create-walle 0.10.1 → 0.10.3

package/template/coding-task-manager/lib/claude-table-layout.js

@@ -0,0 +1,322 @@
+'use strict';
+
+// Port of Claude Code 2.1.310's Markdown-table layout, read from the installed CLI
+// (the versioned CLI binary under the user's local Claude install, Mach-O arm64; the layout sits at byte
+// offset ~= 243,694,000, the `kind:"vertical"` literal: functions jr / Q / Z / Y / _t / ce,
+// constants Ke=4 _e=3 as=4 Or=200). Design: docs/reader-claude-table-layout-parity-2026-10-25.html
+// §3.1 (the algorithm) and §5 (rules R-1..R-8).
+//
+// WHY THIS EXISTS: the reader re-draws a Claude transcript into rows and then proves the seam
+// against what the live terminal painted. A table the transcript renderer draws differently from
+// the TUI is content the screen never had, and the proof refuses (dup rows / an overlap). So this
+// module reproduces Claude's own layout EXACTLY -- same branch choice, same column widths, same
+// line breaks, same glyphs, same fallback to the stacked key-value "cards", quirks included
+// (R-6: floor rounding in the proportional branch, `max(floor(E*C/W), 3)` in the hard branch,
+// the `> 4` wrapped-line rule, `floor` vertical centring, the 200-row cap). No "improvement" here
+// is a fix; every deviation is a bug (R-1).
+//
+// TWO FORMS: `bordered` (the box, lines carry NO indent and never exceed cols - 4) and `cards`
+// (the vertical key-value form, re-wrapped a second time by Ink's box: see inkWrapLines). The
+// caller (lib/claude-markdown-ansi.js emitTable) prefixes the 2-column message indent and closes
+// each row; `cols` is the TERMINAL width and the indent is never subtracted from it (R-5).
+//
+// VERIFIED against three live captures (golden fixtures under
+// tests/golden/claude-transcript/table-captures/, reproduced byte-for-byte by
+// tests/claude-table-captures.test.js):
+//   lid-options-196  -- session 6ea59930 painted rows 4192-4197, cols 196, hard branch -> cards
+//   tasks-steps-171  -- session 3320adc3 painted rows 493-517, cols 171, proportional -> cards
+//                       (the 170-cell card line re-wrapped at 169 by Ink's box)
+//   inject-ways-196  -- session 7cf57222 painted rows 8396-8408, cols 196, proportional -> bordered
+// There is no runtime switch on the Claude version (R-8): drift is caught by those fixtures.
+
+const { stringCellWidth } = require('./terminal-cell-width');
+
+// wrap-ansi is ESM-only; Node's require(esm) (>= 22.12, the pinned 25.2.1 here) hands back the
+// namespace, so `.default` is the function. Loaded ONCE at module top (D-4).
+const wrapAnsiModule = require('wrap-ansi');
+const wrapAnsi = wrapAnsiModule.default || wrapAnsiModule;
+
+// Claude's own constants, by their de-minified names (Ke / _e / as / Or) plus the rule cap and
+// the version/offset the port was read from (R-8).
+const CLAUDE_TABLE = Object.freeze({
+  MARGIN: 4, // Ke: a bordered table must fit inside cols - 4
+  MIN_COL: 3, // _e: never allocate less than 3 columns to a cell
+  MAX_CELL_LINES: 4, // as: a cell wrapping to MORE lines than this sends the table to cards
+  MAX_ROWS: 200, // Or: rows beyond this are dropped and announced
+  RULE_MAX: 40, // the card separator is '─'.repeat(min(cols - 1, 40))
+  VERSION: '2.1.310',
+});
+
+const SGR_RE = /\x1b\[[0-9;?]*[ -\/]*[@-~]/g;
+
+function stripSgr(text) {
+  return String(text == null ? '' : text).replace(SGR_RE, '');
+}
+
+/**
+ * Claude's `ce(text, width, {hard})`: wrap-ansi with `trimEnd()` first, `{hard, trim:false,
+ * wordWrap:true}`, empty lines dropped, `['']` when nothing is left. `width <= 0` returns the
+ * text untouched (Claude's own early return).
+ */
+function wrapCell(text, width, hard) {
+  const source = String(text == null ? '' : text);
+  if (width <= 0) return [source];
+  const lines = wrapAnsi(source.trimEnd(), width, { hard: !!hard, trim: false, wordWrap: true })
+    .split('\n')
+    .filter((line) => line.length > 0);
+  return lines.length > 0 ? carryExtendedColour(lines) : [''];
+}
+
+// wrap-ansi closes bold / italic / strike and the 16 basic colours at its own line break and re-opens
+// them on the next line, but it has no closer for an EXTENDED colour selector (`38;5;n`, `38;2;r;g;b`):
+// a coloured span that wraps inside a cell stays open past the cell's `│` and paints the border and
+// the neighbouring cell. The live screen never does that -- painted-rows census 2026-10-26: 556 of
+// 556 bordered rows carrying a 256-colour span close it before every border (Ink styles each text
+// node on its own) -- so carry the colour across the break exactly the way wrap-ansi carries the
+// other attributes: close it (`39`) at the end of the line, re-open it at the start of the next.
+function carryExtendedColour(lines) {
+  let open = null;
+  return lines.map((line) => {
+    const prefix = open || '';
+    for (const m of line.matchAll(/\x1b\[([0-9;]*)m/g)) {
+      const codes = m[1] === '' ? [0] : m[1].split(';').map(Number);
+      for (let i = 0; i < codes.length; i += 1) {
+        const code = codes[i];
+        if (code === 38 && codes[i + 1] === 5) { open = `\x1b[38;5;${codes[i + 2]}m`; i += 2; }
+        else if (code === 38 && codes[i + 1] === 2) { open = `\x1b[38;2;${codes.slice(i + 2, i + 5).join(';')}m`; i += 4; }
+        else if (code === 0 || code === 39 || (code >= 30 && code <= 37) || (code >= 90 && code <= 97)) open = null;
+      }
+    }
+    return prefix + line + (open ? '\x1b[39m' : '');
+  });
+}
+
+// Claude's `bgr(text, width, align)` -- pad by VISIBLE width. `center` puts the odd space on the
+// right (floor on the left), `right` pads all on the left, `left` all on the right.
+function pad(text, width, align, strWidth) {
+  const total = Math.max(0, width - strWidth(stripSgr(text)));
+  if (align === 'center') {
+    const left = Math.floor(total / 2);
+    return ' '.repeat(left) + text + ' '.repeat(total - left);
+  }
+  if (align === 'right') return ' '.repeat(total) + text;
+  return text + ' '.repeat(total);
+}
+
+/**
+ * Lay a table out exactly as Claude Code 2.1.310 does.
+ *
+ *   header: ANSI-rendered header cells (emitInline output)   rows: ANSI-rendered body cells
+ *   align:  ('left'|'center'|'right'|null)[]                 cols: terminal columns (p)
+ *
+ * Returns the layout DECISION, never the indented rows:
+ *   { kind:'bordered', widths, hard, branch:'natural'|'proportional'|'hard', lines }
+ *     -- lines carry no indent; the widest is <= cols - 4
+ *   { kind:'cards', branch, reason:'cellLines'|'tooWide'|'headerOnly', headers, rows, truncated }
+ *     -- the vertical form's inputs, before Ink's box wrap (see cardLines/inkWrapLines)
+ */
+function layoutClaudeTable({ header, rows, align } = {}, cols, { strWidth = stringCellWidth } = {}) {
+  const p = Number(cols) || 0;
+  const headerCells = (header || []).map((cell) => String(cell == null ? '' : cell));
+  const everyRow = (rows || []).map((row) => (row || []).map((cell) => String(cell == null ? '' : cell)));
+  const truncated = Math.max(0, everyRow.length - CLAUDE_TABLE.MAX_ROWS);
+  const bodyRows = truncated > 0 ? everyRow.slice(0, CLAUDE_TABLE.MAX_ROWS) : everyRow;
+
+  const K = headerCells.length;
+  if (K === 0) return { kind: 'bordered', widths: [], hard: false, branch: 'natural', lines: [] };
+
+  // R-3: widths come from the SGR-stripped RENDERED cell (a link counts as `label (href)`).
+  // E[c] = the widest whitespace-separated word, H[c] = the widest whole cell, both floored at 3.
+  const wordWidth = (cell) => {
+    const words = stripSgr(cell).split(/\s+/).filter((word) => word.length > 0);
+    if (words.length === 0) return CLAUDE_TABLE.MIN_COL;
+    let widest = CLAUDE_TABLE.MIN_COL;
+    for (const word of words) widest = Math.max(widest, strWidth(word));
+    return widest;
+  };
+  const cellWidth = (cell) => Math.max(strWidth(stripSgr(cell)), CLAUDE_TABLE.MIN_COL);
+
+  const E = headerCells.map((cell, i) => {
+    let width = wordWidth(cell);
+    for (const row of bodyRows) width = Math.max(width, wordWidth(row[i] || ''));
+    return width;
+  });
+  const H = headerCells.map((cell, i) => {
+    let width = cellWidth(cell);
+    for (const row of bodyRows) width = Math.max(width, cellWidth(row[i] || ''));
+    return width;
+  });
+
+  const M = 1 + 3 * K;
+  const C = Math.max(p - M - CLAUDE_TABLE.MARGIN, K * CLAUDE_TABLE.MIN_COL);
+  const W = E.reduce((sum, w) => sum + w, 0);
+  const z = H.reduce((sum, w) => sum + w, 0);
+
+  let hard = false;
+  let branch;
+  let D;
+  if (z <= C) {
+    D = H;
+    branch = 'natural';
+  } else if (W <= C) {
+    // Proportional: hand out the slack in proportion to each column's (natural - minimum) want,
+    // floored (R-6: Claude floors, it does not round).
+    branch = 'proportional';
+    const slack = C - W;
+    const want = H.map((w, i) => w - E[i]);
+    const U = want.reduce((sum, w) => sum + w, 0);
+    D = E.map((w, i) => (U === 0 ? w : w + Math.floor((want[i] / U) * slack)));
+  } else {
+    // Hard: scale every minimum by C/W, never below 3.
+    branch = 'hard';
+    hard = true;
+    const ratio = C / W;
+    D = E.map((w) => Math.max(Math.floor(w * ratio), CLAUDE_TABLE.MIN_COL));
+  }
+
+  // > 4 wrapped lines anywhere -> the whole table becomes cards.
+  let maxLines = 1;
+  for (let i = 0; i < K; i += 1) maxLines = Math.max(maxLines, wrapCell(headerCells[i], D[i], hard).length);
+  for (const row of bodyRows) {
+    for (let i = 0; i < row.length; i += 1) maxLines = Math.max(maxLines, wrapCell(row[i] || '', D[i], hard).length);
+  }
+
+  // The vertical form's inputs: a header-only table has no labels and its one row is the header
+  // (so it draws as unlabeled lines). `headerOnly` names that shape; the bordered attempt still
+  // runs first, exactly as Claude's does (a header-only table that fits stays a box).
+  const cards = (cause) => ({
+    kind: 'cards',
+    branch,
+    reason: bodyRows.length === 0 ? 'headerOnly' : cause,
+    headers: bodyRows.length === 0 ? [] : headerCells.map((cell) => stripSgr(cell).trim()),
+    rows: (bodyRows.length === 0 ? [headerCells] : bodyRows).map((row) => row.slice()),
+    truncated,
+  });
+  if (maxLines > CLAUDE_TABLE.MAX_CELL_LINES) return cards('cellLines');
+
+  const border = (kind) => {
+    const [left, bar, join, right] = {
+      top: ['┌', '─', '┬', '┐'],
+      middle: ['├', '─', '┼', '┤'],
+      bottom: ['└', '─', '┴', '┘'],
+    }[kind];
+    let line = left;
+    D.forEach((width, i) => {
+      line += bar.repeat(width + 2);
+      line += i < D.length - 1 ? join : right;
+    });
+    return line;
+  };
+
+  // One table row -> its bordered lines. Cells are vertically centred with floor((G - n)/2).
+  // Header cells are centred; body cells follow `align[c] ?? 'left'` (both Claude's rules).
+  const drawRow = (cells, isHeader) => {
+    const lines = cells.map((cell, i) => wrapCell(cell || '', D[i], hard));
+    const height = Math.max(...lines.map((l) => l.length), 1);
+    const off = lines.map((l) => Math.floor((height - l.length) / 2));
+    const out = [];
+    for (let r = 0; r < height; r += 1) {
+      let row = '│';
+      for (let c = 0; c < cells.length; c += 1) {
+        const idx = r - off[c];
+        const text = idx >= 0 && idx < lines[c].length ? lines[c][idx] : '';
+        row += ` ${pad(text, D[c], isHeader ? 'center' : ((align && align[c]) || 'left'), strWidth)} │`;
+      }
+      out.push(row);
+    }
+    return out;
+  };
+
+  const lines = [border('top'), ...drawRow(headerCells, true), border('middle')];
+  bodyRows.forEach((row, i) => {
+    lines.push(...drawRow(row, false));
+    if (i < bodyRows.length - 1) lines.push(border('middle'));
+  });
+  lines.push(border('bottom'));
+
+  let widest = 0;
+  for (const line of lines) widest = Math.max(widest, strWidth(stripSgr(line)));
+  if (widest > p - CLAUDE_TABLE.MARGIN) return cards('tooWide');
+
+  if (truncated > 0) lines.push(notShown(truncated));
+  return { kind: 'bordered', widths: D, hard, branch, lines };
+}
+
+// Claude's `lt(n)`: the 200-row cap's footnote.
+function notShown(count) {
+  return `… ${count.toLocaleString()} more ${count === 1 ? 'row' : 'rows'} not shown`;
+}
+
+/**
+ * The vertical form, before Ink's box wrap: one `Bold Header: value` line per non-empty cell,
+ * continuation lines verbatim, a `─`.repeat(min(cols - 1, 40)) rule BETWEEN cards only (never
+ * before the first, never after the last). `style.bold`/`style.boldOff` label the key (Claude
+ * paints `\x1b[1m`…`\x1b[22m`).
+ */
+function cardLines(layout, cols, style) {
+  const m = Number(cols) || 0;
+  const out = [];
+  const rule = '─'.repeat(Math.max(0, Math.min(m - 1, CLAUDE_TABLE.RULE_MAX)));
+  const headers = (layout && layout.headers) || [];
+  for (const row of (layout && layout.rows) || []) {
+    const lines = [];
+    row.forEach((cell, i) => {
+      const label = headers[i] || '';
+      // Claude flattens the cell to one line for the FIRST line, then re-wraps the rest.
+      const flat = String(cell == null ? '' : cell)
+        .trimEnd()
+        .replace(/\n+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim();
+      if (!label && !flat) return; // an unlabeled empty cell prints nothing at all
+      const firstWidth = label ? m - stringCellWidth(label) - 3 : m - 1;
+      const contWidth = m - 3;
+      const wrapped = wrapCell(flat, Math.max(firstWidth, 10), false);
+      const head = wrapped[0] || '';
+      const rest = wrapped.length <= 1
+        ? wrapped
+        : [head, ...wrapCell(wrapped.slice(1).map((line) => line.trim()).join(' '), contWidth, false)];
+      lines.push(label
+        ? `${styleSpanText(`${label}:`, style)} ${rest[0] || ''}`
+        : (rest[0] || ''));
+      for (let d = 1; d < rest.length; d += 1) {
+        if (!rest[d].trim()) continue;
+        lines.push(rest[d]);
+      }
+    });
+    if (!lines.length) continue;
+    if (out.length) out.push(rule);
+    out.push(...lines);
+  }
+  if (layout && layout.truncated > 0) {
+    if (out.length) out.push(rule);
+    out.push(notShown(layout.truncated));
+  }
+  return out;
+}
+
+// The card label's own span: open with `style.bold`, close with `style.boldOff` (never a blanket
+// reset, so a caller's surrounding style survives). Kept local so this module stays pure.
+function styleSpanText(text, style) {
+  const open = (style && style.bold) || [];
+  const close = (style && style.boldOff) || [];
+  const openCodes = (Array.isArray(open) ? open : [open]).filter((c) => c !== undefined && c !== null && c !== '');
+  if (!openCodes.length) return text;
+  const closeCodes = (Array.isArray(close) ? close : [close]).filter((c) => c !== undefined && c !== null && c !== '');
+  return `\x1b[${openCodes.join(';')}m${text}${closeCodes.length ? `\x1b[${closeCodes.join(';')}m` : ''}`;
+}
+
+/**
+ * Ink's `<Text wrap="wrap">` inside the 2-column message box: every line is re-wrapped with
+ * `wrapAnsi(line, boxWidth, {trim:false, hard:true})` and split on '\n' (D-5 -- observed: the
+ * tasks capture's 170-cell card line breaks at 169 into `…rubric` / `and` / `0.60 threshold`).
+ */
+function inkWrapLines(lines, boxWidth) {
+  const out = [];
+  for (const line of lines || []) {
+    out.push(...wrapAnsi(String(line == null ? '' : line), boxWidth, { trim: false, hard: true }).split('\n'));
+  }
+  return out;
+}
+
+module.exports = { CLAUDE_TABLE, wrapCell, layoutClaudeTable, cardLines, inkWrapLines };

package/template/coding-task-manager/lib/claude-transcript-terminal-renderer.js

@@ -51,10 +51,13 @@ const {
 const { _jsonlContentText } = require('./jsonl-conversation-parser');
 const {
   COMMAND_ENVELOPE_RE, LOCAL_COMMAND_STDOUT_RE, PEER_RELAY_PREFIX_RE, UNKNOWN_TAG_RE,
-  SYSTEM_REMINDER_RE, PASTED_CONTENT_RE, IDE_SELECTION_RE,
+  SYSTEM_REMINDER_RE, IDE_SELECTION_RE,
   TASK_NOTIFICATION_RE, TASK_NOTIFICATION_SUMMARY_RE,
   BASH_INPUT_RE, BASH_STDOUT_RE, BASH_STDERR_RE,
 } = require('../../shared/conversation-provenance');
+// D-5: the ONE strict paste-wrapper recogniser (line-exact opener/closer pair, 4 lowercase
+// hex ids) lives in public/js/pasted-content.js. Nothing here re-derives it.
+const PastedContent = require('../public/js/pasted-content');
 // WP-1 (rule D-9): wrap/measure/pad through the ONE width authority that matches the xterm.js
 // pane this renders into, not a hand-written East-Asian-Width table -- `wrapToCells`/
 // `stringCellWidth`/`truncateToCells` no longer flow from the codex renderer into this one.
@@ -184,18 +187,19 @@ function _bashStdoutOnly(text) {
   return null;
 }
 
-// Corrected 2026-09-27 (WP-3 live capture, fix round 1): the real screen shows a
-// `<pasted_content>` block VERBATIM, inline with the rest of the message -- never the
-// "[Pasted text #n +N lines]" placeholder this used to invent (a real bracketed paste, sent
-// through the same input path a real keystroke takes and confirmed present in the JSONL, showed
-// as ordinary wrapped prompt lines: "❯ line one" / "  line two" / ... / "  summarize the pasted
-// text in one line", with no collapse marker anywhere). D-8 branch 6: strip the tags, keep the
-// inner text, dropping exactly one leading/trailing blank line the tag wrapping usually
-// introduces (same trim the old placeholder's line count used).
+// Corrected 2026-09-27 (WP-3 live capture, fix round 1): the real screen shows a pasted
+// block VERBATIM, inline with the rest of the message -- never the "[Pasted text #n +N lines]"
+// placeholder this used to invent (a real bracketed paste, sent through the same input path a
+// real keystroke takes and confirmed present in the JSONL, showed as ordinary wrapped prompt
+// lines: "❯ line one" / "  line two" / ... / "  summarize the pasted text in one line", with no
+// collapse marker anywhere). D-8 branch 6: strip the wrapper, keep the inner text.
+//
+// D-5 (WP-2): recognition is NOT re-derived here any more -- the strict rule (a line that is
+// exactly the opener with a 4-lowercase-hex id, matched by the same-id closer line) lives in
+// public/js/pasted-content.js; `PastedContent.unwrap` drops the wrapper and keeps the body
+// verbatim, so the escaped/unknown-tag handling below sees body text only.
 function _replacePastedContent(text) {
-  return String(text || '').replace(PASTED_CONTENT_RE, (whole, inner) => (
-    inner.replace(/^\n+/, '').replace(/\n+$/, '')
-  ));
+  return PastedContent.unwrap(text);
 }
 
 // D-10 (WP-3 live capture): a raw tool_use name is not always what the TUI displays -- see
@@ -557,7 +561,7 @@ function parseClaudeTranscript(records, opts = {}) {
       const bashStdoutOnly = _bashStdoutOnly(text);
       if (bashStdoutOnly) { flushTools(); turns.push({ kind: 'local_stdout', uuid: rec.uuid, ts: rec.timestamp, lines: bashStdoutOnly }); continue; }
 
-      // 6/7/9/10/11: strip <pasted_content> to a placeholder, drop <ide_selection> and
+      // 6/7/9/10/11: strip the paste wrapper, drop <ide_selection> and
       // <system-reminder> entirely, then fall back to a plain prompt; an unmatched leading
       // tag on what's left is recorded (never hidden) via stats.unknownEnvelopes.
       let working = _replacePastedContent(text);

package/template/coding-task-manager/lib/client-diag-handler.js

@@ -44,6 +44,15 @@ function resolveDiagClientId(ws) {
 // while still capping memory if a client rotates clientId to evade this.
 const MAX_DIAG_THROTTLE_KEYS = 512;
 
+// WP-0 (docs/box-session-client-diag-and-reader-jump-2026-11-01.html §5 R-1/R-2): a box-owned
+// "mirror" session has no entry in the hub's local `sessions` Map, so `getSession(id)` is null for
+// it and every client-diag frame from a hub viewer on that session was dropped before recording —
+// even though the hub is the observer that owns the browser and telemetry.db. Mirror ids now get a
+// per-id holder object (throttle state only — nothing but the terminal-authority branch reads local
+// session fields, and mirrors skip that branch) from this bounded map. FIFO eviction keeps a long-
+// lived hub process from pinning one holder per mirror it has ever seen.
+const MAX_MIRROR_DIAG_HOLDERS = 256;
+
 // Cap on the generic (unlisted-event) detail passthrough below. 32 rather than 24 because the
 // history-seam-crossing beacon carries up to 27 non-null keys (joinDup/joinBlk included), and a
 // 24-key cut silently dropped its trailing distPx/exitBy/provider fields.
@@ -68,6 +77,9 @@ function clientDiagHostSnapshot() {
 
 function createClientDiagHandler(deps = {}) {
   const getSession = deps.getSession || (() => null);
+  // WP-0 R-1: (id) => truthy for a box-owned mirror session id, else null. Default keeps every
+  // existing caller byte-identical (a mirror id stays dropped).
+  const getMirrorSession = typeof deps.getMirrorSession === 'function' ? deps.getMirrorSession : () => null;
   const isSubscribed = typeof deps.isSubscribed === 'function' ? deps.isSubscribed : () => false;
   const recordDiagnostic = deps.recordDiagnostic || (() => {});
   const recordAuthority = deps.recordAuthority || (() => {});
@@ -79,14 +91,59 @@ function createClientDiagHandler(deps = {}) {
   // A socket close is page-scoped rather than session-scoped, so it alone may use the bounded
   // global pseudo-session. Terminal/render recovery events must name a real session.
   let globalDiagSession = null;
+  // WP-0 (§6.4, D-8) review fix: a create-ready frame names a PENDING CREATE id, which is not
+  // necessarily a session this machine knows — outcome 'failed'/'expired' never became one, and
+  // on the hub a successfully created session is owned by the box, so getSession(msg.id) is
+  // empty here. It is therefore answered BEFORE the session gate (the client-ws-close-observed
+  // escape is the same idea) and needs its own bounded 1 s window, since the per-session
+  // throttle map below is unreachable for a session-less id.
+  const createReadyAtByKey = new Map();
+  // WP-0 R-1: per-mirror-id throttle holders, newest-last (Map insertion order), FIFO-evicted at
+  // MAX_MIRROR_DIAG_HOLDERS. Scoped per handler instance so one hub process's churn cannot affect
+  // another's (and so a test harness gets a fresh map).
+  const mirrorDiagHolders = new Map();
 
-  return function handleClientDiag(ws, msg) {
+  function handleClientDiag(ws, msg) {
     if (!msg || !msg.id) return;
     const event = String(msg.event || '');
+    if (event === 'create-ready') {
+      const at = now();
+      const throttleKey = `${event} ${resolveDiagClientId(ws)} ${msg.id}`;
+      const lastEventAt = Number(createReadyAtByKey.get(throttleKey)) || 0;
+      if (lastEventAt && at - lastEventAt < 1000) return;
+      createReadyAtByKey.delete(throttleKey);
+      createReadyAtByKey.set(throttleKey, at);
+      while (createReadyAtByKey.size > MAX_DIAG_THROTTLE_KEYS) {
+        createReadyAtByKey.delete(createReadyAtByKey.keys().next().value);
+      }
+      // Display only: the numbers come from the client's own clock, so they are coerced
+      // (non-finite → -1) and the strings cut before they reach the log.
+      const d = msg.details && typeof msg.details === 'object' ? msg.details : {};
+      const num = (value) => (Number.isFinite(Number(value)) ? Number(value) : -1);
+      const text = (value, max) => (typeof value === 'string' ? value.slice(0, max) : '');
+      console.log(
+        `[create-client] id=${text(msg.id, 160)} machine=${text(d.machine, 160)} outcome=${text(d.outcome, 40)} ` +
+        `clickToAcceptedMs=${num(d.clickToAcceptedMs)} clickToSettledMs=${num(d.clickToSettledMs)}`
+      );
+      return;
+    }
     let session = getSession(msg.id);
+    // WP-0 R-2: a mirror session skips only terminal-authority (recordAuthority reads LOCAL session
+    // fields and drives local wedge remediation); every other branch records as normal.
+    let isMirror = false;
     if (!session) {
       if (msg.id === 'global' && event === 'client-ws-close-observed') {
         session = globalDiagSession || (globalDiagSession = {});
+      } else if (getMirrorSession(msg.id)) {
+        isMirror = true;
+        session = mirrorDiagHolders.get(msg.id);
+        if (!session) {
+          session = {};
+          mirrorDiagHolders.set(msg.id, session);
+          while (mirrorDiagHolders.size > MAX_MIRROR_DIAG_HOLDERS) {
+            mirrorDiagHolders.delete(mirrorDiagHolders.keys().next().value);
+          }
+        }
       } else {
         return;
       }
@@ -109,6 +166,7 @@ function createClientDiagHandler(deps = {}) {
       session._clientDiagAtByEvent.delete(session._clientDiagAtByEvent.keys().next().value);
     }
     if (event === 'terminal-authority') {
+      if (isMirror) return;
       if (msg.details && typeof msg.details === 'object') {
         recordAuthority(ws, session, msg.id, msg.details);
       }
@@ -137,6 +195,11 @@ function createClientDiagHandler(deps = {}) {
         toCols: nonNegInt(d.toCols),
         widthPx: nonNegInt(d.widthPx),
         reason: typeof d.reason === 'string' ? d.reason.slice(0, 40) : '',
+        // WP-2 (docs/codex-terminal-geometry-sticky-cols-2026-10-24.html §5): the two
+        // layout facts that make an adoption explainable -- browser viewport width and whether
+        // split view was on. Whitelisted here or the beacon's producer fields would be dropped.
+        viewportWidthPx: nonNegInt(d.viewportWidthPx),
+        split: d.split === true,
       });
       return;
     }
@@ -206,7 +269,11 @@ function createClientDiagHandler(deps = {}) {
       }
     }
     recordDiagnostic(msg.id, `client-${event}`, details);
-  };
+  }
+
+  // WP-0 AC-0e: test-only probe for the mirror holder bound. Production callers never read it.
+  handleClientDiag._mirrorHolderCount = () => mirrorDiagHolders.size;
+  return handleClientDiag;
 }
 
 module.exports = { createClientDiagHandler };

package/template/coding-task-manager/lib/codex-app-server-client.js

@@ -21,27 +21,25 @@
 // half of this claim so a stray production `require` here is caught.
 
 const { spawn } = require('child_process');
+const { spawnNdjsonTransport } = require('./acp/ndjson-stdio-transport');
 const bridge = require('./codex-approval-bridge');
 
 // A transport is { write(jsonString), onLine(cb), close() }. The default spawns codex;
-// tests inject a fake one to drive the client deterministically.
-function spawnCodexTransport({ cwd, env, spawnFn = spawn, command = 'codex', args = ['app-server'] } = {}) {
-  const child = spawnFn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], cwd, env });
-  let buf = '';
-  let lineCb = null;
-  child.stdout.on('data', (d) => {
-    buf += d.toString();
-    let i;
-    while ((i = buf.indexOf('\n')) >= 0) {
-      const line = buf.slice(0, i); buf = buf.slice(i + 1);
-      if (line.trim() && lineCb) lineCb(line);
-    }
+// tests inject a fake one to drive the client deterministically. The framing itself moved
+// to lib/acp/ndjson-stdio-transport.js (WP-1) so the ACP client shares one implementation.
+function spawnCodexTransport(o = {}) {
+  const t = spawnNdjsonTransport({
+    command: o.command || 'codex',
+    args: o.args || ['app-server'],
+    cwd: o.cwd,
+    env: o.env,
+    spawnFn: o.spawnFn || spawn,
   });
   return {
-    write: (s) => { try { child.stdin.write(s + '\n'); } catch (error) { void error; } },
-    onLine: (cb) => { lineCb = cb; },
-    close: () => { try { child.kill(); } catch (error) { void error; } },
-    _child: child,
+    write: t.write,
+    onLine: t.onLine,
+    close: () => t.kill(),
+    _child: t._child,
   };
 }
 

package/template/coding-task-manager/lib/codex-config-guard.js

@@ -105,20 +105,50 @@ function buildCodexTransportOverrideArgs(names, opts = {}) {
   return out;
 }
 
-// Read CODEX_HOME/config.toml and return the override args (best-effort: unreadable/missing → []).
-function codexMcpTransportGuardArgs(codexHome, opts = {}) {
+// Read CODEX_HOME/config.toml (best-effort: unreadable/missing → null). The one sync read both
+// guards share; it is the ledgered main-thread site (docs/main-thread-sync-baseline.json).
+function readCodexConfigToml(codexHome) {
   let text;
   try {
     text = fs.readFileSync(path.join(codexHome || '', 'config.toml'), 'utf8');
   } catch {
-    return [];
+    return null;
   }
+  return text;
+}
+
+// Return the override args (unreadable/missing config → []).
+function codexMcpTransportGuardArgs(codexHome, opts = {}) {
+  const text = readCodexConfigToml(codexHome);
+  if (text === null) return [];
   return buildCodexTransportOverrideArgs(findTransportlessMcpServers(text), opts);
 }
 
+// WP-1 (codex-routed-fork-cold-restore-guard-2026-10-22.html §5 D-2, §9 S-5): the ids a native
+// `codex` config load resolves through `model_providers.get(id)` — Codex merges its built-in
+// providers with this user table. Only the TABLE HEADERS are needed (the values are irrelevant to
+// servability), so this is a line scan, not a TOML parse: `[model_providers.<id>]` and its
+// sub-tables (`[model_providers.<id>.http_headers]`) both name the provider `<id>`; text before a
+// `[model_providers]` header (or after a different table) is never attributed to it. Best-effort
+// exactly like the transport guard: a missing/unreadable config is an empty set, never a throw.
+// `codexHome` is the CODEX_HOME directory (the one that holds config.toml).
+function readModelProviderKeys(codexHome) {
+  const text = readCodexConfigToml(codexHome);
+  if (text === null) return [];
+  const out = [];
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const segs = _tableHeaderSegments(line);
+    if (!segs || segs.length < 2 || _unquote(segs[0]) !== 'model_providers') continue;
+    const key = _unquote(segs[1]);
+    if (key) out.push(key);
+  }
+  return [...new Set(out)];
+}
+
 module.exports = {
   INERT_COMMAND,
   findTransportlessMcpServers,
   buildCodexTransportOverrideArgs,
   codexMcpTransportGuardArgs,
+  readModelProviderKeys,
 };

package/template/coding-task-manager/lib/codex-configuration-history.js

@@ -0,0 +1,55 @@
+'use strict';
+
+// D-7 (docs/codex-upgrades-without-version-approval-2026-10-28.html §configuration-followup): Codex
+// 0.165.0 persists a harness-authored reasoning-configuration control record in the rollout as
+// `response_item` / `configuration_update`. The tagged release source
+// (codex-rs/protocol/src/models/configuration_update.rs -> ConfigurationReasoning { effort },
+// codex-rs/core/src/client.rs:596-599,935-939 @ rust-v0.165.0) enables the update only for native
+// OpenAI targets that advertise it and REMOVES configuration updates from the outgoing request copy
+// for every other target, so the record is source history CTM classifies (and never rewrites) --
+// the selected effort is the source model's own setting and is never adopted as CTM's.
+//
+// This module is the ONE shape definition for that record. It is PURE: no file effects, no runtime
+// version check, no enum/version list. The scanner (lib/history-transition-read-op.js) uses it to
+// classify the record into its own history kind; the planner
+// (lib/harness-history-transition.js) decides where that kind may travel.
+const ENVELOPE_KEYS = new Set(['type', 'payload', 'timestamp', 'ordinal', 'metadata']);
+const PAYLOAD_KEYS = new Set(['type', 'reasoning']);
+const METADATA_KEYS = new Set(['client_authored', 'harness_authored_configuration']);
+
+function isRecord(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+// A record is a native configuration update only when every measured field is exact: the envelope
+// carries no unknown key, `type` is the `response_item` envelope, the payload holds exactly
+// `type`/`reasoning` with a nonblank effort STRING (never an enum or version list), and the payload
+// matches the native harness-authored marker the REQUIRED `harness_authored_configuration: true`
+// names. This is SHAPE validation, not cryptographic authentication: the marker only has to match
+// the value the native harness writes. Any other shape returns false so the caller's existing
+// refusal fires unchanged.
+function isNativeConfigurationUpdate(record) {
+  if (!isRecord(record)) return false;
+  if (Object.keys(record).some((key) => !ENVELOPE_KEYS.has(key))) return false;
+  if (record.type !== 'response_item') return false;
+  if (Object.hasOwn(record, 'timestamp') && typeof record.timestamp !== 'string') return false;
+  if (record.ordinal !== undefined && record.ordinal !== null
+      && (!Number.isSafeInteger(record.ordinal) || record.ordinal < 0)) return false;
+  if (!Object.hasOwn(record, 'metadata') || !isRecord(record.metadata)) return false;
+  const metadata = record.metadata;
+  if (Object.keys(metadata).some((key) => !METADATA_KEYS.has(key))) return false;
+  if (metadata.harness_authored_configuration !== true) return false;
+  if (Object.hasOwn(metadata, 'client_authored') && metadata.client_authored !== false) return false;
+  if (!isRecord(record.payload)) return false;
+  const payload = record.payload;
+  if (Object.keys(payload).length !== PAYLOAD_KEYS.size) return false;
+  if (Object.keys(payload).some((key) => !PAYLOAD_KEYS.has(key))) return false;
+  if (payload.type !== 'configuration_update') return false;
+  if (!isRecord(payload.reasoning)) return false;
+  const reasoningKeys = Object.keys(payload.reasoning);
+  if (reasoningKeys.length !== 1 || reasoningKeys[0] !== 'effort') return false;
+  const effort = payload.reasoning.effort;
+  return typeof effort === 'string' && effort.trim().length > 0;
+}
+
+module.exports = { isNativeConfigurationUpdate };