only projection below — the same input
+  // the read-pool op carries, so the legacy and published projections stamp identically. Deliberately
+  // read HERE, never in apiRecentSessions (tests/r4-9-recent-sessions-caps.test.js:144 pins that
+  // handler body to a pure published-buffer lookup).
+  const machineTags = remoteMachineCatalog.machineTagInputs();
 
   // First access after (a cold) boot: seed the in-memory cache from the persisted snapshot so this
   // request serves the last good list immediately instead of an empty one. It's marked stale, so
@@ -21117,7 +21282,7 @@ async function _apiRecentSessionsLegacy(req, res, url, options = {}) {
     if (_isProviderChildSessionRow(row)) continue;
     if (existingSessionIds.has(row.id)) continue;
     if (dbRowAgentSessionIds(row).some(agentId => existingSessionIds.has(agentId))) continue;
-    const session = _recentSessionFromDbRow(row, { fileStats });
+    const session = _recentSessionFromDbRow(row, { fileStats, machineTags });
     if (!_shouldIncludeDbOnlyRecentSession(row, session, fileStats)) continue;
     result.push(session);
     existingSessionIds.add(row.id);
@@ -24860,15 +25025,21 @@ function _resolveCodexOwnerCtmSessionId(requestedSessionId, agentSessionId) {
   return requestedSessionId || agentSessionId || '';
 }
 
-function _codexIndexTitleForSession(ctmSessionId, candidateTitle) {
-  let existingTitle = null;
-  try { existingTitle = dbModule.getSessionTitleNew(ctmSessionId); } catch {}
-  const liveSession = sessions.get(ctmSessionId) || null;
-  const candidate = (candidateTitle || '').trim();
-  if (candidate && shouldApplyCodexAutoTitle({ session: liveSession || { title: existingTitle?.title || '', label: existingTitle?.title || '' }, existingTitle })) {
-    return candidate;
-  }
-  return existingTitle?.title || liveSession?.title || liveSession?.label || candidate;
+// WP-4/D-10: read the Codex thread's OWN name (threads.name) and apply it through the shared
+// applyProviderTitle path (tier rules live there, never here) — the ONE entry point for the link
+// path and every Codex rollout event, never a timer. Main-thread-only effects: live label, the
+// startup-task label and one session-list broadcast.
+function _refreshCodexThreadName(ref, liveSession = findLiveSessionByAnyId(ref)) {
+  const threadId = String(liveSession?._claudeSessionId || liveSession?._providerResumeId || '');
+  const agentName = threadId ? getCodexThreadAgentName(threadId) : '';
+  if (!liveSession || !agentName) return { applied: 'none' };
+  const outcome = applyProviderTitle({ db: dbModule, sessionId: liveSession.id, provider: 'codex', agentName });
+  if (outcome.applied !== 'agent') return outcome;
+  const label = `Codex: ${agentName}`;
+  if (liveSession.label !== label) { liveSession.label = label; _invalidateTitleInfoCache(liveSession); }
+  void _detachOwnerMutation('agent-title-label', () => dbModule.updateStartupTaskLabel(liveSession.id, agentName));
+  broadcastSessionList();
+  return outcome;
 }
 
 function _shouldReclaimStandaloneAgentOwner(agentSessionId, ctmSessionId) {
@@ -25005,15 +25176,9 @@ function _linkCodexThreadToSession(ctmSessionId, liveSession, thread, source, re
   }
 
   const title = _codexThreadTitle(thread);
-  try {
-    const titleInfo = dbModule.getSessionTitleNew(ctmSessionId);
-    if (title && shouldApplyCodexAutoTitle({ session: liveSession, existingTitle: titleInfo })) {
-      liveSession.label = `Codex: ${title}`;
-      liveSession._codexTitleSynced = true;
-    } else if (title) {
-      liveSession._codexTitleSynced = true;
-    }
-  } catch {}
+  // WP-4/D-10: the thread's OWN name (threads.name) is read at link through the shared
+  // applyProviderTitle path; no `_codexTitleSynced` latch is set from the index title any more (S-23).
+  try { _refreshCodexThreadName(ctmSessionId, liveSession); } catch (e) { console.error('[codex-link] thread name read error:', e.message); }
 
   const candidateTransitionId = String(liveSession._modelExecutionRecipe?.transitionId || '');
   const startupPointerWritten = persistCodexStartupResumeFromLink({ session: liveSession, dbModule,
@@ -26666,11 +26831,21 @@ function apiGenerateTitles(req, res) {
         if (existing && (existing.userRenamed || existing.titleSource === 'provider_title' || existing.title)) return false;
         return !!s.firstMessage;
       });
-      const skippedInternal = candidates.filter(s => isCtmInternalSession(s.firstMessage));
-      for (const s of skippedInternal) {
-        persistTitleStatus(s.sessionId, 'skipped', 'ctm_internal');
+      // D-7 (WP-3): harness/provider boilerplate (<local-command-caveat>, <task-notification>,
+      // "# AGENTS.md instructions for", a compaction summary) is not a human prompt — the same
+      // predicate server/boot.js's background auto-title job gates its candidates on.
+      const needTitles = [];
+      for (const s of candidates) {
+        if (isCtmInternalSession(s.firstMessage)) {
+          persistTitleStatus(s.sessionId, 'skipped', 'ctm_internal');
+          continue;
+        }
+        if (!isHumanPromptCandidate(s.provider, s.firstMessage)) {
+          persistTitleStatus(s.sessionId, 'skipped', 'not_human_prompt');
+          continue;
+        }
+        needTitles.push(s);
       }
-      const needTitles = candidates.filter(s => !isCtmInternalSession(s.firstMessage));
 
       if (needTitles.length === 0) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -26686,19 +26861,9 @@ function apiGenerateTitles(req, res) {
       // provider credentials itself; a credential-less setup surfaces as a normal
       // callClaudeAsync failure below, classified by titleGenerationFailureInfo().
 
-      // Strip resume/continuation boilerplate from first messages
-      function cleanFirstMessage(msg) {
-        if (!msg) return '';
-        return msg
-          .replace(/^This session is being continued from a previous conversation[^\n]*\n*/i, '')
-          .replace(/^Continue the conversation[^\n]*\n*/i, '')
-          .replace(/^Resume:?\s*/i, '')
-          .replace(/^Summary:?\s*\n?/i, '')
-          .replace(/^The summary below covers[^\n]*\n*/i, '')
-          .replace(/^\[(?:Request interrupted|Tool use|Error|Retrying)[^\]]*\]\s*/g, '')
-          .trim();
-      }
-
+      // Resume/continuation boilerplate is stripped by server/boot.js's cleanFirstMessage, shared
+      // with the background auto-title job (its `This session is being continued…` line is gone:
+      // isHumanPromptCandidate already rejects that compaction row).
       const prompt = `Generate short, descriptive titles (max 60 chars) for these Claude Code sessions.
 Each session has an ID and the user's first message. Create a title that summarizes what the user was working on.
 
@@ -27533,7 +27698,7 @@ function _sessionLifecycleView(session, options = {}) {
     pinned: !!session?._lifecyclePinned,
     isActiveTab: !!(session?.id && _sessionIsDeclaredShown(session.id)),
     isMru: !!(session?.id && mruIds.has(session.id)),
-    hasBackgroundShell: !!(_statusLedgerFor(session)?.backgroundLive(now)) || (!_statusLedgerFor(session)?.backgroundDeclared && _backgroundAgentsActive(session, now)),
+    hasBackgroundShell: !!(_statusLedgerFor(session)?.backgroundActive(now)) || (!_statusLedgerFor(session)?.backgroundDeclared && _backgroundAgentsActive(session, now)),
     isRestoring: _inRestoreStorm() || restoreRuntime.restoreStartingActive(session),
     recentNonStatusActivityAt: Number(session?._lastMeaningfulNonStatusAt || session?.lastMeaningfulActivityAt || 0),
     lastActivatedAt: Number(session?._lastActivatedAt || 0),
@@ -27913,6 +28078,25 @@ function _lifecycleProvider(session) {
   return detectAgentType(session?.cmd || '') || session?.agentType || session?.type || 'unknown';
 }
 
+// WP-3 (§5 D-5/D-6, D-9): the one recorder for a skip that does NOT flow through the
+// _setDeferredRestoreStarting funnel. Per-session latch: a session skipped for the SAME reason
+// (drain passes, background-client storms) records once per episode; the claim clears it.
+function _noteWakeSkip(session, reason, detail = {}, id = '') {
+  if (!reason) return;
+  if (session && session._lastRestoreSkip?.reason === reason) return;
+  if (session) session._lastRestoreSkip = { reason, at: Date.now() };
+  const sid = String(id || session?.id || '');
+  if (sid) {
+    try { recordSessionDiagnostic(sid, 'deferred-restore-skip', { reason, ...detail }); }
+    catch { /* expected: session diagnostics ring is not constructed in sliced unit harnesses */ }
+  }
+  try { _lifecycleDiagnostics.recordWakeSkip({ id: sid, provider: _lifecycleProvider(session), reason: String(reason) }); }
+  catch { /* expected: lifecycle diagnostics are not constructed in sliced unit harnesses */ }
+}
+
+// WP-3 (§9 S-10..S-20): the `onSkip(reason, id, session)` dep the extracted restore helpers use.
+function _restoreWakeSkipSink(reason, id, session) { _noteWakeSkip(session, reason, {}, id); }
+
 function _canonicalLifecycleWakePhases(phases = {}) {
   return {
     admitted: Number(phases.gateAdmittedAt || phases.activationRequestedAt || 0),
@@ -28155,12 +28339,23 @@ function _lifecycleOrphanTotals() {
 }
 
 async function _refreshLifecycleOrphanTotals() {
+  if (_lifecycleOrphanGroups.size === 0) return _lifecycleOrphanTotals();
+  // D-9 (WP-6, clock-free-tests-followups-2026-10-23 §5 D-9): ONE whole-table `ps` for the whole
+  // sweep. N orphan groups used to mean N table reads; the rows are identical within a sweep.
+  let rows;
+  try {
+    rows = await _sessionResourceSampler.sampleProcessTable();
+  } catch {
+    /* expected: best-effort sweep — a failed read skips this refresh and keeps the stored groups for
+       one more sweep, exactly like the per-group catch below, instead of dropping known orphans. */
+    return _lifecycleOrphanTotals();
+  }
   for (const [pgid, prev] of [..._lifecycleOrphanGroups]) {
     try {
       // D-4/D-6 (session-park-busy-background-shell-truth-2026-10-14): carry the stored survivor set
       // forward, so a survivor that leads its OWN process group (invisible to the pgid rollup) is not
       // forgotten by the next sweep while it is still alive.
-      const group = await _sessionResourceSampler.sampleProcessGroup(pgid, prev?.survivorPids || []);
+      const group = await _sessionResourceSampler.sampleProcessGroup(pgid, prev?.survivorPids || [], { rows });
       if (group.procCount > 0) _lifecycleOrphanGroups.set(pgid, group);
       else _lifecycleOrphanGroups.delete(pgid);
     } catch {}
@@ -28280,7 +28475,7 @@ function _stripPtyOutputReplies(session, sessionId, data, site) {
 }
 
 function _writeLifecyclePty(session, data, source = 'input', options = {}) {
-  if (!session?.ptyProcess) return { posted: false, inputSeq: 0 };
+  if (!session?.ptyProcess) return { posted: false, inputSeq: 0, dispatchDisposition: 'preflight-refused' };
   // Image, typing and lifecycle frames share one monotonic transport sequence. Typing keeps its
   // separate echo counter and passes the exact allocated frame sequence through options.inputSeq.
   // WP-2 (§6.2, D6): ONE monotonic allocator for every host frame. Keystrokes pass the exact seq they
@@ -28312,23 +28507,22 @@ function _writeLifecyclePty(session, data, source = 'input', options = {}) {
     }
   }
   session._lifecycleInputInFlight = true;
+  let dispatchDisposition = 'preflight-refused';
   try {
-    // WP-1 (D-2): `session.ptyProcess.write` is HostedPtyAdapter.write, which returns
-    // whether the frame was POSTED to the host -- never whether the byte was written.
-    // "written" is a fact that arrives later as an 'input-ack' frame (see
-    // _onHostInputAck below); nothing here may treat a truthy synchronous return as
-    // delivery proof.
+    // A1: preserve the selected writer's legacy result while observing its actual route.
+    // Neither a Boolean nor this local disposition is byte-write or withdrawal proof;
+    // the separate input-ack is still the host's byte-write observation.
     const posted = writeWithDeviceReplyFirewall({
       data,
       exempt: authoritativeDeviceReply,
-      // A real HostedPtyAdapter.write() returns an explicit boolean ("posted to the
-      // host", never "written"). Legacy/non-hosted/test-double PTYs whose write() has no
-      // return value (undefined) keep today's behavior: not throwing means posted; only
-      // an EXPLICIT `false` return means the frame never left this process.
-      write: value => session.ptyProcess.write(value, { inputSeq }) !== false,
+      write: value => {
+        const observed = _observePtyWrite(session.ptyProcess, value, { inputSeq });
+        dispatchDisposition = observed.disposition;
+        return observed.posted;
+      },
       onDrop: classification => _recordDroppedDeviceReply(session, source, classification),
     });
-    return { posted: posted === true, inputSeq };
+    return { posted: posted === true, inputSeq, dispatchDisposition };
   }
   finally { session._lifecycleInputInFlight = false; }
 }
@@ -28348,7 +28542,7 @@ function _lifecycleBackgroundLease(session, now = Date.now()) {
   const ledger = session ? _statusLedgerFor(session) : null;
   const snap = ledger && typeof ledger.backgroundSnapshot === 'function' ? ledger.backgroundSnapshot(now) : null;
   if (!snap || !Array.isArray(snap.entries) || !snap.entries.length) return null;
-  let shells = 0, tasks = 0, firstSeenAt = Infinity, renewedAt = 0, expiresAt = Infinity, renewals = 0, capCrossed = 0;
+  let shells = 0, tasks = 0, firstSeenAt = Infinity, renewedAt = 0, expiresAt = Infinity, renewals = 0, capCrossed = 0, quiet = 0, activeAt = 0;
   for (const e of snap.entries) {
     if (e.type === 'shell') shells += 1; else tasks += 1;
     firstSeenAt = Math.min(firstSeenAt, Number(e.firstSeenAt) || 0);
@@ -28356,8 +28550,10 @@ function _lifecycleBackgroundLease(session, now = Date.now()) {
     expiresAt = Math.min(expiresAt, Number(e.expiresAt) || 0);
     renewals += Number(e.renewals) || 0;
     if (Number(e.capCrossedAt) > 0) capCrossed += 1;
+    if (typeof ledger.backgroundQuiet === 'function' && ledger.backgroundQuiet(e, now)) quiet += 1; // D-5: no classifier, nothing is quiet
+    activeAt = Math.max(activeAt, Number(e.activeAt) || 0);
   }
-  return { shells, tasks, firstSeenAt, renewedAt, expiresAt, renewals, capCrossed };
+  return { shells, tasks, firstSeenAt, renewedAt, expiresAt, renewals, capCrossed, quiet, activeAt };
 }
 
 function _lifecycleJournalGate(session, decision, configName) {
@@ -29013,6 +29209,17 @@ async function _sampleLifecycleResources(options = {}) {
       _sessionResourceSampler.warnedPressureFailure = true;
       console.warn('[lifecycle] memory-pressure probe was unparseable; treating pressure as normal');
     }
+    // WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1/D-11): one host sample per
+    // RESOURCE SAMPLE, hooked here rather than in _runLifecycleSweep on purpose. This function's own
+    // due() gate (CTM_RESOURCE_SAMPLE_MS, default 60 s) is what makes host_samples hold "one row per
+    // minute, ≤1440 rows/machine" -- the same number db.js's listHostSamples caps at, so a 24 h read
+    // always fits. Hooking the sweep instead would record on the 30 s maintenance tick and halve the
+    // readable window (the read takes the OLDEST `limit` rows in the window). No new timer either
+    // way. Fire-and-forget: record() is defined never to throw and a failed sub-read degrades to null
+    // fields, but a rejection here would still be a bug, so it is reported rather than swallowed.
+    void _hostStats.record(snapshot).catch((error) => {
+      errorSink.report('host-stats:record', error, { at: Number(snapshot && snapshot.sampledAt) || 0 });
+    });
     for (const resource of snapshot.sessions || []) {
       const session = sessions.get(resource.id);
       if (!session || session._restoreDeferred) continue;
@@ -29029,7 +29236,7 @@ async function _sampleLifecycleResources(options = {}) {
       // matches every other footprint field's "sampled vs not yet" contract in this file.
       session.footprintMB = resource.footprintMB == null ? null : resource.footprintMB;
       _statusBindings.applyCpuSample(session, resource);
-      if (resource.agentProcCount > 0) { session.descendantGroupLeaderCount = resource.descendantGroupLeaderCount; _statusBindings.applyProcessShape(session, resource); } // D-10: unknown agent pid is not zero
+      if (resource.agentProcCount > 0) { session.descendantGroupLeaderCount = resource.descendantGroupLeaderCount; _statusBindings.applyProcessShape(session, resource); void _statusBindings.observeTaskOutputs(session, resource.sampledAt); } // D-10: unknown agent pid is not zero
     }
     const previousPressure = _lifecyclePressure.level;
     const pressureResult = _lifecyclePressure.observe(snapshot.signals || snapshot.pressure, {
@@ -29895,7 +30102,12 @@ wss.on('connection', async (ws, req) => {
   const url = new URL(req.url, `http://${req.headers.host}`);
   const reqSnapshot = {
     socket: { remoteAddress: _remoteIpFromReq(req) },
-    headers: { 'user-agent': req.headers?.['user-agent'] || '' },
+    // X-CTM-Forwarded-By (WP-2a P-3) joins the snapshot so the WS create path can apply the
+    // one-hop guard (lib/remote-machine-create.js forwardRemoteCreate reads it off ctx.ws here).
+    headers: {
+      'user-agent': req.headers?.['user-agent'] || '',
+      'x-ctm-forwarded-by': req.headers?.['x-ctm-forwarded-by'] || '',
+    },
   };
   const cfDecision = cloudflareAccessVerifier.verifyRequestSync(req, { isLocalhost });
   if (!cfDecision.ok) {
@@ -31389,6 +31601,9 @@ headlessWorker.on('message', _perfTracker.wrap('worker:headless-terminal-message
       ? _recordInputEchoFromFrame(session, msg.echoedThroughSeq, Date.now(), {
         targetClientId: String(msg.targetClientId || ''),
         targetSocketGeneration: Number(msg.targetSocketGeneration || 0),
+        // WP-4 (R-7): session-host-manager.js's `_stampMainArrival` stamped this frame object
+        // when it first touched the main thread; 0 when the sender predates the stamp.
+        frameArrivedAt: Number(msg._mainArrivedAt) || 0,
       })
       : [];
     const holdingRestoreFrames = _stateSyncHoldingRestoreFrames(session);
@@ -33896,6 +34111,35 @@ function _sendWalleSessionCreated(ws, session, extra = {}) {
   return true;
 }
 
+// WP-4 (§5 D-12): the `created` frame a DUPLICATE same-id create for an ALREADY LIVE native session
+// is re-answered with. Byte-for-byte the frame the spawn path sends (lib/session-create/response.js's
+// sendCreated): the SAME builder, the SAME `_sessionPayload` projection, the same arguments -- read
+// off the LIVE session object instead of the spawn's locals. No attach, no snapshot, no
+// client-list mutation, no state-sync subscription: the client attaches itself on `created`, exactly
+// as it does after a fresh create (public/index.html's onCreated replaces the tab in place).
+function _sendNativeSessionCreated(ws, session) {
+  if (!ws || ws.readyState !== 1 || !session || typeof session !== 'object') return false;
+  const cmd = session.cmd || session.shell || '';
+  const createAgentType = session.agentType || detectAgentType(cmd);
+  _wsSend(ws, JSON.stringify(buildCreatedSessionPayload({
+    sessionPayload: _sessionPayload(session, { lightweight: true, stormSafe: true }),
+    session,
+    id: session.id,
+    // The session's CURRENT pid. On a hosted PTY the adapter re-points `ptyProcess.pid` from the
+    // wrapper to the real child once the host receipt lands, so this can differ from the pid the
+    // first `created` named; the re-answer reports the live truth, not a replay.
+    pid: session.ptyProcess.pid,
+    cwd: session.cwd || '',
+    cmd,
+    args: Array.isArray(session.args) ? session.args : [],
+    branch: session.branch ?? null,
+    createAgentType,
+    projectDirName: session._claudeProjectDir ? path.basename(session._claudeProjectDir) : null,
+    getAgentCapabilities,
+  })));
+  return true;
+}
+
 // WP-3 (design/walle-conv-order-authority-2026-08-21 D-5, §6): min/max order key over a
 // served page's messages, for the envelope's keyRange. Min/max (not first/last array
 // position) because callers serve pages in different physical row orders (e.g. a
@@ -35913,6 +36157,37 @@ function _onHostInputAck(session, ack, origin = null) {
   }
 }
 
+// WP-4 (R-8): the top ≤3 recent main-thread spans overlapping [startMs, endMs], by overlapped ms
+// descending, as `{ name, overlapMs }` -- "what was main running while this frame was in flight".
+// Reads the same recent-span ring lib/perf-tracker.js's selectBlockCoverage reads (via its
+// getRecentSpans accessor; `eventLoopBlockOverlap` is the aggregate view of the same ring and
+// names no op, so it cannot answer this). A pure read + compute: no span is recorded, no counter
+// moves, and a caller can never make this loop do work it would not otherwise do. Spans on a
+// different clock (or absent) simply contribute nothing.
+function _mainSpansForWindow(startMs, endMs) {
+  const start = Number(startMs);
+  const end = Number(endMs);
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return [];
+  // The window's own start can be older than the ring's default 3 s lookback; ask for the ring's
+  // full 24-span depth and let the overlap test below decide.
+  const spans = _perfTracker.getRecentSpans({ maxAgeMs: Math.max(3000, Date.now() - start + 1000), limit: 24 }).recent;
+  const byName = new Map();
+  for (const span of spans) {
+    if (!span) continue;
+    const spanStart = Number(span.start);
+    const spanEnd = Number(span.end);
+    if (!Number.isFinite(spanStart) || !Number.isFinite(spanEnd)) continue;
+    const overlap = Math.min(spanEnd, end) - Math.max(spanStart, start);
+    if (overlap <= 0) continue;
+    const name = String(span.name || '').slice(0, 120);
+    if (!name) continue;
+    byName.set(name, (byName.get(name) || 0) + overlap);
+  }
+  return Array.from(byName, ([name, overlapMs]) => ({ name, overlapMs: Math.max(0, Math.floor(overlapMs)) }))
+    .sort((a, b) => b.overlapMs - a.overlapMs)
+    .slice(0, 3);
+}
+
 function _recordInputEchoFromFrame(session, echoedThroughSeq, at = Date.now(), target = {}) {
   if (!session || !(session._inputEchoPending instanceof Map)) return [];
   const echoed = Math.max(0, Number(echoedThroughSeq) || 0);
@@ -35930,6 +36205,10 @@ function _recordInputEchoFromFrame(session, echoedThroughSeq, at = Date.now(), t
   }
   const targetClientId = String(target.targetClientId || '');
   const targetSocketGeneration = Number(target.targetSocketGeneration || 0);
+  // WP-4 (clock-free-tests-followups-r4-2026-10-24.html §5 R-7/R-8, §6.5): the frame's arrival
+  // stamp, set by session-host-manager.js's `_stampMainArrival` at the first main-thread touch.
+  // 0 (an older/unstamped sender) means "no arrival leg to price" -- never a real epoch 0.
+  const frameArrivedAt = Math.max(0, Math.floor(Number(target.frameArrivedAt) || 0));
   for (const [seq, rawRecord] of session._typingInteractionByInputSeq || []) {
     if (seq > echoed) continue;
     const record = typeof rawRecord === 'string'
@@ -35938,6 +36217,14 @@ function _recordInputEchoFromFrame(session, echoedThroughSeq, at = Date.now(), t
     if (!record?.interactionId) continue;
     if (!record.mirrored) {
       _noteTypingInteraction({ interactionId: record.interactionId, stage: 'mirror-revision', at });
+      // R-7/R-8: exactly the interactions that just got `mirror-revision` also get
+      // `frame-arrived`, at the arrival instant rather than at the instant main finished
+      // stamping -- the difference between the two IS the receiver-loop leg this measures.
+      // R-8's mainSpans are attached by the trace store once BOTH this stamp and the worker's
+      // `frame-posted` are in (either order; see mainSpansForWindow at its construction).
+      if (frameArrivedAt > 0) {
+        _noteTypingInteraction({ interactionId: record.interactionId, stage: 'frame-arrived', at: frameArrivedAt });
+      }
       record.mirrored = true;
       session._typingInteractionByInputSeq.set(seq, record);
     }
@@ -36295,7 +36582,7 @@ function _terminateResumeLifecycle(session, failure) {
     agentType: session._resumeAgentType || detectAgentType(session.cmd) || '',
     generation,
   };
-  markSessionResumeBlocked(session.id, info);
+  markSessionResumeBlocked(session.id, info, 'lifecycle-terminate');
   session._resumeAttemptFailed = true;
   // This is a system-enforced provider termination, not an explicit user close. The PTY exit
   // handler already suppresses auto-restart while `resumeBlocked` is set, and
@@ -36846,6 +37133,10 @@ const _DETERMINISTIC_PREFLIGHT_CODES = new Set([
   'missing_claude_transcript',
   'missing_codex_rollout',
   'agent_cli_not_found',
+  // WP-1 (docs/codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-4, §9 S-7): a Codex
+  // thread created on a gateway provider no native config load can resolve. Retrying cannot heal it
+  // — the picker (or the journal-backed repair, D-3) is the only way out — so it quarantines.
+  'codex_provider_missing',
 ]);
 
 // Pure decision (test seam): is a resume-preflight failure DETERMINISTIC (quarantine) or
@@ -36871,7 +37162,7 @@ function _shouldRefreshLaunchReadinessForBlock(code, blockDeterministic) {
   return code === 'launch_rollout_index_pending' && blockDeterministic !== true;
 }
 
-function markSessionResumeBlocked(sessionId, info = {}) {
+function markSessionResumeBlocked(sessionId, info = {}, site = 'unspecified') {
   const id = String(sessionId || '');
   if (!id) return null;
   const record = {
@@ -36892,24 +37183,18 @@ function markSessionResumeBlocked(sessionId, info = {}) {
     checkedAt: info.checkedAt || '',
     // WP-2: 'removed'|'never_seen'; only set on the two missing-transcript codes.
     localHistory: info.localHistory || (['missing_claude_transcript', 'missing_codex_rollout'].includes(info.code) ? 'unknown' : ''), lastSeenBytes: Number(info.lastSeenBytes) || 0,
-    lastSeenAt: info.lastSeenAt || '', trashPath: info.trashPath || '', originalPath: info.originalPath || '',
+    lastSeenAt: info.lastSeenAt || '', trashPath: info.trashPath || '', originalPath: info.originalPath || '', trashReason: info.trashReason || '', trashedAt: info.trashedAt || '',
     // WP-6: the resume ladder's answer, only on the two missing-transcript codes.
     resumeRung: info.resumeRung || '', coverage: info.coverage || null, offerStoreFirst: info.offerStoreFirst === true, restoreError: info.restoreError || '',
   };
   _resumeBlockedSessions.set(id, record);
+  // WP-0 (D-8): one diagnostic names the site that set this block, so a card the user saw is always
+  // attributable to a code path -- including the sites that used to log nothing at all.
+  recordSessionDiagnostic(id, 'resume-blocked-set', resumeBlockSetDetails(site, record));
   // WP-2: callers that built an info object inline get the enriched record back instead of re-reading the map.
   return record;
 }
 
-// The ladder fields every resume-blocked message for a missing transcript carries (S-33).
-function _resumeBlockedRungWire(info) {
-  return {
-    resumeRung: info?.resumeRung || '', coverage: info?.coverage || null, offerStoreFirst: info?.offerStoreFirst === true, restoreError: info?.restoreError || '',
-    deterministic: info?.deterministic === true, origin: info?.origin || 'unknown',
-    storeTurns: normalizeStoreTurns(info?.storeTurns), checkedAt: info?.checkedAt || '',
-  };
-}
-
 // WP-2 (multi-machine §C): the pure relative-origin rule now lives in lib/resume-origin-facts.js, so this
 // launch-plan projection, the resume-blocked record and the transcripts route share exactly one rule.
 // Re-exported here under the name every existing call site in this file already uses.
@@ -36944,9 +37229,17 @@ function isSessionResumeBlocked(sessionId) {
 // explicit user action (attach, click, "Start fresh here") — those paths consult the block
 // directly (see `_startDeferredRestoreSession`), not this drain-eligibility predicate.
 function _sessionEligibleForAutoResumeDrain(session, isBlockedFn) {
+  // WP-3 (§9 S-19): only the two NON-normal-state arms below are skips (a session merely not being a
+  // drain candidate is not). Zero return-value change; sliced into bare vm contexts by unit tests.
   if (!session || !session._restoreDeferred || session._restoreStarting || session._exited) return false;
-  if (!sessionPolicy(session).relaunchFromRestore) return false;
-  if (typeof isBlockedFn === 'function' && isBlockedFn(session.id)) return false;
+  if (!sessionPolicy(session).relaunchFromRestore) {
+    _noteWakeSkip(session, 'DrainIneligible');
+    return false;
+  }
+  if (typeof isBlockedFn === 'function' && isBlockedFn(session.id)) {
+    _noteWakeSkip(session, 'ResumeBlocked');
+    return false;
+  }
   return true;
 }
 
@@ -37021,16 +37314,16 @@ function _notifyResumePreflightFailure(id, ws, agentType, result) {
   let blockedInfo = null;
   if (deterministic) {
     blockedInfo = {
-      ..._resumeBlockedRungWire(result), code: result.code || 'resume_blocked', message, agentType, detail: result.detail || '', attempts: Number(result.attempts || 0), deterministic: true,
+      ...resumeBlockedRungWire(result), code: result.code || 'resume_blocked', message, agentType, detail: result.detail || '', attempts: Number(result.attempts || 0), deterministic: true,
       origin: result.origin || _resumeOriginForSession(id), storeTurns: result.storeTurns, checkedAt: result.checkedAt || new Date().toISOString(),
-      localHistory: result.localHistory, lastSeenBytes: result.lastSeenBytes, lastSeenAt: result.lastSeenAt, trashPath: result.trashPath, originalPath: result.originalPath,
+      localHistory: result.localHistory, lastSeenBytes: result.lastSeenBytes, lastSeenAt: result.lastSeenAt, trashPath: result.trashPath, originalPath: result.originalPath, trashReason: result.trashReason, trashedAt: result.trashedAt,
     };
-    blockedInfo = markSessionResumeBlocked(id, blockedInfo) || blockedInfo; // WP-2: the wire carries the enriched record (host + peer + transcript state)
+    blockedInfo = markSessionResumeBlocked(id, blockedInfo, 'preflight') || blockedInfo; // WP-2: the wire carries the enriched record (host + peer + transcript state)
   }
   if (!ws) return deterministic;
   if (deterministic) {
     try {
-      _wsSend(ws, JSON.stringify(resumeBlockedWire(id, blockedInfo, { agentType, rungWire: _resumeBlockedRungWire(blockedInfo) })));
+      _wsSend(ws, JSON.stringify(resumeBlockedWire(id, blockedInfo, { agentType, rungWire: resumeBlockedRungWire(blockedInfo) })));
     } catch {}
   } else {
     try {
@@ -37091,7 +37384,7 @@ function _notifyPreparedResumePreflightFailure(id, ws, agentType, resumePrefligh
   if (MISSING_TRANSCRIPT_CODES.has(resumePreflight.code) && existingSession) {
     existingSession._resumeRung = {
       code: resumePreflight.code, message: resumePreflight.message || '', resumeId: resumePreflight.resumeId || '',
-      ..._resumeBlockedRungWire(resumePreflight), origin: resumePreflight.origin || _resumeOriginForSession(id),
+      ...resumeBlockedRungWire(resumePreflight), origin: resumePreflight.origin || _resumeOriginForSession(id),
     };
   }
   _notifyResumePreflightFailure(id, ws, agentType, resumePreflight);
@@ -37129,7 +37422,7 @@ function _blockResumeAttempt(session, code, message, detail) {
     attempts: Number(attemptState.failures || attemptState.attempt || 1),
     agentType: session._resumeAgentType || detectAgentType(session.cmd) || '',
   };
-  markSessionResumeBlocked(session.id, info);
+  markSessionResumeBlocked(session.id, info, 'attempt-block');
   markResumeFailureExit(session, { code, source: code });
   _clearResumeLoading(session, code);
   recordSessionDiagnostic(session.id, 'resume-blocked', info);
@@ -37363,6 +37656,9 @@ const preparedSessionCreate = require('./lib/session-create/prepared').createPre
   ptyStartupCommitComplete,
   _rollbackPtyStartupAttempt,
   console,
+  // WP-4 (§5 D-12): the duplicate-create re-answer frame, next to the walle one identity.js already
+  // owns; the module sends it, server.js only builds it.
+  sendNativeSessionCreated: _sendNativeSessionCreated,
   get _ownerRecovery() { return _ownerRecovery; },
 });
 
@@ -37691,6 +37987,8 @@ sessionCreateProvider.configure(() => ({
   parseSessionStartMs,
   path,
   recordSessionDiagnostic,
+  // WP-1 (§5 D-4): the deterministic refusal hook the launch-time native-provider gate uses.
+  markSessionResumeBlocked,
   resolveResumeGeneration,
   // WP-2 (default-subagent-model-delegate-pick-2026-10-13.html §5 D-1..D-3): the Wall-E delegate
   // pick reader for a lead launch. Injected here (not required in provider-process) so the launch
@@ -37969,6 +38267,40 @@ function apiResumeSession(req, res) {
         if (_ownerDecisionInvalidRequest(ownerDecision)) return sendJsonResponse(res, 400, { ok: false, error: 'SESSION_ID_REQUIRED' });
         _emitOwnerMismatchDiagnostic(ownerDecision);
       }
+      // WP-6 (S-8/S-25, AC-6d): a session whose ORIGIN is a registered, REACHABLE machine is
+      // resumed ON that machine. The box owns the session and its transcript (D-2), and this hub
+      // has no local copy to launch from — the pre-WP-6 code checked the local sessions Map and
+      // 500'd ("Resume launch did not start"). The forward is a WP-2 create carrying the resume
+      // args through the EXISTING allowlist; not registered / not reachable keeps today's flow,
+      // byte-for-byte (resumeMachineFor returns null).
+      const resumeMachine = remoteMachineCatalog.resumeMachineFor(launch.ctmSessionId || launch.id);
+      if (resumeMachine) {
+        const forwarded = await remoteMachineCatalog.forwardResumeOnMachine({ launch, machine: resumeMachine });
+        if (!forwarded.ok) {
+          res.writeHead(502, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            error: `Machine ${resumeMachine.displayName || resumeMachine.instanceId} could not start this resume`,
+            code: forwarded.code || 'machine_unreachable',
+            machine: resumeMachine.instanceId,
+            machineName: resumeMachine.displayName || '',
+          }));
+          return;
+        }
+        res.writeHead(201, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          ok: true,
+          id: forwarded.sessionId,
+          tab_id: forwarded.sessionId,
+          source_ctm_session_id: launch.ctmSessionId,
+          session_id: launch.resumeSessionId,
+          agent: launch.agentType,
+          cwd: launch.cwd,
+          title: launch.title,
+          machine: resumeMachine.instanceId,
+          machineName: resumeMachine.displayName || '',
+        }));
+        return;
+      }
       await handleCreatePrepared(null, {
         id: launch.id,
         title: launch.title,
@@ -40063,7 +40395,9 @@ function sendDeferredRestoreStatus(ws, session, sessionId, cols, rows, source, o
       id: sessionId,
       cached: served,
       starting,
-      reason: String(opts.reason || ''),
+      // WP-3 (§5 D-7): fill the existing, always-'' field with the session's last skip reason
+      // (no new wire name, no client change; an explicit caller reason still wins).
+      reason: String(opts.reason || session?._lastRestoreSkip?.reason || ''),
       message: opts.message || (starting
         ? 'Starting terminal process for the visible session.'
         : 'Session terminal process is deferred until this tab is activated.'),
@@ -40073,9 +40407,10 @@ function sendDeferredRestoreStatus(ws, session, sessionId, cols, rows, source, o
 }
 
 // Extracted to lib/restore-prepare-retry.js (createScheduleDeferredRestoreStart); semantics unchanged.
-const _scheduleDeferredRestoreStart = createScheduleDeferredRestoreStart({ getSession, startDeferredRestoreSession: (session, opts) => _startDeferredRestoreSession(session, opts) });
+// WP-3 (§9 S-16): onSkip is the wakeSkips sink -- reason plumbing only, no return value changes.
+const _scheduleDeferredRestoreStart = createScheduleDeferredRestoreStart({ getSession, startDeferredRestoreSession: (session, opts) => _startDeferredRestoreSession(session, opts), onSkip: _restoreWakeSkipSink });
 
-const _scheduleDeferredRestoreRetry = createScheduleDeferredRestoreRetry({ getSession, recordSessionDiagnostic, scheduleStart: _scheduleDeferredRestoreStart }); // WP-2 (D-4)
+const _scheduleDeferredRestoreRetry = createScheduleDeferredRestoreRetry({ getSession, recordSessionDiagnostic, scheduleStart: _scheduleDeferredRestoreStart, onSkip: _restoreWakeSkipSink }); // WP-2 (D-4)
 
 function _maybeAutoStartDeferredRestore(session, msg, source, ws) {
   if (!session?._restoreDeferred || !msg?.autoStartRestore) return false;
@@ -40088,6 +40423,9 @@ function _maybeAutoStartDeferredRestore(session, msg, source, ws) {
       reason: msg.prewarm === true ? 'prewarm-disabled' : 'background-client',
       clientKind: _lifecycleClientKind(ws, msg),
     });
+    // WP-3 (§9 S-19 / D-8 AutoStartNotAttach): same latch as every other skip -- a background
+    // client that keeps re-attaching records once per episode, not once per message.
+    _noteWakeSkip(session, 'AutoStartNotAttach', { autostartBlock: msg.prewarm === true ? 'prewarm-disabled' : 'background-client' });
     return false;
   }
   if (!shouldAutoStartDeferredRestore(session, msg, source)) {
@@ -40969,12 +41307,12 @@ function handleResumeRetry(ws, msg) {
     // A quarantine record gets its full facts again; no record means there is nothing blocking.
     const record = id ? getSessionResumeBlocked(id) : null;
     const send = (reply) => { if (ws) try { _wsSend(ws, JSON.stringify(reply)); } catch { /* expected: the asking socket closed; the next attach replays the record */ } };
-    const wire = (r) => resumeBlockedWire(id, r, { agentType: session?.agentType, rungWire: _resumeBlockedRungWire(r) });
+    const wire = (r) => resumeBlockedWire(id, r, { agentType: session?.agentType, rungWire: resumeBlockedRungWire(r) });
     if (record) { // Check again re-asks the ladder for any blocked record; a stale record is never replayed as the answer
       Promise.resolve().then(() => { // every outcome replies: a throw anywhere below answers with the unchanged (stale) record
         const agent = dbModule.getSessionIdentity(id)?.primaryAgent || {};
         return require('./lib/resume-preflight').recheckResumeBlockedRecord(record, { resolveRung: (input) => require('./lib/resume-from-store-client').resolveResumeRungOffThread({ ...input, dbPath: dbModule.getDbPath(), trashRoot: SESSION_TRANSCRIPT_TRASH_ROOT }), input: { ctmSessionId: id, agentSessionId: String(agent.agent_session_id || ''), provider: record.agentType || session?.agentType, jsonlPath: String(agent.jsonl_path || '') } });
-      }).then((fresh) => { markSessionResumeBlocked(id, fresh); send(wire(getSessionResumeBlocked(id) || fresh)); })
+      }).then((fresh) => { markSessionResumeBlocked(id, fresh, 'resume-retry-recheck'); send(wire(getSessionResumeBlocked(id) || fresh)); })
         .catch((error) => { console.warn(`[resume-retry] recheck failed for ${id.slice(0, 8)}: ${error && error.message}`); send(wire(record)); });
     } else send(record ? wire(record) : { type: 'resume-retry-noop', id, checkedAt: new Date().toISOString() });
     return false;
@@ -41580,11 +41918,11 @@ function _imageDeliveryAckWindowMs() {
 }
 
 // The classified failure reason a refused/no-op image write leaves on the draft. Kept next to the
-// delivery path so the rollback reason names the real cause (a post that never left the process, or a
-// host ack that never arrived) instead of a generic "could not be started".
+// delivery path so refusal, uncertain dispatch and a missing host ack stay distinct rather than
+// claiming that every failed publication was known not to have left this process.
 function _imageWriteFailureReason(error) {
   const code = String((error && error.code) || '');
-  if (code === 'pty_write_not_posted') return code;
+  if (code === 'pty_write_not_posted' || code === 'pty_dispatch_uncertain') return code;
   if (code.startsWith('pty_write_ack_')) return code.slice(0, 64);
   return 'Provider delivery could not be started';
 }
@@ -41668,14 +42006,14 @@ async function _deliverImageDraftAttempt(sessionId, attachmentId, deliveryAttemp
     // draw from, so this frame's ack number is unique for the session and can never be confused with a
     // keystroke's echo identity (which is tracked by map membership, not by a numeric range).
     const writeResult = _writeLifecyclePty(session, payload, 'image-input');
-    // A POST is not a write: HostedPtyAdapter.write only queues the frame, and the byte-write fact
-    // arrives later as this inputSeq's host 'input-ack'. A frame that never left this process
-    // (posted === false — the device-reply firewall dropped it, the PTY rejected it, or the frozen
-    // branch discarded it) can never be acked, and the draft must not conclude that it was delivered:
-    // take the EXISTING failure transition (the catch below rolls the attempt back to 'failed').
+    // A POST is not a byte write. Only an observed preflight refusal means this invocation
+    // did not enter a transport; an exception after publication may still have effects.
+    // Keep the existing failure transition, but never label uncertain dispatch "not posted".
     if (!writeResult || writeResult.posted !== true) {
-      const error = new Error('Image paste frame was not posted to the host PTY');
-      error.code = 'pty_write_not_posted';
+      const refused = writeResult?.dispatchDisposition === 'preflight-refused';
+      const error = new Error(refused ? 'Image paste frame was not posted to the host PTY'
+        : 'Image paste dispatch could not be confirmed');
+      error.code = refused ? 'pty_write_not_posted' : 'pty_dispatch_uncertain';
       throw error;
     }
     // §6.3/D6: a PATH-mode draft reaches 'attached' only on the host's actual written ack — a
@@ -44679,7 +45017,7 @@ function handleKill(ws, msg) {
 async function handleKillAsync(ws, msg) {
   if (_ownerRecovery.rejectRequest(ws, msg)) return null; const session = sessions.get(msg.id);
   if (!session) return;
-  const ownerDecision = await _sessionOwnerDecisionAsync(msg.id);
+  const ownerDecision = _sessionOwnerDecision(msg.id);
   if (!ownerDecision.ok) {
     if (_ownerDecisionInvalidRequest(ownerDecision)) return;
     _emitOwnerMismatchDiagnostic(ownerDecision);
@@ -44713,6 +45051,8 @@ async function handleKillAsync(ws, msg) {
   }
   session._intentionalKill = true;
   session._userCloseAccepted = true; // inventory stops listing it now; the kill always ends in exit + delete
+  // D-6: announce the close before anything is awaited, so no racing list can put the tab back.
+  broadcastSessionList(true);
   if (RESUME_LIFECYCLE_V2_ENABLED && session._resumeAttemptState) {
     _resumeLifecycleCoordinator.dispatch(session, {
       type: RESUME_EVENT.CANCEL,
@@ -44732,14 +45072,12 @@ async function handleKillAsync(ws, msg) {
     broadcastSessionList(true);
     return;
   }
-  // Retire the startup_task durably on an explicit user close, BEFORE killing the
-  // PTY. Don't rely solely on the PTY onExit handler to retire it: onExit
-  // early-returns during shutdown (`if (_isShuttingDown) return`), so closing a
-  // session and then restarting CTM before the PTY finishes exiting would leave
-  // the row at status='running' and the session would be resurrected by restore on
-  // the next boot. The onExit retire stays as an idempotent backstop.
-  await _retireStartupTaskForUserClose(msg.id, 'kill');
+  // D-6: submit the durable startup_task retire FIRST — the op FIFO-queues on the DB owner, so a
+  // restart racing this exit still finds it queued — then signal the PTY at once and await the
+  // retire after. The PTY onExit retire stays as the idempotent backstop.
+  const retire = _retireStartupTaskForUserClose(msg.id, 'kill');
   try { _killSessionProcess(session, 'user_close'); } catch { /* expected: a PTY already gone on user close must not fail the close handler */ }
+  await retire;
 }
 
 // Delegates to lib/session-workspace-binding.js's TTL-memoized safeRealpath (60s TTL, bounded
@@ -46992,7 +47330,10 @@ function handleList(ws) {
   const listPayload = JSON.stringify({
     type: 'sessions',
     restoring: _restoreInProgress,
-    sessions: _listableSessions().map(s => _sessionPayload(s, { lightweight: true })),
+    // WP-6 (S-3/S-4, AC-6c): local live rows ∪ remote rows, deduped by ctm session id with a LOCAL
+    // id always winning. With zero registered machines mergeSessionRows returns this exact array, so
+    // the payload is byte-identical to the pre-WP-6 one.
+    sessions: remoteMachineCatalog.mergeSessionRows(_listableSessions().map(s => _sessionPayload(s, { lightweight: true }))),
   });
   _wsSend(ws, listPayload, { class: 'interactive', channel: 'sessions' });
   _kickPendingAutoResumeDeferred('client-list');
@@ -48638,7 +48979,7 @@ function _sessionPayload(s, options = {}) {
     // WP-2: only set on the two missing-transcript codes.
     resumeBlockedLocalHistory: resumeBlocked?.localHistory || '', resumeBlockedLastSeenBytes: Math.max(0, Number(resumeBlocked?.lastSeenBytes || 0)),
     resumeBlockedLastSeenAt: resumeBlocked?.lastSeenAt || '', resumeBlockedTrashPath: resumeBlocked?.trashPath || '',
-    resumeBlockedOriginalPath: resumeBlocked?.originalPath || '',
+    resumeBlockedOriginalPath: resumeBlocked?.originalPath || '', resumeBlockedTrashReason: resumeBlocked?.trashReason || '', resumeBlockedTrashedAt: resumeBlocked?.trashedAt || '',
     resumeBlockedRung: resumeBlocked?.resumeRung || '', resumeBlockedCoverage: resumeBlocked?.coverage || null,
     resumeBlockedOfferStoreFirst: resumeBlocked?.offerStoreFirst === true, resumeBlockedRestoreError: resumeBlocked?.restoreError || '',
     resumeBlockedOrigin: resumeBlocked?.origin || 'unknown',
@@ -50167,8 +50508,13 @@ const _broadcastPayload = require('./lib/broadcast-serialize').createBroadcastPa
 // `arr` is the session snapshot the payloads were built from (used for the elision signature so it stays
 // consistent with `built` even if the live sessions Map mutated during a sliced build's yields).
 function _finishBroadcast(arr, built, fresh) {
-  return _broadcastPayload.broadcast({ type: 'sessions', restoring: _restoreInProgress, sessions: built }, wss.clients,
-    { fresh, elideNoop: _BROADCAST_ELIDE_NOOP, sourceSessions: arr, isMemoBypass: s => _lightPayloadMemo.isMemoBypass(s) });
+  // WP-6 (S-3/S-4): the same merge as handleList, so a broadcast row set matches a requested list.
+  // `sourceSessions: arr` stays the LOCAL snapshot (it is the elision signature's subject); the
+  // remote rows are appended after the merge and are cheap, already-built objects.
+  const merged = remoteMachineCatalog.mergeSessionRows(built);
+  return _broadcastPayload.broadcast({ type: 'sessions', restoring: _restoreInProgress, sessions: merged }, wss.clients,
+    { fresh, elideNoop: _BROADCAST_ELIDE_NOOP, sourceSessions: arr, extraSignature: remoteMachineCatalog.lastMergeSignature(),
+      isMemoBypass: s => _lightPayloadMemo.isMemoBypass(s) });
 }
 
 function _maybePrewarmRestoreBroadcastPayloadCaches(sessionList) {
@@ -51259,7 +51605,8 @@ async function _quiesceSessionsForProcessExit(reason = 'shutdown') {
 }
 
 // --- Graceful Shutdown ---
-function shutdown() {
+// R3 WP-2: `signal` ('SIGTERM'/'SIGINT', passed by Node) is recorded in the clean-shutdown marker's reason.
+function shutdown(signal) {
   if (_isShuttingDown) return;
   console.log('\n  Shutting down...');
   _isShuttingDown = true;
@@ -51341,6 +51688,8 @@ function shutdown() {
         new Promise((resolve) => { const t = setTimeout(resolve, 3000); if (t && typeof t.unref === 'function') t.unref(); }),
       ]);
     } catch (e) { console.error('[shutdown] walle-transcript flush failed:', e.message); }
+    let inFlight;
+    try { inFlight = _collectInFlightSessionsForShutdown(); } catch { inFlight = undefined; /* expected: exit must never be blocked; marker omits inFlight */ }
     await _quiesceSessionsForProcessExit('shutdown');
     try { await headlessWorker.terminate({ intent: 'restart' }); } catch {} // hosts linger through SIGTERM (WP-2)
     _ctmDbClosingForProcessExit = true;
@@ -51354,6 +51703,9 @@ function shutdown() {
     if (_imageWriteProofs) _imageWriteProofs.dispose();
     try { await _desktopIndex.stop(); } catch {}
     const dbExit = await _closeDbForProcessExit('shutdown'); // D-7
+    // R3 WP-2: a graceful signal stop is a clean exit, marked after the DB close; fatal/SIGKILL stay unmarked.
+    const reason = `shutdown:${typeof signal === 'string' && signal ? signal : 'unknown'}`;
+    _restartLedger.writeCleanShutdownMarker({ exitCode: 0, reason, oldPid: process.pid, dbClose: _dbCloseOutcome(dbExit), inFlight });
     try { await managedBrowserBroker.close(); } catch (e) { console.error('[shutdown] managed browser close failed:', e.message); }
     try { await runtimeGoalStore.close?.(); } catch (e) { console.error('[shutdown] runtime goal store close failed:', e.message); }
     // Kill Wall-E child so it doesn't outlive us (detached + unref'd = orphan
@@ -51538,7 +51890,21 @@ function _startSdWatchdog() {
 function _startHostedSyncWorker() {
   if (_hostedSyncWorker) return;
   try {
-    const worker = startHostedSyncWorker({ env: process.env, db: dbModule, fetch: global.fetch });
+    const worker = startHostedSyncWorker({
+      env: process.env,
+      db: dbModule,
+      fetch: global.fetch,
+      // WP-2 / P-8: the machine probe's credential is chosen PER TARGET — the shared pool secret for
+      // a pool member, the legacy env bearer for a box that never joined. The builder is injected
+      // from here because lib/remote-machine-create.js requires lib/hosted-sync-worker.js (for
+      // parseSyncPeers), so the worker requiring it back would close a lib/** dependency cycle
+      // (dependency-lint ceiling 0).
+      peerHeadersFor: (instanceId) => require('./lib/remote-machine-create').buildPeerControlHeaders(process.env, { instanceId }) || {},
+      // WP-2 / P-5: this machine's own minted id for the sweep's roster pull (a member never writes
+      // its own row). Injected from here for the same cycle reason; read lazily so it is the id the
+      // boot ladder actually minted, not a pre-DB guess.
+      selfInstanceId: () => _instanceIdentityAccess.getInstanceIdentity({ required: false })?.instanceId || '',
+    });
     _hostedSyncWorker = worker;
     if (worker.started) console.log(`[sync] hosted sync worker started for ${worker.peers.length} peer(s)`);
   } catch (err) {
@@ -51781,10 +52147,20 @@ function _executeHook(hook, data) {
   }
 }
 
-async function _getWalleStatusSafe() {
+// D-7 (WP-5, docs/clock-free-tests-followups-2026-10-23.html §6) + r3 R-3/R-4
+// (docs/clock-free-tests-followups-r3-2026-10-24.html §5): EVERY GET path that reports whether
+// Wall-E is up — /api/services/status, /api/instance/manifest, /api/instance/sync-status and the
+// hosted runtime context behind /readyz, setup-status and friends — passes { snapshot: true } and
+// gets the supervisor's cached status (revalidated with kill(pid, 0), single-flight on a miss)
+// instead of running kill-authority discovery — a whole-table `ps` — on every request. The default
+// getStatus() is left to the paths that need fresh ownership: kill and repair (lib/walle-repair.js)
+// and the walle-bridge unavailable context (getWalleSupervisorStatus), which is a failure path.
+async function _getWalleStatusSafe({ snapshot = false } = {}) {
   let walleStatus;
   try {
-    walleStatus = await walleSupervisor.getStatus();
+    walleStatus = snapshot
+      ? await walleSupervisor.getStatusSnapshot()
+      : await walleSupervisor.getStatus();
   } catch (err) {
     walleStatus = { running: false, pid: null, error: err.message };
   }
@@ -51810,6 +52186,9 @@ function _buildInstanceManifest(walleStatus, ctmUptime) {
     golivePlan: _golivePlanCache,
     observedOrigin: _lastMicrosoftTunnelOrigin,
     nowMs: Date.now(),
+    // WP-2a D-4: the machine-owned settings come from the in-memory cache (lib/machine-self.js),
+    // never a DB read on the manifest/ETag path.
+    machineSelf: require('./lib/machine-self').current(),
   });
 }
 
@@ -52082,7 +52461,7 @@ function _storageRiskSnapshot() {
 
 async function _buildHostedRuntimeContextUncached() {
   const ctmUptime = Math.floor((Date.now() - _ctmStartTime) / 1000);
-  const walleStatus = await _getWalleStatusSafe();
+  const walleStatus = await _getWalleStatusSafe({ snapshot: true }); // R-4: never the full ownership probe or the recovery await
   const instance = _buildInstanceManifest(walleStatus, ctmUptime);
   const envWorkspaceBindings = buildWorkspaceBindingsStatus({ manifest: instance, env: process.env });
   void _detachOwnerMutation('hosted-workspace-bindings-seed', () =>
@@ -52097,7 +52476,9 @@ async function _buildHostedRuntimeContextUncached() {
   const localEdge = buildLocalEdgeStatus({ manifest: instance, env: process.env });
   const syncSchema = hostedStorage.syncSchema;
   syncSchema.worker = _hostedSyncWorkerStatus();
-  const sync = buildInstanceSyncStatus({ manifest: instance, workspaceBindings, localEdge, env: process.env, schema: syncSchema });
+  // S-30 (WP-0): the machine registry's rollup rides the sync status. Machine rows are read on
+  // the main thread (they are one indexed SELECT), so no owner round-trip is needed here.
+  const sync = buildInstanceSyncStatus({ manifest: instance, workspaceBindings, localEdge, env: process.env, schema: syncSchema, machines: machineRegistry.summarizeMachines({ db: dbModule }) });
   const security = await _buildRemoteSecuritySummary(instance);
   const terminalUx = buildTerminalRemoteUxStatus({ manifest: instance, env: process.env });
   const deadMan = buildDeadManStatus({ env: process.env });
@@ -52180,7 +52561,7 @@ function _manifestCorsHeaders(req) {
 
 async function apiInstanceManifest(req, res) {
   const ctmUptime = Math.floor((Date.now() - _ctmStartTime) / 1000);
-  const walleStatus = await _getWalleStatusSafe();
+  const walleStatus = await _getWalleStatusSafe({ snapshot: true }); // D-7 (WP-5): status GETs read the snapshot, not the process table
   const manifest = _buildInstanceManifest(walleStatus, ctmUptime);
   sendConditionalJson(req, res, 200, manifest, _manifestCorsHeaders(req), { etagBody: _manifestEtagBody(manifest) }); // D-7 fix A: the tag skips per-read noise the phone never reads
 }
@@ -52888,8 +53269,6 @@ function fetchMcpGatewayLedgerStatus(timeoutMs = 300) {
 async function apiServicesStatus(req, res) {
   const {
     ctmUptime,
-    walleStatus,
-    instance,
     sync,
     workspaceBindings,
     localEdge,
@@ -52898,6 +53277,8 @@ async function apiServicesStatus(req, res) {
     deadMan,
     hostedReadiness,
   } = await _buildHostedRuntimeContext();
+  const walleStatus = await _getWalleStatusSafe({ snapshot: true }); // R-3: per request, never the 20 s hosted context
+  const instance = _buildInstanceManifest(walleStatus, ctmUptime); // R-3: the manifest block uses the same snapshot
   const mcpGateway = await fetchMcpGatewayStatus();
   const walleRuntimeStatus = walleStatus.running
     ? await getWalleStatusDataOrNull(500)
@@ -53538,6 +53919,22 @@ function _recordWorktreeCreateJobProgress(job, event) {
   };
   job.progress = progress;
   job.updatedAt = now;
+  // WP-4 (nightly-browser-tier-round2-2026-10-21 §6): this is the ONE chokepoint every
+  // job transition passes through, so the log lines live here instead of in a response
+  // observer in lib/api/worktrees.js -- that observer only saw the two dispatch routes,
+  // so the GET poll route and 9 of 13 transitions never logged at all. One line per
+  // distinct (stage, status); the transition is recorded on the job so a repeated
+  // progress event (same stage+status) does not repeat the line.
+  if (job._loggedStage !== progress.stage || job._loggedStatus !== progress.status) {
+    job._loggedStage = progress.stage;
+    job._loggedStatus = progress.status;
+    const line = `[worktree-job] id=${job.id} stage=${progress.stage} status=${progress.status} elapsedMs=${progress.elapsedMs}`
+      + (progress.stage === 'queued'
+        ? ` name=${JSON.stringify(job.name)} namespace=${job.namespace || ''} cwd=${JSON.stringify(job.cwd || '')}`
+        : '');
+    if (progress.status === 'failed' || progress.status === 'cancelled') console.warn(line);
+    else console.log(line);
+  }
   job.events.push({
     at: now,
     stage: progress.stage,
@@ -54181,15 +54578,24 @@ function apiAdoptBranch(req, res) {
   });
 }
 
+// A dispatch refused before a job exists never reaches _recordWorktreeCreateJobProgress,
+// so it logs its own one-liner with the same [worktree-job] prefix: a red browser artifact
+// can then tell "CTM refused the dispatch" apart from "the job started and never advanced".
+function _logWorktreeCreateJobRejected(code, message) {
+  console.warn(`[worktree-job] rejected code=${code} error=${JSON.stringify(String(message || ''))}`);
+}
+
 function apiCreateWorktree(req, res) {
   _worktreeReadJsonBody(req, res, async (payload) => {
     const reqUrl = new URL(req.url, 'http://localhost');
     const { name, base_branch, cwd: reqCwd, namespace, agentType } = payload;
     if (!name || !/^[a-zA-Z0-9_-]+$/.test(name)) {
+      _logWorktreeCreateJobRejected('invalid_name', 'Invalid worktree name. Use alphanumeric, hyphens, underscores only.');
       res.writeHead(400, WORKTREE_JSON_HEADERS);
       return res.end(JSON.stringify({ error: 'Invalid worktree name. Use alphanumeric, hyphens, underscores only.' }));
     }
     if (base_branch && !VALID_GIT_REF.test(base_branch)) {
+      _logWorktreeCreateJobRejected('invalid_base_branch', 'Invalid base branch name');
       res.writeHead(400, WORKTREE_JSON_HEADERS);
       return res.end(JSON.stringify({ error: 'Invalid base branch name' }));
     }
@@ -54201,6 +54607,7 @@ function apiCreateWorktree(req, res) {
       const rawRequestId = payload.request_id || payload.requestId || '';
       const requestId = normalizeWorktreeCreateRequestId(rawRequestId);
       if (rawRequestId && !requestId) {
+        _logWorktreeCreateJobRejected('invalid_request_id', 'Invalid worktree create request id.');
         res.writeHead(400, WORKTREE_JSON_HEADERS);
         return res.end(JSON.stringify({ error: 'Invalid worktree create request id.' }));
       }
@@ -54216,6 +54623,7 @@ function apiCreateWorktree(req, res) {
         job = findReusableWorktreeCreateJob(_worktreeCreateJobs, createParams)
           || _startWorktreeCreateJob(createParams);
       } catch (e) {
+        _logWorktreeCreateJobRejected(e.code || 'WORKTREE_CREATE_FAILED', e.message);
         res.writeHead(e.statusCode || 500, WORKTREE_JSON_HEADERS);
         return res.end(JSON.stringify({ error: e.message, code: e.code || 'WORKTREE_CREATE_FAILED' }));
       }
@@ -54575,7 +54983,10 @@ function apiSyncAllWorktrees(req, res) {
   });
 }
 
-function _restartGuardSnapshot(now = Date.now()) {
+// WP-3 D-10 (model-proxy-survives-ctm-restart): `proxy` is the model-proxy verdict from
+// oauthProxySupervisor.proxyPreflight() -- a LIVE probe, so only async callers can supply it
+// (GET /api/restart/ctm/preflight does); the sync callers get the preflight's own default.
+function _restartGuardSnapshot(now = Date.now(), { proxy = null } = {}) {
   return summarizeRestartGuard(sessions.values(), {
     statusForSession: (session) => _standupLiveStatusForSession(session, now),
     isWaitingForInput: (session) => _isServerWaitingForInput(session.id, session, now),
@@ -54584,7 +54995,7 @@ function _restartGuardSnapshot(now = Date.now()) {
     // WP-4 (S-16): reuse the existing hosted-session discriminator (WP-2's
     // `_sessionIsHosted`, defined above at _quiesceSessionsForProcessExit) --
     // do not redefine it here.
-    isHostedSession: _sessionIsHosted, preflight: _computeRestartPreflight({ sessions: sessions.values(), sessionHostManager, isHosted: _sessionIsHosted, isRunning: (s) => !!s.ptyProcess, isExited: (s) => _standupLiveStatusForSession(s, now) === 'exited', hostCodeDiffers: (hostId) => !!sessionHostManager?.hostCodeDiffersFromDisk?.(hostId) }), // WP-6 (S-22); WP-2: loaded code vs disk
+    isHostedSession: _sessionIsHosted, preflight: _computeRestartPreflight({ sessions: sessions.values(), sessionHostManager, isHosted: _sessionIsHosted, isRunning: (s) => !!s.ptyProcess, isExited: (s) => _standupLiveStatusForSession(s, now) === 'exited', hostCodeDiffers: (hostId) => !!sessionHostManager?.hostCodeDiffersFromDisk?.(hostId), proxy }), // WP-6 (S-22); WP-2: loaded code vs disk; WP-3 D-10: proxy verdict
   });
 }
 
@@ -55881,6 +56292,7 @@ function _announceDeferredRestoreRetry(session, opts) {
 // Extracted to lib/restore-backoff-gate.js (semantics unchanged; 'prepare-retry' is user-initiated per design D-4).
 const _awaitRestoreBackoffOutsideGate = createAwaitRestoreBackoffOutsideGate({
   enabled: _RESTORE_BACKOFF_ENABLED, restoreBackoff: _restoreBackoff, recordSessionDiagnostic, getSession, maxCooldownMs: _RESTORE_BACKOFF_MAX_MS,
+  onSkip: _restoreWakeSkipSink, // WP-3 (§9 S-10/S-11): BackoffTaskMissingSessionId / BackoffSessionReplaced
 });
 
 function _startDeferredRestoreSession(session, opts = {}) {
@@ -55954,12 +56366,18 @@ async function _startDeferredRestoreSessionAttempt(session, opts = {}) {
       }
     }
     if (sharedCapacityAdmission) {
-      if (!capacity.ok) { _endInteractiveActivationIfNeeded(); return false; }
+      // WP-3 (§9 S-12): a shared admission that came back refused is a skip of THIS activation.
+      if (!capacity.ok) {
+        _noteWakeSkip(session, 'CapacityRejected', {}, id);
+        _endInteractiveActivationIfNeeded();
+        return false;
+      }
       if (session._activationAdmissionPromise) { _endInteractiveActivationIfNeeded(); return session._activationAdmissionPromise; }
     }
     if (!capacity.ok) {
       session._lifecycleState = session._parkedAt ? 'parked' : 'deferred';
       _notifyLifecycleWakeBlocked(session, capacity);
+      _noteWakeSkip(session, 'WakeBlocked', {}, id); // WP-3 (§9 S-12)
       console.log(`[lifecycle] wake-blocked id=${id.slice(0, 8)} reason=${capacity.code || 'live-session-cap'}`);
       _endInteractiveActivationIfNeeded();
       return false;
@@ -56035,7 +56453,10 @@ async function _startDeferredRestoreSessionAttempt(session, opts = {}) {
     session._lifecycleState = session._parkedAt ? 'parked' : 'deferred';
     _scheduleStandupMaterializedRefresh(`lifecycle:deferred:${id.slice(0, 8)}`, 0, { markDirty: true });
     _clearLifecyclePrewarm(session);
-    _lifecycleDiagnostics.recordPrewarm({ id, outcome: 'skipped', reason: 'gate-busy' });
+    // WP-3 (§9 S-17, AC-3d): recordPrewarm fires ONLY for a real prewarm; the non-prewarm case is a
+    // genuine restore skip, counted GateBusy instead of polluting prewarmByOutcome.
+    if (prewarm) _lifecycleDiagnostics.recordPrewarm({ id, outcome: 'skipped', reason: 'gate-busy' });
+    else _noteWakeSkip(session, 'GateBusy', {}, id);
     console.log(`[lifecycle] prewarm-skip id=${id.slice(0, 8)} reason=gate-busy`);
     _endInteractiveActivationIfNeeded();
     return false;
@@ -56133,6 +56554,16 @@ function _setDeferredRestoreStarting(session, value, reason = '') {
   const next = value === true;
   if (session._restoreStarting === next) return false;
   session._restoreStarting = next;
+  // WP-3 (§5 D-5, §9 S-15): this is the release funnel -- the ~20 sites that bail after claiming a
+  // placeholder pass a reason that used to be discarded. Record it on all three surfaces.
+  if (next) session._lastRestoreSkip = null; // the claim ends any skip episode (the D-7 wire reads it)
+  if (!next && reason) {
+    session._lastRestoreSkip = { reason, at: Date.now() };
+    try { recordSessionDiagnostic(session.id, 'deferred-restore-skip', { reason }); }
+    catch { /* expected: session diagnostics ring is not constructed in sliced unit harnesses */ }
+    try { _lifecycleDiagnostics.recordWakeSkip({ id: String(session.id || ''), provider: _lifecycleProvider(session), reason: String(reason) }); }
+    catch { /* expected: lifecycle diagnostics are not constructed in sliced unit harnesses */ }
+  }
   _markHeartbeatDirty(session);
   return true;
 }
@@ -56144,7 +56575,12 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     return false;
   }
   let task = session._restoreTask || {};
-  if (!task.session_id) return false;
+  // WP-3 (§9 S-14): a placeholder with no durable task row can never be claimed. (The
+  // `_restoreStarting` re-entry above records nothing -- the in-flight attempt owns the outcome.)
+  if (!task.session_id) {
+    _noteWakeSkip(session, 'BackoffTaskMissingSessionId', {}, session.id);
+    return false;
+  }
   // WI-2/WI-6: quarantine short-circuit. A session already marked resume_blocked (deterministic
   // prerequisite failure from a prior attempt — missing transcript/rollout, agent CLI
   // unresolvable) must never be re-driven by ANY of the auto-retry triggers that funnel through
@@ -56156,7 +56592,10 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
   // id stays quarantined until the deterministic cause changes or CTM restarts.
   const _blockedInfo = getSessionResumeBlocked(task.session_id);
   if (_blockedInfo) {
-    sendResumeBlockedToClients(session.clients, resumeBlockedWire(task.session_id, _blockedInfo, { agentType: session.agentType, rungWire: _resumeBlockedRungWire(_blockedInfo) }), _wsSend);
+    // WP-0 (S-3): this replay re-sends an existing record without going through markSessionResumeBlocked,
+    // so it writes the same diagnostic itself -- otherwise this card is unattributable.
+    recordSessionDiagnostic(task.session_id, 'resume-blocked-set', resumeBlockSetDetails('deferred-restore-replay', _blockedInfo));
+    sendResumeBlockedToClients(session.clients, resumeBlockedWire(task.session_id, _blockedInfo, { agentType: session.agentType, rungWire: resumeBlockedRungWire(_blockedInfo) }), _wsSend);
     return false;
   }
   if (task._codexLinkDeferred) {
@@ -56165,7 +56604,11 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     // operation instead of falling back to cwd/creation-time discovery.
     const codexLink = await _ensureCodexThreadLinkOffThread(task.session_id, 'deferred-restore-codex',
       { selectedIdentity: task._codexRestoreTarget || null });
-    if (codexLink?.status === 'stale') return false;
+    if (codexLink?.status === 'stale') {
+      // WP-3 (§9 S-13): carry the linker's own conflict reason (lib/codex-restore-linker.js).
+      _noteWakeSkip(session, 'CodexLinkStale', { linkerReason: codexLink.reason || '' }, task.session_id);
+      return false;
+    }
     if (codexLink?.status === 'unavailable') {
       recordSessionDiagnostic(task.session_id, 'codex-link-resolution-deferred', {
         source: String(opts.source || ''),
@@ -56177,6 +56620,8 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
         detail: codexLink.reason || 'Codex thread resolution is temporarily unavailable.',
         retryable: true,
       });
+      // WP-3 (§9 S-13 / D-8 CodexLinkUnavailable): count the skip beside the existing records.
+      _noteWakeSkip(session, 'CodexLinkUnavailable', { linkerReason: codexLink.reason || '' }, task.session_id);
       return false;
     }
     if (codexLink?.blocked) {
@@ -56184,13 +56629,15 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
         code: 'codex_thread_owned_by_other_ctm',
         message: 'The saved Codex thread is already attached to another CTM session.',
         agentType: 'codex',
-      });
+      }, 'codex-thread-owned');
       _recordRuntimeSessionLifecycle(session, 'degraded', {
         adapter: 'codex',
         reason: 'codex_thread_owned_by_other_ctm',
         detail: 'The saved Codex thread is already attached to another CTM session.',
         retryable: false,
       });
+      // WP-3 (§9 S-13 / D-8 CodexLinkBlocked): a hard block is still a skip of this activation.
+      _noteWakeSkip(session, 'CodexLinkBlocked', { linkerReason: codexLink.reason || '' }, task.session_id);
       return false;
     }
     if (codexLink?.agentSessionId) {
@@ -56226,7 +56673,10 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     sessionLaunchOverrides: session._launchEnvOverrides, options: opts,
   });
   if (restoreLaunchProjection.sourceRecoveryEnvironmentInvalid) {
-    _setDeferredRestoreStarting(session, false, 'source-recovery-environment-invalid');
+    _setDeferredRestoreStarting(session, false, 'SourceRecoveryEnvironmentInvalid');
+    // WP-3 (§9 S-15): PRE-CLAIM -- the funnel call above is a no-op here (_restoreStarting is already
+    // false), so record the skip directly; the funnel call stays (D-9, no control-flow change).
+    _noteWakeSkip(session, 'SourceRecoveryEnvironmentInvalid', {}, task.session_id);
     recordSessionDiagnostic(task.session_id, 'source-recovery-environment-rejected', {
       reason: 'captured_source_environment_owner_mismatch',
     });
@@ -56276,7 +56726,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
   let launchGeneration = suppliedPlan.generation;
   if (launchGeneration <= 0) {
     const reserved = _codingSessionGenerationRuntime.revalidateReservation(await _codingSessionGenerationRuntime.reserveSessionGeneration(task.session_id, Math.max(inputGeneration - 1, Number.isSafeInteger(session._launchPlanGeneration) ? session._launchPlanGeneration : 0)));
-    if (!reserved.ok) { recordSessionDiagnostic(task.session_id, 'launch-generation-refused', { code: reserved.code, message: reserved.message }); _setDeferredRestoreStarting(session, false, 'launch-generation-unavailable'); _releaseResumeStormBudgetIfHeld(session); return false; }
+    if (!reserved.ok) { recordSessionDiagnostic(task.session_id, 'launch-generation-refused', { code: reserved.code, message: reserved.message }); _setDeferredRestoreStarting(session, false, 'LaunchGenerationUnavailable'); _releaseResumeStormBudgetIfHeld(session); return false; }
     launchGeneration = reserved.generation;
   }
   session._launchPlanGeneration = launchGeneration;
@@ -56354,7 +56804,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
         : _hydrateCanonicalAgentEventCaches([task.session_id]),
     ]);
   } catch (error) {
-    _setDeferredRestoreStarting(session, false, 'prepare-failed');
+    _setDeferredRestoreStarting(session, false, 'PrepareFailed');
     // round-3 WP-3 T5 (S-24, I-8b): a read-pool ADMISSION failure (the lane was full/paused, or
     // the pool itself is disabled) is a fact about the POOL at this instant, never about this
     // session's data or its agent -- the prior code folded it into the same generic
@@ -56420,23 +56870,23 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     return false;
   }
   if (launchPlanResult?.status === 'stale') {
-    _setDeferredRestoreStarting(session, false, 'launch-plan-stale');
+    _setDeferredRestoreStarting(session, false, 'LaunchPlanStale');
     return false;
   }
   if (sessions.get(task.session_id) !== session || !session._restoreDeferred) {
-    _setDeferredRestoreStarting(session, false, 'session-replaced-or-not-deferred');
+    _setDeferredRestoreStarting(session, false, 'SessionReplaced');
     return false;
   }
   const rungHook = await _resolveMissingTranscriptRung(task.session_id, launchPlanResult.plan, detectAgentType(task.cmd));
   if (rungHook.restored) {
     // The archived copy is back on disk: prepare the launch again and continue natively.
     try { launchPlanResult = await runDeferredLaunchPlan(launchPlanResult.plan); } catch (error) {
-      _setDeferredRestoreStarting(session, false, 'prepare-failed');
+      _setDeferredRestoreStarting(session, false, 'PrepareFailed');
       errorSink.report('deferred-restore:replan-after-restore', error);
       return false;
     }
     if (launchPlanResult?.status === 'stale') {
-      _setDeferredRestoreStarting(session, false, 'launch-plan-stale');
+      _setDeferredRestoreStarting(session, false, 'LaunchPlanStale');
       return false;
     }
   }
@@ -56450,7 +56900,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
       rungHook.restored ? launchPlanResult.plan.resume?.preflight : (rungHook.preflight || launchPlanResult.plan.resume?.preflight),
     );
     const _planBlocked = getSessionResumeBlocked(task.session_id);
-    if (_planBlocked) sendResumeBlockedToClients(session.clients, resumeBlockedWire(task.session_id, _planBlocked, { agentType: session.agentType, rungWire: _resumeBlockedRungWire(_planBlocked) }), _wsSend);
+    if (_planBlocked) sendResumeBlockedToClients(session.clients, resumeBlockedWire(task.session_id, _planBlocked, { agentType: session.agentType, rungWire: resumeBlockedRungWire(_planBlocked) }), _wsSend);
     recordSessionDiagnostic(task.session_id, 'deferred-restore-blocked', {
       code,
       source: _restoreSource,
@@ -56461,7 +56911,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
       detail: launchPlanResult.plan.blockReason.message || 'Session launch is blocked.',
       retryable: code === 'launch_rollout_index_pending' && launchPlanResult.plan.blockReason.deterministic !== true,
     });
-    _setDeferredRestoreStarting(session, false, 'launch-blocked');
+    _setDeferredRestoreStarting(session, false, 'LaunchBlocked');
     if (_shouldRefreshLaunchReadinessForBlock(code, launchPlanResult.plan.blockReason.deterministic === true)) {
       _refreshLaunchReadiness().catch((e) => errorSink.report('launch-readiness:refresh', e));
     }
@@ -56496,7 +56946,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
             transition_id: String(pendingTransition.transition_id || '').slice(0, 16),
             reason: targetAuthorization.reason || 'host_target_receipt_mismatch',
           });
-          _setDeferredRestoreStarting(session, false, 'lead-transition-target-owner-mismatch');
+          _setDeferredRestoreStarting(session, false, 'LeadTransitionTargetOwnerMismatch');
           return false;
         }
       }
@@ -56515,7 +56965,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
           transition_id: String(pendingTransition.transition_id || '').slice(0, 16),
           reason: 'startup_task_not_exact_source',
         });
-        _setDeferredRestoreStarting(session, false, 'lead-transition-source-owner-mismatch');
+        _setDeferredRestoreStarting(session, false, 'LeadTransitionSourceOwnerMismatch');
         return false;
       }
       const reconciled = await leadModelSwitch.reconcileUnownedTransition({ sessionId: task.session_id,
@@ -56525,7 +56975,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
           transition_id: String(pendingTransition.transition_id || '').slice(0, 16),
           reason: reconciled.reason || 'transition_reconciliation_failed',
         });
-        _setDeferredRestoreStarting(session, false, 'lead-transition-reconciliation-failed');
+        _setDeferredRestoreStarting(session, false, 'LeadTransitionReconciliationFailed');
         return false;
       }
       }
@@ -56534,7 +56984,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     recordSessionDiagnostic(task.session_id, 'lead-transition-source-restore-refused', {
       reason: 'transition_reconciliation_unavailable', message: String(error?.message || error).slice(0, 160),
     });
-    _setDeferredRestoreStarting(session, false, 'lead-transition-reconciliation-unavailable');
+    _setDeferredRestoreStarting(session, false, 'LeadTransitionReconciliationUnavailable');
     return false;
   }
   if (opts.expectedProviderThreadId) {
@@ -56547,7 +56997,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
         expectedThreadPrefix: String(opts.expectedProviderThreadId).slice(0, 8),
         actualThreadPrefix: String(resolvedThreadId).slice(0, 8),
       });
-      _setDeferredRestoreStarting(session, false, 'lead-source-recovery-resume-mismatch');
+      _setDeferredRestoreStarting(session, false, 'LeadSourceRecoveryResumeMismatch');
       return false;
     }
   }
@@ -56567,7 +57017,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
         throw new Error(`backup restore not possible: ${decision?.reason || 'unavailable'}`);
       }
     } catch (error) {
-      _setDeferredRestoreStarting(session, false, 'transcript-restore-failed');
+      _setDeferredRestoreStarting(session, false, 'TranscriptRestoreFailed');
       _launchPlanCoordinator.markFailed(task.session_id, launchGeneration, 'launch_transcript_restore_failed', launchPlanResult.plan);
       recordSessionDiagnostic(task.session_id, 'deferred-restore-transcript-copy-failed', { error: error.message });
       _recordRuntimeSessionLifecycle(session, 'degraded', {
@@ -56591,7 +57041,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     }),
   });
   if (sessions.get(task.session_id) !== session || !session._restoreDeferred) {
-    _setDeferredRestoreStarting(session, false, 'mcp-wait-stale');
+    _setDeferredRestoreStarting(session, false, 'McpWaitStale');
     return false;
   }
   // WI-8: gate a large-transcript resume BEFORE committing to spawn. `source` here is
@@ -56634,7 +57084,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
       // immediately — nothing downstream will ever reach _clearResumeLoading for it.
       if (_resumeStormAdmission.gated) _resumeStormBudget.release(_resumeStormAdmission.ticket);
       session._resumeStormBudgetTicket = null;
-      _setDeferredRestoreStarting(session, false, 'resume-storm-stale');
+      _setDeferredRestoreStarting(session, false, 'ResumeStormStale');
       return false;
     }
     session._resumeStormBudgetHeld = _resumeStormAdmission.gated;
@@ -56651,7 +57101,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
   const geometryLeaseBeforeRestore = _geometryLease(session, task.session_id);
   if (!_launchPlanCoordinator.markSpawning(task.session_id, launchGeneration, launchPlanResult.plan)) {
     _releaseResumeStormBudgetIfHeld(session);
-    _setDeferredRestoreStarting(session, false, 'launch-plan-not-spawning');
+    _setDeferredRestoreStarting(session, false, 'LaunchPlanNotSpawning');
     return false;
   }
   // D-8 (WP-3): capture the placeholder's cached-snapshot fields BEFORE _destroySession
@@ -56674,7 +57124,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     });
     if (!issued) {
       _releaseResumeStormBudgetIfHeld(session);
-      _setDeferredRestoreStarting(session, false, 'lead-transition-attempt-issue-refused');
+      _setDeferredRestoreStarting(session, false, 'LeadTransitionAttemptIssueRefused');
       recordSessionDiagnostic(task.session_id, 'lead-transition-attempt-issue-refused', {
         generation: launchGeneration,
       });
@@ -56848,7 +57298,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     // finds this session not-live) instead of waiting out its deadline for a wake-ready that
     // will never come, and push visibility unconditionally.
     _announceRestoredSessionLive(session, 'create-rollback');
-    _setDeferredRestoreStarting(session, false, 'create-rollback');
+    _setDeferredRestoreStarting(session, false, 'CreateRollback');
     recordSessionDiagnostic(task.session_id, 'deferred-restore-create-rollback', {
       source: _restoreSource,
       code: createError
@@ -56878,7 +57328,7 @@ async function _startDeferredRestoreSessionNow(session, opts = {}) {
     // a missing file will not appear on the next tick, so there is nothing to wait out (and
     // every future call into this function short-circuits at the top before reaching here).
     if (_newlyBlocked) {
-      sendResumeBlockedToClients(existingClients, resumeBlockedWire(task.session_id, _newlyBlocked, { agentType: session.agentType, rungWire: _resumeBlockedRungWire(_newlyBlocked) }), _wsSend);
+      sendResumeBlockedToClients(existingClients, resumeBlockedWire(task.session_id, _newlyBlocked, { agentType: session.agentType, rungWire: resumeBlockedRungWire(_newlyBlocked) }), _wsSend);
     } else {
       for (const client of existingClients) {
         if (client && client.readyState === 1) {
@@ -57060,6 +57510,8 @@ function _autoResumeDeferredSessions(source = 'auto-resume') {
           idleHours: diet.idleHours,
           bytes: diet.bytes,
         });
+        // WP-3 (§9 S-19): beside the existing diag; the latch keeps a long diet to one skip.
+        _noteWakeSkip(s, 'DrainPressureSkipped');
       }
       continue;
     }
@@ -57107,9 +57559,11 @@ function _autoResumeDeferredSessions(source = 'auto-resume') {
   const resumeIds = warmDrain.selected;
   // S-18/skipReason: a session skipped this pass stays a lazy placeholder as before, but
   // now carries WHY -- surfaced on its eventual activation log (grep deferredForMin).
+  // WP-3 (§9 S-19): the warm-drain policy skip (budget/pressure/limit) also reaches wakeSkips.
   for (const skip of warmDrain.skipped) {
     const s = sessions.get(skip.id);
     if (s) s._resumeDrainSkipReason = skip.reason;
+    _noteWakeSkip(s, 'DrainPressureSkipped');
   }
   for (const id of resumeIds) {
     const s = sessions.get(id);
@@ -57206,6 +57660,7 @@ function _autoResumeDeferredSessions(source = 'auto-resume') {
           coalesceBroadcast: true, // batch emits a single list refresh per tick
         }),
         onError: (id, e) => console.error(`[auto-resume] ${String(id).slice(0, 8)} error: ${e.message}`),
+        onSkip: _restoreWakeSkipSink, // WP-3 (§9 S-18): DrainPaused, once per pause transition
         broadcast: () => broadcastSessionList(true),
         scheduleGap: _scheduleResumeGap,
         // WI-7(d): yield the whole drain to an in-flight interactive activation.
@@ -57289,13 +57744,18 @@ const _reviveUnresponsiveHost = createReviveUnresponsiveHost({
   recordSessionDiagnostic,
   log: (msg) => console.warn(msg),
 });
+// WP-3 (D-3): the stall action -- one handoffHost per episode, the existing revive as its fallback.
+// `_evacuateStalledHostSafe` is a function declaration so the hoisted references above (the manager's
+// onThreadpoolReport option and the ledger's onEvacuate) resolve to it.
+const _evacuateStalledHost = createEvacuateStalledHost({ manager: sessionHostManager, handoffHost: _hostHandoffOrchestrator.handoffHost, reviveUnresponsiveHost: _reviveUnresponsiveHost, recordSessionDiagnostic, hostHealth, log: (m) => console.warn(m), handoffOpts: { errorSink } });
+function _evacuateStalledHostSafe(v) { _evacuateStalledHost(v.hostId, v).catch((e) => errorSink.report('host-evacuate', e, { hostId: v.hostId })); }
 
 // Reconcile previous-boot hosts before classifying startup tasks. Incompatible
 // hosts are quiesced, then restored through the ordinary provider-resume path.
 const RECONCILE_PROBE_CONCURRENCY = 4;
 async function _reconcileSurvivingHostsForRestore(startupTasks) {
   const aliveHostIndex = new Map();
-  const hostRecordsById = new Map();
+  const hostRecordsById = new Map(); const threadpoolByHostId = new Map(); // WP-3 (§9 S-8): adopted hosts' state-reply threadpool snapshots, keyed by hostId
   const dataDir = require('./lib/data-dir').getDataDir();
   // WP-4 (D-9 crash cap): >= 3 unexpected host deaths inside the trailing 10-
   // minute window means the topology itself is unhealthy right now -- skip
@@ -57313,7 +57773,7 @@ async function _reconcileSurvivingHostsForRestore(startupTasks) {
         await _restartOutcomeTruth.killHostsForCrashCap({ records: await _listHostRecords(dataDir), rollup: _hostAdoptionRollup, isAlive: _isProcessAlive, shutdownHost: _shutdownOrphanHost,
           removeRecord: (r) => _removeHostRecordFile(dataDir, r.hostId), skip: (r) => r.serverBootId === _serverBootId || sessionHostManager.ownsHostId(r.hostId), errorSink });
       } catch (e) { errorSink.report('boot-reconcile:crash-cap-kill', e); }
-      _restartOutcomeTruth.recordCrashCapRows({ recordSessionDiagnostic, startupTasks, deaths }); return { aliveHostIndex, hostRecordsById };
+      _restartOutcomeTruth.recordCrashCapRows({ recordSessionDiagnostic, startupTasks, deaths }); return { aliveHostIndex, hostRecordsById, threadpoolByHostId };
     }
   } catch (e) {
     errorSink.report('boot-reconcile:read-host-crashes', e);
@@ -57323,9 +57783,9 @@ async function _reconcileSurvivingHostsForRestore(startupTasks) {
     records = await _listHostRecords(dataDir);
   } catch (e) {
     errorSink.report('boot-reconcile:list-host-records', e);
-    return { aliveHostIndex, hostRecordsById };
+    return { aliveHostIndex, hostRecordsById, threadpoolByHostId };
   }
-  if (!records.length) return { aliveHostIndex, hostRecordsById };
+  if (!records.length) return { aliveHostIndex, hostRecordsById, threadpoolByHostId };
   const startupSessionIds = new Set(startupTasks.map((t) => t.session_id));
   const aliveHosts = []; // { record, matching } per probed-alive host; indexed AFTER all probes, hostId order
   let cursor = 0;
@@ -57387,7 +57847,7 @@ async function _reconcileSurvivingHostsForRestore(startupTasks) {
         console.log(`  [boot-reconcile] host ${record.hostId} runs different code (closure hash ${String(probed.hostClosureHash || '').slice(0, 8)}≠${String(probed.diskClosureHash || '').slice(0, 8)}) — adopting now; handoff to new code after restore`);
         for (const sessionId of matching) recordSessionDiagnostic(sessionId, 'host-upgrade-pending', { hostId: record.hostId, upgrade: probed.upgrade });
       }
-      hostRecordsById.set(record.hostId, record);
+      hostRecordsById.set(record.hostId, record); threadpoolByHostId.set(record.hostId, probed.state && probed.state.threadpool); // WP-3 (D-4/S-9): the boot-time stall reading, absent on a pre-WP-3 host
       aliveHosts.push({ record, matching });
     }
   }
@@ -57404,7 +57864,7 @@ async function _reconcileSurvivingHostsForRestore(startupTasks) {
   if (aliveHostIndex.size) {
     console.log(`  [boot-reconcile] ${aliveHostIndex.size} session(s) have a surviving host — will adopt instead of respawning`);
   }
-  return { aliveHostIndex, hostRecordsById };
+  return { aliveHostIndex, hostRecordsById, threadpoolByHostId };
 }
 
 // D-2: one-line stamp for restore/adopt/placeholder sites (idempotent; no row = untouched).
@@ -57458,6 +57918,54 @@ function _reloadWorkerSessionMarkersAtBoot() {
   if (rearmed > 0) console.log(`  [restore] re-armed ${rearmed} worker retirement timer(s) from worker_sessions.hide_at.`);
 }
 
+// WP-3 (worker-transcript-link-derived-not-discovered-2026-10-25.html §5 D-5): the derived-transcript
+// boot backfill — one bounded, idempotent, fire-and-forget pass that fills agent_sessions.jsonl_path
+// for Claude rows whose transcript already sits at the DERIVED path (nothing else ever does: resume,
+// the targeted import, the review view and usage attribution all come up empty for them).
+//
+// The latch is module scope, not a local in _restoreSessionsAsync, so a re-entrant restore cannot
+// re-run the pass; only a process restart clears it. It means "scheduled this process", not "finished
+// this process" — the single re-arm below is the only extra attempt. The dispatch lives in this helper
+// — rather than inline at the call site — because the restore-loop test files slice
+// _restoreSessionsAsync into a vm sandbox with a curated global list: the call site must read nothing
+// that sandbox does not inject (see the typeof guard at the call site). Nothing in the restore loop
+// waits on this pass.
+let _derivedTranscriptLinkBackfillStarted = false;
+
+// Why a re-arm exists at all (fix round 2, live defect on a dev restart): the owner worker's
+// statement lock is fail-fast by design and the dispatcher retries a write-lock-busy op only 3x with
+// ~60 ms backoff, so an op that lands while the main thread holds `transaction:immediate` rejects in
+// about a second. The call site was moved after the restore loop drains for exactly that reason; this
+// single 60 s re-arm covers a burst that outlives the loop (a slow adoption write, a busy disk).
+// Bounded: attempt 2 is the last one, there is no loop, and the latch above is not consulted again.
+async function _linkDerivedClaudeTranscriptsOnce(attempt = 1) {
+  if (attempt === 1) {
+    if (_derivedTranscriptLinkBackfillStarted) return;
+    _derivedTranscriptLinkBackfillStarted = true;
+  }
+  try {
+    const r = await _runCtmDbWorkerOp(
+      'linkDerivedClaudeTranscripts',
+      { limit: 500, homeDir: os.homedir(), claudeConfigDir: serverConfig.CLAUDE_CONFIG_DIR || '' },
+      { timeoutMs: 60 * 1000 },
+    );
+    console.log(`[transcript-link] backfill checked=${r.checked} linked=${r.linked} missing=${r.missing} mismatched=${r.mismatched} unreadable=${r.unreadable} ms=${r.ms}`);
+  } catch (e) {
+    const writeLockBusy = !!e && (e.code === 'SQLITE_WRITE_LOCK_BUSY' || e.code === 'SQLITE_BUSY' || /write lock busy/i.test(String(e.message || '')));
+    if (!writeLockBusy) {
+      console.warn(`[transcript-link] backfill failed: ${e && e.message}`);
+      return;
+    }
+    if (attempt >= 2) {
+      console.warn(`[transcript-link] backfill deferred (attempt 2/2, giving up): ${e && e.message}`);
+      return;
+    }
+    console.warn(`[transcript-link] backfill deferred (attempt 1/2, retry in 60s): ${e && e.message}`);
+    const retry = setTimeout(() => { void _linkDerivedClaudeTranscriptsOnce(2); }, 60 * 1000);
+    if (retry && typeof retry.unref === 'function') retry.unref();
+  }
+}
+
 async function _restoreSessionsAsync() {
   await _ownerRecovery.beforeRestore();
   _hostAdoptionRollup.markRestoreStarted(); _restoreAdmission.markTierAActive('restore-start');
@@ -57476,11 +57984,11 @@ async function _restoreSessionsAsync() {
   );
   _listStartupTasksMs = Date.now() - _listStartupTasksStartedAt;
   _restoreWindowVerdict.fillRestorePendingIds(_startupTasks.map((t) => t.session_id));
-  let _restoreAliveHostIndex = new Map(), _restoreHostRecordsById = new Map();
+  let _restoreAliveHostIndex = new Map(), _restoreHostRecordsById = new Map(), _restoreThreadpoolByHostId = new Map(); // WP-3 (§9 S-8)
   const _earlyAdopted = new Set(); const _earlyAdoptStartedAt = Date.now();
   if (_startupTasks.length) {
     try {
-      ({ aliveHostIndex: _restoreAliveHostIndex, hostRecordsById: _restoreHostRecordsById } = await _reconcileSurvivingHostsForRestore(_startupTasks));
+      ({ aliveHostIndex: _restoreAliveHostIndex, hostRecordsById: _restoreHostRecordsById, threadpoolByHostId: _restoreThreadpoolByHostId } = await _reconcileSurvivingHostsForRestore(_startupTasks));
     } catch (e) { errorSink.report('boot-reconcile:reconcile', e); }
     await Promise.all(_startupTasks.filter((t) => _restoreAliveHostIndex.has(t.session_id)).map((t) => _adoptStartupTaskSession(t, _restoreAliveHostIndex.get(t.session_id).record, _restoreAliveHostIndex)
       .then((adopted) => { if (adopted) _earlyAdopted.add(t.session_id); }, (e) => errorSink.report('boot-adopt:restore-early', e, { sessionId: t.session_id }))));
@@ -57636,6 +58144,11 @@ async function _restoreSessionsAsync() {
     try { await dbModule.clearScrollbackIdentities(); } catch {}
     _resumeShadowAfterBoot('no-sessions'); // nothing to restore — resume mirroring now
     _reloadWorkerSessionMarkersAtBoot(); // once per boot in either branch (quota holds, worker markers, lead notices)
+    // WP-4 (model-proxy-survives-ctm-restart D-10): a boot with nothing to restore still ledgers its
+    // restore_complete row -- the model proxy's adopt/handoff/spawn outcome is per RESTART, not per
+    // session -- written after the proxy's adoption decision (waitForHealth awaits it, bounded 2 s) so
+    // adoption.proxy names what happened, never the in-flight fallback. Not awaited: boot never waits on it.
+    oauthProxySupervisor.waitForHealth().catch(() => { /* expected: waitForHealth rejects only on an aborted signal and none is passed; the row is ledgered either way */ }).then(() => _restartOutcomeTruth.appendRestoreCompleteLedger({ build: _bootBuildSha, summary: _hostAdoptionMetricsSummary, errorSink }));
     broadcastToAll({ type: 'server-ready' });
     return;
   }
@@ -57687,6 +58200,16 @@ async function _restoreSessionsAsync() {
       // auto-resume below runs shadowed; only the restore loop itself was the
       // suppressed window.)
       _resumeShadowAfterBoot('restore-complete');
+      // D-5 (worker transcript link): one bounded, idempotent pass that links every Claude row whose
+      // transcript exists at the derived path. Placed here — after the loop drained, not in the boot
+      // write burst — because the owner worker's statement lock is fail-fast: dispatching it while the
+      // main thread holds back-to-back `transaction:immediate` writes (0.8-4.8 s each during restore)
+      // makes the op reject in ~1 s, and the once-latch would then skip it for the whole boot. The
+      // helper re-arms once if a burst still outlives the loop. Fire-and-forget: nothing waits on it.
+      // typeof guard, not a missing dependency: the restore-loop tests evaluate this function in a vm
+      // sandbox whose curated globals do not include the helper, and an unguarded call would throw there.
+      // Same reason as `typeof _markStreamBehind === 'function'` above.
+      if (typeof _linkDerivedClaudeTranscriptsOnce === 'function') void _linkDerivedClaudeTranscriptsOnce();
       // WP-3 (design doc §5 D-4, §8 WP-3, §9 S-18): force one real sampler snapshot
       // before draining so the warm-drain budget's pressure/free/inactive reflect the
       // ACTUAL host state at the exact moment deferred sessions would auto-resume,
@@ -57696,7 +58219,7 @@ async function _restoreSessionsAsync() {
       try { await _sampleLifecycleResources({ force: true }); }
       catch (error) { errorSink.report('restore:warm-drain-pre-sample', error); }
       // Bring deferred placeholders back to life by themselves (staggered).
-      _autoResumeDeferredSessions('post-restore-auto-resume'); _hostHandoffOrchestrator.runUpgradePendingHandoffs({ manager: sessionHostManager, rollup: _hostAdoptionRollup, recordSessionDiagnostic, hostHealth, errorSink }).finally(() => _restartOutcomeTruth.appendRestoreCompleteLedger({ build: _bootBuildSha, summary: _hostAdoptionMetricsSummary, errorSink })); // WP-4: upgrade-pending hosts hand off after the loop
+      _autoResumeDeferredSessions('post-restore-auto-resume'); _hostHandoffOrchestrator.runUpgradePendingHandoffs({ manager: sessionHostManager, rollup: _hostAdoptionRollup, recordSessionDiagnostic, hostHealth, errorSink, skipHostIds: evacuateStalledAdoptedHosts({ hostHealth, evacuateStalledHost: _evacuateStalledHost, threadpoolByHostId: _restoreThreadpoolByHostId, ownsHostId: (id) => [...sessionHostManager.hosts.values()].some((a) => a._hostId === id && !a.closed) }) }).finally(() => oauthProxySupervisor.waitForHealth().catch(() => { /* expected: waitForHealth rejects only on an aborted signal and none is passed; the row is ledgered either way */ }).then(() => _restartOutcomeTruth.appendRestoreCompleteLedger({ build: _bootBuildSha, summary: _hostAdoptionMetricsSummary, errorSink }))) // WP-4 D-10: after the proxy's adoption decision, same as the empty branch; // WP-4: upgrade-pending hosts hand off after the loop
       // Clean orphan scrollback identities — entries for sessions no longer in
       // startup_tasks (e.g. a hard crash where pty.onExit cleanup didn't run).
       // (scrollback_log was dropped in schema v10; snapshot files are reaped by the
@@ -58047,7 +58570,7 @@ async function _restoreSessionsAsync() {
 // broadcastToAll, isCtmInternalSession, callClaudeAsync, _detachOwnerMutation,
 // _inRestoreStorm, _offthreadRead) is already initialized. See server/boot.js's own
 // header comment for the TDZ-safety argument.
-const { createBootJobs, readPackageVersion } = require('./server/boot');
+const { createBootJobs, readPackageVersion, isHumanPromptCandidate, cleanFirstMessage } = require('./server/boot');
 const _bootJobs = createBootJobs({
   installRoot: path.join(__dirname, '..'),
   telemetry,
@@ -61525,6 +62048,129 @@ servicesApi.configure({
 });
 servicesApi.register();
 
+// WP-0 (remote-machine-hub-sessions-2026-10-22.html §6.1): machines route cluster. Unlike the
+// extraction slices above there is no legacy handleApi branch to delete — this is NEW surface, so
+// the handlers live in lib/api/machines.js (its header states the convention) and the policy is
+// lib/machine-registry.js. Auth comes from lib/auth-rules.js's three /api/machines rows
+// (loopbackOnly + admin), which is also why nothing here evaluates a token.
+machinesApi.configure({
+  db: dbModule,
+  registry: machineRegistry,
+  // WP-3 §6.3: the pair/remove handlers join a pool, so they need the pool store and the boot read's
+  // promise — both declared further down this file (the pool cluster below owns them), so they are
+  // passed as LAZY accessors; the cluster is configured here to keep the `machines` route-group
+  // registration order the route golden pins. F2: this machine's own dial list is no longer injected
+  // here — the roster shape (members + self) is lib/api/machine-pool.js's `rosterMembers()` now.
+  pool: () => require('./lib/machine-pool').getMachinePool(),
+  ready: () => _machinePoolReady,
+  readJsonRequestBody,
+  sendJsonResponse,
+});
+machinesApi.register();
+
+// WP-1 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.1/D-13): host-stats route
+// cluster. Same shape as the machines cluster above — NEW surface, so no legacy handleApi branch
+// exists to delete, and the auth row (read + peerControl, NOT loopbackOnly) lives in
+// lib/auth-rules.js.
+hostStatsApi.configure({
+  hostStats: _hostStats,
+  sendJsonResponse,
+});
+hostStatsApi.register();
+
+// WP-2a (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.2, D-4/D-13, §9 S-24): the pool
+// + machine-self route cluster. Same shape as the two clusters above — NEW surface, no legacy
+// handleApi branch to delete. lib/machine-pool.js's process singleton is the POOL STORE (its
+// load() ran at boot, above); lib/machine-self.js is the machine-owned settings CACHE (loaded at
+// boot too, so the manifest build below never reads the DB).
+const machinePoolApi = require('./lib/api/machine-pool');
+const machineSelfStore = require('./lib/machine-self');
+machineSelfStore.configure({ db: dbModule });
+// §6.2: pool.load() and the machine-self cache load run ONCE at boot, before routes are served.
+// Kicked here (module load, ahead of every listener's 'listening' / _runBootSequence, which is a
+// frozen function at its line ceiling) rather than inside the boot sequence. Both are a single
+// small file read / one-row SELECT; a failure leaves the member pool-less (verify() fails closed
+// to 401) which is the same state as "never paired", never a broken boot.
+function _loadMachinePoolState() {
+  const fail = (name) => (error) => console.warn(`[machine-pool] ${name} load failed: ${error?.message || error}`);
+  return Promise.all([
+    require('./lib/machine-pool').getMachinePool().load().catch(fail('pool')),
+    machineSelfStore.load().catch(fail('machine-self')),
+  ]);
+}
+// `_machinePoolReady` is that same promise, named: this kick is fire-and-forget (nothing on the
+// request path may await a boot read), so a handler that MUTATES the pool — WP-3's pair/remove —
+// awaits it first and never races a load that is still in flight. A read-only handler does not.
+const _machinePoolReady = _loadMachinePoolState();
+machinePoolApi.configure({
+  db: dbModule,
+  pool: require('./lib/machine-pool').getMachinePool(),
+  machineSelf: require('./lib/machine-self'),
+  // The boot load's promise, so a pool-MUTATING handler (WP-3's pair/remove) can await it.
+  ready: _machinePoolReady,
+  registry: machineRegistry,
+  readJsonRequestBody,
+  sendJsonResponse,
+  listenPort: PORT,
+  // §6.2 "then executionHost.publicOrigin if set": EXACTLY the origin lib/instance-manifest.js
+  // publishes on executionHost.publicOrigin — read back from the builder rather than off
+  // `serverConfig`.
+  //
+  // Why the builder and not the four names: server-config's seam (RAW_ENV_NAMES) does not carry
+  // CTM_CANONICAL_PUBLIC_ORIGIN / CTM_STABLE_PUBLIC_ORIGIN / CTM_PUBLIC_ORIGIN / CTM_EXTERNAL_ORIGIN,
+  // so every `serverConfig.<name>` read here was `undefined` and this fallback could NEVER fire —
+  // a loopback- or tailnet-bound instance advertised only its LAN addresses, and selfUrls() (P-4)
+  // had nothing dialable to append. WP-3's three-box pairing test hit it head-on: the roster push
+  // to a peer whose only dial URL was a LAN address nothing was bound to never arrived.
+  // lib/instance-manifest-runtime.js spreads `process.env` first, so this reads the same values the
+  // manifest publishes, through the sanctioned seam, with no new raw env member read here.
+  publicOrigin: () => {
+    try {
+      const manifest = _buildInstanceManifest(null, Math.floor((Date.now() - _ctmStartTime) / 1000));
+      return String((manifest && manifest.executionHost && manifest.executionHost.publicOrigin) || '');
+    } catch {
+      return ''; // expected: a failed manifest build just leaves self URLs LAN-only (P-4 order preserved)
+    }
+  },
+});
+machinePoolApi.register();
+
+// WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-6/D-9/D-13, §9 S-15/S-16/S-23):
+// the pairing route cluster — the routes a JOINING member talks to. Same shape as the three
+// clusters above: NEW surface, no legacy handleApi branch to delete.
+//
+// POST /api/machine-pairing/offers is an ordinary authorised route (admin + step-up remote, row in
+// lib/auth-rules.js). POST /api/machine-pairing/join AND GET /api/machine-pairing/identity are
+// registered with phase 'api-cloudflare' — the dispatcher server.js already runs BEFORE
+// `_authorizeHttpRequest` (line ~12278, the seam lib/api/microsoft-owner.js's public rows use),
+// because the caller does not hold this box's credential yet; the pool secret in the body IS the
+// thing being proven, and the identity probe exists exactly so a member can ask "is there a code
+// here" without one (D-9: /api/sync/manifest is `sync`-scoped and would 401 on a real LAN before the
+// pair began). The defence on both is the `machine_pair` bucket below plus the single-use code
+// (lib/api/machine-pairing.js states this in full). The limiter and the remote-IP reader are injected
+// rather than re-derived, so both routes are charged to the SAME AuthRateLimiter instance every
+// authorised route uses.
+const machinePairingApi = require('./lib/api/machine-pairing');
+const machinePairingStore = require('./lib/machine-pairing').createMachinePairing({ db: dbModule });
+machinePairingApi.configure({
+  db: dbModule,
+  pool: require('./lib/machine-pool').getMachinePool(),
+  pairing: machinePairingStore,
+  machineSelf: require('./lib/machine-self'),
+  registry: machineRegistry,
+  selfUrls: machinePoolApi.selfUrls,
+  readJsonRequestBody,
+  sendJsonResponse,
+  // The PRE-AUTH rate limit: `_rateLimitDecision`'s own limiter and KDF, keyed by remote address
+  // because there is no principal yet. Same `AuthRateLimiter` instance (`authRateLimiter`).
+  rateLimit: (kind, key) => authRateLimiter.check(kind, key),
+  remoteIp: (req) => _remoteIpFromReq(req),
+  // F5: the offer/identity failure path logs here and echoes nothing to the caller.
+  logError: (...args) => console.error(...args),
+  ready: _machinePoolReady,
+});
+machinePairingApi.register();
+
 // WP-8 slice 3: setup/diagnostics/misc-ops route clusters.
 const setupApi = require('./lib/api/setup');
 setupApi.configure({
@@ -61619,6 +62265,7 @@ miscopsApi.configure({
   apiListRules,
   apiDeleteHook,
   apiRestartCtm, restartGuardSnapshot: _restartGuardSnapshot,
+  proxyPreflight: () => oauthProxySupervisor.proxyPreflight(), // WP-3 D-10: the live model-proxy verdict
   wss,
   clientBuildDiagnosticDetails,
   attachedSessionIds,
@@ -61687,6 +62334,7 @@ ingressApi.configure({
   observeWorkspaceActivity: _observeWorkspaceActivity,
   dbModule,
   delegateWorker,
+  recordSessionDiagnostic,
 });
 ingressApi.register();
 const { createMicrosoftOwnerServer } = require('./lib/microsoft-owner-server');
@@ -62009,10 +62657,10 @@ const rootPromptFlow = createRootPromptFlow({
     }, Date.now(),
   ),
   sendWsJson: (ws, frame) => _sendWsJsonBounded(ws, frame),
-  reportDiagnostic: ({ phase, code, returnedRecordConfirmed, canonicalRecordConfirmed,
+  reportDiagnostic: ({ phase, code, sessionId, clientMessageId, returnedRecordConfirmed, canonicalRecordConfirmed,
     recordFieldsMatch, errorKind, sourceFile, sourceLine, nativeHandleOpen, nativeHandleClosed, failureClass }) =>
     recordSessionDiagnostic('__host__', 'root-prompt-flow-suppressed-failure', {
-      phase, code, returnedRecordConfirmed, canonicalRecordConfirmed, recordFieldsMatch,
+      phase, code, sessionId, clientMessageId, returnedRecordConfirmed, canonicalRecordConfirmed, recordFieldsMatch,
       errorKind, sourceFile, sourceLine, nativeHandleOpen, nativeHandleClosed, failureClass,
     }),
   markDirty: (sessionId, reason) => {
@@ -62578,7 +63226,7 @@ function _runBootSequence() {
   // configDir/instanceTag/port are passed explicitly so a dev/test instance
   // (its own CONFIG_DIR, per lib/server-config.js) never lands its journal
   // under the real ~/.walle — see lib/ctm-boot-lifecycle.js.
-  appendCtmBootLine({ configDir: CONFIG_DIR, instanceTag: INSTANCE_TAG, port: PORT });
+  appendCtmBootLine({ configDir: CONFIG_DIR, instanceTag: INSTANCE_TAG, port: PORT, enteredAtServer: require.main === module });
 
   // Stale CTM cleanup: with launchd KeepAlive, only one instance runs.
   // No pgrep needed — launchd manages the lifecycle.
@@ -62603,8 +63251,13 @@ function _runBootSequence() {
   // Wall-E daemon and surfaced through its HTTP API after startup.
   const shouldStartOauthProxy = (() => {
     if (isWalleSupervisorDisabled()) return false;
-    // Sync boot path: Wall-E's stored provider is not readable here; the auth method alone gates the proxy.
-    return serverConfig.WALLE_AUTH_METHOD === 'oauth_proxy';
+    // Sync boot path: Wall-E's stored provider is not readable here; the auth method gates a fresh spawn.
+    if (serverConfig.WALLE_AUTH_METHOD === 'oauth_proxy') return true;
+    // WP-4 AC-4e (model-proxy-survives-ctm-restart D-4): a proxy that outlived the previous CTM (live
+    // process named by this data dir's instance record) is adopted by start() regardless of the auth
+    // method -- the primary's proxy is started by the setup surface, not this env var, and a survivor
+    // left un-adopted keeps serving but no longer gets this CTM's lead tokens.
+    return oauthProxySupervisor.hasLiveSurvivor();
   })();
   if (shouldStartOauthProxy) {
     try {
@@ -63244,6 +63897,16 @@ function _runBootSequence() {
         // coalescing keeps at most one queued behind the in-flight one).
         _transcriptDeltaCoalescer.request(filePath, payload);
       }
+      // WP-2 (D-11): publish the title the db-owner worker wrote; a drifted tier-1 row asks for one re-assert.
+      const titleApply = applied.titleApply;
+      if (titleApply?.applied === 'agent') {
+        if (liveSession) { liveSession.title = titleApply.title; _invalidateTitleInfoCache(liveSession); }
+        void _detachOwnerMutation('agent-title-label', () => dbModule.updateStartupTaskLabel(ownerSessionId, titleApply.title));
+        broadcastSessionList();
+      }
+      if (titleApply?.reassert) {
+        void mirrorSessionTitle({ db: dbModule, sessionId: ownerSessionId, force: true }).catch(() => { /* expected: exit/relink and the next observation retry it */ });
+      }
     } catch (e) {
       fallback('pipeline-error');
       console.error(`[event-delta] ${String(sessionId).slice(0, 8)} pipeline error:`, e.message);