create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/workers/watch-worker.js

@@ -0,0 +1,105 @@
+'use strict';
+/**
+ * WP-3 watch worker — design doc typing-delay-session-list-broadcast-storm-2026-11-01.html
+ * §5 D-4, §6 (WP-3), §8 WP-3, §9 S-3..S-8.
+ *
+ * Every `fs.watch()` directory handle CTM owns used to live on the main thread's libuv loop.
+ * On macOS libuv serves all of them from ONE FSEventStream per `uv_loop_t`, and
+ * `uv__fsevents_close` blocks the calling thread on `uv_sem_wait` until libuv's CF thread has
+ * destroyed + recreated + `FSEventStreamStart`ed that stream with every remaining path
+ * (src/unix/fsevents.c). With ~690 directory watchers open, one `close()` costs 0.4-1.6 s of
+ * RPC to fseventsd, on the thread that also has to echo keystrokes and paint frames — the
+ * 2026-11-01 23:52Z incident sample has 1,330/1,339 main-thread samples in
+ * `HandleWrap::Close -> uv__fsevents_close -> uv_sem_wait`.
+ *
+ * libuv keeps that CF state PER LOOP, so a `worker_threads` Worker gets its own stream and its
+ * own semaphore. This file runs inside that worker and owns every directory watcher; a blocked
+ * close then stalls only this thread.
+ *
+ * Protocol over `parentPort` (main → worker):
+ *   { op: 'watch',   id, dir }   create one non-recursive watcher (persistent:false — the same
+ *                                contract the main thread's `fs.watch` callers used)
+ *   { op: 'unwatch', id }        close + forget the handle, then ack (see below)
+ *   { op: 'shutdown' }           stop processing; the main side terminates the worker, so the
+ *                                per-handle closes are NOT required at exit (§9 S-8: closes at
+ *                                exit are the ones the process reclaims for free)
+ * worker → main:
+ *   { op: 'event',   id, eventType, filename|null }  one raw fs.watch callback
+ *   { op: 'error',   id, code, message, sync?: true } sync:true = `fs.watch` threw synchronously
+ *                                (ENOENT and friends) — the owner must NOT schedule a reattach
+ *                                timer for those, matching its old synchronous try/catch
+ *   { op: 'unwatched', id }      the handle is closed; the main thread's close() already returned
+ *
+ * The filename is stringified (or null) so it survives structured clone.
+ */
+const fs = require('node:fs');
+const { parentPort } = require('node:worker_threads');
+
+const handles = new Map(); // id -> fs.FSWatcher
+let shuttingDown = false;
+
+function post(message) {
+  if (!parentPort) return;
+  try {
+    parentPort.postMessage(message);
+  } catch {
+    /* expected: the port is already closed when the main thread tears this worker down */
+  }
+}
+
+function errorFields(error) {
+  return {
+    code: (error && error.code) || '',
+    message: (error && error.message) || String(error),
+  };
+}
+
+function attach(id, dir) {
+  if (handles.has(id)) return;
+  let handle;
+  try {
+    handle = fs.watch(dir, { persistent: false }, (eventType, filename) => {
+      post({ op: 'event', id, eventType, filename: filename == null ? null : String(filename) });
+    });
+  } catch (error) {
+    post({ op: 'error', id, sync: true, ...errorFields(error) });
+    return;
+  }
+  // F-2 (clock-free tests r3): a synchronous try/catch is NOT an 'error' listener. libuv
+  // broadcasts one FSEventStreamStart failure (UV_EMFILE) to EVERY watcher in the loop, on the
+  // async path — without this listener the EventEmitter would throw out of the callback.
+  handle.on('error', (error) => {
+    handles.delete(id);
+    try {
+      handle.close();
+    } catch {
+      /* expected: an already-errored FSWatcher may throw again on close */
+    }
+    post({ op: 'error', id, ...errorFields(error) });
+  });
+  handles.set(id, handle);
+}
+
+function detach(id) {
+  const handle = handles.get(id);
+  if (handle) {
+    handles.delete(id);
+    try {
+      handle.close();
+    } catch {
+      /* expected: a handle whose 'error' listener already closed it may throw on the second close */
+    }
+  }
+  post({ op: 'unwatched', id });
+}
+
+function onMessage(message) {
+  if (shuttingDown || !message || typeof message !== 'object') return;
+  if (message.op === 'watch') attach(Number(message.id), String(message.dir));
+  else if (message.op === 'unwatch') detach(Number(message.id));
+  else if (message.op === 'shutdown') shuttingDown = true;
+}
+
+if (parentPort) parentPort.on('message', onMessage);
+
+module.exports = { onMessage };

package/template/coding-task-manager/workers/worktree-worker.js

@@ -1,8 +1,10 @@
 'use strict';
 
-const { parentPort } = require('node:worker_threads');
+const { parentPort, isMainThread } = require('node:worker_threads');
 const fs = require('node:fs');
 const path = require('node:path');
+const { setTimeout: sleepPromise } = require('node:timers/promises');
+const { boolFlag, registerFlag } = require('../lib/env-flags');
 const gitUtils = require('../git-utils');
 const createWorktreeGitObservation = require('../lib/worktree-git-observation');
 const branchInventory = require('../lib/branch-inventory');
@@ -23,7 +25,39 @@ let closing = false;
 let enqueued = 0;
 let completed = 0;
 let failed = 0;
-const queue = [];
+let dropped = 0;
+
+// D-1 (docs/session-create-box-restart-and-git-lane-starvation-2026-10-30.html §5, §6.1):
+// the serial git lane serves the waiting human first. An op a human is blocked on is
+// "interactive"; everything else is "background". The class is decided HERE, from a static
+// table, never by the caller — callers already disagree about budgets (the review registry
+// allows 10 s per statusV2, the create flow 10 min + 30 s), so a caller-set priority drifts.
+const INTERACTIVE_OPS = new Set([
+  'createWorktree', 'removeWorktree', 'finishWorktree', 'mergeWorktree', 'deleteBranch',
+  'recoverWorktree', 'syncWorktree', 'pushAndCreatePR', 'projectRows', 'scanRoots',
+  'resolveFileReference', 'lsTree', 'resolveRef', 'getBranch',
+]);
+// Every other op in runOp's switch, explicitly acknowledged as background. The coverage test
+// (tests/worktree-worker-queue.test.js, AC-1c) parses runOp's `case` labels and fails on a
+// label that is in neither set (or in both), so a new op cannot be added unclassified.
+const BACKGROUND_OPS_ACK = new Set([
+  'listRichWorktrees', 'mainSha', 'resolveSyncTarget', 'repoFacts', 'statusV2', 'observeWorktree',
+  'listWorktrees', 'gitRemoteKeys', 'richWorktreeStatusForPath', 'gatherGitFacts',
+  'listReviewDocuments', 'findHtmlInWorktrees', 'getUnmergedCommitList', 'pruneGhosts',
+  'syncAllWorktrees', 'resolveMainBranch', 'getDefaultReviewBase', 'getDefaultDiffStat',
+  'getDiffStat', 'getDiffStatVsRef', 'bestOfDiff', 'untrackedDiff', 'untrackedCount',
+  '__testSleep', // test-only op — see runOp's case; unreachable outside the test env gate
+]);
+
+function opClass(op, payload = {}) {
+  // Test-only: the queue tests need both classes out of one op name (`__testSleep`).
+  if (op === '__testSleep' && payload?.interactive === true) return 'interactive';
+  return INTERACTIVE_OPS.has(op) ? 'interactive' : 'background';
+}
+
+// D-1: two FIFO queues, drained interactive-first. One lane, so there is no preemption and the
+// worst case for a human op is the one op already running (P-3).
+const queues = { interactive: [], background: [] };
 const { observeWorktree } = createWorktreeGitObservation({
   git: (cwd, args, options = {}) => gitUtils.git(cwd, args, { ...options, env: gitUtils._gitProbeEnv() }),
   gitStrict: (cwd, args, options = {}) => gitUtils.gitStrict(cwd, args, { ...options, env: gitUtils._gitProbeEnv() }),
@@ -47,13 +81,60 @@ function serializeError(error) {
   };
 }
 
+function unsupportedOpError(op) {
+  const error = new Error(`Unsupported worktree worker op: ${op}`);
+  error.code = 'CTM_WORKTREE_OP_UNSUPPORTED';
+  return error;
+}
+
+// D-2a: the one shape a task that will never run is answered with. The client deletes its
+// pending entry BEFORE it posts `cancel` (lib/worktree-worker-client.js:99-104,117), so this
+// answer is simply ignored there; it exists for a caller that is still waiting.
+function cancelledError() {
+  return Object.assign(new Error('Worktree worker request cancelled'), {
+    code: 'CTM_WORKTREE_WORKER_CANCELLED',
+    cancelled: true,
+  });
+}
+
+// Test-only op body (see runOp's `__testSleep` case): a sleep that honours the task's signal.
+async function sleepHonoringSignal(ms, signal) {
+  if (signal?.aborted) throw cancelledError();
+  try {
+    await sleepPromise(Math.max(0, Number(ms) || 0), undefined, { signal });
+  } catch (err) {
+    if (err?.name === 'AbortError') throw cancelledError();
+    throw err;
+  }
+}
+
+registerFlag('CTM_WORKTREE_WORKER_TEST_OPS', {
+  kind: 'bool',
+  default: false,
+  desc: 'Test-only: enable the __testSleep fake op in the worktree worker so the queue tests '
+    + 'drive workers/worktree-worker.js without git. Requires NODE_ENV=test as well; never set outside tests.',
+  expires: null,
+});
+
+function testOpsEnabled() {
+  return process.env.NODE_ENV === 'test' && boolFlag('CTM_WORKTREE_WORKER_TEST_OPS', false);
+}
+
 function status() {
+  const heads = [queues.interactive[0], queues.background[0]].filter(Boolean);
   return {
     active: activeTask?.op || '',
-    queued: queue.length,
+    activeClass: activeTask?.taskClass || '',
+    queued: queues.interactive.length + queues.background.length,
+    queuedInteractive: queues.interactive.length,
+    queuedBackground: queues.background.length,
+    oldestQueuedMs: heads.length
+      ? Math.max(0, Date.now() - Math.min(...heads.map(task => task.enqueuedAt)))
+      : 0,
     enqueued,
     completed,
     failed,
+    dropped,
     errors: errorSink.snapshot(),
     ...gitUtils._getGitProbeMetrics(),
   };
@@ -358,18 +439,32 @@ async function runOp(op, payload = {}, context = {}) {
       return untrackedDiffer.untrackedDiff(cwd, payload || {});
     case 'untrackedCount':
       return { total: (await untrackedDiffer.listUntracked(cwd)).length };
-    default: {
-      const error = new Error(`Unsupported worktree worker op: ${op}`);
-      error.code = 'CTM_WORKTREE_OP_UNSUPPORTED';
-      throw error;
+    case '__testSleep': {
+      // Test-only (tests/worktree-worker-queue.test.js AC-0a..c/AC-1a/AC-1b/meta): drives the
+      // real queue of THIS file without touching git. Off unless NODE_ENV=test and
+      // CTM_WORKTREE_WORKER_TEST_OPS=1, where the op is otherwise unsupported.
+      if (!testOpsEnabled()) throw unsupportedOpError(op);
+      context.emitProgress?.({ stage: 'test-start', tag: payload.tag });
+      await sleepHonoringSignal(payload.ms, context.signal);
+      return { tag: payload.tag };
     }
+    default:
+      throw unsupportedOpError(op);
   }
 }
 
 function pump() {
   if (activeTask || closing) return;
-  const task = queue.shift();
-  if (!task) return;
+  // D-1: the oldest interactive task first, otherwise the oldest background one (FIFO within a
+  // class). D-2b: a task whose signal already aborted never starts — it is answered like a
+  // cancel and skipped, so a dropped caller never costs the lane real work.
+  let task;
+  for (;;) {
+    task = queues.interactive.shift() || queues.background.shift();
+    if (!task) return;
+    if (!task.controller.signal.aborted) break;
+    answerCancelled(task);
+  }
   activeTask = task;
   try { parentPort.postMessage({ type: 'status', status: status() }); } catch (_) {}
   const emitProgress = (event) => {
@@ -391,9 +486,32 @@ function pump() {
     });
 }
 
+// D-2a: a queued task leaves its queue the moment its caller stops waiting (splice by index,
+// O(queue)); the caller is answered now instead of at the front of a lane it no longer wants.
+function findQueued(requestId) {
+  for (const name of ['interactive', 'background']) {
+    const index = queues[name].findIndex(candidate => candidate.requestId === requestId);
+    if (index !== -1) return { name, index };
+  }
+  return null;
+}
+
+function answerCancelled(task) {
+  dropped += 1;
+  try {
+    parentPort.postMessage({
+      type: 'response',
+      requestId: task.requestId,
+      error: serializeError(cancelledError()),
+      status: status(),
+    });
+  } catch (_) { /* expected: the parent port is already closed during shutdown */ }
+}
+
 function closeWhenIdle() {
   closing = true;
-  queue.length = 0;
+  queues.interactive.length = 0;
+  queues.background.length = 0;
   if (activeTask) {
     setTimeout(closeWhenIdle, 10).unref?.();
     return;
@@ -402,27 +520,44 @@ function closeWhenIdle() {
   setImmediate(() => parentPort.close());
 }
 
-parentPort.on('message', (message) => {
-  if (!message || typeof message !== 'object') return;
-  if (message.type === 'request') {
-    enqueued += 1;
-    queue.push({
-      requestId: message.requestId,
-      op: message.op,
-      payload: message.payload || {},
-      controller: new AbortController(),
-    });
-    pump();
-  } else if (message.type === 'cancel') {
-    const task = activeTask?.requestId === message.requestId
-      ? activeTask
-      : queue.find(candidate => candidate.requestId === message.requestId);
-    try { task?.controller.abort(); } catch (_) {}
-  } else if (message.type === 'status') {
-    parentPort.postMessage({ type: 'status', status: status() });
-  } else if (message.type === 'close') {
-    closeWhenIdle();
-  }
-});
+if (!isMainThread) {
+  parentPort.on('message', (message) => {
+    if (!message || typeof message !== 'object') return;
+    if (message.type === 'request') {
+      enqueued += 1;
+      const task = {
+        requestId: message.requestId,
+        op: message.op,
+        payload: message.payload || {},
+        controller: new AbortController(),
+        enqueuedAt: Date.now(),
+      };
+      task.taskClass = opClass(task.op, task.payload);
+      queues[task.taskClass].push(task);
+      pump();
+    } else if (message.type === 'cancel') {
+      // D-2c: cancelling the RUNNING task only aborts its controller. The lane is not freed
+      // early — the next task starts when this one settles.
+      if (activeTask?.requestId === message.requestId) {
+        try { activeTask.controller.abort(); } catch (_) {}
+        return;
+      }
+      // D-2a: a QUEUED task is removed and answered at once.
+      const queued = findQueued(message.requestId);
+      if (!queued) return;
+      const [task] = queues[queued.name].splice(queued.index, 1);
+      answerCancelled(task);
+    } else if (message.type === 'status') {
+      parentPort.postMessage({ type: 'status', status: status() });
+    } else if (message.type === 'close') {
+      closeWhenIdle();
+    }
+  });
+
+  parentPort.postMessage({ type: 'ready', status: status() });
+}
 
-parentPort.postMessage({ type: 'ready', status: status() });
+// The queue tests (tests/worktree-worker-queue.test.js, AC-1c) require this module from the
+// main thread to check runOp's `case` labels against the classification tables; loaded as a
+// worker thread this export is inert.
+module.exports = { INTERACTIVE_OPS, BACKGROUND_OPS_ACK, opClass };

package/template/ctm-relay/lib/protocol.js

@@ -11,7 +11,13 @@ const { EventEmitter } = require('node:events');
 const TYPE = Object.freeze({
   HELLO: 0x01, // client->relay once after upgrade; payload JSON {v:1, client:'cli', version, caps:{enc:[]}}
   READY: 0x02, // relay->client; payload JSON {tunnel_id, slug, hostname, quota:{bytes_30d, used_30d, reset_at}}
-  OPEN: 0x03, // relay->client; payload JSON {kind:'http'|'upgrade', method, url, headers:{...}, remote:'1.2.3.4'}
+  // OPEN 0x03 is relay->client; payload JSON. Rev 2 has one kind:
+  //   { kind: 'tls', sni: 'mac.r.walle.sh', alpn: ['h2','http/1.1'] | [], remote: '203.0.113.7', remote_port: 51234 }
+  // The first DATA frames carry the buffered ClientHello bytes verbatim; then the
+  // rest of the TCP stream. Rev 1's 'http' and 'upgrade' kinds are removed by
+  // WP-11 (relay edge) / WP-14 (box terminator); a receiver RSTs any kind outside
+  // OPEN_KINDS with {code:'client_error'}.
+  OPEN: 0x03,
   HEAD: 0x04, // client->relay; payload JSON {status, headers:{...}}  (first frame of every response)
   DATA: 0x05, // either direction; payload = raw bytes
   END: 0x06, // either direction; half-close (no more DATA from the sender)
@@ -26,6 +32,12 @@ const TYPE = Object.freeze({
   // the frame and count it in stats().reservedFrames.
 });
 
+// Kinds an OPEN frame may carry. Rev 2 has exactly one ('tls'); WP-11 (relay
+// edge) and WP-14 (box terminator) delete rev 1's 'http'/'upgrade' paths and
+// reduce this list to ['tls'] in the same pass. Until then every kind here is
+// accepted, and a receiver RSTs anything else with {code:'client_error'}.
+const OPEN_KINDS = Object.freeze(['tls', 'http', 'upgrade']);
+
 const INITIAL_WINDOW = 256 * 1024; // DATA bytes in flight per stream before WINDOW is required
 const MAX_FRAME = 64 * 1024; // max DATA payload per frame; the encoder splits larger writes
 const MAX_STREAMS_PER_TUNNEL = 512; // the 513th concurrent OPEN is RST {code:'client_error'} and NOT created
@@ -496,6 +508,7 @@ function createMux(transport, options = {}) {
 
 module.exports = {
   TYPE,
+  OPEN_KINDS,
   INITIAL_WINDOW,
   MAX_FRAME,
   MAX_STREAMS_PER_TUNNEL,

package/template/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "walle",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "walle",
-      "version": "0.10.2",
+      "version": "0.10.3",
       "hasInstallScript": true,
       "dependencies": {
         "pg": "^8.22.0"

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "walle",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "description": "Wall-E — your personal digital twin",
   "walleRuntime": {

package/template/shared/backup-retention.js

@@ -0,0 +1,82 @@
+'use strict';
+
+// Backup retention policy shared by CTM (db.js cleanOldBackups) and Wall-E (brain.js
+// cleanOldBackups). Design: coding-task-manager/docs/backup-retention-days-setting-2026-10-31.html
+// §5 R-1..R-6, §6.
+//
+// Policy (R-1): group backups by the UTC date of `createdAt` and keep EVERY backup whose day is
+// among the N most recent days that have a backup. Days without a backup do not count (Borg /
+// Proxmox keep-daily semantics), so downtime never empties the window and no count floor is
+// needed. The UTC date matches the day key both daily schedulers already use
+// (`new Date().toISOString().slice(0, 10)`).
+//
+// Pure: no fs, no clock. Callers list their own backups and delete the expired rows as a set.
+
+const DEFAULT_BACKUP_RETENTION_DAYS = 3;
+const MIN_BACKUP_RETENTION_DAYS = 1;
+const MAX_BACKUP_RETENTION_DAYS = 365;
+const BACKUP_RETENTION_SETTING_KEY = 'backup_retention_days';
+
+function _inRange(n) {
+  return Number.isInteger(n) && n >= MIN_BACKUP_RETENTION_DAYS && n <= MAX_BACKUP_RETENTION_DAYS;
+}
+
+/** Read path (R-5): any stored value -> integer in [1,365]; anything invalid -> the default. Never throws. */
+function normalizeRetentionDays(value) {
+  let n = NaN;
+  if (typeof value === 'number') n = value;
+  else if (typeof value === 'string' && /^\d+$/.test(value.trim())) n = Number(value.trim());
+  return _inRange(n) ? n : DEFAULT_BACKUP_RETENTION_DAYS;
+}
+
+/** Write path (R-6): strict. A missing, fractional, padded or out-of-range value is rejected, never defaulted. */
+function parseRetentionDaysInput(value) {
+  let n = NaN;
+  if (typeof value === 'number') n = value;
+  else if (typeof value === 'string' && /^\d+$/.test(value)) n = Number(value);
+  if (_inRange(n)) return { ok: true, days: n };
+  return {
+    ok: false,
+    error: 'retention_days_invalid',
+    min: MIN_BACKUP_RETENTION_DAYS,
+    max: MAX_BACKUP_RETENTION_DAYS,
+  };
+}
+
+function _utcDayKey(createdAt) {
+  if (createdAt === null || createdAt === undefined || createdAt === '') return null;
+  const ms = createdAt instanceof Date ? createdAt.getTime() : new Date(createdAt).getTime();
+  if (!Number.isFinite(ms)) return null;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+/**
+ * R-1..R-3. Returns the EXPIRED rows (same object references), newest first. Rows whose
+ * createdAt does not parse are never expired and do not consume a day slot. The input array
+ * is not mutated.
+ * @param {Array<{name: string, createdAt: string|number|Date}>} backups
+ * @param {*} days retention days (normalized; invalid -> default)
+ */
+function selectExpiredBackups(backups, days) {
+  const keepDays = normalizeRetentionDays(days);
+  const dated = [];
+  for (const row of Array.isArray(backups) ? backups : []) {
+    const day = _utcDayKey(row && row.createdAt);
+    if (day) dated.push({ row, day, ms: new Date(row.createdAt instanceof Date ? row.createdAt.getTime() : row.createdAt).getTime() });
+  }
+  const keptDays = new Set([...new Set(dated.map((d) => d.day))].sort().reverse().slice(0, keepDays));
+  return dated
+    .filter((d) => !keptDays.has(d.day))
+    .sort((a, b) => b.ms - a.ms)
+    .map((d) => d.row);
+}
+
+module.exports = {
+  DEFAULT_BACKUP_RETENTION_DAYS,
+  MIN_BACKUP_RETENTION_DAYS,
+  MAX_BACKUP_RETENTION_DAYS,
+  BACKUP_RETENTION_SETTING_KEY,
+  normalizeRetentionDays,
+  parseRetentionDaysInput,
+  selectExpiredBackups,
+};

package/template/shared/conversation-admission.js

@@ -59,6 +59,8 @@ const PROVIDER_ALIASES = Object.freeze({
   anthropic: 'claude',
   claude: 'claude',
   'claude-desktop': 'claude',
+  // DeepSeek Harness: CTM writes its transcript as Claude-shaped rows (deepseek-harness-acp-agent-2026-10-28.html D-8).
+  dsh: 'claude',
   openai: 'openai',
   codex: 'openai',
   gemini: 'gemini',

package/template/shared/conversation-provenance.js

@@ -80,12 +80,8 @@ const PEER_RELAY_PREFIX_RE = /^(Another Claude session sent a message:|<agent-me
 // tool tags, task-notification summaries, system-reminder blocks wherever
 // they appear -- user text AND tool_result previews).
 const SYSTEM_REMINDER_RE = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
-// Corrected 2026-09-27 (WP-3 live capture, fix round 1): a REAL pasted-content closing tag
-// repeats the `id` attribute -- `</pasted_content id="824e">`, not the bare `</pasted_content>`
-// this regex required (verified against a real bracketed-paste capture; the closing tag never
-// matched, so the whole envelope leaked through unstripped). `(?:\s[^>]*)?` accepts that
-// attribute (or any other) on the closing tag without requiring it.
-const PASTED_CONTENT_RE = /<pasted_content id="[^"]*">([\s\S]*?)<\/pasted_content(?:\s[^>]*)?>/g;
+// Paste-wrapper recognition moved to coding-task-manager/public/js/pasted-content.js, Claude
+// Code's strict rule (docs/hub-viewed-box-conv-freshness-and-paste-render-2026-10-31.html D-5).
 const IDE_SELECTION_RE = /<ide_selection>[\s\S]*?<\/ide_selection>/g;
 const TASK_NOTIFICATION_RE = /^<task-notification>([\s\S]*?)<\/task-notification>/i;
 const TASK_NOTIFICATION_SUMMARY_RE = /<summary>([\s\S]*?)<\/summary>/i;
@@ -291,7 +287,7 @@ module.exports = {
   claudeQueuedPromptEntry, userRowKind,
   PROVENANCE, classifyUserProvenance, ENVELOPES, BUILTIN_LOCAL_COMMANDS, parseCommandEcho, UNKNOWN_TAG_RE,
   COMMAND_ENVELOPE_RE, LOCAL_COMMAND_STDOUT_RE, PEER_RELAY_PREFIX_RE,
-  SYSTEM_REMINDER_RE, PASTED_CONTENT_RE, IDE_SELECTION_RE,
+  SYSTEM_REMINDER_RE, IDE_SELECTION_RE,
   TASK_NOTIFICATION_RE, TASK_NOTIFICATION_SUMMARY_RE,
   BASH_INPUT_RE, BASH_STDOUT_RE, BASH_STDERR_RE,
 };

package/template/shared/conversation-storage-v2-contract.js

@@ -96,6 +96,11 @@ const CTM_KNOWN_CONVERSATION_TABLES = Object.freeze(new Set([
   'conversation_projection_outbox_v2',
   'conversation_projection_deletes_v2', // v36 change-feed delete log: session_id/stable_key/timestamps, no text
   'conversation_store_epoch_v2', // v36 change-feed store epoch: one row, random token
+  // WP-5 replica clock (key + origin/seq + timestamps, no text), declared by migration v61; not
+  // content-bearing. conversation_vv/conversation_local_seq are the vector and seq allocator.
+  'conversation_item_clock',
+  'conversation_vv',
+  'conversation_local_seq',
   'conversation_storage_metrics_v2',
   'conversation_text_fts_v2',
   'conversation_events',

package/template/shared/linked-worktree.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// Is this code running from a LINKED git worktree (`git worktree add`, e.g. .claude/worktrees/<name>)?
+//
+// Why it exists (2026-10-31 incident): a delegated worker in a feature-branch worktree ran
+// `node -e "require('./server.js')"` with no CTM_DATA_DIR override. server.js booted against the
+// default data dir (~/.walle/data, the user's PRIMARY), and the branch's unmerged schema migration
+// (v59) ran on the live DB. main was at v58, so every primary respawn then died with SchemaAheadError.
+//
+// A primary install never runs from a linked worktree: the primary checkout is a plain clone (`.git` is
+// a directory) and an npm install has no `.git` at all. So "linked worktree" is a precise marker for
+// "unmerged branch code". The DB guards in coding-task-manager/db.js and wall-e/brain.js refuse the
+// primary data dir in that case, so a branch's migrations can only reach a live DB after they land on
+// main and ship, where every install applies them automatically at boot.
+//
+// Detection: walk up from `startDir` to the first `.git`. A linked worktree's `.git` is a FILE whose
+// `gitdir:` line points into `<repo>/.git/worktrees/<name>`. Memoized per start dir; sync fs, called
+// only on the (already sync) DB-open path.
+
+const fs = require('fs');
+const path = require('path');
+
+const _memo = new Map();
+
+function isLinkedWorktreeCheckout(startDir = __dirname) {
+  const key = path.resolve(startDir);
+  if (_memo.has(key)) return _memo.get(key);
+  let answer = false;
+  let dir = key;
+  for (;;) {
+    const gitPath = path.join(dir, '.git');
+    let stat = null;
+    try { stat = fs.statSync(gitPath); } catch { /* expected: no .git at this level -- keep walking up */ }
+    if (stat) {
+      if (stat.isFile()) {
+        let text = '';
+        try { text = fs.readFileSync(gitPath, 'utf8'); } catch { /* expected: unreadable .git file -- treat as not linked */ }
+        const match = /^gitdir:\s*(.+)$/m.exec(text);
+        answer = !!(match && /[\\/]worktrees[\\/][^\\/]+[\\/]?$/.test(match[1].trim()));
+      }
+      break;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  _memo.set(key, answer);
+  return answer;
+}
+
+module.exports = { isLinkedWorktreeCheckout };

package/template/shared/macos-fda-target.js

@@ -0,0 +1,57 @@
+'use strict';
+
+// macOS Full Disk Access (FDA) target identity — WHICH process identity the grant must name.
+//
+// macOS keys a TCC/FDA grant to the RESPONSIBLE process: for a launchd job that is the exec
+// launchd started, and its children inherit the grant. Neither CTM nor Wall-E runs out of an
+// app bundle on every host (the measured box runs both as
+// `~/.walle/notarized-node/bin/node`), so a hint that always names
+// `~/.walle/bundles/Coding Task Manager.app` points the user at a path that does not exist —
+// and a Homebrew `node` the user grants instead (System Settings lists it as "node" too) has a
+// different, versioned Cellar identity that never matches the running binary.
+//
+// So every FDA hint/reveal is computed from the RUNNING exec path. Pure + DI so the mapping is
+// unit-testable without a real macOS.
+//
+// Design: docs/signin-flow-restart-settle-and-fda-target-identity-2026-10-26.html §5 D-4..D-7.
+
+const fs = require('fs');
+const path = require('path');
+
+// `<X>.app/Contents/MacOS/<name>` — an app bundle's exec. Anything else is a plain binary.
+const APP_EXEC_RE = /^(.*\.app)\/Contents\/MacOS\/[^/]+$/;
+
+/**
+ * Map a running exec path to the identity an FDA grant must name.
+ *
+ * @param {string} execPath the running executable (process.execPath, or the Wall-E daemon exec)
+ * @param {{ realpathSync?: (p: string) => string, existsSync?: (p: string) => boolean }} [deps]
+ * @returns {{ kind: 'app'|'binary', path: string, displayName: string, exists: boolean }|null}
+ *   null when execPath is empty / not a string. An app exec maps to its `.app` directory; any
+ *   other exec maps to its realpath (the UNRESOLVED path when realpath throws). `exists` follows
+ *   existsSync on the resolved path (a throw reads as false).
+ */
+function fdaTargetForExec(execPath, { realpathSync = fs.realpathSync, existsSync = fs.existsSync } = {}) {
+  if (typeof execPath !== 'string' || execPath === '') return null;
+  const appMatch = APP_EXEC_RE.exec(execPath);
+  let kind;
+  let targetPath;
+  let displayName;
+  if (appMatch) {
+    kind = 'app';
+    targetPath = appMatch[1];
+    displayName = path.basename(targetPath, '.app');
+  } else {
+    kind = 'binary';
+    targetPath = execPath;
+    try { targetPath = realpathSync(targetPath); }
+    catch { /* expected: broken symlink / unreadable parent — the unresolved exec path is still the identity to name */ }
+    displayName = path.basename(targetPath);
+  }
+  let exists = false;
+  try { exists = !!existsSync(targetPath); }
+  catch { exists = false; /* expected: an unreadable parent is not "exists" — never reveal what we cannot confirm */ }
+  return { kind, path: targetPath, displayName, exists };
+}
+
+module.exports = { fdaTargetForExec };