create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/session-path-grant.js

@@ -9,8 +9,10 @@
 //
 // Nothing here touches fs or sqlite: every read is injected through `deps`, so the whole
 // short-circuit order is decidable in a pure unit test. The order is the design's:
-//   D-3 canonical file (realpath; missing / directory / non-regular → not-found)
-//   D-4 deny list beats the grant, on the realpath AND the lexical expanded path
+//   D-4a the lexical deny runs FIRST, before any filesystem call: a sensitive expanded path
+//        returns `sensitive-path` without a realpath/stat (2026-10-27 D-1, the Cortex fix)
+//   D-3  canonical file (realpath; missing / directory / non-regular → not-found)
+//   D-4b the deny list beats the grant on the canonical realpath too (the symlink case)
 //   D-5 only link-detector extensions
 //   E1 admitted Review Hub worktree → root = that worktree
 //   E2 the session's stored text mentions the path → root = dirname(real)
@@ -121,6 +123,12 @@ async function grantForAbsolutePath(p, deps) {
   const sessionId = String(p?.sessionId || '');
   if (!expanded || !path.isAbsolute(expanded) || !sessionId) return { ok: false, code: 'not-printed' };
 
+  // D-4: deny beats grant — the lexical form the user typed, decided BEFORE any filesystem
+  // call. A request for `~/.ssh/anything` is refused without a realpath/stat, so the server
+  // never touches a credential path on behalf of a link (and a test can assert the deny on a
+  // path that does not exist). The canonical form is re-checked after realpath below.
+  if (isSensitive(expanded)) return { ok: false, code: 'sensitive-path' };
+
   // D-3: decide on the canonical file, never on the request string.
   let real;
   try {
@@ -137,8 +145,9 @@ async function grantForAbsolutePath(p, deps) {
   }
   if (!stat || typeof stat.isFile !== 'function' || !stat.isFile()) return { ok: false, code: 'not-found' };
 
-  // D-4: deny beats grant — the canonical target AND the lexical form the user typed.
-  if (isSensitive(real) || isSensitive(expanded)) return { ok: false, code: 'sensitive-path' };
+  // D-4: deny beats grant — the canonical target (the lexical form was checked above, before
+  // realpath, so a symlink whose target is a credential path is still refused here).
+  if (isSensitive(real)) return { ok: false, code: 'sensitive-path' };
 
   // D-5: only what the terminal could have linked.
   if (!GRANT_EXTENSIONS.includes(path.extname(real).slice(1).toLowerCase())) {

package/template/coding-task-manager/lib/session-status-ledger.js

@@ -91,6 +91,14 @@ function normalizeBackgroundTask(task) {
 
 function bgCapFor(type) { return type === 'shell' ? BG_SHELL_MAX_MS : BG_DECLARED_MAX_MS; }
 
+// R4/WP-1: the lifetime a launcher declared inside its own command line (`bin/bounded.js --deadline-ms N -- ...`).
+// Read from the label only; nothing here parses, signals or inspects a process.
+const BG_DEADLINE_RE = /\bbin\/bounded\.js\s+--deadline-ms\s+(\d+)/;
+function bgDeadlineMsOf(label) {
+  const m = BG_DEADLINE_RE.exec(String(label || ''));
+  return m ? Number(m[1]) : null;
+}
+
 class SessionStatusLedger {
   constructor({
     sessionId = '', providerId = '',
@@ -158,7 +166,18 @@ class SessionStatusLedger {
       if (now < e.expiresAt) continue;
       this.background.delete(id);
       if (!e.leased) {
-        this._bgPending.push({ kind: 'status-background-expired', payload: { id: e.id, type: e.type, ageMs: Math.max(0, now - e.firstSeenAt) } });
+        // WP-4 (M1/M5): the expired row carries the terminal spell (quietForMs) and the declared deadline, so the
+        // census can count quiet hours and deadline coverage without re-deriving either from the entry.
+        const firstSeenAt = Number(e.firstSeenAt) || 0;
+        this._bgPending.push({
+          kind: 'status-background-expired',
+          payload: {
+            id: e.id, type: e.type,
+            ageMs: Math.max(0, now - firstSeenAt),
+            quietForMs: Math.max(0, now - (Number(e.activeAt) || firstSeenAt)),
+            deadlineMs: bgDeadlineMsOf(e.label),
+          },
+        });
       }
     }
     if (!this.background.size) this._bgEvent = null;
@@ -169,6 +188,8 @@ class SessionStatusLedger {
     this.backgroundObservedAt = at;
     if (!Array.isArray(tasks)) { // D-6: absent is not empty
       const hadDeclared = this.backgroundDeclared;
+      // R4/WP-1: an absent set is NOT an empty one (D-6) -- the CLI did not report the set, so the owner
+      // retired nothing and no entry here reports a retirement. Only a set that omits an entry does that.
       this.background.clear();
       this.backgroundDeclared = false;
       // Noisy on older Claude Code (every Stop is null): only a declared->absent flip, or the ledger's first null, is a row.
@@ -191,8 +212,11 @@ class SessionStatusLedger {
         ...n, firstSeenAt, expiresAt: keep ? Math.max(Number(prev.expiresAt) || 0, cap) : cap, source: 'hook', count: 1,
         renewedAt: keep ? (prev.renewedAt || 0) : 0, renewals: keep ? (prev.renewals || 0) : 0, capCrossedAt: keep ? (prev.capCrossedAt || 0) : 0,
         activeAt: keep ? (prev.activeAt || firstSeenAt) : firstSeenAt, outSize: keep ? (prev.outSize || 0) : 0, outMtimeMs: keep ? (prev.outMtimeMs || 0) : 0,
+        nudgedAt: keep ? (prev.nudgedAt || 0) : 0, nudgeCount: keep ? (prev.nudgeCount || 0) : 0, firstNudgedAt: keep ? (prev.firstNudgedAt || 0) : 0,
       });
     }
+    // R4/WP-1: an entry the new set no longer names has left the set (M2 evidence), whether it ended or was omitted.
+    for (const [id, e] of this.background) if (!next.has(id)) this._bgRetire(e, 'snapshot', at);
     let changed = next.size !== before || !this.backgroundDeclared;
     if (!changed) for (const [id, e] of next) { const o = this.background.get(id); if (!o || o.type !== e.type || o.label !== e.label) { changed = true; break; } }
     this.background = next;
@@ -200,6 +224,28 @@ class SessionStatusLedger {
     if (changed) this._bgNote('snapshot', source || 'hook', before);
   }
 
+  // R4/WP-1 (M2) + WP-4 (M1/M5): one row for every entry that leaves the set and is either a hook-declared shell
+  // (the class M1/M3/M5 measure) or was ever nudged. The payload carries the whole terminal spell — the age, the
+  // quiet spell, the declared deadline and the nudge tally — so a census computes M1/M2/M5 from diagnostics alone.
+  // Expiry is not a retirement (_bgExpire keeps its own row); only the three callers that delete an entry report here.
+  _bgRetire(entry, via, now) {
+    const firstSeenAt = Number(entry.firstSeenAt) || 0;
+    const firstNudgedAt = Number(entry.firstNudgedAt) || 0;
+    const hookShell = entry.type === 'shell' && entry.source === 'hook';
+    if (!hookShell && !(firstNudgedAt > 0)) return;
+    this._bgPending.push({
+      kind: 'status-background-retired',
+      payload: {
+        id: entry.id, type: entry.type, via,
+        ageMs: Math.max(0, now - firstSeenAt),
+        quietForMs: Math.max(0, now - (Number(entry.activeAt) || firstSeenAt)),
+        deadlineMs: bgDeadlineMsOf(entry.label),
+        nudgeCount: entry.nudgeCount || 0,
+        sinceFirstNudgeMs: firstNudgedAt > 0 ? Math.max(0, now - firstNudgedAt) : null,
+      },
+    });
+  }
+
   _bgTask(meta, at, source) {
     const op = meta.op;
     const n = normalizeBackgroundTask(meta);
@@ -207,7 +253,10 @@ class SessionStatusLedger {
     const before = this.background.size;
     const src = meta.source || source || 'hook';
     if (op === 'remove') {
-      if (!this.background.delete(n.id)) return;
+      const gone = this.background.get(n.id);
+      if (!gone || !this.background.delete(n.id)) return;
+      // R4/WP-1 (M2): a removed entry that was ever nudged reports its retirement.
+      this._bgRetire(gone, 'remove', at);
       this.backgroundObservedAt = at;
       this._bgNote('remove', src, before);
       return;
@@ -225,6 +274,7 @@ class SessionStatusLedger {
       source: src, count,
       renewedAt: keep ? (prev.renewedAt || 0) : 0, renewals: keep ? (prev.renewals || 0) : 0, capCrossedAt: keep ? (prev.capCrossedAt || 0) : 0,
       activeAt: keep ? (prev.activeAt || firstSeenAt) : firstSeenAt, outSize: keep ? (prev.outSize || 0) : 0, outMtimeMs: keep ? (prev.outMtimeMs || 0) : 0,
+      nudgedAt: keep ? (prev.nudgedAt || 0) : 0, nudgeCount: keep ? (prev.nudgeCount || 0) : 0, firstNudgedAt: keep ? (prev.firstNudgedAt || 0) : 0,
     };
     if (leaseMs) entry.leased = true;
     this.background.set(n.id, entry);
@@ -247,6 +297,51 @@ class SessionStatusLedger {
     return [...this.background.values()].some(e => !this.backgroundQuiet(e, now));
   }
 
+  // R4 (WP-1): the entries the owner should be asked about at this Stop, oldest quiet spell first. Pure reader:
+  // it signals nothing, schedules nothing and mutates nothing (noteBackgroundNudged records the emission).
+  // Nudge n for one task fires once its quiet spell reaches BG_QUIET_MS * 2**n (30 min, 1 h, 2 h, 4 h ...), and
+  // activity after a nudge starts a fresh spell whose count is 0 again.
+  backgroundNudges(now = Date.now(), { max = 3 } = {}) {
+    this._bgExpire(now);
+    const due = [];
+    for (const e of this.background.values()) {
+      if (e.leased || !this.backgroundQuiet(e, now)) continue;
+      const activeAt = e.activeAt || 0;
+      const quietForMs = Math.max(0, now - activeAt);
+      // a fresh quiet spell (activity after the last nudge) resets the ladder
+      const count = (e.nudgedAt && activeAt > e.nudgedAt) ? 0 : (e.nudgeCount || 0);
+      if (quietForMs < BG_QUIET_MS * 2 ** count) continue;
+      if (count > 0 && now - e.nudgedAt < BG_QUIET_MS * 2 ** (count - 1)) continue;
+      due.push({
+        id: e.id, label: e.label, type: e.type, firstSeenAt: e.firstSeenAt, activeAt,
+        quietForMs, outSize: e.outSize || 0, outMtimeMs: e.outMtimeMs || 0, nudgeCount: count,
+        deadlineMs: bgDeadlineMsOf(e.label),
+      });
+    }
+    due.sort((a, b) => a.activeAt - b.activeAt);
+    return due.slice(0, Math.max(0, Number(max) || 0));
+  }
+
+  // R4 (WP-1): record that the owner was asked about these ids. Bookkeeping only — no timer, no signal, no
+  // onBackgroundChange (the set itself did not move). Returns how many ids were noted.
+  noteBackgroundNudged(ids, now = Date.now()) {
+    let noted = 0;
+    for (const id of Array.isArray(ids) ? ids : []) {
+      const e = this.background.get(id);
+      if (!e) continue;
+      if (e.nudgedAt && (e.activeAt || 0) > e.nudgedAt) e.nudgeCount = 0; // a fresh spell restarts the ladder
+      e.nudgeCount = (e.nudgeCount || 0) + 1;
+      e.nudgedAt = now;
+      e.firstNudgedAt ||= now;
+      this._bgPending.push({
+        kind: 'status-background-nudged',
+        payload: { id: e.id, nudgeCount: e.nudgeCount, quietForMs: Math.max(0, now - (e.activeAt || 0)), ageMs: Math.max(0, now - e.firstSeenAt) },
+      });
+      noted += 1;
+    }
+    return noted;
+  }
+
   backgroundView(now = Date.now()) {
     this._bgExpire(now);
     if (!this.background.size) return null;
@@ -273,6 +368,7 @@ class SessionStatusLedger {
         id: e.id, type: e.type, label: e.label, firstSeenAt: e.firstSeenAt, expiresAt: e.expiresAt, source: e.source, count: e.count,
         renewedAt: e.renewedAt || 0, renewals: e.renewals || 0, capCrossedAt: e.capCrossedAt || 0,
         activeAt: e.activeAt || 0, outSize: e.outSize || 0, outMtimeMs: e.outMtimeMs || 0,
+        nudgedAt: Number(e.nudgedAt) || 0, nudgeCount: Number(e.nudgeCount) || 0, firstNudgedAt: Number(e.firstNudgedAt) || 0,
       });
     }
     return { declared: this.backgroundDeclared, observedAt: this.backgroundObservedAt, entries };
@@ -296,6 +392,7 @@ class SessionStatusLedger {
         source: String(raw.source || 'hook'), count: Math.max(1, Number(raw.count) || 1),
         renewedAt: Number(raw.renewedAt) || 0, renewals: Math.max(0, Number(raw.renewals) || 0), capCrossedAt: Number(raw.capCrossedAt) || 0,
         activeAt: Number(raw.activeAt) > 0 ? Number(raw.activeAt) : now, outSize: Number(raw.outSize) || 0, outMtimeMs: Number(raw.outMtimeMs) || 0,
+        nudgedAt: Number(raw.nudgedAt) || 0, nudgeCount: Number(raw.nudgeCount) || 0, firstNudgedAt: Number(raw.firstNudgedAt) || 0,
       });
       n += 1;
     }
@@ -311,7 +408,12 @@ class SessionStatusLedger {
   dropBackground(predicate, now = Date.now(), reason = '') {
     this._bgExpire(now);
     const before = this.background.size;
-    for (const [id, e] of this.background) if (predicate(e)) this.background.delete(id);
+    for (const [id, e] of this.background) {
+      if (!predicate(e)) continue;
+      this.background.delete(id);
+      // R4/WP-1 (M2): a dropped entry that was ever nudged reports its retirement.
+      this._bgRetire(e, 'drop', now);
+    }
     const removed = before - this.background.size;
     if (removed) {
       this.backgroundObservedAt = now;
@@ -618,4 +720,4 @@ class SessionStatusLedger {
   }
 }
 
-module.exports = { SessionStatusLedger, EVIDENCE, AGENT_OUTPUT, PROVIDER_STATUS_POLICY, BG_END_STATUSES, BG_SHELL_MAX_MS, BG_QUIET_MS, BG_DECLARED_MAX_MS, BG_LABEL_MAX, normalizeBackgroundTask };
+module.exports = { SessionStatusLedger, EVIDENCE, AGENT_OUTPUT, PROVIDER_STATUS_POLICY, BG_END_STATUSES, BG_SHELL_MAX_MS, BG_QUIET_MS, BG_DECLARED_MAX_MS, BG_LABEL_MAX, normalizeBackgroundTask, bgDeadlineMsOf };

package/template/coding-task-manager/lib/session-transport.js

@@ -0,0 +1,17 @@
+'use strict';
+
+// WP-4 of docs/deepseek-harness-acp-agent-2026-10-28.html (§5 D-4).
+//
+// The one predicate for "this session speaks the Agent Client Protocol on pipes and has no PTY"
+// (today the DeepSeek Harness). Required from the prompt lane (lib/acp/dsh-prompt-lane.js), the
+// snapshot redirect (lib/ws/state-sync.js, S-39) and server.js's approval-executor seam.
+//
+// PTY-shaped status code (lib/session-status-runtime.js) deliberately does NOT skip ACP sessions:
+// they own a status ledger fed by turn evidence, which is how their chip reads running/needs-you/idle.
+
+/** A session driven over the Agent Client Protocol (child on pipes, no terminal). */
+function isAcpSession(session) {
+  return session?.transport === 'acp';
+}
+
+module.exports = { isAcpSession };

package/template/coding-task-manager/lib/session-workspace-projection.js

@@ -2,6 +2,29 @@
 
 const { parseWorkspaceIncarnation } = require('../../shared/storage/session-workspace-activity');
 
+// Sorted-key stable JSON — the same 6-line function as lib/standup-incremental.js:5-10 (copied,
+// not imported: that module is unrelated). Keys are sorted recursively so two structurally equal
+// values compare equal as strings; arrays keep their order.
+function stableStringify(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+}
+
+// WP-1 (§5 D-1/D-2 of docs/typing-delay-session-list-broadcast-storm-2026-11-01.html): the git
+// FACTS of an observation, excluding exactly the two per-probe fields — `snapshotVersion` (the
+// ordering counter incremented on every probe, runtime.js:137) and `collectedAt` (the probe
+// time). Every other field stays in, because projectSessionWorkspaceTracking spreads the whole
+// snapshot into the row (`git = { ...gitSnapshot, … }`), so any other field is visible on the
+// wire and must count as a change. Null/non-object input has the empty signature, which is what
+// makes the first installation of a session's snapshot a change.
+function gitFactsSignature(git) {
+  if (!git || typeof git !== 'object') return '';
+  const { snapshotVersion, collectedAt, ...facts } = git;
+  return stableStringify(facts);
+}
+
 const GIT_STATES = ['checking', 'known', 'unknown', 'unavailable'];
 const PROVENANCE = ['current-snapshot', 'last-observed', 'configured', 'unavailable'];
 const UNAVAILABLE_CODES = ['WORKSPACE_IDENTITY_CHANGED', 'WORKSPACE_IDENTITY_UNAVAILABLE'];
@@ -41,7 +64,13 @@ function scopedErrorCode(gitSnapshot, tracking, selection) {
 // so no consumer can read it as "still checking" or join it to another workspace.
 // D-6: `checkoutProvenance` scopes the branch that may be shown; counts are only ever joined to
 // a matching fresh snapshot, so one workspace's numbers can never accompany another selection.
-function projectSessionWorkspaceTracking(tracking, gitSnapshot) {
+//
+// WP-3 (§6.3): the third argument is this session's landing-queue view, already computed by the
+// caller (lib/landing/ctm-view.js is pure; the runtime owns the per-repo probe). It is gated on
+// `git.freshness === 'fresh'` for the same reason every other count is: a stale or refused
+// snapshot describes a workspace we can no longer prove this session is on, and a landing view
+// quoting a branch from an unproven workspace is worse than no view at all.
+function projectSessionWorkspaceTracking(tracking, gitSnapshot, landing = null) {
   const selection = tracking?.selection || null;
   if (!selection) return null;
   const sameWorkspace = !!gitSnapshot && gitSnapshot.workspaceKey === selection.workspaceKey
@@ -94,14 +123,34 @@ function projectSessionWorkspaceTracking(tracking, gitSnapshot) {
     workspaceIncarnation: selection.workspaceIncarnation,
     selection,
     git,
+    landing: git.freshness === 'fresh' && landing ? landing : null,
     recentWorkspaceCount: (tracking.history || []).filter(item => item.actorRole === 'foreground').length,
     history: (tracking.history || []).filter(item => item.actorRole === 'foreground').slice(0, 12),
   };
 }
-function workspaceTrackingMemoSignature(tracking, git) {
+
+// WP-3 (census 1e): the broadcast memo key. A landing-only change (the queue drained, a new pair
+// appeared) moves nothing else in the row, so without this tuple the sessions frame would keep
+// serving the previous memo and the chip would freeze. The view is built by a pure function with a
+// fixed key order and a sorted `with` list, so this derived tuple — never the object itself — is
+// what gets compared; it is stable across two runs over equal data.
+function landingSignature(landing) {
+  if (!landing || typeof landing !== 'object') return null;
+  const radar = landing.radar && typeof landing.radar === 'object' ? landing.radar : {};
+  const with_ = Array.isArray(radar.with) ? radar.with : [];
+  return [landing.jobId ?? null, landing.state ?? null, landing.position ?? null, landing.total ?? null,
+    landing.eta_s ?? null, radar.max ?? null,
+    with_.map(entry => [entry?.session ?? null, entry?.branch ?? null, entry?.level ?? null])];
+}
+
+// WP-1 (§5 D-2): the git part of the key is the FACTS signature, not `snapshotVersion`. With the
+// per-probe counter in the key, every 30 s probe of an unchanged worktree missed the memo and
+// rebuilt all 105 rows; the same signature the change test uses is what lets an unchanged row
+// reuse its memo (the 1 s memo TTL still bounds clock-only fields).
+function workspaceTrackingMemoSignature(tracking, git, landing) {
   return tracking?.selection ? JSON.stringify([tracking.sessionEpoch, tracking.selectionVersion,
-    tracking.selection.workspaceKey, tracking.selection.workspaceIncarnation, git?.snapshotVersion,
-    git?.freshness, git?.state, git?.errorCode, git?.checkoutProvenance]) : '';
+    tracking.selection.workspaceKey, tracking.selection.workspaceIncarnation, gitFactsSignature(git),
+    git?.freshness, git?.state, git?.errorCode, git?.checkoutProvenance, landingSignature(landing)]) : '';
 }
 
 // D-6/AC-3c: a checkout is presented as CURRENT only from a matching fresh snapshot. A
@@ -175,4 +224,4 @@ function workspaceTrackingCompatibility(tracking) {
   };
 }
 
-module.exports = { projectSessionWorkspaceTracking, workspaceTrackingMemoSignature, workspaceTrackingCompatibility };
+module.exports = { projectSessionWorkspaceTracking, workspaceTrackingMemoSignature, workspaceTrackingCompatibility, landingSignature, gitFactsSignature };

package/template/coding-task-manager/lib/session-workspace-tracking-runtime.js

@@ -2,6 +2,12 @@
 
 const path = require('node:path');
 const { parseWorkspaceIncarnation } = require('../../shared/storage/session-workspace-activity');
+// WP-1 (§5 D-1): the change test compares git FACTS, not the per-probe ordering counter.
+// No require cycle: session-workspace-projection.js requires only ../../shared/storage/*.
+const { gitFactsSignature } = require('./session-workspace-projection');
+// WP-3 (§6.3): the per-session landing view is a PURE function over the `land` CLI's own JSON —
+// this runtime owns the probe that produces that JSON, the view module owns nothing but the shape.
+const { landingForSession, landingStatusForRepo } = require('./landing/ctm-view');
 
 // Activity moves only after the durable owner commits. Git reconciliation has its own version
 // and never changes last-used activity.
@@ -56,6 +62,26 @@ function createSessionWorkspaceTrackingRuntime(deps = {}) {
   const nativeDrain = new WeakMap();
   const probes = new Map();
   let snapshotVersion = 0;
+  // WP-3 (§5 D-1/D-2, §6.3, §8 WP-3): ONE landing probe per repository. The landing queue is
+  // per-repository state that only `bin/land.js` can read, so the runtime does not parse it — it
+  // hands a `{ repo, branches }` request to the injected probe (server.js wires the real async CLI
+  // child) and keeps the last payload. A probe for a repository that is already running is never
+  // started again: the in-flight promise is returned, so the request path and the sweep share one
+  // child per repository instead of racing two.
+  const runLandingProbe = typeof deps.runLandingProbe === 'function' ? deps.runLandingProbe : null;
+  const onLandingChanged = typeof deps.onLandingChanged === 'function' ? deps.onLandingChanged : null;
+  const landingSlots = new Map();
+  // A worktree path -> the key its probe actually resolved to (the git common dir the CLI printed).
+  // Sessions whose snapshot has no common dir (an unvalidated hydration) key on their worktree path
+  // until the first probe resolves it, and this alias is what keeps that first probe from becoming a
+  // second, parallel cache entry for the same repository.
+  const landingAliases = new Map();
+  const LANDING_PROBE_CAP = 64;
+  let landingSessions = [];
+  // repo key -> { branch -> [session id] }, rebuilt once per sweep so the per-session view is a map
+  // lookup instead of a scan of every live session (the payload projection runs once per session per
+  // broadcast, and a scan there would be quadratic in the session count).
+  let landingBranchIndex = new Map();
 
   // §6: `git.errorCode` is a closed set. Raw Git/worker codes are mapped onto it so the
   // projection never publishes an unbounded string.
@@ -132,7 +158,13 @@ function createSessionWorkspaceTrackingRuntime(deps = {}) {
     const installed = { ...observation };
     delete installed.refusedSelection;
     state.gitSnapshot = installed;
-    const changed = previous?.snapshotVersion !== observation.snapshotVersion || previous?.freshness !== observation.freshness;
+    // WP-1 (§5 D-1/D-3): `snapshotVersion` is the ORDERING key (the fence above), never the change
+    // key — it advances on every probe, so comparing it made every 30 s probe of an unchanged
+    // worktree a change and re-broadcast the whole session list. Compare the git facts instead
+    // (everything but `snapshotVersion`/`collectedAt`), plus `freshness`, which is probe-local
+    // state rather than an observation fact. The observation itself is still installed above.
+    const changed = gitFactsSignature(previous) !== gitFactsSignature(installed)
+      || previous?.freshness !== observation.freshness;
     if (changed) onChange(session);
     return changed;
   }
@@ -523,8 +555,188 @@ function createSessionWorkspaceTrackingRuntime(deps = {}) {
     return reconcile(session, state, options);
   }
 
+  // --- WP-3 (§5 D-1/D-2, §6.3, §8 WP-3): the landing probe cache --------------------------------
+
+  /**
+   * What CTM knows about this session's repository, or `null` when it cannot be PROVEN. A session
+   * whose git freshness is not `fresh` contributes nothing — the same gate the projection applies to
+   * the view itself, so the probe and the chip can never disagree about whose branch this is. No I/O:
+   * every field comes from the snapshot the sweep already installed.
+   */
+  function describeSession(session) {
+    const state = session && typeof session === 'object' ? contexts.get(session) : null;
+    const git = state ? state.gitSnapshot : null;
+    if (!git || git.freshness !== 'fresh') return null;
+    const checkout = git.checkout || null;
+    const branch = checkout && typeof checkout.branch === 'string' ? checkout.branch : '';
+    if (!branch) return null;
+    const workspace = git.workspace || {};
+    const root = (typeof workspace.root === 'string' && workspace.root)
+      || (typeof session.worktree_path === 'string' && session.worktree_path)
+      || (typeof session.cwd === 'string' && session.cwd)
+      || null;
+    if (!root) return null;
+    const commonDir = typeof workspace.commonDir === 'string' && workspace.commonDir ? workspace.commonDir : null;
+    return { id: String(session.id), branch, repo: commonDir || landingAliases.get(root) || root, path: root };
+  }
+
+  const landingKeyFor = (repo) => landingAliases.get(repo) || repo;
+
+  function landingSlotFor(key) {
+    const existing = landingSlots.get(key);
+    if (existing) return existing;
+    if (landingSlots.size >= LANDING_PROBE_CAP) {
+      const idle = [...landingSlots].find(([, entry]) => !entry.pending);
+      // Every slot is in flight: keep the results already held and start nothing new. A probe that
+      // cannot be started is not a failure — the last payload stays, exactly like a failed probe's.
+      if (!idle) return null;
+      landingSlots.delete(idle[0]);
+    }
+    const slot = { path: key, root: null, branches: [], payload: null, error: null, at: 0, pending: null };
+    landingSlots.set(key, slot);
+    return slot;
+  }
+
+  function startLandingProbe(key, repoPath, branches) {
+    const slot = landingSlotFor(key);
+    if (!slot) {
+      return Promise.resolve({ ok: false, payload: null, error: { code: 'landing_probe_capacity', message: 'every landing probe slot is in flight' } });
+    }
+    // `key` is the repository IDENTITY (the git common dir, so every worktree of a repository shares
+    // one slot) while `repoPath` is the WORK TREE the CLI is run in. They are deliberately different
+    // values: the CLI refuses a bare git directory (`git rev-parse --show-toplevel` inside `.git`
+    // exits non-zero => `not_a_repo`), so probing the common dir would leave every chip permanently
+    // dark. Any work tree of the repository answers identically — the queue state lives under the
+    // common dir and the radar policy is read from the target branch tip.
+    slot.path = repoPath;
+    slot.root = repoPath;
+    slot.branches = branches;
+    // SINGLE-FLIGHT: a repository whose probe is still running is never probed again — the request
+    // path and the sweep join the child already in flight, and its result is the one that lands.
+    if (slot.pending) return slot.pending;
+    const pending = Promise.resolve()
+      .then(() => runLandingProbe({ repo: repoPath, branches }))
+      .then((result) => {
+        slot.at = now();
+        if (result && result.ok === true) {
+          const changed = JSON.stringify(slot.payload) !== JSON.stringify(result.payload || null);
+          slot.payload = result.payload || null;
+          // The sweep does not await the probe, so its broadcast went out with the previous payload;
+          // a changed payload must ask for one more (the memo still filters unchanged sessions).
+          if (changed && onLandingChanged) onLandingChanged(key);
+          slot.error = null;
+          const resolved = result.payload && typeof result.payload.repo === 'string' ? result.payload.repo : null;
+          // The CLI prints the repository's REAL common dir, which may differ from the key we probed
+          // with (a worktree path, or a snapshot that had no common dir yet): alias both directions so
+          // the next sweep keys on the same slot instead of starting a second cache entry.
+          if (resolved && resolved !== key) landingAliases.set(resolved, key);
+          if (repoPath !== key) landingAliases.set(repoPath, key);
+        } else {
+          // A failed probe says nothing new about the queue and keeps the last payload: an empty chip
+          // is worse than a slightly old one. The error is retained for the status route to report.
+          slot.error = (result && result.error) || { code: 'landing_probe_failed', message: 'the landing probe returned no result' };
+        }
+        return { ok: !!slot.payload, payload: slot.payload, error: slot.error };
+      })
+      .catch((error) => {
+        // The probe is injected; a rejection here is a wiring bug, not a CLI refusal. Record it and
+        // keep the previous payload rather than dropping the repository out of the cache.
+        slot.error = { code: (error && error.code) || 'landing_probe_failed', message: (error && error.message) || String(error) };
+        return { ok: !!slot.payload, payload: slot.payload, error: slot.error };
+      })
+      .finally(() => { if (slot.pending === pending) slot.pending = null; });
+    slot.pending = pending;
+    return pending;
+  }
+
+  /**
+   * The WORK TREE to run the CLI in for a repository keyed by `key`. A sweep always supplies the
+   * live session's own worktree root; the request path may be handed the git common dir instead
+   * (`?repo=<commonDir>`), and `dirname(<repo>/.git)` is that repository's primary work tree — the
+   * same rule lib/review-repo-admission.js uses to name a repository's root from its administrative
+   * directory. No such directory means the CLI refuses and the route answers `repo_unknown`.
+   */
+  function landingRepoFor(key, repo) {
+    const slot = landingSlots.get(key);
+    if (slot && slot.root) return slot.root;
+    return path.basename(repo) === '.git' ? path.dirname(repo) : repo;
+  }
+
+  function landingBranchesFor(key) {
+    const branches = new Set();
+    for (const entry of landingSessions) {
+      if (landingKeyFor(entry.repo) === key) branches.add(entry.branch);
+    }
+    return [...branches];
+  }
+
+  /**
+   * One probe per repository, driven by the SAME sweep that just refreshed the per-session git
+   * snapshots — no new timer and no idle loop, so a repository with no live session on any branch is
+   * never probed at all. Errors are handled inside `startLandingProbe`; nothing here is awaited.
+   */
+  function refreshLanding(sessions) {
+    const described = [];
+    for (const session of Array.isArray(sessions) ? sessions : []) {
+      const entry = describeSession(session);
+      if (entry) described.push(entry);
+    }
+    landingSessions = described;
+    const index = new Map();
+    const groups = new Map();
+    for (const entry of described) {
+      const key = landingKeyFor(entry.repo);
+      let byBranch = index.get(key);
+      if (!byBranch) { byBranch = {}; index.set(key, byBranch); }
+      if (!byBranch[entry.branch]) byBranch[entry.branch] = [];
+      byBranch[entry.branch].push(entry.id);
+      let group = groups.get(key);
+      if (!group) {
+        group = { key, repo: entry.path || entry.repo, branches: new Set() };
+        groups.set(key, group);
+      }
+      group.branches.add(entry.branch);
+    }
+    landingBranchIndex = index;
+    if (!runLandingProbe) return;
+    for (const group of groups.values()) startLandingProbe(group.key, group.repo, [...group.branches]);
+  }
+
+  /**
+   * The request path's probe: awaited, and single-flight with the sweep (same slot). `sessions`
+   * (optional) re-describes the live sessions first, so a route call cannot answer with a `with` list
+   * from a stale session set.
+   */
+  function probeLanding(args = {}) {
+    if (Array.isArray(args.sessions)) refreshLanding(args.sessions);
+    const repo = typeof args.repo === 'string' && args.repo ? args.repo : null;
+    if (!repo) return Promise.resolve({ ok: false, payload: null, error: { code: 'repo_required', message: 'probeLanding needs a repository path' } });
+    if (!runLandingProbe) return Promise.resolve({ ok: false, payload: null, error: { code: 'landing_unavailable', message: 'no landing probe is wired on this instance' } });
+    const key = landingKeyFor(repo);
+    return startLandingProbe(key, landingRepoFor(key, repo), landingBranchesFor(key));
+  }
+
+  /**
+   * The per-session view (§6.3) over the last payload for this session's repository. `null` when the
+   * repository has nothing to say OR its probe has not landed yet — the projection turns that into an
+   * absent chip, which is the honest state for "we have not read this queue".
+   */
+  function landingView(session) {
+    const described = describeSession(session);
+    if (!described) return null;
+    const key = landingKeyFor(described.repo);
+    const slot = landingSlots.get(key);
+    if (!slot || !slot.payload) return null;
+    return landingForSession(slot.payload, {
+      sessionId: described.id,
+      branch: described.branch,
+      sessionsByBranch: landingBranchIndex.get(key) || {},
+    });
+  }
+
   return { observe, observeNativeActivity, refresh, stateFor, snapshot: session => contexts.get(session)?.tracking || null,
     gitSnapshot: session => contexts.get(session)?.gitSnapshot || null,
+    describeSession, refreshLanding, probeLanding, landingView,
     bindSource: bindSource ? (input, options) => bindSource(input, options) : null };
 }