create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/session-integrity.js

@@ -15,6 +15,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { NOOP_LAP, createPerfTrace, perfPhasesJson } = require('./lib/perf-phase-trace');
 const { writeStartupPointerGuarded, readStartupTaskProjectDir } = require('./lib/startup-pointer-write');
 const crypto = require('crypto');
 const claudeDesktopSessions = require('./lib/claude-desktop-sessions');
@@ -65,6 +66,17 @@ function resolveWalleLiveTranscriptPath(ctmSessionId, chatSessionId) {
 // stale-metadata check (2) still run.
 const INTEGRITY_CONTENT_CHECK_MAX_BYTES = 256 * 1024 * 1024;
 
+// --- Perf attribution (WP-0 / M-3, measurement only; see lib/perf-phase-trace.js) ---
+// The trace of the detectMismatches run in flight — lets the findCodexSessionFiles wrapper
+// below count calls made from helpers that do not receive the trace. detectMismatches is
+// synchronous and never re-entrant, so one slot is enough.
+let _activeDetectPerfTrace = null;
+
+function findCodexSessionFilesCounted(sessionId) {
+  const trace = _activeDetectPerfTrace;
+  return trace ? trace.timed('findCodexSessionFiles', () => findCodexSessionFiles(sessionId)) : findCodexSessionFiles(sessionId);
+}
+
 // --- Detection ---
 
 function sessionFileIdFromPath(filePath) {
@@ -358,7 +370,8 @@ function codexAgentRowHasTranscript(row) {
  * Run a full integrity check between the sessions DB and JSONL files on disk.
  * Returns an array of issue objects, each with { type, severity, sessionId, details, suggestion }.
  */
-function detectMismatches(db, getAllSessionFiles) {
+function _detectMismatchesInner(db, getAllSessionFiles, trace) {
+  const lap = trace ? trace.lap : NOOP_LAP;
   const issues = [];
   // 1. Load all DB sessions (v1 schema: ctm_sessions + agent_sessions)
   let allSessions;
@@ -397,10 +410,12 @@ function detectMismatches(db, getAllSessionFiles) {
       LEFT JOIN agent_sessions a ON a.ctm_session_id = c.id
     `).all();
   } catch (e) {
+    lap('load_sessions', 0);
     issues.push({ type: 'db_error', severity: 'critical', sessionId: null,
       details: { error: e.message }, suggestion: 'Check DB connectivity' });
     return issues;
   }
+  lap('load_sessions', 1);
 
   // 2. Build file index from disk
   const fileIndex = {}; // uuid -> { filePath, stat, projectEntry }
@@ -412,6 +427,7 @@ function detectMismatches(db, getAllSessionFiles) {
     issues.push({ type: 'scan_error', severity: 'warning', sessionId: null,
       details: { error: e.message }, suggestion: 'JSONL directory may be inaccessible' });
   }
+  lap('build_file_index', Object.keys(fileIndex).length);
 
   const timestampStartBySession = new Map();
   for (const row of allSessions) {
@@ -434,6 +450,7 @@ function detectMismatches(db, getAllSessionFiles) {
       });
     }
   }
+  lap('timestamp_start_pass', allSessions.length);
 
   // 3. Track claims to detect duplicates
   const agentIdClaims = {}; // agent_session_id -> [session ids that claim it]
@@ -457,6 +474,7 @@ function detectMismatches(db, getAllSessionFiles) {
     const expectedFileId = (agentId && agentId !== sid) ? agentId : sid;
     const file = resolveDbSessionFile(row, expectedFileId, fileIndex);
     let reportedCodexAgentJsonlMismatch = false;
+    lap('check0_row_prep', 1);
 
     if (isCodexSessionRow(row) && agentId) {
       const providerResumeId = String(row.provider_resume_id || '').trim();
@@ -502,6 +520,7 @@ function detectMismatches(db, getAllSessionFiles) {
         reportedCodexAgentJsonlMismatch = true;
       }
     }
+    lap('check0_codex_alias', (isCodexSessionRow(row) && agentId) ? 1 : 0);
 
     // Check 1: Missing file
     if (!file && row.file_size > 0 && !reportedCodexAgentJsonlMismatch) {
@@ -531,10 +550,15 @@ function detectMismatches(db, getAllSessionFiles) {
           suggestion: 'File may have been deleted or moved. Check .jsonl.bak variant.',
         });
       }
+      lap('check1_missing_file', 1);
       continue;
     }
 
-    if (!file) continue; // No file expected or found — OK for legacy entries
+    if (!file) {
+      lap('check1_missing_file', 1);
+      continue; // No file expected or found — OK for legacy entries
+    }
+    lap('check1_missing_file', 1);
 
     // Check 2: Stale metadata (file_size mismatch)
     if (row.file_size > 0 && file.stat.size > 0) {
@@ -557,6 +581,7 @@ function detectMismatches(db, getAllSessionFiles) {
         });
       }
     }
+    lap('check2_stale_metadata', 1);
 
     // Check 3: Timestamp drift (created_at vs JSONL timestamp)
     // Filesystem birthtime is not reliable for Claude JSONL sessions: Dropbox,
@@ -586,6 +611,7 @@ function detectMismatches(db, getAllSessionFiles) {
         });
       }
     }
+    lap('check3_timestamp_drift', 1);
 
     // Check 4a: Wrong mapping via slug mismatch (primary, slug-based detector).
     // Flags rows whose slug differs from the tab's canonical slug AND whose
@@ -651,6 +677,7 @@ function detectMismatches(db, getAllSessionFiles) {
         }
       }
     } catch (e) { /* lineage helpers unavailable — fall through to content check */ }
+    lap('check4a_slug_mapping', 1);
 
     // Check 4b: Wrong mapping detection via content fingerprint (legacy).
     // Kept for pre-slug JSONLs and as a defense-in-depth check.
@@ -689,6 +716,7 @@ function detectMismatches(db, getAllSessionFiles) {
         }
       } catch {}
     }
+    lap('check4b_content_mapping', 1);
   }
 
   // Check 5: Duplicate claims
@@ -705,6 +733,7 @@ function detectMismatches(db, getAllSessionFiles) {
       });
     }
   }
+  lap('check5_duplicate_claims', Object.keys(agentIdClaims).length);
 
   // Check 6: Orphan files (on disk but not in DB)
   const dbFileIds = new Set();
@@ -712,13 +741,15 @@ function detectMismatches(db, getAllSessionFiles) {
     addAgentRowFileIds(dbFileIds, row);
     if (isCodexSessionRow(row) && row.agent_session_id) {
       try {
-        for (const filePath of findCodexSessionFiles(row.agent_session_id)) {
+        for (const filePath of findCodexSessionFilesCounted(row.agent_session_id)) {
           const rolloutFileId = sessionFileIdFromPath(filePath);
           if (rolloutFileId) dbFileIds.add(rolloutFileId);
         }
       } catch {}
     }
   }
+  lap('check6_pass1', allSessions.length);
+  let agentRowCount = 0;
   try {
     const agentCols = new Set(db.prepare('PRAGMA table_info(agent_sessions)').all().map(c => c.name));
     const threadSourceCol = agentCols.has('thread_source') ? 'thread_source' : "'' AS thread_source";
@@ -728,11 +759,12 @@ function detectMismatches(db, getAllSessionFiles) {
         ${threadSourceCol}, ${parentAgentSessionCol}
       FROM agent_sessions
     `).all();
+    agentRowCount = allAgentRows.length;
     for (const row of allAgentRows) {
       addAgentRowFileIds(dbFileIds, row);
       if (isCodexSessionRow(row) && row.agent_session_id) {
         try {
-          for (const filePath of findCodexSessionFiles(row.agent_session_id)) {
+          for (const filePath of findCodexSessionFilesCounted(row.agent_session_id)) {
             const rolloutFileId = sessionFileIdFromPath(filePath);
             if (rolloutFileId) dbFileIds.add(rolloutFileId);
           }
@@ -740,6 +772,7 @@ function detectMismatches(db, getAllSessionFiles) {
       }
     }
   } catch {}
+  lap('check6_pass2', agentRowCount);
   for (const issue of issues) {
     if (issue.type === 'codex_agent_jsonl_mismatch' && issue.details?.file_agent_session_id) {
       dbFileIds.add(issue.details.file_agent_session_id);
@@ -770,6 +803,7 @@ function detectMismatches(db, getAllSessionFiles) {
       suggestion: `${orphanCount} orphan files total. Only first 10 reported.`,
     });
   }
+  lap('check6_orphan_count', orphanCount);
 
   // Check 6b: Codex startup_tasks must contain provider-native resume args.
   // A CTM tab UUID is a lifecycle id, not a Codex resume id. If a crash restart
@@ -834,6 +868,7 @@ function detectMismatches(db, getAllSessionFiles) {
       suggestion: 'Startup task integrity scan failed; check startup_tasks schema.',
     });
   }
+  lap('check6b_startup_resume', 1);
 
   // Check 7: Orphan top-level agent_sessions (no valid ctm_session parent).
   // Provider-native child threads (Codex subagents, etc.) are deliberately
@@ -875,7 +910,32 @@ function detectMismatches(db, getAllSessionFiles) {
   } catch (e) {
     console.error('[session-integrity] Error checking orphan agent_sessions:', e.message);
   }
+  lap('check7_orphan_agents', 1);
+
+  return issues;
+}
 
+/**
+ * Perf-attribution wrapper (WP-0 / M-3): runs the detection scan with a phase trace,
+ * attaches it as `issues.phases` (additive; a property on the array, so consumers that
+ * iterate/filter it and JSON serialization of an array are both unaffected) and logs one
+ * `[session-integrity] phases {...}` line for this run. Measurement only — the trace is
+ * null when CTM_PERF_ATTRIBUTION is off, in which case nothing is attached or logged.
+ */
+function detectMismatches(db, getAllSessionFiles) {
+  const trace = createPerfTrace();
+  _activeDetectPerfTrace = trace;
+  let issues;
+  try {
+    issues = _detectMismatchesInner(db, getAllSessionFiles, trace);
+  } finally {
+    _activeDetectPerfTrace = null;
+  }
+  if (trace) {
+    trace.lap('finalize', 1);
+    issues.phases = trace.phases;
+    console.log(`[session-integrity] phases ${perfPhasesJson('detect', trace)}`);
+  }
   return issues;
 }
 

package/template/coding-task-manager/workers/db-owner-worker.js

@@ -163,6 +163,9 @@ function _interactiveRequestPending() {
   });
 }
 
+// WP-0c (§6.5 D-13, AC-0e): names a `low` dispatch while signalled high/urgent work is not yet queued.
+const observeLowDispatch = require('../lib/db-owner-dispatch-probe').createLowOverSignalledProbe();
+
 // Background writer: transient write-lock contention with the main thread should
 // retry rather than surface (e.g. a pasted image failing). Safe because a busy
 // error means the write never started. This worker thread may async-wait freely.
@@ -1778,6 +1781,11 @@ async function _runOpWithCursorPublication(op, payload = {}, rowCursorBases = []
   };
 }
 
+// D-12 (S-17): dispatch on the NEXT turn, never inline from a delivery or a completion. Inline,
+// every delivered request ran at once on an empty queue, so the MessagePort's FIFO decided the order
+// and a high request posted behind three lows ran fourth (tests-integration/db-owner-repump-starvation.test.js).
+let _pumpScheduled = false;
+function _schedulePump() { if (_pumpScheduled) return; _pumpScheduled = true; setImmediate(() => { _pumpScheduled = false; _pump(); }); }
 function _pump() {
   if (active || closing) return;
   const dispatchNow = Date.now();
@@ -1786,6 +1794,15 @@ function _pump() {
     _postStatus();
     return;
   }
+  if (task.priority === 'low') {
+    observeLowDispatch({
+      op: task.op,
+      snapshot: workSignal?.snapshot(),
+      queuedUrgent: queue.pendingUrgent(),
+      queuedHigh: queue.pendingHigh(),
+      at: dispatchNow,
+    });
+  }
   try {
     activeDecl = getDbOwnerDispatchDeclaration(task.op, task.payload);
     assertDbOwnerOpDispatch(activeDecl, {
@@ -1929,7 +1946,7 @@ function _pump() {
       activeWedgeDumped = false;
       activeBudgetLogged = false;
       try { dbOwnerHeartbeat?.clear(); } catch { /* expected: same best-effort observability rationale as the beat() call above */ }
-      _pump();
+      _schedulePump(); // D-12 (S-17), see _schedulePump
     });
 }
 
@@ -1978,7 +1995,7 @@ function _enqueue(msg) {
     return;
   }
   enqueued += 1;
-  _pump();
+  _schedulePump();
 }
 
 function _postCancelledResponse(task, reason = '') {

package/template/coding-task-manager/workers/online-backup-worker.js

@@ -13,6 +13,7 @@ function serializeError(error) {
 
 db.createBackupFromPath(workerData.dbPath, workerData.label, {
   backupDir: workerData.backupDir,
+  retentionDays: workerData.retentionDays,
 }).then(
   (result) => parentPort.postMessage({ ok: true, result }),
   (error) => parentPort.postMessage({ ok: false, error: serializeError(error) }),

package/template/coding-task-manager/workers/read-pool-model-collector.js

@@ -139,7 +139,7 @@ function collectNativeModelObservations(items, options = {}) {
   try {
     for (const item of items) {
       activeResultIndex = out.length;
-      if (!item || typeof item !== 'object' || typeof item.id !== 'string' || safeText(item.id) !== item.id || !['claude', 'codex', 'gemini', 'opencode'].includes(item.agentType) || ownerRejection(item.owner, item.agentType) !== null) {
+      if (!item || typeof item !== 'object' || typeof item.id !== 'string' || safeText(item.id) !== item.id || !['claude', 'codex', 'gemini', 'opencode', 'dsh'].includes(item.agentType) || ownerRejection(item.owner, item.agentType) !== null) {
         out.push(identityResult(item, 'invalid_or_unbound_owner'));
         continue;
       }
@@ -149,7 +149,9 @@ function collectNativeModelObservations(items, options = {}) {
       }
       const env = envFor(item, options);
       try {
-        if (item.agentType === 'claude') out.push(collectClaude(item, env, options));
+        // dsh (ACP) has no native file to scan: its model facts arrive live from the bridge's configOptions.
+        if (item.agentType === 'dsh') out.push(identityResult(item, null));
+        else if (item.agentType === 'claude') out.push(collectClaude(item, env, options));
         else if (item.agentType === 'gemini') out.push(collectGemini(item, env, options));
         else if (item.agentType === 'codex') out.push(collectCodex(item, env, options, getDb));
         else out.push(collectOpencode(item, env, options, getDb));
@@ -450,8 +452,18 @@ function collectOpencode(item, env, options, getDb) {
   const handle = getDb(dbPath);
   if (!handle.db) return identityResult(item, 'database_error', { ...errorFields(handle.error), sourceRevision: statSignature(dbPath) });
   try {
+    /*
+     * WP-3 (OpenCode 2.x): 2.2.x keeps sessions in `session_v2`/`session_message` in the same db file
+     * and drops `session`/`message`. Detect the 2.x schema first; the 1.x branch below is unchanged.
+     */
+    const v2Cols = sqliteColumns(handle.db, 'session_v2', handle.columns);
+    // A db holding both schemas (a 1.x install sharing the file) falls through to 1.x when the id is not a 2.x session.
+    if (v2Cols.has('id') && v2Cols.has('model') && v2Cols.has('time_updated')) {
+      const v2 = collectOpencodeV2(item, handle, dbPath);
+      if (v2.reason !== 'session_missing' || !sqliteColumns(handle.db, 'session', handle.columns).has('id')) return v2;
+    }
     const sessionCols = sqliteColumns(handle.db, 'session', handle.columns);
-    const session = selectColumns(handle.db, 'session', sessionCols, ['id', 'parent_id', 'model', 'time_updated'], 'id', item.owner.providerSessionId);
+    const session = selectColumns(handle.db, 'session', sessionCols, ['id', 'parent_id', 'model', 'time_created', 'time_updated'], 'id', item.owner.providerSessionId);
     if (!session) return identityResult(item, 'session_missing', { sourceRevision: statSignature(dbPath) });
     if (session.parent_id) return identityResult(item, 'child_session', { sourceRevision: digest([statSignature(dbPath), session.id, session.parent_id]) });
     const messageCols = sqliteColumns(handle.db, 'message', handle.columns);
@@ -472,4 +484,40 @@ function collectOpencode(item, env, options, getDb) {
   }
 }
 
+/*
+ * WP-3: map a 2.x `session_message` assistant row onto the 1.x `message.data` shape the unchanged
+ * `opencodeModelObservations` adapter already decodes. A `finish:"error"` (or a present `error`) row
+ * is mapped to have `data.error` so the adapter refuses it -- no `completed-turn` fact. Unparseable
+ * `data` yields null and the caller drops the row.
+ */
+function v2AssistantRow(row) {
+  if (!row || typeof row.data !== 'string') return null;
+  let parsed;
+  try { parsed = JSON.parse(row.data); } catch { return null; }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  const data = { role: 'assistant', modelID: parsed.model?.id, providerID: parsed.model?.providerID, time: parsed.time };
+  if (parsed.error || parsed.finish === 'error') data.error = parsed.error || { type: 'finish_error' };
+  return { id: row.id, session_id: row.session_id, data: JSON.stringify(data) };
+}
+function collectOpencodeV2(item, handle, dbPath) {
+  const sessionCols = sqliteColumns(handle.db, 'session_v2', handle.columns);
+  // `time_created` too: the adapter stamps the session-store facts with it (I-5). 2.x bumps `time_updated` to
+  // the last turn's completion, so a fact stamped with it ties the newest opencode:message turn and wins.
+  const session = selectColumns(handle.db, 'session_v2', sessionCols, ['id', 'parent_id', 'model', 'time_created', 'time_updated'], 'id', item.owner.providerSessionId);
+  if (!session) return identityResult(item, 'session_missing', { sourceRevision: statSignature(dbPath) });
+  if (session.parent_id) return identityResult(item, 'child_session', { sourceRevision: digest([statSignature(dbPath), session.id, session.parent_id]) });
+  const messageCols = sqliteColumns(handle.db, 'session_message', handle.columns);
+  if (!messageCols.has('session_id') || !messageCols.has('data') || !messageCols.has('time_created')) throw Object.assign(new Error('missing session_message columns'), { code: 'SCHEMA' });
+  const selected = ['id', 'session_id', 'type', 'data', 'time_created'].filter((name) => messageCols.has(name));
+  const orderId = messageCols.has('id') ? ', "id" DESC' : '';
+  const rows = handle.db.prepare(`SELECT ${selected.map((name) => `"${name}"`).join(', ')} FROM "session_message" WHERE "session_id" = ? AND "type" = 'assistant' ORDER BY "time_created" DESC${orderId} LIMIT 128`).all(item.owner.providerSessionId).reverse();
+  const assistantRows = rows.map((row) => v2AssistantRow(row)).filter(Boolean);
+  const observations = opencodeModelObservations(item.owner, { sessionRow: session, assistantRows });
+  const revision = digest([statSignature(dbPath), session, rows.map((row) => [row.id, row.time_created, row.data])]);
+  for (const fact of observations) if (fact.source === 'opencode:session-store') {
+    fact.sourceRevision = digest([session.id, fact.value, fact.providerId, fact.effort, session.time_updated]);
+  }
+  return { id: item.id, owner: item.owner, observations, reason: observations.length ? null : 'unknown', sourceRevision: revision };
+}
+
 module.exports = { collectNativeModelObservations, MAX_ITEMS, TAIL_BYTES, GEMINI_MAX_BYTES };

package/template/coding-task-manager/workers/read-pool-worker.js

@@ -19,6 +19,8 @@ require('../../shared/network/external-network-guard').armExternalNetworkGuardFr
 // request / response / status / close) so it can share the client transport.
 
 const { parentPort, workerData } = require('node:worker_threads');
+const v8 = require('node:v8');
+const { boolFlag } = require('../lib/env-flags');
 const fs = require('node:fs'), path = require('node:path');
 const transcriptSource = require('../lib/transcript-source');
 const { readAgentTitleBackfillPage } = require('../lib/agent-title-backfill-read');
@@ -56,6 +58,9 @@ let enqueued = 0;
 let completed = 0;
 let failed = 0;
 const queue = [];
+// WP-0 M-1/M-4 AC-0d: test-only retained allocations (see the `ping` allocMb hook). Bounded to
+// 4 entries; unused unless CTM_READ_POOL_TEST_OPS=1.
+const _perfTestHoldings = [];
 const JSON_FRAME_MAX_BYTES = 60 * 1024;
 const JSON_STRING_PART_BYTES = 24 * 1024;
 // readCanonicalAgentEvents blast-radius bound. This was 10000 events/session with
@@ -1124,6 +1129,48 @@ function _telemetry(currentOpBytes = 0) {
   };
 }
 
+// WP-0 M-1 + M-4 (docs/hub-local-cpu-memory-burn-2026-10-31.html §7): attribute CPU and heap to
+// the op that actually cost them, inside the worker that runs it.
+//
+//   M-1 CPU: process.threadCpuUsage() -- THIS worker thread's own CPU, not the process's, so a
+//            sibling worker's burn can never be charged to this op.
+//   M-4 heap: v8.getHeapStatistics() rather than process.memoryUsage(). It exposes exactly the
+//            two fields wanted (used_heap_size, external_memory) and skips memoryUsage()'s extra
+//            uv_resident_set_memory() syscall -- measured 176 ns vs 545 ns per call on the
+//            pinned node (v25.2.1); threadCpuUsage() is 728 ns. Two samples per op ≈ 1.8 µs,
+//            negligible against any op that reaches a worker.
+// Nothing is sampled or attached when CTM_PERF_ATTRIBUTION=0.
+const _perfAttributionOn = () => boolFlag('CTM_PERF_ATTRIBUTION', true);
+const _threadCpu = typeof process.threadCpuUsage === 'function'
+  ? () => process.threadCpuUsage()
+  : () => ({ user: 0, system: 0 });
+
+function _perfSample() {
+  return { cpu: _threadCpu(), heap: v8.getHeapStatistics() };
+}
+
+// null when attribution is off -- _perfDelta() then returns null and the response carries no
+// `perf` field at all.
+function _perfStart() {
+  return _perfAttributionOn() ? _perfSample() : null;
+}
+
+// `op` rides along so the client can attribute the delta without re-deriving the op from a
+// requestId the worker handle may already have released (late responses).
+function _perfDelta(start, op) {
+  if (!start) return null;
+  const cpu = _threadCpu();
+  const heap = v8.getHeapStatistics();
+  return {
+    op,
+    cpuUserUs: cpu.user - start.cpu.user,
+    cpuSystemUs: cpu.system - start.cpu.system,
+    // Signed on purpose: a delta may be negative (GC ran, or a transferred buffer was neutered).
+    heapDeltaBytes: heap.used_heap_size - start.heap.used_heap_size,
+    externalDeltaBytes: heap.external_memory - start.heap.external_memory,
+  };
+}
+
 function _postStatus() {
   try { parentPort.postMessage({ type: 'status', status: _status() }); } catch {}
 }
@@ -1185,6 +1232,9 @@ async function _runOp(op, payload = {}, task = null) {
       // that switch must not be reachable on a production instance even though `ping`
       // has no production caller today.
       const _testHooks = process.env.CTM_READPOOL_TEST_HOOKS === '1';
+      // WP-0 M-1/M-4: default OFF, like _testHooks above -- an allocation this size is a test
+      // affordance, never something a production caller may ask for.
+      const _testOps = boolFlag('CTM_READ_POOL_TEST_OPS', false);
       const rawSleepMs = _testHooks ? Math.min(5000, Math.max(0, Number(payload.rawSleepMs) || 0)) : 0;
       if (rawSleepMs > 0) await new Promise((r) => setTimeout(r, rawSleepMs));
       // Test hook (WP-2): throw OUTSIDE the awaited task chain entirely — a genuinely
@@ -1194,6 +1244,18 @@ async function _runOp(op, payload = {}, task = null) {
         setImmediate(() => { throw new Error('WP-2 test: forced uncaughtException'); });
         await new Promise(() => {}); // this task never resolves; the fault kills the worker instead.
       }
+      // WP-0 M-1/M-4 AC-0d: an op that allocates and RETAINS `allocMb` MB until it returns, so
+      // the heap-delta attribution has a real allocation to attribute (a declared op's own output
+      // caps top out well under 50 MB, and a transferred response is neutered before the delta is
+      // read). Inert unless CTM_READ_POOL_TEST_OPS=1 -- production must not be able to allocate
+      // on demand through `ping`. Retained in a bounded ring (4 buffers) so a long-lived test
+      // process cannot grow without limit.
+      const allocMb = _testOps ? Math.min(256, Math.max(0, Number(payload.allocMb) || 0)) : 0;
+      if (allocMb > 0) {
+        const held = Buffer.alloc(allocMb * 1024 * 1024, 1);
+        _perfTestHoldings.push(held);
+        if (_perfTestHoldings.length > 4) _perfTestHoldings.shift();
+      }
       return { pong: true, ts: Number(payload.ts) || 0 };
     }
 
@@ -2909,7 +2971,7 @@ async function _runOp(op, payload = {}, task = null) {
       // connection makes it side-effect-free (better-sqlite3 readonly + fs only).
       const ctx = require('../../wall-e/memory/ctm-session-context');
       const args = (payload && payload.args) || {};
-      const conn = _readonlyDb(payload.dbPath);
+      const conn = _readonlyRoutedDb(payload.dbPath); // ROUTED: ctm_sessions is domain core (core.db after the flip); base-only gave title/cwd "" (cross-machine-session-context C-4)
       if (op === 'ctmSessionMemorySearch') return _transferJson(ctx.searchCtmSessions({ ...args, db: conn }));
       if (op === 'ctmSessionMemoryContext') return _transferJson(ctx.getCtmSessionContext({ ...args, db: conn }));
       if (op === 'ctmSessionMemoryHealth') return _transferJson(ctx.getCtmDbHealth({ ...args, db: conn }));
@@ -3007,6 +3069,14 @@ function _pump() {
   }
   active = task;
   _postStatus();
+  // WP-0 M-1/M-4: one start sample per executed op; the delta is attached to whichever response
+  // (success, size refusal, or error) ends it. Cancelled/never-dispatched requests take the
+  // _postCancelledResponse path above and are not ops, so they carry no perf.
+  const perfStart = _perfStart();
+  const postResponse = (message, transferList) => {
+    const perf = _perfDelta(perfStart, task.op);
+    parentPort.postMessage(perf ? { ...message, perf } : message, transferList);
+  };
   Promise.resolve()
     .then(() => _runOp(task.op, task.payload, task))
     .then((result) => {
@@ -3016,7 +3086,7 @@ function _pump() {
           const error = new Error(`read-pool output exceeds declared byte bound: ${task.op}`);
           error.code = 'CTM_READ_POOL_OUTPUT_TOO_LARGE';
           failed += 1;
-          parentPort.postMessage({
+          postResponse({
             type: 'response', requestId: task.requestId, error: _serializeError(error), telemetry: _telemetry(),
           });
           return;
@@ -3025,7 +3095,7 @@ function _pump() {
         // multi-MB object. transferList moves ownership + neuters our copy (race-free).
         const buf = _toTransferBuffer(result.buffer);
         completed += 1;
-        parentPort.postMessage(
+        postResponse(
           {
             type: 'response', requestId: task.requestId,
             resultBuffer: buf.buffer, byteOffset: buf.byteOffset, byteLength: buf.byteLength,
@@ -3041,13 +3111,13 @@ function _pump() {
           const error = new Error(`read-pool output exceeds declared byte bound: ${task.op}`);
           error.code = 'CTM_READ_POOL_OUTPUT_TOO_LARGE';
           failed += 1;
-          parentPort.postMessage({
+          postResponse({
             type: 'response', requestId: task.requestId, error: _serializeError(error), telemetry: _telemetry(),
           });
           return;
         }
         completed += 1;
-        parentPort.postMessage({
+        postResponse({
           type: 'response', requestId: task.requestId, result, serializedBytes,
           telemetry: _telemetry(serializedBytes),
         });
@@ -3064,7 +3134,7 @@ function _pump() {
       // catches BOTH: a rejection from _runOp, and a throw from the onFulfilled
       // handler above.
       failed += 1;
-      parentPort.postMessage({
+      postResponse({
         type: 'response', requestId: task.requestId, error: _serializeError(err), telemetry: _telemetry(),
       });
     })

package/template/coding-task-manager/workers/session-host-pool-process.js

@@ -30,7 +30,7 @@ const {
   MAX_FRAME_BYTES,
   PROTOCOL_VERSION, FLOOR_VERSION,
 } = require('../lib/host-control-protocol');
-const { createHandoff, handoffManifestFromArgv, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata } = require('../lib/host-handoff'); const { modelExecutionRecipeFromEnv, modelExecutionRecipeMetadata } = require('../lib/model-execution-recipe-metadata'); const { createProbeFrameHold } = require('../lib/probe-frame-hold');
+const { createHandoff, handoffManifestFromArgv, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata, launchEnvironmentMetadata } = require('../lib/host-handoff'); const { modelExecutionRecipeFromEnv, modelExecutionRecipeMetadata } = require('../lib/model-execution-recipe-metadata'); const { createProbeFrameHold } = require('../lib/probe-frame-hold');
 const { computeClosure } = require('../lib/host-closure-hash'), { createScrollbackSnapshotStore } = require('../lib/scrollback-snapshot-store'); // hoisted: loaded set frozen at startup
 
 const POST_EXIT_HEADLESS_TTL_MS = 60000;
@@ -199,7 +199,7 @@ function createSessionState(sessionId, o) {
     seq: 0, // WP-0: monotonic per-session data counter, socket-protocol-only (see buildSessionsState)
     ...modelProcessGenerationMetadata(o.modelProcessGeneration),
     ...modelStorageRootsMetadata(o.modelStorageRoots),
-    ...modelExecutionRecipeMetadata(o.modelExecutionRecipe),
+    ...modelExecutionRecipeMetadata(o.modelExecutionRecipe), ...launchEnvironmentMetadata(o.launchEnvironment),
     cmd: String(o.cmd || ''),
     cwd: o.cwd || '',
     name: o.name || '',
@@ -268,7 +268,7 @@ async function startSession(msg) {
   const state = createSessionState(sessionId, {
     cols, rows, suppress: msg.suppressPtyHeadlessUntilInput, cmd: msg.cmd, cwd: msg.cwd, name: msg.name, outputEpoch: msg.outputEpoch,
     modelProcessGeneration: modelProcessGenerationFromEnv(msg.env),
-    modelStorageRoots: modelStorageRootsFromEnv(msg.env),
+    modelStorageRoots: modelStorageRootsFromEnv(msg.env), launchEnvironment: msg.launchEnvironment,
     displayContext: isWorkerDisplaySession({ env: msg.env }) ? { agentRole: 'worker', _workerAgent: workerAgentOf({ env: msg.env }), cwd: msg.cwd || '' } : null,
   });
   try {
@@ -293,7 +293,7 @@ async function startSession(msg) {
     attachSessionProcess(state, proc);
     // D-3/S-7: fresh spawns only; a no-op unless msg.env came from buildSandboxCliEnv (non-primary, D-5).
     armSessionLoginTripwire({ proc, env: childEnv, onBlocked: (record) => { state.loginBlocked = record; send({ type: 'host-diagnostic', sessionId, event: 'login-attempt-blocked', details: { id: record.id, excerpt: record.excerpt } }); } });
-    send({ type: 'started', sessionId, pid: proc.pid, cols, rows, ...modelProcessGenerationMetadata(state.modelProcessGeneration), ...modelStorageRootsMetadata(state.modelStorageRoots), ...modelExecutionRecipeMetadata(state.modelExecutionRecipe) });
+    send({ type: 'started', sessionId, pid: proc.pid, cols, rows, ...modelProcessGenerationMetadata(state.modelProcessGeneration), ...modelStorageRootsMetadata(state.modelStorageRoots), ...modelExecutionRecipeMetadata(state.modelExecutionRecipe), ...launchEnvironmentMetadata(state.launchEnvironment) });
   } catch (err) {
     hostError(sessionId, err, { code: 'spawn_failed' });
     send({ type: 'exit', sessionId, exitCode: 1, signal: null, spawnFailed: true });
@@ -379,7 +379,7 @@ function buildSessionsState() {
       headlessReady: headless.hasTerminal(sessionId),
       ...modelProcessGenerationMetadata(state.modelProcessGeneration),
       ...modelStorageRootsMetadata(state.modelStorageRoots),
-      ...modelExecutionRecipeMetadata(state.modelExecutionRecipe),
+      ...modelExecutionRecipeMetadata(state.modelExecutionRecipe), ...launchEnvironmentMetadata(state.launchEnvironment),
       ...(state.exitSource ? { exitSource: state.exitSource } : {}),
     });
   }
@@ -414,7 +414,7 @@ const handoff = createHandoff({
 });
 const stateFromEntry = (e) => createSessionState(e.sessionId, {
   cols: e.cols, rows: e.rows, suppress: e.suppressPtyHeadlessUntilInput, displayContext: e.workerDisplayContext, cmd: e.cmd, cwd: e.cwd, name: e.name, outputEpoch: e.outputEpoch,
-  modelProcessGeneration: e.modelProcessGeneration, ...modelStorageRootsMetadata(e.modelStorageRoots), ...modelExecutionRecipeMetadata(e.modelExecutionRecipe, { sessionId: e.sessionId, processGeneration: e.modelProcessGeneration }),
+  modelProcessGeneration: e.modelProcessGeneration, ...modelStorageRootsMetadata(e.modelStorageRoots), ...modelExecutionRecipeMetadata(e.modelExecutionRecipe, { sessionId: e.sessionId, processGeneration: e.modelProcessGeneration }), launchEnvironment: e.launchEnvironment,
 });
 // WP-3: a successor host rebuilds its sessions from the manifest BEFORE its control socket listens.
 const handoffRestored = !handoffManifestFromArgv() ? Promise.resolve() : handoff.restore(handoffManifestFromArgv(), {

package/template/coding-task-manager/workers/session-host-process.js

@@ -26,7 +26,7 @@ const {
   MAX_FRAME_BYTES,
   PROTOCOL_VERSION, FLOOR_VERSION,
 } = require('../lib/host-control-protocol');
-const { createHandoff, handoffManifestFromArgv, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata } = require('../lib/host-handoff'); const { modelExecutionRecipeFromEnv, modelExecutionRecipeMetadata } = require('../lib/model-execution-recipe-metadata'); const { createProbeFrameHold } = require('../lib/probe-frame-hold');
+const { createHandoff, handoffManifestFromArgv, modelProcessGenerationFromEnv, modelProcessGenerationMetadata, modelStorageRootsFromEnv, modelStorageRootsMetadata, launchEnvironmentMetadata } = require('../lib/host-handoff'); const { modelExecutionRecipeFromEnv, modelExecutionRecipeMetadata } = require('../lib/model-execution-recipe-metadata'); const { createProbeFrameHold } = require('../lib/probe-frame-hold');
 const { computeClosure } = require('../lib/host-closure-hash'), { createScrollbackSnapshotStore } = require('../lib/scrollback-snapshot-store'); // hoisted: loaded set frozen at startup
 let sessionId = '';
 let ptyProcess = null;
@@ -255,7 +255,7 @@ async function startSession(msg) {
   const rows = Number(msg.rows || 30) || 30;
   sessionCols = cols;
   sessionRows = rows;
-  sessionMeta = { cwd: msg.cwd || '', name: msg.name || '', outputEpoch: String(msg.outputEpoch || ''), ...modelProcessGenerationMetadata(modelProcessGenerationFromEnv(msg.env)), modelStorageRoots: modelStorageRootsFromEnv(msg.env) };
+  sessionMeta = { cwd: msg.cwd || '', name: msg.name || '', outputEpoch: String(msg.outputEpoch || ''), ...modelProcessGenerationMetadata(modelProcessGenerationFromEnv(msg.env)), modelStorageRoots: modelStorageRootsFromEnv(msg.env), launchEnvironment: msg.launchEnvironment };
   workerDisplayContext = isWorkerDisplaySession({ env: msg.env }) ? { agentRole: 'worker', _workerAgent: workerAgentOf({ env: msg.env }), cwd: msg.cwd || '' } : null;
   try {
     const createMessage = { type: 'create', sessionId, cols, rows, outputEpoch: String(msg.outputEpoch || '') };
@@ -280,7 +280,7 @@ async function startSession(msg) {
     attachSessionProcess(proc);
     // D-3/S-7: fresh spawns only; a no-op unless msg.env came from buildSandboxCliEnv (non-primary, D-5).
     armSessionLoginTripwire({ proc, env: childEnv, onBlocked: (record) => { loginBlocked = record; send({ type: 'host-diagnostic', sessionId, event: 'login-attempt-blocked', details: { id: record.id, excerpt: record.excerpt } }); } });
-    send({ type: 'started', sessionId, pid: proc.pid, cols, rows, ...modelProcessGenerationMetadata(sessionMeta.modelProcessGeneration), ...modelStorageRootsMetadata(sessionMeta.modelStorageRoots), ...modelExecutionRecipeMetadata(sessionMeta.modelExecutionRecipe) });
+    send({ type: 'started', sessionId, pid: proc.pid, cols, rows, ...modelProcessGenerationMetadata(sessionMeta.modelProcessGeneration), ...modelStorageRootsMetadata(sessionMeta.modelStorageRoots), ...modelExecutionRecipeMetadata(sessionMeta.modelExecutionRecipe), ...launchEnvironmentMetadata(sessionMeta.launchEnvironment) });
   } catch (err) {
     hostError(err, { code: 'spawn_failed' });
     send({ type: 'exit', sessionId, exitCode: 1, signal: null, spawnFailed: true });
@@ -301,7 +301,7 @@ function buildSessionsState() {
     headlessReady: headless.hasTerminal(sessionId),
     ...modelProcessGenerationMetadata(sessionMeta.modelProcessGeneration),
     ...modelStorageRootsMetadata(sessionMeta.modelStorageRoots),
-    ...modelExecutionRecipeMetadata(sessionMeta.modelExecutionRecipe),
+    ...modelExecutionRecipeMetadata(sessionMeta.modelExecutionRecipe), ...launchEnvironmentMetadata(sessionMeta.launchEnvironment),
     ...(exitSource ? { exitSource } : {}),
   }];
 }
@@ -335,7 +335,7 @@ const handoffRestored = !handoffManifestFromArgv() ? Promise.resolve() : handoff
   adopt: (e, proc) => {
     if (ptyProcess) throw new Error('a dedicated host holds exactly one session');
     sessionId = e.sessionId; sessionCmd = e.cmd || ''; sessionCols = e.cols; sessionRows = e.rows; sessionSeq = e.seq || 0;
-    sessionMeta = { cwd: e.cwd || '', name: e.name || '', outputEpoch: e.outputEpoch || '', ...modelProcessGenerationMetadata(e.modelProcessGeneration), ...modelStorageRootsMetadata(e.modelStorageRoots), ...modelExecutionRecipeMetadata(e.modelExecutionRecipe, { sessionId: e.sessionId, processGeneration: e.modelProcessGeneration }) };
+    sessionMeta = { cwd: e.cwd || '', name: e.name || '', outputEpoch: e.outputEpoch || '', ...modelProcessGenerationMetadata(e.modelProcessGeneration), ...modelStorageRootsMetadata(e.modelStorageRoots), ...modelExecutionRecipeMetadata(e.modelExecutionRecipe, { sessionId: e.sessionId, processGeneration: e.modelProcessGeneration }), launchEnvironment: e.launchEnvironment };
     workerDisplayContext = e.workerDisplayContext || null; suppressPtyHeadlessUntilInput = !!e.suppressPtyHeadlessUntilInput;
     attachSessionProcess(proc);
   },