create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/walle-row-history.js

@@ -0,0 +1,495 @@
+'use strict';
+
+// Landing-throughput WP-6 shard S16 (design doc §5 D-10 "move-only", §6 "Shard module
+// seam"): the Wall-E row-history cluster moves out of server.js VERBATIM into this module
+// behind the same configure(deps) seam as lib/api/session-attach.js and
+// lib/terminal-attach-geometry.js (S6), lib/walle-history-serve.js (S8),
+// lib/codex-rollout-history.js (S9), lib/terminal-input-prepared.js (S10), lib/idle-notify.js
+// (S11), lib/session-park.js (S12), lib/terminal-draft-operation.js (S13) and
+// lib/conversation-freshness-diagnostics.js (S14). It registers NO route and NO socket handler:
+// server.js keeps the call sites as walleRowHistory.<name>(...) and this configure() seam.
+// Bodies are identical to the server.js declarations except for the `_deps.` prefix on every
+// identifier that used to resolve to a server.js top-level binding (D-10 rule 1), proven by
+// `node bin/move-only-check.js`. Three inline `require('./lib/...')` calls are rebased to this
+// module's own `require('./...')` (S8 precedent: one move-only DIFF per rebased require -- the
+// remainder is proven by re-running against a copy with
+// `sed "s#require('\./#require('./lib/#g"` applied).
+//
+// The module deliberately lives at lib/walle-row-history.js and NOT under lib/ws/: these are the
+// durable per-message row store readers/shaper, not ws-router handlers.
+//
+// Injected deps, per function:
+//   _walleRowHistoryForCtmId: CTM_SESSION_ROWS_ENABLED, _fetchSessionMessagesArrayOffThread, _fetchWalleHistoryMetaOffThread, _handleWalleProjectionReadResult, _loadWalleHistoryOffThread, _noteWalleHistoryReadMiss, _offthreadRead, _resolveWalleHistorySource, _scheduleWalleSessionRowsCatchUp, _walleHistoryMigrationRuntime, _walleHistoryWindowBreaker, _walleSessionRowsFreshness, catchUpKind, classifyReadPoolMiss, dbModule, errorSink, isRenderableWalleHistoryWindow, recordSessionDiagnostic, rowCursorRegistry, walleConversationCacheFreshness
+//   _walleHistoryForReview: (none)
+//   _appendWalleUserRowAtSubmit: _notifyConversationUpdated, _runCtmDbWorkerOp, walleTranscript
+//   _walleProgressTranscriptPart: redactSecrets
+//
+// Mutable module state (D-10 rule 2 / S9 lesson 7): _walleHistoryMigrationRuntime is a server.js
+// `let` reassigned during boot, so it is injected as a GETTER -- never a copy. No moved body
+// ASSIGNS a server.js top-level binding, so this seam carries no get/set pair. Every other dep is
+// a by-value reference (all declared before the seam's configure() call). Calls between the moved
+// functions stay direct (no `_deps.`): _appendWalleUserRowAtSubmit calls _walleHistoryForReview.
+
+let _deps = null;
+
+function configure(deps = {}) {
+  _deps = deps;
+}
+
+// Wall-E chat history from CTM's durable per-message store (session_message_rows), keyed on the
+// CANONICAL ctmSessionId (one id; no agentSessionId/ctmSessionId split that drifts). Returns the
+// review-shaped messages when rows are present and fresh vs the live JSONL (a cheap file-size
+// metadata check on the same canonical id; no provider JSONL body parse). Projection admission
+// controls branch mode only: stale/invalid manifests still return complete row pages for audit-mode
+// rendering. This is the post-blob-retirement display source of truth.
+async function _walleRowHistoryForCtmId(source, {
+  offset = 0,
+  limit = 0,
+  before = '',
+  afterCursor = '',
+  around = '',
+  after = '',
+  projectionEpoch = 0,
+  orderingEpoch = 0,
+  allowStale = false,
+  budget = null,
+  budgetRung = 'window',
+} = {}) {
+  if (!_deps.CTM_SESSION_ROWS_ENABLED || !source?.ctmSessionId) return { __miss: 'meta_unavailable' };
+  try {
+    const id = source.ctmSessionId;
+    const rowFreshness = _deps._walleSessionRowsFreshness(source);
+    _deps._walleHistoryMigrationRuntime?.raisePriority(id, 0);
+    let selectedWindow = null;
+    if (limit > 0) {
+      const windowTimeoutMs = budget ? budget.timeoutFor(budgetRung) : 8_000;
+      if (windowTimeoutMs <= 0) return { __miss: 'budget_exhausted' };
+      selectedWindow = await _deps._offthreadRead({
+        breaker: _deps._walleHistoryWindowBreaker,
+        op: 'getWalleHistoryWindow',
+        timeoutMs: windowTimeoutMs,
+        requestClass: 'interactive',
+        strictTimeout: true,
+        payload: {
+          dbPath: _deps.dbModule.getDbPath(),
+          sessionId: id,
+          offset,
+          limit,
+          before,
+          afterCursor,
+          around,
+          after,
+          projectionEpoch,
+          orderingEpoch,
+          // This is an authority grant, not a display preference: only the exact source-cursor
+          // proof may let the rich structured projection supersede the canonical text view.
+          preferRichProjection: rowFreshness.fresh,
+          telemetryReason: 'walle-history-window',
+        },
+        onSuccess: (result) => result,
+        onFail: (error) => {
+          const reason = _deps.classifyReadPoolMiss(error);
+          _deps._noteWalleHistoryReadMiss(error);
+          _deps.errorSink.report('walle-history:window-read', error, { sessionId: id, reason });
+          return { __miss: reason };
+        },
+      });
+      if (selectedWindow?.__miss) return selectedWindow;
+      // Active, partial-v2, AND active structured-projection pages are self-proving through the
+      // cutover ledger and exact v2 cursor. They bypass legacy row/file freshness, which is no
+      // longer an authority after activation, but a measured source-cursor lag still keeps the
+      // page in catch-up lifecycle. 'structured-projection' (walle-history-source-selection.js)
+      // is granted ONLY when the cutover is 'active' and the exact v2 cursor already proved
+      // coverage (options.preferRichProjection === true), so it is exactly as self-proving as a
+      // plain 'v2' window -- review round 2: it was falling through to the legacy gates below,
+      // which compare a row-store byte count against the growing jsonl and false-positive
+      // 'freshness_gate' during any running turn.
+      if (selectedWindow?.sourceAuthority === 'v2'
+          || selectedWindow?.sourceAuthority === 'v2-partial'
+          || selectedWindow?.sourceAuthority === 'structured-projection') {
+        // D-1/S-2 (WP-0): a v2 window still importing (kind 'partial') is a real miss and
+        // falls to the stale lane exactly as before. A merely LAGGING v2 window (kind 'lag')
+        // is not a miss -- it is complete-to-its-cursor history that carries its own
+        // catch-up lifecycle markers so the caller can serve it from THIS read, without a
+        // second stale-lane read, an unconditional catch-up import, or a degraded diagnostic.
+        // catchUpKind returns 'none' for 'structured-projection' (it only classifies 'v2'/
+        // 'v2-partial'), so it is always served as a normal settled page here -- correct, since
+        // the rich projection is only granted when rows are already proven fresh.
+        const kind = _deps.catchUpKind(selectedWindow, rowFreshness);
+        if (kind === 'partial' && !allowStale) return { __miss: 'freshness_gate' };
+        if (kind === 'lag') {
+          selectedWindow.catchingUp = true;
+          selectedWindow.lag = {
+            bytes: rowFreshness.lagBytes,
+            seconds: rowFreshness.lagSeconds,
+            state: 'rows_behind_cursor',
+          };
+        }
+        // A structured-projection window is where the inline repair manifest / forced
+        // structural rebuild lives (_handleWalleProjectionReadResult) -- the legacy path below
+        // used to call it for every serve; preserve that here since this window no longer
+        // reaches the legacy path at all. A plain v2 window never called it and still doesn't.
+        if (selectedWindow?.sourceAuthority === 'structured-projection') {
+          await _deps._handleWalleProjectionReadResult(id, selectedWindow);
+        }
+        // D-1 (WP-1, walle-history-source-selection.js): a proven-empty v2 window vs a non-empty transcript is the wedge this design fixes.
+        if (require('./env-flags').boolFlag('CTM_WALLE_SOURCE_AUTHORITY', true)) { const emptyMiss = await require('./walle-history-source-selection').detectWalleProjectionEmptyMiss(selectedWindow, source, _deps._resolveWalleHistorySource, _deps._scheduleWalleSessionRowsCatchUp, _deps.recordSessionDiagnostic, allowStale ? _deps._loadWalleHistoryOffThread : null); if (emptyMiss) return emptyMiss; }
+        // D-6 (WP-0): this early v2/structured-projection branch's own non-renderable label --
+        // NOT the legacy meta_unavailable sites below, which stay untouched.
+        return _deps.isRenderableWalleHistoryWindow(selectedWindow)
+          ? selectedWindow : { __miss: 'window_unrenderable' };
+      }
+    }
+    // S-3 (review round 2): this legacy row/file-size freshness gate only runs for a session
+    // whose v2 cutover is NOT active (sourceAuthority 'legacy' or no v2 authority at all) --
+    // that is import-incomplete, not lag, and is unaffected by D-1's catch-up kinds. Once
+    // cutover is active, the v2 cursor (or structured-projection's cursor-proven coverage,
+    // above) is the sole authority; this file_size-vs-jsonlSize comparison is stale evidence
+    // that would false-positive 'freshness_gate' while the jsonl keeps growing mid-turn.
+    const cursor = _deps.rowCursorRegistry.get(source.agentSessionId || source.chatSessionId || id)
+      || _deps.rowCursorRegistry.get(id);
+    if (!allowStale && (!cursor || !rowFreshness.fresh)) return { __miss: 'freshness_gate' };
+    const fileStat = cursor
+      ? { size: Math.max(0, Number(cursor.jsonlSize || 0)), mtimeMs: Number(cursor.jsonlMtimeMs || 0) }
+      : null;
+    const metaTimeoutMs = budget ? budget.timeoutFor('meta') : 2_500;
+    const meta = await _deps._fetchWalleHistoryMetaOffThread(id, metaTimeoutMs);
+    if (meta?.__miss) return meta;
+    if (!meta) return { __miss: 'meta_unavailable' };
+    if (!allowStale && !_deps.walleConversationCacheFreshness(meta, source, fileStat).fresh) {
+      return { __miss: 'freshness_gate' };
+    }
+    if (limit > 0) {
+      await _deps._handleWalleProjectionReadResult(id, selectedWindow);
+      return _deps.isRenderableWalleHistoryWindow(selectedWindow)
+        ? selectedWindow : { __miss: 'meta_unavailable' };
+    }
+    // Legacy callers still request a full array. Probe projection truth through the same
+    // off-thread reader before serving it so this path participates in read repair without
+    // unconditionally spending a repair-budget slot for healthy sessions.
+    const projectionProbe = await _deps._offthreadRead({
+      breaker: _deps._walleHistoryWindowBreaker,
+      op: 'getWalleHistoryWindow',
+      timeoutMs: budget ? Math.max(250, budget.timeoutFor(budgetRung)) : 2500,
+      requestClass: 'interactive',
+      strictTimeout: true,
+      payload: {
+        dbPath: _deps.dbModule.getDbPath(),
+        sessionId: id,
+        offset: 0,
+        limit: 1,
+        telemetryReason: 'walle-history-full-array-projection-probe',
+      },
+      onSuccess: (result) => result,
+      onFail: (error) => {
+        const reason = _deps.classifyReadPoolMiss(error);
+        _deps.errorSink.report('walle-history:full-array-projection-probe', error, {
+          sessionId: id,
+          reason,
+        });
+        return { __miss: reason };
+      },
+    });
+    if (!projectionProbe?.__miss) await _deps._handleWalleProjectionReadResult(id, projectionProbe);
+    const rows = await _deps._fetchSessionMessagesArrayOffThread(id, {
+      allowMainFallback: false,
+      reason: 'walle-row-history',
+      // D-3 (WP-2 item 5): this is the Wall-E resume/attach path -- a live-connected
+      // viewer is waiting on this exact array. Background readers of the same helper
+      // (standup summary's cursor-local-store/direct-conversation/cache-detailed
+      // reasons) intentionally do not pass this.
+      requestClass: 'interactive',
+    });
+    return Array.isArray(rows) && rows.length > 0 ? rows : { __miss: 'meta_unavailable' };
+  } catch (error) {
+    _deps._noteWalleHistoryReadMiss(error);
+    return { __miss: _deps.classifyReadPoolMiss(error) };
+  }
+}
+
+function _walleHistoryForReview(history) {
+  // Shared lib shaper: the targeted walle importer (api-prompts) writes rows
+  // through the SAME projection, so the render store has a single schema.
+  return require('./walle-ctm-history').walleHistoryForReview(history);
+}
+
+// WI-1 (RC-1 fix): append ONE review-shaped user row to session_message_rows, under the
+// canonical ctm id, at Wall-E prompt SUBMIT time — before the turn runs. Without this the
+// durable row store has no trace of the current turn (and, after a restart, no trace of the
+// session at all — RC-1) until the turn-close sync (_syncWalleDurableRowsAfterTurn) or a cold
+// rebuild runs, so a client that (re)attaches mid-turn sees nothing even after the turn
+// finishes. Projects the just-appended user JSONL record through the SAME
+// _walleHistoryForReview shaper every other rows-writer uses, so identity (message_uuid) and
+// shape match a later full re-projection and the two writes dedupe cleanly. The DB-owner
+// worker is the only commit path; failure records freshness debt and the turn-close sync heals it.
+function _appendWalleUserRowAtSubmit(session, userAppend) {
+  if (!session || !session.id || !userAppend || !userAppend.record) return;
+  const record = userAppend.record;
+  const historyItem = {
+    role: 'user',
+    content: _deps.walleTranscript.extractText(record.message && record.message.content),
+    timestamp: record.timestamp || 0,
+    uuid: record.uuid || undefined,
+    parentUuid: record.parentUuid != null ? record.parentUuid : undefined,
+  };
+  if (record.branchEdit === true || record.forkedFromMessageId || record.branchId) {
+    historyItem.metadata = {
+      branchEdit: record.branchEdit === true,
+      forkedFromMessageId: String(record.forkedFromMessageId || ''),
+      branchId: String(record.branchId || ''),
+    };
+  }
+  if (record.attachments) historyItem.attachments = record.attachments;
+  let reviewRows;
+  try {
+    reviewRows = _walleHistoryForReview([historyItem]);
+  } catch (e) {
+    console.error('[walle-session] user-row projection error:', e.message);
+    return;
+  }
+  if (!Array.isArray(reviewRows) || reviewRows.length === 0) return;
+  const sessionId = session.id;
+  const row = reviewRows[0];
+  const appendEvidence = {
+    locator: String(userAppend.filePath || ''),
+    byteStart: Math.max(0, Number(userAppend.offset || 0)),
+    byteEnd: Math.max(0, Number(userAppend.offset || 0) + Number(userAppend.bytes || 0)),
+    uuid: String(userAppend.uuid || record.uuid || ''),
+  };
+  const afterAppend = (res) => {
+    if (res && res.ok && !res.skipped) {
+      _deps._notifyConversationUpdated(sessionId, { reason: 'walle-user-submit', inserted: 1 });
+    }
+  };
+  _deps._runCtmDbWorkerOp('appendWalleUserRow', {
+    sessionId,
+    logicalSessionKey: session.chatSessionId || session.agentSessionId || sessionId,
+    row,
+    appendEvidence,
+  }, { priority: 'urgent', timeoutMs: 15 * 1000 })
+    .then(afterAppend)
+    .catch((err) => {
+      // Worker unavailability creates durable catch-up debt; never activate a main-thread writer.
+      if (err && err.code !== 'CTM_DB_OWNER_WORKER_DEGRADED') {
+        console.error('[walle-session] off-thread user-row append failed:', err.message);
+      }
+    });
+}
+
+function _walleProgressTranscriptPart(event) {
+  if (!event || typeof event !== 'object') return null;
+  if (event.type === 'thinking') {
+    return {
+      partType: 'thinking',
+      data: { turn: event.turn || null, text: typeof event.text === 'string' ? event.text : '' },
+    };
+  }
+  // text_delta/reasoning_delta are durably written by Wall-E's embedded stream
+  // processor. This mirror must not add a second writer for those event types.
+  if (event.type === 'model_selected') {
+    return {
+      partType: 'model',
+      data: {
+        model: event.model || event.model_id || '',
+        provider: event.provider || '',
+      },
+    };
+  }
+  if (event.type === 'tool_call') {
+    // The stream processor re-emits raw events whose call fields live under
+    // event.data — reading only the top level wrote one EMPTY tool_call twin
+    // per narration/thinking part (junk "tool" rows on reload).
+    const call = event.data && typeof event.data === 'object' ? event.data : {};
+    const id = event.id || event.tool_call_id || event.toolCallId
+      || call.id || call.tool_call_id || call.toolCallId || '';
+    const name = event.name || event.tool || call.name || call.tool || '';
+    const input = event.input || event.arguments || call.input || call.args || null;
+    const summary = event.summary || call.summary || '';
+    if (!id && !name && input == null && !summary) return null;
+    return {
+      partType: 'tool_call',
+      data: { id, name, input, summary },
+    };
+  }
+  if (event.type === 'tool_result') {
+    const call = event.data && typeof event.data === 'object' ? event.data : {};
+    return {
+      partType: 'tool_result',
+      data: {
+        id: event.id || event.tool_call_id || event.toolCallId
+          || call.id || call.tool_call_id || call.toolCallId || '',
+        name: event.name || event.tool || call.name || call.tool || '',
+        result: event.result || event.output || call.result || call.output || '',
+        summary: event.summary || call.summary || '',
+        error: event.error || call.error || null,
+      },
+    };
+  }
+  if (event.type === 'skill_loaded' || event.type === 'skill_load_failed') {
+    return {
+      partType: event.type,
+      data: {
+        skill: event.skill || event.input?.skill_name || '',
+        input: event.input || event.args || null,
+        summary: event.summary || '',
+        source: event.source || '',
+        prefix: event.prefix || '',
+        agentType: event.agentType || event.agent_type || '',
+        error: event.error || '',
+      },
+    };
+  }
+  if (event.type === 'coding_summary') {
+    const activity = event.activity && typeof event.activity === 'object'
+      ? {
+          toolCount: Number(event.activity.toolCount || 0),
+          sources: Array.isArray(event.activity.sources)
+            ? event.activity.sources.slice(0, 12).map((source) => ({
+                tool: String(source && source.tool || ''),
+                detail: String(source && source.detail || ''),
+              })).filter((source) => source.tool || source.detail)
+            : [],
+        }
+      : null;
+    // Deterministic actionable summary (status · changed files · preview URLs
+    // and read-only activity/source evidence).
+    // Persisted so the pinned summary card survives a reload — attached to the
+    // turn's assistant message during history assembly (walle-ctm-history.js).
+    return {
+      partType: 'coding_summary',
+      data: {
+        status: event.status || '',
+        reason: event.reason || '',
+        verified: !!event.verified,
+        cwd: event.cwd || '',
+        changedFiles: Array.isArray(event.changedFiles) ? event.changedFiles : [],
+        previewUrls: Array.isArray(event.previewUrls) ? event.previewUrls : [],
+        activity,
+      },
+    };
+  }
+  if (event.type === 'retry') {
+    const detail = event.detail && typeof event.detail === 'object' ? event.detail : {};
+    return {
+      partType: 'status',
+      data: {
+        type: 'retry',
+        status: 'retrying',
+        message: event.message || '',
+        step: event.step,
+        channel: detail.channel || event.channel || '',
+        attempt: Number(detail.attempt || event.attempt || 0),
+        stepMax: Number(detail.stepMax || 0),
+        runRetries: Number(detail.runRetries || 0),
+        runMax: Number(detail.runMax || 0),
+        delayMs: Number(detail.delayMs || 0),
+        deadlineMs: Number(detail.deadlineMs || 0),
+      },
+    };
+  }
+  if (event.type === 'slow_provider') {
+    const detail = event.detail && typeof event.detail === 'object' ? event.detail : {};
+    return {
+      partType: 'status',
+      data: {
+        type: 'slow_provider',
+        status: 'waiting',
+        message: event.message || '',
+        provider: event.provider || '',
+        model: event.model || '',
+        kind: detail.kind || '',
+        elapsedMs: Number(detail.elapsedMs || 0),
+        thresholdMs: Number(detail.thresholdMs || 0),
+        timeoutMs: Number(detail.timeoutMs || 0),
+      },
+    };
+  }
+  if (event.type === 'provider_attempt_error') {
+    return {
+      partType: 'provider_attempt_error',
+      data: {
+        attempt: Number(event.attempt || 0),
+        message: event.message || event.error || 'Provider attempt failed',
+        rawError: event.rawError || '',
+        providerError: event.providerError || null,
+        messageId: event.messageId || '',
+        threadId: event.threadId || '',
+        turnId: event.turnId || '',
+      },
+    };
+  }
+  if (event.type === 'cancelled') return { partType: 'cancelled', data: {} };
+  // WP-2 (walle-silent-cli-turn-and-history-source-livelock, 2026-09-05): the codex
+  // CLI-fallback lane (wall-e/agent-runners/codex.js) now streams its own progress
+  // during the run instead of staying silent until exit — without a mapping here
+  // those events were broadcast live (see emitWalleProgress's unconditional
+  // broadcastToSession above) but never durably written, so a reload lost them.
+  // Reuse the SAME tool_call/tool_result partTypes the 'tool_call'/'tool_result'
+  // branches above already render, rather than inventing a parallel card shape.
+  if (event.type === 'cli_fallback_tool') {
+    const toolCall = event.toolCall && typeof event.toolCall === 'object' ? event.toolCall : {};
+    const id = String(toolCall.toolCallId || toolCall.id || '');
+    const name = String(toolCall.name || 'cli.tool');
+    if (toolCall.status === 'in_progress') {
+      return { partType: 'tool_call', data: { id, name, input: toolCall.input || null, summary: `Running ${name}` } };
+    }
+    const failed = toolCall.status === 'failed';
+    // Security follow-up (review round 1): raw CLI tool output can echo back
+    // credentials (a captured header, a token the tool was passed) — scrub
+    // before this reaches the durable transcript, same as the failureDetail
+    // sink already does on the wall-e side.
+    const output = _deps.redactSecrets(toolCall.result && typeof toolCall.result === 'object' ? String(toolCall.result.output || '') : '');
+    return {
+      partType: 'tool_result',
+      data: {
+        id,
+        name,
+        result: output,
+        summary: `${failed ? 'Failed' : 'Completed'} ${name}`,
+        error: failed ? output : null,
+      },
+    };
+  }
+  // A "Reconnecting..." notice is a transient CLI-transport retry, not a failure
+  // (see the codex `exec --json` contract note in agent-runners/codex.js) — surface
+  // it via the same 'status' partType the existing 'retry'/'slow_provider' branches
+  // above already use. Security follow-up: the notice text is raw CLI error
+  // output (the live incident this WP closes was a 401 quoted verbatim in one)
+  // — scrub before slicing/persisting.
+  if (event.type === 'cli_fallback_notice') {
+    return {
+      partType: 'status',
+      data: {
+        type: 'cli_fallback_notice',
+        status: 'waiting',
+        message: _deps.redactSecrets(String(event.message || '')).slice(0, 500),
+        phase: event.phase || '',
+      },
+    };
+  }
+  // The CLI-fallback lane's final agent_message, narrated as it arrives. This is
+  // NOT the durable answer-writing path (the coding turn's normal completion
+  // machinery still writes the turn's actual assistant message/coding_summary) —
+  // it is a live narration marker so the UI stops looking silent for the whole
+  // run, matching what the in-process (text_delta) lane already provides.
+  // Security follow-up: scrub before slicing/persisting, same reasoning as above.
+  if (event.type === 'cli_fallback_message') {
+    return {
+      partType: 'status',
+      data: {
+        type: 'cli_fallback_message',
+        status: 'done',
+        message: _deps.redactSecrets(String(event.text || '')).slice(0, 2000),
+        phase: event.phase || '',
+      },
+    };
+  }
+  return null;
+}
+module.exports = {
+  configure,
+  _walleRowHistoryForCtmId,
+  _walleHistoryForReview,
+  _appendWalleUserRowAtSubmit,
+  _walleProgressTranscriptPart,
+};

package/template/coding-task-manager/lib/walle-supervisor.js

@@ -22,6 +22,7 @@ const { isPrimaryInstance: isPrimaryCtmInstance } = require('./ctm-boot-lifecycl
 // D-3/D-4: a same-title ps row is never enough on its own — see
 // lib/walle-kill-authority.js for why (untagged non-primary instances share
 // the primary's exact "Wall-E" title).
+const { orphanParentPids } = require('../../shared/orphan-parents'); // WP-12 (S-29)
 const { isOwnedRow, indexRowsByPid, logSkippedForeignPids } = require('./walle-kill-authority');
 const {
   checkWalleNativeDeps,
@@ -234,6 +235,7 @@ function commandInvokesScriptUnderRoot(command, rootMarker) {
 
 const defaultProcessOps = {
   pid: process.pid,
+  orphanParentPids,
   kill: (pid, signal) => process.kill(pid, signal),
   findListeningPidsByExactCommand,
   getProcessUptime,
@@ -1583,6 +1585,8 @@ function createWalleSupervisor({
   // D-3/D-4 (kill authority): a same-title process is only ever signalled
   // when it's OURS — spawned by this supervisor (ppid===myPid) or reparented
   // to init after a crash (ppid===1). Never by title alone; never myPid.
+  // WP-12 (S-29): pids an orphan is re-parented to ({1} on macOS; + the systemd --user subreaper on Linux).
+  const orphanParentSet = () => (typeof processOps.orphanParentPids === 'function' ? processOps.orphanParentPids() : orphanParentPids());
   async function collectManagedPids() {
     const myPid = processOps.pid || process.pid;
     const pidSet = new Set();
@@ -1603,7 +1607,8 @@ function createWalleSupervisor({
 
     const titles = new Set(processTitles());
     const byPid = indexRowsByPid(rows);
-    const owned = (row) => isOwnedRow(row, { titles, myPid });
+    const orphanParents = orphanParentSet();
+    const owned = (row) => isOwnedRow(row, { titles, myPid, orphanParents });
     const skippedByPid = new Map();
 
     let savedPid = null;
@@ -1663,6 +1668,7 @@ function createWalleSupervisor({
     const myPid = processOps.pid || process.pid;
     const rootMarker = path.resolve(walleDir());
     const titles = new Set(processTitles());
+    const orphanParents = orphanParentSet();
     const gatewaySurviveOn = String(process.env['WALLE_MCP_GATEWAY_SURVIVE'] ?? '') !== '0';
     // adoptedPid included as defense-in-depth (B11): an adopted daemon has
     // ppid==1 and matches the instance signature — never casually reap it while
@@ -1693,7 +1699,7 @@ function createWalleSupervisor({
         const command = String(row.command || '');
         if (!Number.isInteger(pid) || pid <= 1) continue;
         if (excluded.has(pid)) continue;
-        if (!Number.isInteger(ppid) || ppid !== 1) continue;
+        if (!Number.isInteger(ppid) || !orphanParents.has(ppid)) continue;
         if (!(titles.has(command) || commandInvokesScriptUnderRoot(command, rootMarker))) continue;
         // WP-3/S-9 (docs/mcp-startup-blackout-restart-storm-2026-08-21.html): the
         // gateway worker deliberately outlives its parent for adoption under this
@@ -2033,6 +2039,22 @@ function createWalleSupervisor({
     scheduleRestart(delayMs, 'auto-restart');
   }
 
+  // WP-2 (D-5): the exec the daemon runs as — pure + synchronous, so it answers identically
+  // whether the daemon was spawned by us or adopted from a pid file. The FDA hint must name
+  // the real exec on both paths (see walleExecPath in the returned object).
+  function resolveWalleExec() {
+    // Spawn from the Wall-E .app bundle's node exec when present so the daemon shows
+    // its icon + name in macOS Activity Monitor (the bundle's node is an ABI-matched
+    // clone created by create-walle). Falls back to process.execPath otherwise.
+    let walleExec = process.execPath;
+    if (process.platform === 'darwin') {
+      const bundleRoot = process.env.WALLE_BUNDLE_DIR || path.join(os.homedir(), '.walle', 'bundles');
+      const bundleExec = path.join(bundleRoot, 'Wall-E.app', 'Contents', 'MacOS', 'Wall-E');
+      try { if (fs.existsSync(bundleExec)) walleExec = bundleExec; } catch { /* expected: best-effort bundled-binary probe; any fs error leaves walleExec at its already-resolved default */ }
+    }
+    return walleExec;
+  }
+
   function spawnWalle(source) {
     // WP-S3 (B11): a real spawn always supersedes/ends any adopted-daemon
     // tracking — childPid (set below) takes over as the sole supervision
@@ -2105,15 +2127,9 @@ function createWalleSupervisor({
     delete childEnv.CTM_PROCESS_ROLE;
     if (walleToken) childEnv.WALL_E_API_TOKEN = walleToken;
 
-    // Spawn from the Wall-E .app bundle's node exec when present so the daemon shows
-    // its icon + name in macOS Activity Monitor (the bundle's node is an ABI-matched
-    // clone created by create-walle). Falls back to process.execPath otherwise.
-    let walleExec = process.execPath;
-    if (process.platform === 'darwin') {
-      const bundleRoot = process.env.WALLE_BUNDLE_DIR || path.join(os.homedir(), '.walle', 'bundles');
-      const bundleExec = path.join(bundleRoot, 'Wall-E.app', 'Contents', 'MacOS', 'Wall-E');
-      try { if (fs.existsSync(bundleExec)) walleExec = bundleExec; } catch { /* expected: best-effort bundled-binary probe; any fs error leaves walleExec at its already-resolved default */ }
-    }
+    // WP-2 (D-5): one resolution shared with walleExecPath() below, so the spawn and the
+    // FDA hint can never name different execs.
+    const walleExec = resolveWalleExec();
 
     let nextChild;
     try {
@@ -2496,7 +2512,7 @@ function createWalleSupervisor({
           ? (await processOps.listPidsWithPpid() || []).filter((row) => row.pid === savedPid) : await listPidRow(savedPid);
       } catch { /* expected: best-effort per-pid ownership probe; a failure leaves savedRows=null, so the saved pid is never (wrongly) adopted */ }
       const savedRow = Array.isArray(savedRows) ? indexRowsByPid(savedRows).get(savedPid) : undefined;
-      if (isOwnedRow(savedRow, { titles, myPid })) {
+      if (isOwnedRow(savedRow, { titles, myPid, orphanParents: orphanParentSet() })) {
         // WP-S3 (B11): this pid was NOT spawned by us this process lifetime —
         // adopt it into the same supervision the interval monitor gives a real
         // child (arm the monitor if it isn't already, and start tracking it so
@@ -2517,7 +2533,8 @@ function createWalleSupervisor({
     // A null snapshot is a FAILED probe, not "no Wall-E process" (nothing can be owned, so
     // only the not-running return below can see it) — report it instead of reading as empty.
     const psFailedFlag = Array.isArray(rows) ? {} : { ps_snapshot_failed: true };
-    const owned = (pid) => isOwnedRow(byPid.get(pid), { titles, myPid });
+    const orphanParents = orphanParentSet();
+    const owned = (pid) => isOwnedRow(byPid.get(pid), { titles, myPid, orphanParents });
 
     let discovered = [];
     try {
@@ -2678,7 +2695,7 @@ function createWalleSupervisor({
             rows = processOps.listPidsWithPpid ? await processOps.listPidsWithPpid() : await listPidsWithPpid();
           } catch { /* expected: best-effort ownership snapshot; a failed ps leaves rows=null (below), so the saved pid is never (wrongly) treated as our orphan */ }
           const row = Array.isArray(rows) ? indexRowsByPid(rows).get(saved) : undefined;
-          if (isOwnedRow(row, { titles, myPid })) {
+          if (isOwnedRow(row, { titles, myPid, orphanParents: orphanParentSet() })) {
             orphanPid = saved;
           } else {
             staleForeignPid = saved;
@@ -2941,6 +2958,8 @@ function createWalleSupervisor({
     stopMcpReadinessMonitor,
     stopForProcessExit,
     spawnWalle,
+    // WP-2 (D-5): the exec identity an FDA grant must name (pure; no spawn required).
+    walleExecPath: resolveWalleExec,
     waitForMcpReady,
   };
 }