create-walle 0.10.1 → 0.10.2

package/template/shared/fixtures/worker-status-payloads.json

@@ -0,0 +1,392 @@
+{
+  "schema_version": 1,
+  "note": "lead-cost routing round 2 §6.3 (WP-0). The shared contract between CTM (producer: coding-task-manager/tests-integration/api-sessions-worker-payload-shape.test.js) and Wall-E (consumer: the helper-rules hook). The producer asserts each variant's keys are a SUBSET of the live response for that call shape; the consumer drives the hook with each variant verbatim. Every path is a /tmp fixture path, never a real machine path. `ctm_session_id` rides only on the whole-set wait's nested `worker` and its `workers[]` summary rows -- the plain status-by-id body has no such key, which is why the producer omits it for the status shapes.",
+  "variants": {
+    "status_by_id": {
+      "status": "report_ready",
+      "report_path": "/tmp/ctm-fixture/worker-reports/w-1.md",
+      "report_present": true,
+      "report_source": "report",
+      "report_text": "# Report\n\nEvery file:line below is a distinct citation.\n\n| where | what |\n| --- | --- |\n| `src/alpha.js:12` | the first |\n| src/beta.ts:340 | the second |\n| (lib/gamma.mjs:7) | the third |\n",
+      "report_text_truncated": false,
+      "report_citation_rows": 13,
+      "report_chars": 25567,
+      "report_provisional": false,
+      "last_message_path": "/tmp/ctm-fixture/worker-reports/w-1.last.md",
+      "turns": 42,
+      "last_activity_at": 1761350400000,
+      "exitCode": null,
+      "generation": 1,
+      "request_budget": {
+        "requestCount": 29,
+        "knownOutputTokens": 48000,
+        "terminalCode": "",
+        "incomplete_streams": 0,
+        "incomplete_stream_ms": 0
+      },
+      "context_tokens": 120000,
+      "peak_context_tokens": 140000,
+      "compactions": [],
+      "tool_counts": { "Read": 23, "Grep": 18, "Bash": 8, "Write": 1 },
+      "write_tool_calls": 1,
+      "read_tool_calls": 41,
+      "bash_calls": 8,
+      "harness": "claude-code",
+      "worker_profile": "review",
+      "original_brief_sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+      "rendered_brief_sha256": "2222222222222222222222222222222222222222222222222222222222222222",
+      "rendered_brief_path": "/tmp/ctm-fixture/worker-reports/w-1.brief.md",
+      "final_result": null,
+      "progress": null,
+      "advisories": [],
+      "receipt_state": null,
+      "event_receipts": [],
+      "provider_thread_id": "thread-w-1",
+      "agent_consumed": true,
+      "identity": "marked",
+      "failure": null,
+      "terminal_path": "/tmp/ctm-fixture/worker-reports/w-1.terminal.json",
+      "terminal_present": true,
+      "spend": { "usd": 0.054, "priced_requests": 29, "unpriced_requests": 0, "pricing_basis": "model_registry" },
+      "cli_reported_cost_usd": 0.42,
+      "task_requests_so_far": 29,
+      "task_output_tokens_so_far": 48000,
+      "lease": {
+        "current": 1,
+        "ceiling": 4,
+        "renewals": [],
+        "scope": "task",
+        "base_requests": 324,
+        "base_output_tokens": 100000,
+        "task_requests": 29,
+        "task_output_tokens": 48000,
+        "headroom_requests": 295,
+        "headroom_output_tokens": 52000,
+        "resume_accepted": true
+      },
+      "lead_posture": { "source": "ctm_launch", "sandbox": "none", "network": "on", "cwd": "/tmp/ctm-fixture" },
+      "generations": [{ "generation": 1, "unit": "turn", "turns": 42, "terminal_code": "", "lease": 1 }],
+      "parent_ctm_session_id": "lead-1",
+      "retention": {
+        "terminal_at": "2026-10-24T00:00:00.000Z",
+        "consumed_at": "",
+        "acknowledged_at": "",
+        "hide_at": "",
+        "retain_ms": 14400000
+      },
+      "owned_paths": ["/tmp/ctm-fixture/**"],
+      "request_budget_diagnostic": "worker_budget_proxy_unavailable",
+      "denied_tool_calls": [],
+      "scope_violations": [],
+      "poll_after_ms": 0
+    },
+    "wait_by_id": {
+      "status": "report_ready",
+      "report_path": "/tmp/ctm-fixture/worker-reports/w-1.md",
+      "report_present": true,
+      "report_source": "report",
+      "report_citation_rows": 13,
+      "report_chars": 25567,
+      "report_provisional": false,
+      "last_message_path": "/tmp/ctm-fixture/worker-reports/w-1.last.md",
+      "turns": 42,
+      "last_activity_at": 1761350400000,
+      "exitCode": null,
+      "generation": 1,
+      "request_budget": {
+        "requestCount": 29,
+        "knownOutputTokens": 48000,
+        "terminalCode": "",
+        "incomplete_streams": 0,
+        "incomplete_stream_ms": 0
+      },
+      "context_tokens": 120000,
+      "peak_context_tokens": 140000,
+      "compactions": [],
+      "tool_counts": { "Read": 23, "Grep": 18, "Bash": 8, "Write": 1 },
+      "write_tool_calls": 1,
+      "read_tool_calls": 41,
+      "bash_calls": 8,
+      "harness": "claude-code",
+      "worker_profile": "review",
+      "original_brief_sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+      "rendered_brief_sha256": "2222222222222222222222222222222222222222222222222222222222222222",
+      "rendered_brief_path": "/tmp/ctm-fixture/worker-reports/w-1.brief.md",
+      "progress": null,
+      "advisories": [],
+      "receipt_state": null,
+      "event_receipts": [],
+      "provider_thread_id": "thread-w-1",
+      "agent_consumed": true,
+      "identity": "marked",
+      "failure": null,
+      "terminal_path": "/tmp/ctm-fixture/worker-reports/w-1.terminal.json",
+      "terminal_present": true,
+      "spend": { "usd": 0.054, "priced_requests": 29, "unpriced_requests": 0, "pricing_basis": "model_registry" },
+      "cli_reported_cost_usd": 0.42,
+      "task_requests_so_far": 29,
+      "task_output_tokens_so_far": 48000,
+      "lease": {
+        "current": 1,
+        "ceiling": 4,
+        "renewals": [],
+        "scope": "task",
+        "base_requests": 324,
+        "base_output_tokens": 100000,
+        "task_requests": 29,
+        "task_output_tokens": 48000,
+        "headroom_requests": 295,
+        "headroom_output_tokens": 52000,
+        "resume_accepted": true
+      },
+      "lead_posture": { "source": "ctm_launch", "sandbox": "none", "network": "on", "cwd": "/tmp/ctm-fixture" },
+      "generations": [{ "generation": 1, "unit": "turn", "turns": 42, "terminal_code": "", "lease": 1 }],
+      "parent_ctm_session_id": "lead-1",
+      "retention": {
+        "terminal_at": "2026-10-24T00:00:00.000Z",
+        "consumed_at": "",
+        "acknowledged_at": "",
+        "hide_at": "",
+        "retain_ms": 14400000
+      },
+      "owned_paths": ["/tmp/ctm-fixture/**"],
+      "request_budget_diagnostic": "worker_budget_proxy_unavailable",
+      "denied_tool_calls": [],
+      "scope_violations": [],
+      "poll_after_ms": 0,
+      "woke_on": "terminal",
+      "waited_ms": 1200,
+      "watcher_reason": null,
+      "watcher_decisions": [],
+      "lead_next_step": null
+    },
+    "wait_no_id": {
+      "woke_on": "terminal",
+      "waited_ms": 139896,
+      "watcher_reason": null,
+      "watcher_decisions": [],
+      "worker": {
+        "status": "report_ready",
+        "report_path": "/tmp/ctm-fixture/worker-reports/w-1.md",
+        "report_present": true,
+        "report_source": "report",
+        "report_citation_rows": 13,
+        "report_chars": 25567,
+        "report_provisional": false,
+        "last_message_path": "/tmp/ctm-fixture/worker-reports/w-1.last.md",
+        "turns": 42,
+        "last_activity_at": 1761350400000,
+        "exitCode": null,
+        "generation": 1,
+        "request_budget": {
+          "requestCount": 29,
+          "knownOutputTokens": 48000,
+          "terminalCode": "",
+          "incomplete_streams": 0,
+          "incomplete_stream_ms": 0
+        },
+        "context_tokens": 120000,
+        "peak_context_tokens": 140000,
+        "compactions": [],
+        "tool_counts": { "Read": 23, "Grep": 18, "Bash": 8, "Write": 1 },
+        "write_tool_calls": 1,
+        "read_tool_calls": 41,
+        "bash_calls": 8,
+        "harness": "claude-code",
+        "worker_profile": "review",
+        "original_brief_sha256": "1111111111111111111111111111111111111111111111111111111111111111",
+        "rendered_brief_sha256": "2222222222222222222222222222222222222222222222222222222222222222",
+        "rendered_brief_path": "/tmp/ctm-fixture/worker-reports/w-1.brief.md",
+        "progress": null,
+        "advisories": [],
+        "receipt_state": null,
+        "event_receipts": [],
+        "provider_thread_id": "thread-w-1",
+        "agent_consumed": true,
+        "identity": "marked",
+        "failure": null,
+        "terminal_path": "/tmp/ctm-fixture/worker-reports/w-1.terminal.json",
+        "terminal_present": true,
+        "spend": { "usd": 0.054, "priced_requests": 29, "unpriced_requests": 0, "pricing_basis": "model_registry" },
+        "cli_reported_cost_usd": 0.42,
+        "task_requests_so_far": 29,
+        "task_output_tokens_so_far": 48000,
+        "lease": {
+          "current": 1,
+          "ceiling": 4,
+          "renewals": [],
+          "scope": "task",
+          "base_requests": 324,
+          "base_output_tokens": 100000,
+          "task_requests": 29,
+          "task_output_tokens": 48000,
+          "headroom_requests": 295,
+          "headroom_output_tokens": 52000,
+          "resume_accepted": true
+        },
+        "lead_posture": { "source": "ctm_launch", "sandbox": "none", "network": "on", "cwd": "/tmp/ctm-fixture" },
+        "generations": [{ "generation": 1, "unit": "turn", "turns": 42, "terminal_code": "", "lease": 1 }],
+        "parent_ctm_session_id": "lead-1",
+        "retention": {
+          "terminal_at": "2026-10-24T00:00:00.000Z",
+          "consumed_at": "",
+          "acknowledged_at": "",
+          "hide_at": "",
+          "retain_ms": 14400000
+        },
+        "owned_paths": ["/tmp/ctm-fixture/**"],
+        "request_budget_diagnostic": "worker_budget_proxy_unavailable",
+        "denied_tool_calls": [],
+        "scope_violations": [],
+        "poll_after_ms": 0,
+        "ctm_session_id": "w-1"
+      },
+      "workers": [{ "ctm_session_id": "w-1", "status": "report_ready", "generation": 1, "terminal": true }],
+      "lead_next_step": null
+    },
+    "wait_no_id_timeout": {
+      "woke_on": "timeout",
+      "waited_ms": 240003,
+      "watcher_reason": null,
+      "watcher_decisions": [],
+      "worker": null,
+      "workers": [{ "ctm_session_id": "w-1", "status": "working", "generation": 1, "terminal": false }],
+      "lead_next_step": null
+    },
+    "wait_by_route": {
+      "woke_on": "route_clear",
+      "waited_ms": 0,
+      "route": "r-1",
+      "admission": {
+        "recent_throttles": 0,
+        "throttled_until": "2026-10-24T00:05:00.000Z",
+        "quota_held": true,
+        "reason": "quota_held",
+        "refusals": 0,
+        "last_refusal_at": null
+      },
+      "lead_next_step": null
+    },
+    "codex_exited": {
+      "status": "exited",
+      "report_path": "/tmp/ctm-fixture/worker-reports/w-2.md",
+      "report_present": false,
+      "report_source": "last_message",
+      "report_citation_rows": 21,
+      "report_chars": 8946,
+      "report_provisional": false,
+      "last_message_path": "/tmp/ctm-fixture/worker-reports/w-2.last.md",
+      "turns": 17,
+      "last_activity_at": 1761350500000,
+      "exitCode": 0,
+      "generation": 1,
+      "request_budget": null,
+      "context_tokens": null,
+      "peak_context_tokens": null,
+      "compactions": [],
+      "tool_counts": null,
+      "write_tool_calls": 0,
+      "read_tool_calls": null,
+      "bash_calls": null,
+      "harness": "codex-cli",
+      "worker_profile": "implementation",
+      "original_brief_sha256": "3333333333333333333333333333333333333333333333333333333333333333",
+      "rendered_brief_sha256": "4444444444444444444444444444444444444444444444444444444444444444",
+      "rendered_brief_path": "/tmp/ctm-fixture/worker-reports/w-2.brief.md",
+      "progress": null,
+      "advisories": [],
+      "receipt_state": null,
+      "event_receipts": [],
+      "provider_thread_id": "thread-w-2",
+      "agent_consumed": true,
+      "identity": "marked",
+      "failure": null,
+      "terminal_path": "/tmp/ctm-fixture/worker-reports/w-2.terminal.json",
+      "terminal_present": true,
+      "spend": null,
+      "cli_reported_cost_usd": null,
+      "task_requests_so_far": null,
+      "task_output_tokens_so_far": null,
+      "lease": null,
+      "lead_posture": null,
+      "generations": [{ "generation": 1, "unit": "request", "turns": null, "terminal_code": "", "lease": null }],
+      "parent_ctm_session_id": "lead-1",
+      "retention": {
+        "terminal_at": "2026-10-24T00:01:00.000Z",
+        "consumed_at": "",
+        "acknowledged_at": "",
+        "hide_at": "",
+        "retain_ms": 14400000
+      },
+      "owned_paths": [],
+      "request_budget_diagnostic": "worker_budget_proxy_unavailable",
+      "denied_tool_calls": [],
+      "scope_violations": [],
+      "poll_after_ms": 0,
+      "ctm_session_id": "w-2"
+    },
+    "failed": {
+      "status": "failed",
+      "report_path": "/tmp/ctm-fixture/worker-reports/w-3.md",
+      "report_present": false,
+      "report_source": null,
+      "report_citation_rows": 0,
+      "report_chars": 0,
+      "report_provisional": false,
+      "last_message_path": "/tmp/ctm-fixture/worker-reports/w-3.last.md",
+      "turns": 3,
+      "last_activity_at": 1761350600000,
+      "exitCode": 1,
+      "generation": 1,
+      "request_budget": null,
+      "context_tokens": null,
+      "peak_context_tokens": null,
+      "compactions": [],
+      "tool_counts": null,
+      "write_tool_calls": 0,
+      "read_tool_calls": null,
+      "bash_calls": null,
+      "harness": "claude-code",
+      "worker_profile": "implementation",
+      "original_brief_sha256": "5555555555555555555555555555555555555555555555555555555555555555",
+      "rendered_brief_sha256": "6666666666666666666666666666666666666666666666666666666666666666",
+      "rendered_brief_path": "/tmp/ctm-fixture/worker-reports/w-3.brief.md",
+      "progress": null,
+      "advisories": [],
+      "receipt_state": null,
+      "event_receipts": [],
+      "provider_thread_id": "",
+      "agent_consumed": true,
+      "identity": "marked",
+      "failure": {
+        "class": "terminal",
+        "code": "error_during_execution",
+        "resumable": false,
+        "next_step": "Relaunching will not help; report the failure and its message to the user."
+      },
+      "terminal_path": "/tmp/ctm-fixture/worker-reports/w-3.terminal.json",
+      "terminal_present": true,
+      "spend": null,
+      "cli_reported_cost_usd": null,
+      "task_requests_so_far": null,
+      "task_output_tokens_so_far": null,
+      "lease": null,
+      "lead_posture": null,
+      "generations": [{ "generation": 1, "unit": "turn", "turns": 3, "terminal_code": "error_during_execution", "lease": null }],
+      "parent_ctm_session_id": "lead-1",
+      "retention": {
+        "terminal_at": "2026-10-24T00:02:00.000Z",
+        "consumed_at": "",
+        "acknowledged_at": "",
+        "hide_at": "",
+        "retain_ms": 14400000
+      },
+      "owned_paths": [],
+      "request_budget_diagnostic": "worker_budget_proxy_unavailable",
+      "denied_tool_calls": [],
+      "scope_violations": [],
+      "poll_after_ms": 0,
+      "ctm_session_id": "w-3"
+    }
+  }
+}

package/template/shared/git-remote-key.js

@@ -0,0 +1,83 @@
+'use strict';
+
+// WP-4 (docs/remote-machine-hub-sessions-2026-10-22.html §6.5, §9 S-21, prior-art P5):
+// the ONE canonical git-remote key shared by both ends of the hub/box pair.
+//
+// Why a key at all (AC-4b/AC-4c): the hub must decide "is this laptop project the SAME repo as
+// that box checkout?" without asking either machine. Paths never match (different homes, different
+// clone roots) but the origin remote does, once every spelling of one repo collapses to one
+// string. The picker (AC-4c) and the workspace_bindings.git_remote column (S-21) both key on it.
+//
+// The normal form is `<host>/<path>` — lowercase host, path case PRESERVED (GitHub is
+// case-insensitive on host but a self-hosted Gitea/GHE install is not guaranteed to be on path):
+//
+//   https://example.com/Owner/Repo.git        -> example.com/Owner/Repo
+//   git@example.com:Owner/Repo.git            -> example.com/Owner/Repo      (scp form)
+//   ssh://git@example.com:22/Owner/Repo.git   -> example.com/Owner/Repo      (scheme + port)
+//   https://token@example.com:443/Owner/Repo/ -> example.com/Owner/Repo      (userinfo + slash)
+//   git@example.org:team/sub/Repo.git         -> example.org/team/sub/Repo   (deeper path kept)
+//
+// Anything that is not clearly a remote (empty, a local path, prose, a bare host with no path)
+// normalizes to '' — callers treat '' as "no key", never as a key that might accidentally match
+// another keyless row.
+
+/**
+ * Normalize one git remote URL to the canonical `host/path` key.
+ * Pure, dependency-free, and total: never throws, returns '' for anything unusable.
+ *
+ * @param {unknown} url
+ * @returns {string} '' when the input is not a recognisable remote
+ */
+function normalizeGitRemote(url) {
+  if (url == null) return '';
+  let raw;
+  try {
+    raw = String(url).trim();
+  } catch {
+    return ''; // a null-prototype object / a hostile toString — not a remote, not our problem
+  }
+  if (!raw || /\s/.test(raw)) return '';
+
+  let host = '';
+  let pathPart = '';
+
+  const scheme = raw.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/(.*)$/);
+  if (scheme) {
+    // [user[:pass]@]host[:port]/path — userinfo may itself contain '@', so split on the LAST one.
+    let rest = scheme[2];
+    const at = rest.lastIndexOf('@');
+    if (at >= 0) rest = rest.slice(at + 1);
+    const slash = rest.indexOf('/');
+    if (slash <= 0) return '';
+    const authority = rest.slice(0, slash);
+    pathPart = rest.slice(slash + 1);
+    // Bracketed IPv6 keeps its colons; a bare host:port loses only the port.
+    host = authority.startsWith('[')
+      ? authority.slice(0, authority.indexOf(']') + 1)
+      : authority.replace(/:\d+$/, '');
+  } else {
+    // scp-like `[user@]host:path` — the only other remote shape git accepts. A local path
+    // (`/x/y`), a bare word, a Windows drive (`C:\x\y`, the only reason paths skip backslashes)
+    // or prose has no matching host:path pair.
+    const scp = raw.match(/^(?:[^/@\\\s]+@)?([^/:\s@\\]+):([^\s\\]+)$/);
+    if (!scp) return '';
+    host = scp[1];
+    pathPart = scp[2];
+  }
+
+  host = host.trim().toLowerCase();
+  if (!host) return '';
+
+  // Trailing slashes are stripped TWICE because `.git/` is a spelling of `.git`: strip the
+  // separator, then the suffix it was hiding.
+  const cleaned = pathPart
+    .replace(/^\/+/, '')
+    .replace(/\/+$/, '')
+    .replace(/\.git$/i, '')
+    .replace(/\/+$/, '');
+  if (!cleaned) return '';
+
+  return `${host}/${cleaned}`;
+}
+
+module.exports = { normalizeGitRemote };

package/template/shared/host-identity.js

@@ -18,6 +18,37 @@ function computeHostFingerprint({ hostname, port, dbPath } = {}) {
     .slice(0, 24);
 }
 
+// WP-B D-B1 (docs/remote-hub-fences-followups-r2-clone-truth-and-repair-2026-10-23.html §5/§6):
+// the host's OS machine id, hashed. macOS reads IOPlatformUUID from ioreg (~21 ms, measured; the
+// caller memoizes it per process); Linux reads /etc/machine-id, then /var/lib/dbus/machine-id.
+// Any other platform, an empty read, or any failure ⇒ '' so the caller falls back to the
+// fingerprint verdict — today's behavior, never worse. The RAW id never leaves this function
+// (D-B3: machine-id(5) calls it confidential, and equality is all any caller needs); `readFile` /
+// `execFile` are injectable so both readers are unit-tested with no real OS call (AC-Be).
+function readOsMachineIdHash({
+  platform = process.platform,
+  readFile = fs.readFileSync,
+  execFile = require('child_process').execFileSync,
+} = {}) {
+  let raw = '';
+  try {
+    if (platform === 'darwin') {
+      const output = execFile('/usr/sbin/ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], { encoding: 'utf8', timeout: 2000 });
+      raw = (String(output || '').match(/"IOPlatformUUID" = "([0-9A-Fa-f-]+)"/) || [])[1] || '';
+    } else if (platform === 'linux') {
+      for (const machineIdPath of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try {
+          raw = String(readFile(machineIdPath, 'utf8')).split('\n').map(line => line.trim()).find(Boolean) || '';
+        } catch { /* expected: this candidate path is absent on this distro — try the next one */ }
+        if (raw) break;
+      }
+    }
+  } catch { /* expected: the platform reader is unavailable (missing binary, timeout, unreadable file) ⇒ no machine id ⇒ fingerprint fallback */ }
+  const clean = String(raw || '').trim();
+  if (!clean) return '';
+  return crypto.createHash('sha256').update(`ctm-machine-id:${clean}`).digest('hex').slice(0, 24);
+}
+
 function defaultInstanceId({ hostname, port } = {}) {
   const host = _token(hostname || process.env.HOSTNAME || os.hostname() || 'unknown-host', 'unknown-host');
   const cleanPort = _token(String(port || process.env.CTM_PORT || '3456'), '3456');
@@ -182,9 +213,15 @@ function ensureHostIdentity({
 // ANY id in the current instance's lineage component is recognized as the same host, while a
 // truly unrelated instance id (never connected to `currentId` by any lineage row) still fails.
 //
+// WP-C §5 D-C1 (docs/remote-hub-fences-followups-r2-clone-truth-and-repair-2026-10-23.html): a row
+// with cross_host = 1 was minted ACROSS MACHINES (WP-B), so the id on its far side is another
+// machine's — never this host's own history — and is not traversed unless the caller asks with
+// `{ traverseCrossHost: true }`. cross_host 0 / NULL / absent traverses exactly as before.
+//
 // Pure: takes the lineage rows as data (caller reads them from instance_lineage) so this stays
 // unit-testable with no database at all — see tests/local-remote-state-ownership.test.js.
-// `lineageRows`: array of {priorInstanceId|prior_instance_id, newInstanceId|new_instance_id}.
+// `lineageRows`: array of {priorInstanceId|prior_instance_id, newInstanceId|new_instance_id,
+// cross_host|crossHost}.
 // Returns the SET of every instance id transitively reachable from `currentId` (including
 // `currentId` itself) — the connected component isSameOwnerLineage below tests membership of.
 // Exposed separately (not just the boolean) so a caller that must stay synchronous and
@@ -192,7 +229,7 @@ function ensureHostIdentity({
 // WP-3 comment and tests/runtime-db-isolation.test.js's static "no dbModule." scan) can
 // precompute this ONCE (e.g. at boot, alongside its own instance-id snapshot) and consult a
 // plain in-memory Set forever after, instead of calling into the DB from the hot path.
-function ownerLineageComponent(currentId, lineageRows) {
+function ownerLineageComponent(currentId, lineageRows, { traverseCrossHost = false } = {}) {
   const current = String(currentId || '').trim();
   const seen = new Set(current ? [current] : []);
   if (!current) return seen;
@@ -205,6 +242,7 @@ function ownerLineageComponent(currentId, lineageRows) {
     adjacency.get(b).add(a);
   };
   for (const row of (Array.isArray(lineageRows) ? lineageRows : [])) {
+    if (!traverseCrossHost && Number(row?.cross_host ?? row?.crossHost) === 1) continue; // foreign machine's id
     addEdge(
       String((row && (row.priorInstanceId ?? row.prior_instance_id)) || '').trim(),
       String((row && (row.newInstanceId ?? row.new_instance_id)) || '').trim(),
@@ -231,11 +269,69 @@ function isSameOwnerLineage(candidateId, currentId, lineageRows) {
   return ownerLineageComponent(current, lineageRows).has(candidate);
 }
 
+// The port segments a default instance id can carry: `ctm-<host>-<port>` (defaultInstanceId) or
+// `ctm-<host>-<port>-<6-hex suffix>` (mintInstanceId). The host token may itself contain digits
+// and hyphens, so only the trailing forms are read. The two forms are mutually exclusive on the
+// same tail (a 6-char suffix never fits the 1-5 digit bare port), so at most one port is returned;
+// the result is a list so a caller iterates candidates without a null check.
+function instanceIdPorts(instanceId) {
+  const id = String(instanceId || '').trim();
+  const match = id.match(/-(\d{1,5})-[0-9a-f]{6}$/) || id.match(/-(\d{1,5})$/);
+  return match ? [match[1]] : [];
+}
+
+// Cross-host verdict for a re-mint edge (CTM WP-2 §5 D-3 / §9 S-5, AC-2c; WP-B D-B2).
+// WP-B: when BOTH sides know their OS machine id — `priorIdentityRow.machine_id` and `liveMachineId`
+// both non-empty — the machine id decides ALONE (`prior === live` ⇒ 0 else 1), regardless of
+// hostname / port / data-dir churn: a hostname rename or a data-dir move on ONE machine is a
+// same-host edge, and a copied DB on a different machine is foreign even if the fingerprints match.
+// Only when either side is unknown (legacy rows written before the column, an unsupported platform)
+// do the head-comment's fingerprint rules below apply, byte-for-byte as before — never worse.
+//   * prior row's stored host_fingerprint non-empty and equal to this host's live fingerprint or
+//     one of its compatible variants — at this boot's port or at a port the prior instance id
+//     names → 0 (proven same host),
+//   * prior row's stored host_fingerprint empty → 0 (nothing to compare: FAIL TOWARD TODAY'S
+//     BEHAVIOR, i.e. the edge stays claimable — a false "foreign" would strand legitimate rows),
+//   * otherwise → 1 (the DB was minted on a different machine).
+// The prior-port recompute exists because computeHostFingerprint hashes hostname:port:dbPath, so
+// a same-host re-mint on a NEW port (restart-ctm onto a different port, the render harness's
+// restartServer portPolicy 'fresh') never matches this boot's set; without it every port move
+// was misclassified as a cross-host clone and its startup rows parked (observed 2026-10-23:
+// render-dev-server-identity RL-1b, 3 rows parked 'foreign-clone' on a plain same-dir restart).
+// `fingerprintsAtPort(port)` returns a { live, compatible } set for this host at that port.
+function lineageCrossHost(priorIdentityRow, fingerprints, fingerprintsAtPort = null, liveMachineId = '') {
+  const priorMachineId = String(priorIdentityRow?.machine_id || '').trim();
+  const live = String(liveMachineId || '').trim();
+  if (priorMachineId && live) return priorMachineId === live ? 0 : 1;
+  const stored = String((priorIdentityRow && priorIdentityRow.host_fingerprint) || '').trim();
+  if (!stored) return 0;
+  const matchesSet = (set) => {
+    const live = String((set && set.live) || '').trim();
+    if (live && stored === live) return true;
+    const compatible = set && set.compatible;
+    return Array.isArray(compatible)
+      && compatible.some((value) => { const clean = String(value || '').trim(); return clean && clean === stored; });
+  };
+  if (matchesSet(fingerprints)) return 0;
+  if (typeof fingerprintsAtPort === 'function') {
+    for (const priorPort of instanceIdPorts(priorIdentityRow && priorIdentityRow.instance_id)) {
+      let set = null;
+      try { set = fingerprintsAtPort(priorPort); }
+      catch { /* expected: a malformed prior id yields no candidate set; the verdict falls through to 1 */ }
+      if (matchesSet(set)) return 0;
+    }
+  }
+  return 1;
+}
+
 module.exports = {
+  instanceIdPorts,
+  lineageCrossHost,
   computeHostFingerprint,
   defaultInstanceId,
   ensureHostIdentity,
   identityFilePath,
+  readOsMachineIdHash,
   readIdentityFile,
   writeIdentityFile,
   isSameOwnerLineage,