create-walle 0.10.2 → 0.10.3

package/template/wall-e/brain.js

@@ -15,8 +15,12 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const { createMigrationRunner, pragmaVersionStore, MigrationFailedError } = require('./shared/db-migration-runner');
+const { removeSqliteFileSet } = require('./shared/sqlite-file-set');
+// Shared backup-retention policy (R-1..R-6): one pure module both CTM and Wall-E call.
+const backupRetention = require('../shared/backup-retention');
 const crypto = require('crypto');
 const { randomUUID: uuidv4 } = require('node:crypto');
+const { deterministicEntityId } = require('./brain/deterministic-id'); // WP-0 §5 D-4: cross-machine entity identity
 const { isMainThread, threadId } = require('node:worker_threads');
 const { EventEmitter } = require('events');
 const { createWriteAuditLog } = require('./db/write-audit');
@@ -107,6 +111,7 @@ function _isProtectedDevContext() {
   if (process.env.NODE_ENV === 'test') return 'NODE_ENV=test';
   if (/^test/.test(process.env.npm_lifecycle_event || '')) return 'npm_lifecycle_event';
   if ([...process.execArgv, ...process.argv.slice(1)].some((a) => a === '--test')) return 'node --test';
+  if (require('../shared/linked-worktree').isLinkedWorktreeCheckout(__dirname)) return 'linked git worktree (unmerged branch code)'; // 2026-10-31 v59 incident
   return null;
 }
 
@@ -365,6 +370,22 @@ function _resetCloneSensitiveCursors(d) {
   return reset;
 }
 
+// WP-0 (§5 D-4, §6.1): publish this host's own instance id to the v2 clock tables, so the
+// capture triggers can stamp an addressable (origin_instance_id, origin_seq) without a kv
+// lookup on every write (they read brain_local_identity, and fall back to '' — the v1
+// "this host" convention — until this row exists). Host-local by construction: the row is
+// never replicated and never part of a snapshot join (D-7). Runs after the identity step, so
+// the id it reads is the one this boot resolved.
+function _ensureBrainLocalClockIdentity(d) {
+  if (!_tableExists(d, 'brain_local_identity')) return;
+  const instanceId = require('./brain/brain-sync-store').localBrainInstanceId(d);
+  if (!instanceId) return;
+  d.prepare(`
+    INSERT INTO brain_local_identity (id, instance_id) VALUES (1, ?)
+    ON CONFLICT(id) DO UPDATE SET instance_id = excluded.instance_id
+  `).run(instanceId);
+}
+
 function _ensureBrainHostIdentity(d, dbPath) {
   const identityContext = _brainHostIdentityContext(dbPath);
   const dataDir = identityContext.dataDir;
@@ -546,6 +567,23 @@ function getBackupDirInfo() {
   };
 }
 
+function getBackupRetentionInfo() {
+  let stored = null;
+  try { if (db) stored = getKv(backupRetention.BACKUP_RETENTION_SETTING_KEY); } catch { /* expected: kv_store not yet migrated on a fresh/old brain — the default retention applies */ }
+  return {
+    retention_days: backupRetention.normalizeRetentionDays(stored),
+    default_retention_days: backupRetention.DEFAULT_BACKUP_RETENTION_DAYS,
+    min: backupRetention.MIN_BACKUP_RETENTION_DAYS,
+    max: backupRetention.MAX_BACKUP_RETENTION_DAYS,
+    source: (stored !== null && stored !== undefined && stored !== '') ? 'settings' : 'default',
+  };
+}
+
+function setBackupRetentionDays(days) {
+  setKv(backupRetention.BACKUP_RETENTION_SETTING_KEY, String(backupRetention.normalizeRetentionDays(days)));
+  return getBackupRetentionInfo();
+}
+
 function _applyPersistedBackupDirSetting() {
   try {
     if (!db) return;
@@ -1990,6 +2028,8 @@ function initDb(dbPath) {
       _bootSchemaVersion = Number(newDb.pragma('user_version', { simple: true }));
     }
     boot.measure('initDb.hostIdentity', () => _retryBusySync(() => _ensureBrainHostIdentity(newDb, dbPath), bootLockWaitMs));
+    // WP-0 §6.1: the v2 clock's copy of the identity this boot just resolved (host-local row).
+    boot.measure('initDb.brainLocalIdentity', () => _retryBusySync(() => _ensureBrainLocalClockIdentity(newDb), bootLockWaitMs));
     // R-6: a responder mode configured BEFORE the db was open (agent.js reads the config
     // ahead of initDb) lands AFTER the identity step — so explicit config overrides a
     // clone verdict made in this same boot, and the owner sees the row on its next read.
@@ -3016,37 +3056,115 @@ function _quickCheckBackupFile(filePath) {
   return _quickCheckFile(filePath);
 }
 
-async function createBackup(label) {
-  getDb(); // throws if not initialized
-  const backupDir = _backupDirForCurrentDb();
+// A backup runs for minutes, but shutdown forces the DB closed after 1 s and terminates the
+// process after 1.5 s (agent.js:2069-2070 via workers/brain-owner-worker.js:637-638), so a
+// backup killed mid-flight runs NO cleanup at all. The dot-name is invisible to listBackups()
+// and cleanOldBackups() (both filter on the non-dot `wall-e-brain-` prefix), so those strands
+// accumulated unseen — 6.6 GB observed on 2026-10-25. The owner pid in the name is the whole
+// ownership record: a dead pid's set is garbage no reader can use, and this process's own
+// leftovers are stale unless they are the caller's live tmpPath. Non-dot names are never touched.
+const STALE_BACKUP_TEMP_RE = /^\.wall-e-brain-.+\.db\.(\d+)\.tmp(-journal|-wal|-shm)?$/;
 
-  const timestamp = new Date().toISOString().replace(/:/g, '-');
-  const safeLabel = String(label || 'manual').replace(/[^a-z0-9_.-]+/gi, '-').replace(/^-+|-+$/g, '') || 'manual';
-  const backupName = `wall-e-brain-${timestamp}-${safeLabel}.db`;
-  const backupPath = path.join(backupDir, backupName);
-  const tmpPath = path.join(backupDir, `.${backupName}.${process.pid}.tmp`);
+// Temps this process is writing RIGHT NOW. createBackup registers its tmpPath here for the whole
+// write (added before the sweep, removed in a finally), so an overlapping createBackup in the same
+// process — ensureDailyBackup plus a prompt-purge or a manual backup — cannot sweep the other
+// call's live file: unlinking it would let better-sqlite3 keep copying into a dead inode and the
+// in-flight backup would then fail at its rename.
+const _inFlightBackupTemps = new Set();
 
-  if (!fs.existsSync(backupDir)) fs.mkdirSync(backupDir, { recursive: true });
-  fs.rmSync(tmpPath, { force: true });
+function _isProcessAliveByPid(pid) {
   try {
-    // Online incremental backup. better-sqlite3's db.backup() copies the database in
-    // page batches and YIELDS to the event loop between them (default 100 pages/batch),
-    // so a multi-GB brain never freezes the loop — unlike the old synchronous
-    // `VACUUM INTO`, which blocked for 30-120s. Like VACUUM INTO it reads a consistent
-    // snapshot via a read transaction and does not force a WAL checkpoint that would
-    // perturb peer processes; SQLite transparently re-copies any pages a peer writes
-    // mid-backup. The quick_check below validates the produced image before we keep it.
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM means the pid exists but is owned by another user — alive, not reclaimable.
+    return err && err.code === 'EPERM';
+  }
+}
+
+/** Reclaim dot-temps stranded in `backupDir` by an earlier backup run.
+ * `keepPath` (this call's own tmpPath) is exempted; everything else whose name carries a dead
+ * pid, or this process's pid, is unlinked. Returns the number of files removed. */
+function sweepStaleBackupTemps(backupDir, { keepPath = null, isProcessAlive } = {}) {
+  if (!backupDir || !fs.existsSync(backupDir)) return 0;
+  const alive = typeof isProcessAlive === 'function' ? isProcessAlive : _isProcessAliveByPid;
+  const keepBase = keepPath ? path.basename(keepPath) : null;
+  let removed = 0;
+  for (const name of fs.readdirSync(backupDir)) {
+    const match = STALE_BACKUP_TEMP_RE.exec(name);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    const base = name.slice(0, name.length - (match[2] || '').length);
+    if (pid === process.pid) {
+      // This process's own temps: never unlink `keepPath`, and never unlink a temp another
+      // createBackup call in this process is still writing (see _inFlightBackupTemps).
+      if (keepBase !== null && base === keepBase) continue;
+      if (_inFlightBackupTemps.has(path.resolve(backupDir, base))) continue;
+    } else if (alive(pid)) {
+      continue; // a live peer may still be writing it
+    }
+    try {
+      fs.unlinkSync(path.join(backupDir, name));
+      removed += 1;
+    } catch (err) {
+      if (err && err.code === 'ENOENT') continue; // HANDLE: a peer swept the same temp first
+      throw err; // RETHROW: a real unlink failure must not be swallowed
+    }
+  }
+  return removed;
+}
+
+// WP-4 (§5 D-6, §6.7 P-1): the consistent-snapshot primitive shared by the daily/manual backup
+// and the join snapshot route. Copies the LIVE brain to `destPath` through better-sqlite3's online
+// backup API — page batches that yield to the event loop (default 100 pages/batch), so a multi-GB
+// brain never freezes the loop, unlike the old synchronous `VACUUM INTO` (30-120s blocked). Like
+// VACUUM INTO it reads a consistent snapshot via a read transaction and does not force a WAL
+// checkpoint that would perturb peer processes; SQLite transparently re-copies any pages a peer
+// writes mid-backup. The image is written to a dot-temp beside the destination and validated with
+// quick_check before it is renamed into place, so a killed run strands a dot-temp (reclaimed by
+// sweepStaleBackupTemps), never a half-written snapshot. Returns { path }.
+async function createConsistentSnapshot(destPath) {
+  getDb(); // throws if not initialized
+  const dest = path.resolve(destPath);
+  const dir = path.dirname(dest);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const tmpPath = path.join(dir, `.${path.basename(dest)}.${process.pid}.tmp`);
+
+  // Claim this tmpPath before anything touches the dir: the sweep below (and any overlapping
+  // snapshot's own sweep) must skip a temp this process is still writing.
+  _inFlightBackupTemps.add(path.resolve(tmpPath));
+  try {
+    // Reclaim anything an earlier run stranded here BEFORE writing: a temp left by a killed run
+    // is the leak this exists for (D-6), and this run's own tmpPath is removed either way.
+    sweepStaleBackupTemps(dir, { keepPath: null });
+    removeSqliteFileSet(tmpPath);
     await getDb().backup(tmpPath);
     const check = _quickCheckBackupFile(tmpPath);
     if (!check.ok) {
       throw new Error(`backup quick_check failed: ${check.error}`);
     }
-    fs.renameSync(tmpPath, backupPath);
+    fs.renameSync(tmpPath, dest);
   } catch (err) {
-    try { fs.rmSync(tmpPath, { force: true }); } catch { /* expected: tmp backup never materialised when getDb().backup() failed before writing; the backup error is rethrown */ }
+    try { removeSqliteFileSet(tmpPath); } catch { /* expected: tmp snapshot never materialised when getDb().backup() failed before writing; the snapshot error is rethrown */ }
     throw err;
+  } finally {
+    _inFlightBackupTemps.delete(path.resolve(tmpPath));
   }
 
+  return { path: dest };
+}
+
+async function createBackup(label) {
+  getDb(); // throws if not initialized
+  const backupDir = _backupDirForCurrentDb();
+
+  const timestamp = new Date().toISOString().replace(/:/g, '-');
+  const safeLabel = String(label || 'manual').replace(/[^a-z0-9_.-]+/gi, '-').replace(/^-+|-+$/g, '') || 'manual';
+  const backupName = `wall-e-brain-${timestamp}-${safeLabel}.db`;
+  const backupPath = path.join(backupDir, backupName);
+
+  await createConsistentSnapshot(backupPath);
+
   cleanOldBackups(backupDir);
 
   return { backupName, backupPath, timestamp };
@@ -3065,8 +3183,8 @@ function listBackups() {
 }
 
 function deleteBackup(backupName) {
-  const p = path.join(_backupDirForCurrentDb(), path.basename(backupName));
-  if (fs.existsSync(p)) fs.unlinkSync(p);
+  // The whole file set goes: a kept `-wal`/`-shm` beside a deleted base is an unreadable orphan.
+  removeSqliteFileSet(path.join(_backupDirForCurrentDb(), path.basename(backupName)));
 }
 
 function _assertPromptPurgeBackupInventoryIsLocal() {
@@ -3142,17 +3260,18 @@ function restoreAndVerifyPromptPurgeBackupAbsent(baseline = {}, closure = {}) {
 
 function cleanOldBackups(backupDir = BACKUP_DIR) {
   if (!fs.existsSync(backupDir)) return;
-  const files = fs.readdirSync(backupDir);
-  const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
-
-  // Always keep at least 3
-  const brainFiles = files.filter(f => f.startsWith('wall-e-brain-') && f.endsWith('.db')).sort().reverse();
-  for (const file of brainFiles.slice(3)) {
-    const filePath = path.join(backupDir, file);
-    const stat = fs.statSync(filePath);
-    if (stat.mtimeMs < cutoff) {
-      fs.unlinkSync(filePath);
-    }
+  const rows = [];
+  for (const name of fs.readdirSync(backupDir)) {
+    // Non-dot `wall-e-brain-*.db` only, the same filter listBackups() uses (dot names are -tmp).
+    if (!name.startsWith('wall-e-brain-') || !name.endsWith('.db')) continue;
+    try {
+      rows.push({ name, createdAt: fs.statSync(path.join(backupDir, name)).mtime });
+    } catch { /* expected: the base vanished between readdir and stat — a concurrent backup/delete; a missing row is simply not a prune candidate */ }
+  }
+  const days = getBackupRetentionInfo().retention_days;
+  // R-1..R-3: keep EVERY backup from the N most recent UTC days that have one; remove the rest as a set.
+  for (const row of backupRetention.selectExpiredBackups(rows, days)) {
+    removeSqliteFileSet(path.join(backupDir, row.name));
   }
 }
 
@@ -3232,11 +3351,21 @@ function updatePerson(id, updates) {
 function insertEntity({ canonical_name, entity_type, aliases, properties }) {
   if (!canonical_name) throw new Error('Entity requires canonical_name');
   if (!entity_type) throw new Error('Entity requires entity_type');
-  const id = uuidv4();
-  getDb().prepare(`
-    INSERT INTO entities (id, canonical_name, entity_type, aliases, properties)
+  // WP-0 (§5 D-4): the id is derived from (lower(canonical_name), entity_type) — the same
+  // entity extracted on two machines is the same row, and two spellings that differ only in
+  // case are the same entity by construction. INSERT OR IGNORE makes the second insert a
+  // no-op instead of a primary-key violation; the caller still gets the id of the live row.
+  const id = deterministicEntityId(canonical_name, entity_type);
+  const result = getDb().prepare(`
+    INSERT OR IGNORE INTO entities (id, canonical_name, entity_type, aliases, properties)
     VALUES (?, ?, ?, ?, ?)
   `).run(id, canonical_name, entity_type, aliases || null, properties || null);
+  if (result.changes === 0) {
+    // The row is already there (this id, or a pre-WP-0 row that normalized to it). Returning
+    // silently keeps the write log honest: nothing was inserted.
+    const existing = getEntity(id) || findEntity(canonical_name);
+    return { id: existing ? existing.id : id };
+  }
   logWrite('insert', 'entities', { id, subject: canonical_name, category: entity_type });
   return { id };
 }
@@ -5187,6 +5316,8 @@ module.exports = {
   get BACKUP_DIR() { return _backupDirForCurrentDb(); },
   getBackupDirInfo,
   setBackupDir,
+  getBackupRetentionInfo,
+  setBackupRetentionDays,
   // Owner
   setOwner,
   getOwner,
@@ -5369,6 +5500,8 @@ module.exports = {
   // Backup
   checkpointWalOrThrow,
   createBackup,
+  createConsistentSnapshot,
+  sweepStaleBackupTemps,
   listBackups,
   deleteBackup,
   listPromptPurgeBackupVersions,
@@ -5575,6 +5708,9 @@ module.exports = {
   // underscore-prefixed, individual top-level exports.
   __testing: {
     _isProtectedDevContext, // WP-18: widened live-brain guard trigger, unit-tested directly
+    // WP-2 (backup-retention-days): the prune is internal to createBackup; the retention tests
+    // drive it directly against a real temp backup dir (the production call site is brain.js itself).
+    cleanOldBackups,
     __wp7RunMigration54ForTest: MIGRATIONS[54], // D-9 rule-host hygiene, WP-7
     __wp2RunMigration23ForTest: MIGRATIONS[23], // rerunSafe:false both-ways proof, WP-2 db-migration-consolidation
     __wp3RunMigration58ForTest: MIGRATIONS[58], // rerunSafe:false both-ways proof, WP-3 db-migration-consolidation

package/template/wall-e/chat.js

@@ -2302,9 +2302,9 @@ async function chatUnaccounted(message, opts = {}) {
     }
   } catch (error) { errorSink.report('chat', 'user-signal-evaluation', error); }
 
-  // Configure permission checker with CTM connection if available
-  const ctmPort = process.env.CTM_PORT || require('./lib/ctm-endpoint').ctmPort();
-  configurePermissions({ ctmUrl: `http://localhost:${ctmPort}`, ctmToken: process.env.CTM_TOKEN });
+  // Configure permission checker with CTM connection if available (R-7: shared resolver;
+  // WALLE_CTM_API=0 disables the bridge and an explicit base URL still wins).
+  configurePermissions({ ctmUrl: ctmContextClient.resolveApiBaseUrl(process.env) || null, ctmToken: process.env.CTM_TOKEN });
 
   let totalInputTokens = 0;
   let totalOutputTokens = 0;

package/template/wall-e/coding/agent-shell-env.js

@@ -47,10 +47,15 @@ function prepareClaudeAgentShellEnv(overrides = {}, { baseEnv = process.env, tmp
   const inheritedPrefix = env.CLAUDE_CODE_SHELL_PREFIX || '';
   // Plugins add their bin directories after Claude starts. Its documented shell
   // prefix runs at the final Bash execution boundary, after that plugin setup.
+  // The re-exec'd text overrides `eval()` and calls `builtin` (bash/zsh, not POSIX
+  // sh), so it runs in the user's SHELL only when that is bash or zsh, else bash:
+  // /bin/sh is dash on Debian/Ubuntu ("Syntax error: Bad function name", nightly
+  // 2026-10-27), and a service-launched process commonly has SHELL=/bin/sh.
   fs.writeFileSync(wrapperFile, [
     '#!/bin/sh',
+    'case "${SHELL:-}" in */bash|*/zsh) WALLE_AGENT_EVAL_SHELL="$SHELL" ;; *) WALLE_AGENT_EVAL_SHELL=/bin/bash ;; esac',
     'if [ "${1:-}" = "--walle-run-original" ]; then',
-    `  exec "${'${SHELL:-/bin/sh}'}" -c ${shellQuote([
+    `  exec "$WALLE_AGENT_EVAL_SHELL" -c ${shellQuote([
       `export PATH=${shellQuote(walleBin)}:"$PATH"`,
       `eval() { export PATH=${shellQuote(walleBin)}:"$PATH"; builtin eval "$@"; }`,
       'builtin eval "$WALLE_CLAUDE_ORIGINAL_COMMAND"',
@@ -59,7 +64,7 @@ function prepareClaudeAgentShellEnv(overrides = {}, { baseEnv = process.env, tmp
     '[ "$#" -eq 1 ] || exit 64',
     'export WALLE_CLAUDE_ORIGINAL_COMMAND="$1"',
     'if [ -n "${WALLE_INHERITED_CLAUDE_SHELL_PREFIX:-}" ]; then',
-    `  exec "${'${SHELL:-/bin/sh}'}" -c ${shellQuote('builtin eval "$WALLE_INHERITED_CLAUDE_SHELL_PREFIX \\"$1\\""')} walle-shell-prefix ${shellQuote(`${wrapperFile} --walle-run-original`)}`,
+    `  exec "$WALLE_AGENT_EVAL_SHELL" -c ${shellQuote('builtin eval "$WALLE_INHERITED_CLAUDE_SHELL_PREFIX \\"$1\\""')} walle-shell-prefix ${shellQuote(`${wrapperFile} --walle-run-original`)}`,
     'fi',
     `exec ${shellQuote(wrapperFile)} --walle-run-original`,
     '',

package/template/wall-e/coding/prompt-bundle.js

@@ -89,53 +89,69 @@ function fitProjectInstructions(instructions, budgetBytes = PROJECT_INSTRUCTION_
   for (const input of instructions || []) {
     if (remaining <= 0) break;
     if (!input?.content) continue;
+    const ordinal = fitted.length + 1;
     if (input.renderedContent) {
-      const emittedBytes = Buffer.byteLength(input.renderedContent, 'utf8');
-      if (emittedBytes > remaining) break;
-      fitted.push({ ...input, includedBytes: emittedBytes });
-      remaining -= emittedBytes;
-      continue;
+      // Already-fitted input (instruction-service hands its fitted frames back
+      // through here). Budget it on what rendering transmits, like any other
+      // frame; when it no longer fits the remaining cumulative budget, fall
+      // through and re-fit it rather than dropping the instruction.
+      const reused = measureTransmittedFrame(input.renderedContent, ordinal);
+      if (reused.bytes <= remaining && reused.intact) {
+        fitted.push({ ...input, includedBytes: reused.bytes });
+        remaining -= reused.bytes;
+        continue;
+      }
     }
-    const ordinal = fitted.length + 1;
     const neutralized = neutralizeInstructionFrameContent(input.content, ordinal);
-    const originalContentBytes = Buffer.byteLength(neutralized, 'utf8');
+    const contentBytes = Buffer.byteLength(neutralized, 'utf8');
+    // A re-fitted already-rendered input knows its own pre-truncation length:
+    // report that rather than the length of content an earlier fit cropped.
+    const declaredOriginalBytes = Math.floor(Number(input.originalContentBytes));
+    const originalContentBytes = Number.isFinite(declaredOriginalBytes) && declaredOriginalBytes > contentBytes
+      ? declaredOriginalBytes
+      : contentBytes;
     const sourceTruncated = Boolean(input.sourceTruncated || input.truncated);
     const full = buildProjectInstructionFrame(input, ordinal, neutralized, {
-      contentBytes: originalContentBytes,
+      contentBytes,
       originalContentBytes,
       truncated: sourceTruncated,
     });
-    const fullBytes = Buffer.byteLength(full, 'utf8');
-    if (fullBytes <= remaining) {
+    const fullTransmitted = measureTransmittedFrame(full, ordinal);
+    if (fullTransmitted.bytes <= remaining && fullTransmitted.intact) {
       fitted.push({
         ...input,
         content: neutralized,
-        contentBytes: originalContentBytes,
+        contentBytes,
         originalContentBytes,
-        includedBytes: fullBytes,
-        originalBytes: fullBytes,
+        includedBytes: fullTransmitted.bytes,
+        originalBytes: fullTransmitted.bytes,
         truncated: sourceTruncated,
         renderedContent: full,
       });
-      remaining -= fullBytes;
+      remaining -= fullTransmitted.bytes;
       continue;
     }
 
     let low = 0;
-    let high = Math.min(originalContentBytes, remaining);
+    let high = Math.min(contentBytes, remaining);
     let best = null;
     while (low <= high) {
       const target = Math.floor((low + high) / 2);
       const content = truncateUtf8(neutralized, target);
-      const contentBytes = Buffer.byteLength(content, 'utf8');
+      const candidateBytes = Buffer.byteLength(content, 'utf8');
       const renderedContent = buildProjectInstructionFrame(input, ordinal, content, {
-        contentBytes,
+        contentBytes: candidateBytes,
         originalContentBytes,
         truncated: true,
       });
-      const emittedBytes = Buffer.byteLength(renderedContent, 'utf8');
-      if (emittedBytes <= remaining) {
-        best = { content, contentBytes, renderedContent, emittedBytes };
+      // The transmitted cost is not monotone in `target` — a cut inside a
+      // redaction marker is re-expanded by the renderer — so this is a bounded
+      // search for *a* fitting prefix, never a proof that it is the largest.
+      // Correctness only needs the accepted candidate to fit, which is checked
+      // on the measured bytes below.
+      const measured = measureTransmittedFrame(renderedContent, ordinal);
+      if (measured.bytes <= remaining && measured.intact) {
+        best = { content, contentBytes: candidateBytes, renderedContent, emittedBytes: measured.bytes };
         low = target + 1;
       } else {
         high = target - 1;
@@ -148,7 +164,7 @@ function fitProjectInstructions(instructions, budgetBytes = PROJECT_INSTRUCTION_
       contentBytes: best.contentBytes,
       originalContentBytes,
       includedBytes: best.emittedBytes,
-      originalBytes: fullBytes,
+      originalBytes: fullTransmitted.bytes,
       truncated: true,
       renderedContent: best.renderedContent,
     });
@@ -157,6 +173,35 @@ function fitProjectInstructions(instructions, budgetBytes = PROJECT_INSTRUCTION_
   return fitted;
 }
 
+/**
+ * What a project-instruction frame costs *in transmission*.
+ *
+ * `renderPromptEnvelope` re-applies each section's `redactionPolicy` on the way
+ * out (prompt-runtime.js renders `redactPromptContent(section.content, policy)`
+ * and section-creation here sets `redactionPolicy: 'secrets'`), so the bytes a
+ * frame actually spends are those of `redactPromptContent(frame)`, not those of
+ * the frame this module stored. That second pass is not a no-op on a truncated
+ * frame:
+ *
+ *   - a cut inside a redaction marker leaves a fragment (`token=[REDAC`) that is
+ *     not recognised as already redacted and is re-expanded (+4 bytes), and
+ *   - a cut immediately after an assignment operator (`token=`) matches a value
+ *     across the following newline and swallows the frame's own `--- END …`
+ *     delimiter (secret-redaction.js's `\s*` crosses lines).
+ *
+ * Both are how a frame fitted to its pre-render byte count could be transmitted
+ * over budget or lose its framing, so the budget is enforced on this text and a
+ * candidate whose transmitted form has lost either delimiter is refused.
+ */
+function measureTransmittedFrame(frame, ordinal) {
+  const transmitted = redactPromptContent(frame, 'secrets');
+  return {
+    bytes: Buffer.byteLength(transmitted, 'utf8'),
+    intact: transmitted.startsWith(`--- BEGIN PROJECT INSTRUCTION ${ordinal} ---`)
+      && transmitted.endsWith(`--- END PROJECT INSTRUCTION ${ordinal} ---`),
+  };
+}
+
 function buildProjectInstructionFrame(item, ordinal, content, {
   contentBytes,
   originalContentBytes,

package/template/wall-e/config/main-loop-exemptions.json

@@ -7,10 +7,10 @@
       "function": "telemetry child-process route implementation",
       "capability": "isolated_telemetry_sync_io",
       "owner": "wall-e-runtime",
-      "reason": "These exact calls initialize and inspect the optional telemetry database after the daemon transfers telemetry and feedback requests to walle-telemetry-process. Re-reviewed 2026-10-14: handleWalleApi proxies daemon telemetry/feedback routes before local dispatch; TelemetryProcessClient forks telemetry-worker with the isolated role. The unchanged child implementation has exactly 3 synchronous filesystem sites (getTelemetryDb exists/mkdir and telemetryFileStats stat) and 1 SQLite import; direct DB and unbounded brain read allowances stay zero. The next review expires in 14 days; no allowance count was increased.",
+      "reason": "These exact calls initialize and inspect the optional telemetry database after the daemon transfers telemetry and feedback requests to walle-telemetry-process. Re-reviewed 2026-10-27: handleWalleApi still proxies daemon telemetry/feedback routes before local dispatch; TelemetryProcessClient forks telemetry-worker with the isolated role. The unchanged child implementation has exactly 3 synchronous filesystem sites (getTelemetryDb exists/mkdir and telemetryFileStats stat) and 1 SQLite import; direct DB and unbounded brain read allowances stay zero. The next review expires in 14 days; no allowance count was increased.",
       "max_duration_ms": 25,
       "telemetry": "telemetry_process.request",
-      "expires": "2026-10-28T00:00:00.000Z",
+      "expires": "2026-11-10T00:00:00.000Z",
       "allow": {
         "sync_io": 3,
         "direct_db": 0,

package/template/wall-e/http/admin-api.js

@@ -17,6 +17,8 @@
 // in http/.
 const path = require('path');
 const { jsonResponse, readBody } = require('./api-utils');
+// Shared backup-retention policy (R-1..R-6) — the same pure module brain.js prunes with.
+const backupRetention = require('../../shared/backup-retention');
 
 function handleAdminApi(req, res, url, deps) {
   const {
@@ -183,6 +185,41 @@ function handleAdminApi(req, res, url, deps) {
     return true;
   }
 
+  // GET /api/wall-e/storage/backup-retention — the retention window plus the backups it expires.
+  // Read-only: never deletes a file (the scheduler's cleanOldBackups owns deletion).
+  if (p === '/api/wall-e/storage/backup-retention' && m === 'GET') {
+    if (!brain) return jsonResponse(res, { error: 'Brain not available' }, 503), true;
+    (async () => {
+      try {
+        if (ensureBrainInit) ensureBrainInit();
+        const info = brain.getBackupRetentionInfo();
+        const dirInfo = typeof brain.getBackupDirInfo === 'function' ? brain.getBackupDirInfo() : {};
+        const rows = await listBackupFiles(dirInfo.backup_dir || brain.BACKUP_DIR);
+        jsonResponse(res, { data: { ...info, expiring: backupRetention.selectExpiredBackups(rows, info.retention_days).map((r) => r.name) } });
+      } catch (e) { jsonResponse(res, { error: e.message }, 500); }
+    })();
+    return true;
+  }
+
+  // PUT /api/wall-e/storage/backup-retention — persist a validated retention window (R-6).
+  if (p === '/api/wall-e/storage/backup-retention' && m === 'PUT') {
+    if (!brain || !ensureBrainInit()) return jsonResponse(res, { error: 'Brain not available' }, 503), true;
+    readBody(req, 32 * 1024)
+      .then(async (body) => {
+        const parsed = backupRetention.parseRetentionDaysInput(body.retention_days);
+        if (!parsed.ok) {
+          return jsonResponse(res, { error: 'retention_days_invalid', min: 1, max: 365 }, 400);
+        }
+        await writeBrain('setBackupRetentionDays', [parsed.days]);
+        const info = brain.getBackupRetentionInfo();
+        const dirInfo = typeof brain.getBackupDirInfo === 'function' ? brain.getBackupDirInfo() : {};
+        const rows = await listBackupFiles(dirInfo.backup_dir || brain.BACKUP_DIR);
+        jsonResponse(res, { data: { ...info, expiring: backupRetention.selectExpiredBackups(rows, info.retention_days).map((r) => r.name) } });
+      })
+      .catch((e) => jsonResponse(res, { error: e.message }, 400));
+    return true;
+  }
+
   // POST /api/wall-e/backups — create brain backup
   if (p === '/api/wall-e/backups' && m === 'POST') {
     if (!brain || !ensureBrainInit()) return jsonResponse(res, { error: 'Brain not available' }, 503), true;

package/template/wall-e/http/gws-api.js

@@ -427,6 +427,9 @@ async function buildIMessageStatus(brain, imessageCapabilitiesOverride) {
   return {
     dbPresent: imessage.dbPresent,
     fullDiskAccess: imessage.fullDiskAccess,
+    // signin-flow-restart-settle-and-fda-target-identity-2026-10-26 D-8: the exec the FDA grant
+    // must name, so the CTM banner can show the exact file (null on an older live-capabilities).
+    fdaTarget: imessage.fdaTarget || null,
     lastIngestAt: imessage.lastIngestAt,
     maxRowid: imessage.maxRowid,
     count,
@@ -438,4 +441,5 @@ async function buildIMessageStatus(brain, imessageCapabilitiesOverride) {
 
 module.exports = {
   handleGwsApi,
+  buildIMessageStatus,
 };

package/template/wall-e/http/helper-rules-api.js

@@ -121,9 +121,10 @@ function _cellView(d, row) {
   const cellKey = String(row.cell_key);
   const window = readTrailingOutcomes(d, cellKey);
   const metrics = _parseMetrics(row.metrics_json);
+  const kind = row.kind || kindFromCellKey(cellKey);
   return {
     cell_key: cellKey,
-    kind: row.kind || kindFromCellKey(cellKey),
+    kind,
     state: _cellState(row),
     user_veto: Number(row.user_veto) === 1 ? 1 : 0,
     n_window: window.length,
@@ -131,6 +132,11 @@ function _cellView(d, row) {
     metrics,
     collecting: typeof metrics.collecting === 'boolean' ? metrics.collecting : window.length < COLLECTING_MIN,
     last_event: _lastEvent(d, cellKey),
+    // D-8 (round 3): only a wait-watch cell can fail open into a full-rate watcher, so the
+    // per-reason fallback counts ride that view alone -- the explore switch starts no watcher.
+    ...(kind === 'wait-watch'
+      ? { watch_fallbacks: require('../lib/helper-rules/lead-call-hook').watchFallbackCounts() }
+      : {}),
   };
 }
 

package/template/wall-e/http/model-admin.js

@@ -39,6 +39,7 @@ const { workerRegistryResponse } = require('./model-registry-worker-projection')
 const { pagedResult, catalogRouteInputs, codingCatalogRequestError, codingCatalogResponse, codingCatalogTokenSnap, registryListResponse, pricingListResponse, factsListResponse, scorecardPayload } = require('./model-registry-list');
 const { buildWorkerRoute } = require('../llm/worker-route');
 const { handleModelIdentityRoute } = require('./model-identity-routes');
+const { handleModelRouteHealthRoute, annotateCatalogRouteCircuits } = require('./model-route-health');
 const { handleWorkerCapabilityAdminRoute } = require('./model-worker-capability-admin');
 const { handleExecProfileAdminRoute } = require('./model-exec-profile-admin');
 const { handleDelegatePrefAdminRoute } = require('./model-delegate-pref-admin');
@@ -1196,6 +1197,10 @@ async function handleModelAdminApi(req, res, url) {
   const identityRoute = await handleModelIdentityRoute({ req, res, p, m, brainApi, url });
   if (identityRoute) return identityRoute;
 
+  // WP-2 (D-3/D-4): CTM's routed-Lead probe verdict — see model-route-health.js.
+  const routeHealth = await handleModelRouteHealthRoute({ req, res, p, m, brainApi });
+  if (routeHealth) return routeHealth;
+
   const workerCapabilityRoute = await handleWorkerCapabilityAdminRoute({ req, res, p, m, brainApi, url });
   if (workerCapabilityRoute) return workerCapabilityRoute;
 
@@ -1758,7 +1763,9 @@ async function handleModelAdminApi(req, res, url) {
       } else {
         ({ snapshotId, payload } = await _codingCatalogBuildInFlight(brainApi, key, providerId, includeLive));
       }
-      const r = codingCatalogResponse(payload, url, { snapshotId }); // paged read: http/model-registry-list.js
+      // WP-2 (D-6): annotate the pinned payload (a copy) BEFORE paging, so the
+      // page-byte budget measures the circuit fields; pages key on catalog_id.
+      const r = codingCatalogResponse(annotateCatalogRouteCircuits(payload), url, { snapshotId }); // paged read: http/model-registry-list.js
       return jsonResponse(res, r.status, r.body);
     } catch (e) {
       if (e.code === 'WALL_E_HTTP_RESPONSE_TOO_LARGE') throw e; // the proxy maps it to 413