create-walle 0.10.1 → 0.10.3

package/template/wall-e/http/telemetry-api.js

@@ -17,6 +17,11 @@
 // module-state rate-limit bookkeeping (renamed from handleWalleApi._rlMap/
 // _rlTimer, moved verbatim).
 const { jsonResponse, readBody } = require('./api-utils');
+// WP-1 (blog-view-counts, docs/blog-view-counts-2026-10-22.html §5 D-4): the
+// public blog-view counter is a sibling of the telemetry routes — same module
+// boundary, same injected deps, same dispatch chain — and is claimed FIRST so
+// its exact path can never fall through to a telemetry handler.
+const { handleBlogViewsApi } = require('./blog-views-api');
 
 function handleTelemetryApi(req, res, url, deps) {
   const {
@@ -47,6 +52,13 @@ function handleTelemetryApi(req, res, url, deps) {
   const m = req.method;
   const params = url.searchParams;
 
+  // --- Blog view counts (public, unauthenticated, exact path only) ---
+  // Before the telemetry routes: the handler claims only
+  // /api/wall-e/telemetry/blog-views and returns false for everything else, so the
+  // existing dispatch order and behavior below are untouched.
+  const blogViewsHandled = handleBlogViewsApi(req, res, url, { getTelemetryDb, errorSink });
+  if (blogViewsHandled !== false) return blogViewsHandled;
+
   // --- Telemetry endpoints (server mode only) ---
 
   // POST /api/wall-e/telemetry/ingest — receive anonymous telemetry from users

package/template/wall-e/jobs/job-runner.js

@@ -48,6 +48,7 @@
 // `../brain/job-store` here.
 
 const { writeRunArtifact, pruneRunArtifacts, classifySkillError } = require('../lib/run-artifacts');
+const { resolvePlacement } = require('../lib/derivation-home');
 
 // The per-run execution budget constants and the prompt builder live in the
 // require-free leaf `jobs/job-defaults.js` (moved there verbatim by fix round 2);
@@ -65,6 +66,13 @@ const {
 // §4: default concurrency is 1 — run jobs one at a time per tick, no flag.
 const DEFAULT_JOB_CONCURRENCY = 1;
 
+// D-5/S-16 (shared-memory WP-2): job kinds whose INPUT is replicated brain rows, so the
+// derived rows they mint (skill-executor's timestamped `source_id`, a prompt job's model
+// output) would multiply across N replicas. Only the derivation home selects them;
+// `builtin` jobs (e.g. `slack.inbound`) act on data this machine has and always run.
+const DERIVED_JOB_ACTION_KINDS = new Set(['skill', 'prompt']);
+const NOT_DERIVATION_HOME = 'not_derivation_home';
+
 // §6.1 retention: keep the newest 200 runs per job.
 const DEFAULT_RUN_KEEP = 200;
 
@@ -337,9 +345,13 @@ async function runJob(job, { trigger = 'schedule', now = Date.now, executors, ac
  *
  * @returns {Promise<{ran: number, skipped: number, considered: number, decisions: Array}>}
  */
-async function runDueJobs({ now = Date.now, executors, brain, deps } = {}) {
+async function runDueJobs({ now = Date.now, executors, brain, deps, placement } = {}) {
   const io = resolveAccess(brain);
   const at = typeof now === 'function' ? now() : now;
+  // D-5/S-16 (WP-2): the `jobs` table is host-local and stays untouched; the placement gate
+  // lives HERE, at the selection point, so a non-home node simply never selects a derived job.
+  // `placement` is the test seam; production resolves it from CTM (cached 60 s).
+  const resolvedPlacement = placement || await resolvePlacement();
 
   const jobs = await io.read('listJobs', [{ includeDisabled: true }]);
   const decisions = [];
@@ -350,6 +362,19 @@ async function runDueJobs({ now = Date.now, executors, brain, deps } = {}) {
   for (const job of jobs || []) {
     if (ran >= DEFAULT_JOB_CONCURRENCY) break;
     considered += 1;
+    // WP-2: a derived job on a non-home node is skipped with its own reason, reported in the
+    // same `decisions` array every other skip uses (no row is disabled, no run is recorded).
+    if (!resolvedPlacement.home && DERIVED_JOB_ACTION_KINDS.has(job.action_kind)) {
+      skipped += 1;
+      decisions.push({
+        job_id: job.id,
+        name: job.name,
+        decision: 'skip',
+        reason: NOT_DERIVATION_HOME,
+        details: { action_kind: job.action_kind, placement: resolvedPlacement.reason },
+      });
+      continue;
+    }
     // WP-5a (D-12): the connection record is the authority — a job that declares
     // a requirement is judged by its kind's row, and a job that declares none is
     // 'ok'. Only reconnect_required/disabled gate dispatch (§4/D-6).
@@ -527,4 +552,6 @@ module.exports = {
   MIN_TASK_EXECUTION_TIMEOUT_MS,
   DEFAULT_JOB_CONCURRENCY,
   DEFAULT_RUN_KEEP,
+  DERIVED_JOB_ACTION_KINDS,
+  NOT_DERIVATION_HOME,
 };

package/template/wall-e/lib/blog-view-policy.js

@@ -0,0 +1,88 @@
+'use strict';
+
+// WP-1 (docs/blog-view-counts-2026-10-22.html §5/§6): the ONE place the blog
+// view counter's public surface is described — route, article allowlist, policy
+// ceilings, accepted browser origins and the approximate bot filter. Pure data
+// and pure predicates: no env read, no database handle, no module state, no
+// side effects at require time.
+//
+// Counting semantics are deliberately approximate (design §11): one visible
+// article opening per 30-minute per-tab token, no unique-person claim, no
+// historical backfill.
+
+// The EXACT public path. It lives under the /api/wall-e/telemetry/ prefix on
+// purpose (design §5 D-4, lead review correction): api-walle.js already routes
+// that prefix to lib/telemetry-process-client.js in the daemon role, so the
+// counter runs in the isolated telemetry process — no SQLite on the foreground
+// daemon — without touching the frozen dispatcher.
+const BLOG_VIEWS_PATH = '/api/wall-e/telemetry/blog-views';
+
+// The three published static articles. A slug outside this frozen list is never
+// a valid counter key, so an arbitrary/hostile value can never reach a query.
+const BLOG_POSTS = Object.freeze(['delegation-economics', 'delegation-guide', 'paste-the-link']);
+
+// Repeat-visit suppression window: a per-tab random token counts once per 30 min.
+const BLOG_VIEW_WINDOW_MS = 1800000;
+
+// Product policy ceilings (conservative, not measured traffic — design §11).
+const BLOG_VIEW_MAX_RECEIPTS = 100000;
+const BLOG_VIEW_MAX_BODY_BYTES = 1024;
+
+// Bounded receipt pruning: a POST removes at most this many expired receipts.
+const BLOG_VIEW_PRUNE_BATCH = 1000;
+
+// The only browser origins whose POST may increment a counter (and the only ones
+// reflected back in CORS). Both the apex and the www host serve the site.
+const BLOG_VIEW_ORIGINS = Object.freeze(['https://walle.sh', 'https://www.walle.sh']);
+
+// User-Agent input is truncated before matching; the pattern is an approximate
+// filter (design D-4), never proof that a visitor is human.
+const BLOG_VIEW_USER_AGENT_MAX = 1024;
+const BLOG_VIEW_BOT_PATTERN = /bot|crawler|spider|headless|curl|wget|python|preview|facebookexternalhit|meta-externalagent|bytespider|gptbot|claudebot/i;
+
+// Canonical lowercase 8-4-4-4-12 UUID text (the shape crypto.randomUUID emits).
+const BLOG_VIEW_TOKEN_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+function isBlogViewsPath(pathname) {
+  return pathname === BLOG_VIEWS_PATH;
+}
+
+// Returns the request's origin only when it is EXACTLY one of the two published
+// site origins; every other present origin is null (the caller turns that into a
+// refusal — the private API's localhost-only set is never widened).
+function getBlogViewOrigin(origin) {
+  if (typeof origin !== 'string') return null;
+  return BLOG_VIEW_ORIGINS.includes(origin) ? origin : null;
+}
+
+function isBlogPostSlug(slug) {
+  return typeof slug === 'string' && BLOG_POSTS.includes(slug);
+}
+
+function isBlogViewToken(token) {
+  return typeof token === 'string' && BLOG_VIEW_TOKEN_PATTERN.test(token);
+}
+
+// Truncated, case-insensitive, deliberately approximate reconnaissance filter.
+function isKnownBotUserAgent(userAgent) {
+  if (typeof userAgent !== 'string' || userAgent === '') return false;
+  return BLOG_VIEW_BOT_PATTERN.test(userAgent.slice(0, BLOG_VIEW_USER_AGENT_MAX));
+}
+
+module.exports = {
+  BLOG_POSTS,
+  BLOG_VIEWS_PATH,
+  BLOG_VIEW_BOT_PATTERN,
+  BLOG_VIEW_MAX_BODY_BYTES,
+  BLOG_VIEW_MAX_RECEIPTS,
+  BLOG_VIEW_ORIGINS,
+  BLOG_VIEW_PRUNE_BATCH,
+  BLOG_VIEW_TOKEN_PATTERN,
+  BLOG_VIEW_USER_AGENT_MAX,
+  BLOG_VIEW_WINDOW_MS,
+  getBlogViewOrigin,
+  isBlogPostSlug,
+  isBlogViewsPath,
+  isBlogViewToken,
+  isKnownBotUserAgent,
+};

package/template/wall-e/lib/blog-view-store.js

@@ -0,0 +1,169 @@
+'use strict';
+
+// WP-1 (docs/blog-view-counts-2026-10-22.html §5 D-2, §6): durable per-article
+// view counters on the EXISTING telemetry.db. Two additive tables — a running
+// total per article and a bounded set of short-lived per-tab receipts — updated
+// in one IMMEDIATE transaction, so a replay is a no-op and a concurrent writer
+// can never double-count.
+//
+// The handle is ALWAYS injected: nothing here opens a database, calls initDb(),
+// schedules a job or reads the environment. This module contains NO DDL: the two
+// tables are declared and created by lib/telemetry-db-schema.js (the
+// walle-telemetry migration owner), whose baseline and additive migration 2 both
+// call its own createBlogViewTables(). Only queries live here, and the module
+// requires nothing but the pure policy module — no cycle back through the schema.
+//
+// Privacy (design D-5): a receipt stores the slug, the opaque random per-tab
+// token and its expiry — nothing else. No IP address, User-Agent, referrer,
+// account or derived fingerprint is ever written; the raw token is a
+// deduplication key, not a credential, and expires in 30 minutes.
+//
+// Counting semantics are approximate (design §11): a 30-minute per-tab
+// suppression window, not unique people.
+
+const {
+  BLOG_VIEW_MAX_RECEIPTS,
+  BLOG_VIEW_PRUNE_BATCH,
+  BLOG_VIEW_WINDOW_MS,
+  BLOG_POSTS,
+  isBlogPostSlug,
+  isBlogViewToken,
+} = require('./blog-view-policy');
+
+// Typed store errors: the API layer maps them to status codes without ever
+// having to parse a message.
+const BLOG_VIEW_INVALID_SLUG = 'blog_view_invalid_slug';
+const BLOG_VIEW_INVALID_TOKEN = 'blog_view_invalid_token';
+const BLOG_VIEW_INVALID_STATE = 'blog_view_invalid_state';
+const BLOG_VIEW_CAPACITY = 'blog_view_capacity';
+const BLOG_VIEW_OVERFLOW = 'blog_view_overflow';
+
+function blogViewError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// Current totals for every published article, as {slug: views}. A known article
+// with no row yet is authoritatively 0; an unsafe or negative stored value is
+// refused rather than rendered.
+function getBlogViewCounts(db) {
+  const placeholders = BLOG_POSTS.map(() => '?').join(', ');
+  const rows = db.prepare(
+    `SELECT slug, views FROM blog_view_counts WHERE slug IN (${placeholders})`
+  ).all(...BLOG_POSTS);
+  const counts = {};
+  for (const slug of BLOG_POSTS) counts[slug] = 0;
+  for (const row of rows) {
+    // Prototype-safe: only the frozen allowlist's own keys are ever assigned to,
+    // so a hostile stored slug can never write through to Object.prototype.
+    if (!Object.prototype.hasOwnProperty.call(counts, row.slug)) continue;
+    if (!Number.isSafeInteger(row.views) || row.views < 0) {
+      throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+    }
+    counts[row.slug] = row.views;
+  }
+  return counts;
+}
+
+// Records one view for `slug` from the per-tab `token` at `nowMs`, returning
+// {slug, views, counted}. `counted` is false when this exact token already has
+// an unexpired receipt (a refresh or a duplicate submission) — the stored total
+// is then returned unchanged, even when the receipt table is at its cap.
+//
+// Throws a typed error for an unknown slug, a non-canonical token, a full
+// receipt table or a total at the safe-integer ceiling; the caller maps those to
+// a refusal and never acknowledges an uncounted view.
+function recordBlogView(db, slug, token, nowMs = Date.now()) {
+  // Validate the ONLY two things that can reach SQL, before any statement runs:
+  // a frozen-allowlist slug and canonical UUID text. No arbitrary key ever
+  // becomes a query parameter.
+  if (!isBlogPostSlug(slug)) {
+    throw blogViewError(BLOG_VIEW_INVALID_SLUG, 'unknown blog post slug');
+  }
+  // Canonical text only, and nothing below folds case: isBlogViewToken() accepts
+  // ONLY the lowercase 8-4-4-4-12 spelling, so an uppercased uuid is refused as a
+  // malformed token rather than silently normalized into somebody else's receipt
+  // key.
+  if (!isBlogViewToken(token)) {
+    throw blogViewError(BLOG_VIEW_INVALID_TOKEN, 'token is not a canonical uuid');
+  }
+  const now = Number.isSafeInteger(nowMs) ? nowMs : Date.now();
+
+  const record = db.transaction(() => {
+    // 1. Bounded, indexed prune of expired receipts (at most
+    //    BLOG_VIEW_PRUNE_BATCH rows): the table stays bounded with no job.
+    db.prepare(
+      `DELETE FROM blog_view_receipts WHERE rowid IN (
+         SELECT rowid FROM blog_view_receipts
+         WHERE expires_at_ms <= ?
+         ORDER BY expires_at_ms
+         LIMIT ?
+       )`
+    ).run(now, BLOG_VIEW_PRUNE_BATCH);
+
+    // 2. An EXACT unexpired receipt is a duplicate: the stored total is returned
+    //    unchanged, even when the table is at its cap.
+    const existing = db.prepare(
+      'SELECT expires_at_ms FROM blog_view_receipts WHERE slug = ? AND token = ?'
+    ).get(slug, token);
+    if (existing && existing.expires_at_ms > now) {
+      const current = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+      const views = current ? current.views : 0;
+      if (!Number.isSafeInteger(views) || views < 0) {
+        throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+      }
+      return { slug, views, counted: false };
+    }
+    // An expired receipt for this exact token is removed before its replacement
+    // is inserted, so the primary key never collides and no stale expiry is
+    // reused. (Step 1 usually removed it already; this is the exact case.)
+    if (existing) {
+      db.prepare('DELETE FROM blog_view_receipts WHERE slug = ? AND token = ?').run(slug, token);
+    }
+
+    // 3. Capacity is a policy bound, not memory: a full table refuses the view
+    //    (the transaction rolls back, so the cap stays full) instead of
+    //    acknowledging an uncounted one.
+    const receiptCount = db.prepare('SELECT count(*) AS n FROM blog_view_receipts').get().n;
+    if (receiptCount >= BLOG_VIEW_MAX_RECEIPTS) {
+      throw blogViewError(BLOG_VIEW_CAPACITY, 'blog view receipt capacity reached');
+    }
+
+    // 4. Never wrap: a total at the safe-integer ceiling refuses the view.
+    const currentRow = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+    const currentViews = currentRow ? currentRow.views : 0;
+    if (!Number.isSafeInteger(currentViews) || currentViews < 0) {
+      throw blogViewError(BLOG_VIEW_INVALID_STATE, 'stored blog view count is not a safe non-negative integer');
+    }
+    if (currentViews >= Number.MAX_SAFE_INTEGER) {
+      throw blogViewError(BLOG_VIEW_OVERFLOW, 'blog view count reached the safe integer ceiling');
+    }
+
+    db.prepare(
+      `INSERT INTO blog_view_receipts (slug, token, expires_at_ms) VALUES (?, ?, ?)
+       ON CONFLICT(slug, token) DO UPDATE SET expires_at_ms = excluded.expires_at_ms`
+    ).run(slug, token, now + BLOG_VIEW_WINDOW_MS);
+    db.prepare(
+      `INSERT INTO blog_view_counts (slug, views) VALUES (?, 1)
+       ON CONFLICT(slug) DO UPDATE SET views = views + 1`
+    ).run(slug);
+
+    const committed = db.prepare('SELECT views FROM blog_view_counts WHERE slug = ?').get(slug);
+    return { slug, views: committed ? committed.views : 0, counted: true };
+  });
+
+  // IMMEDIATE: take the write lock at BEGIN, so two competing writers serialize
+  // instead of one failing late with SQLITE_BUSY after a stale read.
+  return record.immediate();
+}
+
+module.exports = {
+  BLOG_VIEW_CAPACITY,
+  BLOG_VIEW_INVALID_SLUG,
+  BLOG_VIEW_INVALID_STATE,
+  BLOG_VIEW_INVALID_TOKEN,
+  BLOG_VIEW_OVERFLOW,
+  getBlogViewCounts,
+  recordBlogView,
+};

package/template/wall-e/lib/brain-owner-op-priority.js

@@ -13,7 +13,15 @@ const OWNER_METHOD_PRIORITY = Object.freeze({
   // background — scheduled, resumable
   markTurnLedgerOutboxDelivered: 'background',
   recordTurnLedgerOutboxFailure: 'background',
-  backfillEntityLinkBatch: 'background', backfillClassifyBatch: 'background',
+  backfillEntityLinkBatch: 'background', backfillClassifyBatch: 'background', brainSyncClockSeed: 'background',
+  // WP-1 §6.4: the v2 feed/apply pair and the hub bookkeeping — peer-driven, no user waits on
+  // them locally (the hub's own tick owns the latency budget), so they share the seed walk's
+  // class rather than competing with an interactive turn.
+  brainSyncV2Vector: 'background', brainSyncV2Changes: 'background', brainSyncV2Apply: 'background',
+  brainSyncV2MemberVector: 'background', brainSyncV2PruneTombstones: 'background', brainSyncV2Digest: 'background',
+  // WP-4 §6.7: the join trio + the import job's step — peer/job-driven, no local user waits on them.
+  brainSyncV2JoinSnapshot: 'background', brainSyncV2JoinImport: 'background',
+  brainSyncV2JoinStatus: 'background', brainSyncV2JoinStep: 'background',
   backfillStripNoiseBatch: 'background', backfillInsertMemoryIndexBatch: 'background',
   backfillMarkEmbedFailed: 'background', embeddingsUpsertBatch: 'background',
   commitThinkExtraction: 'background', ingestInsertMemoryBatch: 'background',

package/template/wall-e/lib/client-config-lock.js

@@ -43,6 +43,7 @@ const os = require('os');
 const path = require('path');
 
 const { ClientConfigError, isClientConfigError } = require('./mcp-client-config');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 const POLL_MS = 100; // admission cadence, never a performance budget
 const DEFAULT_TIMEOUT_MS = 10000; // admission deadline only
@@ -145,7 +146,7 @@ function _modeBits(stat) {
 }
 
 function _isGroupOrOtherWritable(stat) {
-  return (_exactInteger(stat.mode) & 0o022n) !== 0n;
+  return !isWritableOnlyByOwner(stat);
 }
 
 function _hasStickyBit(stat) {

package/template/wall-e/lib/coding-journal-writer-child-client.js

@@ -20,7 +20,6 @@ const SAFE_ENV_KEYS = [
   'WALL_E_SQLITE_STORAGE_POLICY',
   'WALL_E_SQLITE_BUSY_TIMEOUT_MS',
   'WALL_E_SQLITE_WRITE_LOCK_TIMEOUT_MS',
-  'WALL_E_SQLITE_WRITE_LOCK_STALE_MS',
   'WALL_E_BRAIN_BOOT_LOCK_WAIT_MS',
   'WALL_E_SQLITE_SYNCHRONOUS',
   'WALL_E_SQLITE_WAL_AUTOCHECKPOINT_PAGES',
@@ -82,16 +81,48 @@ function writeJournalEntryInChild(entry, options = {}) {
       serialization: 'json',
     });
   } catch (error) {
+    // C7: a fork that threw synchronously returned no child, so this call owns
+    // nothing to watch and nothing to terminate — reject with the original value.
     return Promise.reject(error);
   }
 
   return new Promise((resolve, reject) => {
+    // C7: the application result (one reply envelope) and the native lifecycle
+    // (exit/close) are two separate facts about the same child. Only the child's
+    // own 'close' finalizes this operation — a reply envelope or 'exit' alone
+    // leaves the operation pending, because the child may still be running (or
+    // may still die badly) after either one.
+    let replied = false;
+    let replyResult = null;
+    let failed = false; // explicit Boolean: a falsy thrown value is still a failure
+    let failure = null;
+    let nativeExited = false; // 'exit' seen: the process is gone, its stdio is not necessarily closed
+    let nativeClosed = false; // 'close' seen: the only fact that finalizes this operation
+    let terminationRequested = false;
     let settled = false;
+
+    const recordFailure = (error) => {
+      // The FIRST failure wins, verbatim (identity and value): later errors, the
+      // deadline and a nonzero native close must never replace it.
+      if (failed) return;
+      failed = true;
+      failure = error;
+    };
+    const requestTermination = () => {
+      if (terminationRequested) return;
+      // Marked BEFORE kill: an 'error' emitted by the kill call itself must not
+      // re-enter here and signal the same child twice.
+      terminationRequested = true;
+      if (nativeExited || nativeClosed) return; // never signal after the native exit/close was observed
+      try { child.kill('SIGKILL'); }
+      catch { /* expected: the child may already be gone; a throwing kill neither relinquishes ownership nor proves closure — the operation still joins the child's actual close below */ }
+    };
     const cleanup = () => {
       clearTimeout(timer);
       child.off('message', onMessage);
       child.off('error', onError);
       child.off('exit', onExit);
+      child.off('close', onClose);
     };
     const settle = (fn, value) => {
       if (settled) return false;
@@ -101,39 +132,57 @@ function writeJournalEntryInChild(entry, options = {}) {
       return true;
     };
     const onMessage = (message) => {
-      if (!message || message.type !== 'coding-journal-result') return;
-      if (message.ok) settle(resolve, message.result || null);
-      else {
-        const error = new Error(String(message.error || 'One-shot journal writer failed').slice(0, 500));
-        if (message.code) error.code = String(message.code).slice(0, 100);
-        settle(reject, error);
-      }
+      if (!message || message.type !== 'coding-journal-result') return; // unrelated envelope
+      if (replied) return; // first valid result wins; duplicate and late envelopes are ignored
+      replied = true;
+      if (message.ok) { replyResult = message.result || null; return; }
+      const error = new Error(String(message.error || 'One-shot journal writer failed').slice(0, 500));
+      if (message.code) error.code = String(message.code).slice(0, 100);
+      recordFailure(error);
+    };
+    const onError = (error) => {
+      // A process/IPC error is a failure but not a closure: the operation keeps
+      // waiting for the child's own close, and this first failure is preserved.
+      recordFailure(error);
+      requestTermination();
     };
-    const onError = (error) => settle(reject, error);
-    const onExit = (code, signal) => {
+    // 'exit' only records that the process is gone; the verdict reads the close
+    // event's own (code, signal), so exit and close can never be conflated.
+    const onExit = () => { nativeExited = true; };
+    const onClose = (code, signal) => {
+      nativeClosed = true;
+      // A falsy thrown value must not be laundered into a success: the boolean,
+      // not the value, says whether a failure happened.
+      if (failed) { settle(reject, failure); return; }
       const suffix = signal ? `signal ${signal}` : `code ${code}`;
-      settle(reject, new Error(`One-shot journal writer exited before replying (${suffix})`));
+      if (!replied) { settle(reject, new Error(`One-shot journal writer exited before replying (${suffix})`)); return; }
+      if (code === 0 && signal === null) { settle(resolve, replyResult); return; }
+      // Replied, then died badly: the reply alone is not proof the write survived.
+      const error = new Error(`One-shot journal writer exited after replying (${suffix})`);
+      error.code = 'WALL_E_JOURNAL_WRITER_EXIT';
+      settle(reject, error);
     };
     const timer = setTimeout(() => {
       const error = new Error(`One-shot journal writer timed out after ${timeoutMs}ms`);
       error.code = 'WALL_E_JOURNAL_WRITER_TIMEOUT';
-      if (!settle(reject, error)) return;
-      try { child.kill('SIGKILL'); } catch {}
+      recordFailure(error); // only the first failure is kept; the deadline joins the close
+      requestTermination();
     }, timeoutMs);
 
     child.on('message', onMessage);
-    child.once('error', onError);
-    child.once('exit', onExit);
+    child.on('error', onError);
+    child.on('exit', onExit);
+    child.on('close', onClose);
     try {
       child.send({
         type: 'persist-coding-journal',
         dbPath: path.resolve(dbPath),
         entry: JSON.parse(entryJson),
       });
+      // A false return is IPC backpressure, never a failure or a cancellation.
     } catch (error) {
-      if (settle(reject, error)) {
-        try { child.kill('SIGKILL'); } catch {}
-      }
+      recordFailure(error);
+      requestTermination();
     }
   });
 }

package/template/wall-e/lib/ctm-data-dir.js

@@ -0,0 +1,26 @@
+'use strict';
+
+// R-6/R-7 (§5, D-4) — "CTM's data dir", computed the way CTM computes it for itself
+// (coding-task-manager/lib/data-dir.js:17-21) but from a GIVEN env object.
+//
+// Call it in the Wall-E DAEMON (the process that serves POST /api/walle/sync/v2/join/import),
+// NEVER in the brain-owner worker: the owner's env is a deliberate whitelist
+// (lib/brain-owner-env.js) that sets WALL_E_DATA_DIR to the brain's own directory and drops
+// CTM_DATA_DIR (I-5), so resolving the inbox root there names the wrong directory — which is
+// exactly the Spark fault (every join import refused JOIN_PATH_INVALID while CTM wrote its
+// snapshots to the CTM inbox). The daemon resolves the root and passes it down as `dataDir`
+// (http/sync-api.js _handleV2JoinImport → brain/brain-join.js isInsideJoinInbox).
+
+const os = require('node:os');
+const path = require('node:path');
+
+// CTM_DATA_DIR, then WALL_E_DATA_DIR (wall-e's own override, honoured by CTM's resolver too so a
+// single value works for both processes), then <HOME>/.walle/data. An empty — or
+// whitespace-only — value counts as unset, matching CTM's truthiness test on the raw value.
+function resolveCtmDataDir(env = process.env) {
+  const override = String(env.CTM_DATA_DIR || env.WALL_E_DATA_DIR || '').trim();
+  if (override) return path.resolve(override);
+  return path.resolve(env.HOME || os.homedir(), '.walle', 'data');
+}
+
+module.exports = { resolveCtmDataDir };