create-walle 0.10.2 → 0.10.3

package/template/wall-e/jobs/job-runner.js

@@ -48,6 +48,7 @@
 // `../brain/job-store` here.
 
 const { writeRunArtifact, pruneRunArtifacts, classifySkillError } = require('../lib/run-artifacts');
+const { resolvePlacement } = require('../lib/derivation-home');
 
 // The per-run execution budget constants and the prompt builder live in the
 // require-free leaf `jobs/job-defaults.js` (moved there verbatim by fix round 2);
@@ -65,6 +66,13 @@ const {
 // §4: default concurrency is 1 — run jobs one at a time per tick, no flag.
 const DEFAULT_JOB_CONCURRENCY = 1;
 
+// D-5/S-16 (shared-memory WP-2): job kinds whose INPUT is replicated brain rows, so the
+// derived rows they mint (skill-executor's timestamped `source_id`, a prompt job's model
+// output) would multiply across N replicas. Only the derivation home selects them;
+// `builtin` jobs (e.g. `slack.inbound`) act on data this machine has and always run.
+const DERIVED_JOB_ACTION_KINDS = new Set(['skill', 'prompt']);
+const NOT_DERIVATION_HOME = 'not_derivation_home';
+
 // §6.1 retention: keep the newest 200 runs per job.
 const DEFAULT_RUN_KEEP = 200;
 
@@ -337,9 +345,13 @@ async function runJob(job, { trigger = 'schedule', now = Date.now, executors, ac
  *
  * @returns {Promise<{ran: number, skipped: number, considered: number, decisions: Array}>}
  */
-async function runDueJobs({ now = Date.now, executors, brain, deps } = {}) {
+async function runDueJobs({ now = Date.now, executors, brain, deps, placement } = {}) {
   const io = resolveAccess(brain);
   const at = typeof now === 'function' ? now() : now;
+  // D-5/S-16 (WP-2): the `jobs` table is host-local and stays untouched; the placement gate
+  // lives HERE, at the selection point, so a non-home node simply never selects a derived job.
+  // `placement` is the test seam; production resolves it from CTM (cached 60 s).
+  const resolvedPlacement = placement || await resolvePlacement();
 
   const jobs = await io.read('listJobs', [{ includeDisabled: true }]);
   const decisions = [];
@@ -350,6 +362,19 @@ async function runDueJobs({ now = Date.now, executors, brain, deps } = {}) {
   for (const job of jobs || []) {
     if (ran >= DEFAULT_JOB_CONCURRENCY) break;
     considered += 1;
+    // WP-2: a derived job on a non-home node is skipped with its own reason, reported in the
+    // same `decisions` array every other skip uses (no row is disabled, no run is recorded).
+    if (!resolvedPlacement.home && DERIVED_JOB_ACTION_KINDS.has(job.action_kind)) {
+      skipped += 1;
+      decisions.push({
+        job_id: job.id,
+        name: job.name,
+        decision: 'skip',
+        reason: NOT_DERIVATION_HOME,
+        details: { action_kind: job.action_kind, placement: resolvedPlacement.reason },
+      });
+      continue;
+    }
     // WP-5a (D-12): the connection record is the authority — a job that declares
     // a requirement is judged by its kind's row, and a job that declares none is
     // 'ok'. Only reconnect_required/disabled gate dispatch (§4/D-6).
@@ -527,4 +552,6 @@ module.exports = {
   MIN_TASK_EXECUTION_TIMEOUT_MS,
   DEFAULT_JOB_CONCURRENCY,
   DEFAULT_RUN_KEEP,
+  DERIVED_JOB_ACTION_KINDS,
+  NOT_DERIVATION_HOME,
 };

package/template/wall-e/lib/brain-owner-op-priority.js

@@ -13,7 +13,15 @@ const OWNER_METHOD_PRIORITY = Object.freeze({
   // background — scheduled, resumable
   markTurnLedgerOutboxDelivered: 'background',
   recordTurnLedgerOutboxFailure: 'background',
-  backfillEntityLinkBatch: 'background', backfillClassifyBatch: 'background',
+  backfillEntityLinkBatch: 'background', backfillClassifyBatch: 'background', brainSyncClockSeed: 'background',
+  // WP-1 §6.4: the v2 feed/apply pair and the hub bookkeeping — peer-driven, no user waits on
+  // them locally (the hub's own tick owns the latency budget), so they share the seed walk's
+  // class rather than competing with an interactive turn.
+  brainSyncV2Vector: 'background', brainSyncV2Changes: 'background', brainSyncV2Apply: 'background',
+  brainSyncV2MemberVector: 'background', brainSyncV2PruneTombstones: 'background', brainSyncV2Digest: 'background',
+  // WP-4 §6.7: the join trio + the import job's step — peer/job-driven, no local user waits on them.
+  brainSyncV2JoinSnapshot: 'background', brainSyncV2JoinImport: 'background',
+  brainSyncV2JoinStatus: 'background', brainSyncV2JoinStep: 'background',
   backfillStripNoiseBatch: 'background', backfillInsertMemoryIndexBatch: 'background',
   backfillMarkEmbedFailed: 'background', embeddingsUpsertBatch: 'background',
   commitThinkExtraction: 'background', ingestInsertMemoryBatch: 'background',

package/template/wall-e/lib/ctm-data-dir.js

@@ -0,0 +1,26 @@
+'use strict';
+
+// R-6/R-7 (§5, D-4) — "CTM's data dir", computed the way CTM computes it for itself
+// (coding-task-manager/lib/data-dir.js:17-21) but from a GIVEN env object.
+//
+// Call it in the Wall-E DAEMON (the process that serves POST /api/walle/sync/v2/join/import),
+// NEVER in the brain-owner worker: the owner's env is a deliberate whitelist
+// (lib/brain-owner-env.js) that sets WALL_E_DATA_DIR to the brain's own directory and drops
+// CTM_DATA_DIR (I-5), so resolving the inbox root there names the wrong directory — which is
+// exactly the Spark fault (every join import refused JOIN_PATH_INVALID while CTM wrote its
+// snapshots to the CTM inbox). The daemon resolves the root and passes it down as `dataDir`
+// (http/sync-api.js _handleV2JoinImport → brain/brain-join.js isInsideJoinInbox).
+
+const os = require('node:os');
+const path = require('node:path');
+
+// CTM_DATA_DIR, then WALL_E_DATA_DIR (wall-e's own override, honoured by CTM's resolver too so a
+// single value works for both processes), then <HOME>/.walle/data. An empty — or
+// whitespace-only — value counts as unset, matching CTM's truthiness test on the raw value.
+function resolveCtmDataDir(env = process.env) {
+  const override = String(env.CTM_DATA_DIR || env.WALL_E_DATA_DIR || '').trim();
+  if (override) return path.resolve(override);
+  return path.resolve(env.HOME || os.homedir(), '.walle', 'data');
+}
+
+module.exports = { resolveCtmDataDir };

package/template/wall-e/lib/derivation-home.js

@@ -0,0 +1,147 @@
+'use strict';
+
+// shared-memory WP-2 (design `wall-e/docs/shared-memory-every-machine-2026-10-31.html`
+// §5 D-5, §9 S-16..S-21): WHERE derived work runs.
+//
+// After replication every machine holds the same brain rows. A producer whose INPUT is
+// replicated rows would then run N times and mint N different rows (e.g.
+// `skills/skill-executor.js` minting `skill-${skill.id}-${Date.now()}-${count}`), so D-5
+// single-homes *derived* production on the "derivation home": the Wall-E whose CTM does
+// not report `role:'box'`. Host-local ingest keeps running wherever the data lives; only
+// the derived step is gated.
+//
+// The role fact comes from CTM (`memory/hub-bridge-client.js:fetchStatus` ->
+// `GET /api/hub-bridge/status` -> `{ role, hubs, poolMembers }`), which answers null when
+// CTM is unreachable. Three placements:
+//
+//   role 'box'            -> { home: false, reason: 'box' }           (a box skips derived work)
+//   null / no string role -> { home: false, reason: 'role_unknown' }  (D-5: skip, never guess)
+//   any other role        -> { home: true,  reason: 'not_box' }       (hub, standalone installs)
+//
+// The answer is cached for CACHE_TTL_MS in BOTH directions: a probe per scheduler tick per
+// producer would be a CTM round-trip storm, and a negative answer must not flap back to
+// "home" mid-run. Tests never hit a real CTM — `resolvePlacement({ fetchStatus })` is the seam.
+
+const hubBridgeClient = require('../memory/hub-bridge-client');
+
+const CACHE_TTL_MS = 60 * 1000;
+
+const REASON_NOT_BOX = 'not_box';
+const REASON_BOX = 'box';
+const REASON_ROLE_UNKNOWN = 'role_unknown';
+const REASON_MEMBER = 'member';
+
+// `{ at, value }` — one process-wide memo (positive AND negative), reset by
+// `_resetPlacementCacheForTests()`.
+let _cache = null;
+
+function _classify(status) {
+  if (status == null || typeof status !== 'object') {
+    return { home: false, role: null, reason: REASON_ROLE_UNKNOWN };
+  }
+  const role = status.role;
+  // A missing key, an explicit null, and an empty string all mean "CTM did not tell us its
+  // role" — D-5 says skip derived work for that run rather than guess (fail closed).
+  if (typeof role !== 'string' || role === '') {
+    return { home: false, role: null, reason: REASON_ROLE_UNKNOWN };
+  }
+  if (role === 'box') return { home: false, role, reason: REASON_BOX };
+  return { home: true, role, reason: REASON_NOT_BOX };
+}
+
+/**
+ * Resolve where this Wall-E sits. Never throws: an unreachable CTM is the named
+ * `role_unknown`, not a crash.
+ *
+ * @param {Object} [opts]
+ * @param {Object} [opts.env=process.env]                 env handed to the CTM client
+ * @param {Function} [opts.fetchStatus]                   test seam (defaults to the hub-bridge client)
+ * @param {Function|number} [opts.now=Date.now]           clock (injectable for the cache TTL)
+ * @returns {Promise<{home: boolean, role: string|null, reason: string}>}
+ */
+// The durable membership marker (brain/brain-sync-v2.js markMembership): a Wall-E a home has synced
+// is a member. Read locally, before any network: CTM's role:'box' is only reported while a hub link is
+// open (coding-task-manager/lib/hub-bridge-box.js:186), so it cannot be the only signal.
+function _defaultReadMembership() {
+  try {
+    const brain = require('../brain');
+    const db = typeof brain.getDb === 'function' ? brain.getDb() : null;
+    if (!db) return null;
+    return require('../brain/brain-sync-membership').readMembership(db);
+  } catch {
+    return null; // HANDLE: no brain handle in this process yet — fall through to the CTM role
+  }
+}
+
+async function resolvePlacement({ env = process.env, fetchStatus, readMembership, now = Date.now } = {}) {
+  const clock = typeof now === 'function' ? now : () => now;
+  const at = clock();
+  if (_cache && (at - _cache.at) < CACHE_TTL_MS) return _cache.value;
+  const membership = (typeof readMembership === 'function' ? readMembership : _defaultReadMembership)();
+  if (membership && membership.role === 'member') {
+    const value = { home: false, role: 'member', reason: REASON_MEMBER };
+    _cache = { at, value };
+    return value;
+  }
+
+  const fetch = typeof fetchStatus === 'function' ? fetchStatus : hubBridgeClient.fetchStatus;
+  let status = null;
+  try {
+    status = await fetch({ env });
+  } catch {
+    // REPORT: a thrown probe is exactly the unreachable-CTM case the caller must treat as
+    // 'role_unknown' (hub-bridge-client.fetchStatus itself already answers null; this guards
+    // an injected seam that throws instead).
+    status = null;
+  }
+
+  const value = _classify(status);
+  _cache = { at, value };
+  return value;
+}
+
+/** Convenience boolean: is this Wall-E the derivation home? */
+async function isDerivationHome(opts) {
+  return (await resolvePlacement(opts)).home;
+}
+
+/**
+ * The skip record a gated producer returns instead of running. Same shape the loops already
+ * use for "did no work" (`{ skipped: true, reason, ... }`) so `onResult` needs no new branch.
+ */
+function placementSkip(name, placement) {
+  return {
+    skipped: true,
+    reason: (placement && placement.reason) || REASON_ROLE_UNKNOWN,
+    job: name,
+  };
+}
+
+/**
+ * Run `fn` only on the derivation home; otherwise answer the skip record. This is the wrapper
+ * agent.js puts around a `placement: 'home'` registration's `run`:
+ *
+ *   run: () => runIfHome('reflect', () => reflect.runOnce())
+ */
+async function runIfHome(name, fn, opts = {}) {
+  const placement = await resolvePlacement(opts);
+  if (!placement.home) return placementSkip(name, placement);
+  return fn();
+}
+
+/** Test seam: clear the 60 s memo (both directions). */
+function _resetPlacementCacheForTests() {
+  _cache = null;
+}
+
+module.exports = {
+  resolvePlacement,
+  isDerivationHome,
+  placementSkip,
+  runIfHome,
+  _resetPlacementCacheForTests,
+  CACHE_TTL_MS,
+  REASON_NOT_BOX,
+  REASON_BOX,
+  REASON_ROLE_UNKNOWN,
+};

package/template/wall-e/lib/helper-rules/evaluate.js

@@ -124,6 +124,9 @@ function _watchMetrics(outcomes, watcherUsd) {
   const silentUseful = outcomes.filter((row) => row.label === 'silent_useful').length;
   const silentEmpty = outcomes.filter((row) => row.label === 'silent_empty').length;
   const labelled = useful + empty;
+  // Legacy (WP-2): Wall-E no longer produces `silent_*` rows — nothing reads these fields any
+  // more — but events and rows written before the silent mode was retired still carry them, so
+  // the metrics shape stays for the panel.
   const silentLabelled = silentUseful + silentEmpty;
   const watcherUsdWindow = _watcherUsdWindow(watcherUsd);
   return {
@@ -143,24 +146,62 @@ function _watchMetrics(outcomes, watcherUsd) {
   };
 }
 
-function _evaluateWatch(cellState, outcomes, watcherUsd) {
-  const metrics = _watchMetrics(outcomes, watcherUsd);
+/** A labelled row: a wake the lead answered in time (`useful`) or did not need (`empty`). */
+function _isLabelledRow(row) {
+  return row.label === 'useful' || row.label === 'empty';
+}
+
+/**
+ * WP-2 (§6, lead ruling): the rows this cell's CURRENT regime produced — the ones at or after
+ * `state_changed_at`. A cell that just passed its probe still has up to PROBE_N pre-probe rows in
+ * the 20-row trailing window; measuring the whole window would read 7 probe-useful rows next to 9
+ * old empty ones as ~0.44 and turn the cell straight back off. resilience4j starts a fresh metrics
+ * window on every state transition for the same reason. Rows with no readable timestamp are kept
+ * (the same predicate `_evaluateExplore`'s probe filter uses).
+ */
+function _regimeRows(cell, outcomes) {
+  const changedAt = _toMs(cell.state_changed_at);
+  return outcomes.filter((row) => {
+    const createdMs = _toMs(row.created_at);
+    return changedAt == null || createdMs == null || createdMs >= changedAt;
+  });
+}
+
+function _evaluateWatch(cell, outcomes, watcherUsd, now) {
+  const cellState = _stateOf(cell);
+
   if (cellState === 'on') {
+    // Only the current regime is evidence: an on-cell demotes on its own rows, never on the
+    // pre-probe rows its last transition left in the window.
+    const metrics = _watchMetrics(_regimeRows(cell, outcomes), watcherUsd);
     if (metrics.labelled >= MIN_LABELLED && metrics.precision < WATCH_OFF_BELOW) {
       return _verdict('off', cellState, metrics, REASONS.WATCH_PRECISION_BELOW);
     }
     return _verdict(cellState, cellState, metrics, null);
   }
+
   if (cellState === 'off') {
-    // While off, the silent ticks are the window: the lead's own next call is the only
-    // evidence left that the wake was not needed.
-    metrics.collecting = metrics.silent_labelled < MIN_LABELLED;
-    if (metrics.silent_labelled >= MIN_LABELLED && metrics.silent_precision >= WATCH_ON_ABOVE) {
-      return _verdict('on', cellState, metrics, REASONS.WATCH_SILENT_PRECISION_ABOVE);
+    // Rows never move an off cell — not the retired silent ticks, not any other label. Only
+    // elapsed time does, and only when the user has not vetoed the route.
+    const metrics = _watchMetrics(outcomes, watcherUsd);
+    const changedAt = _toMs(cell.state_changed_at);
+    const nowMs = _toMs(now) ?? Date.now();
+    const days = changedAt == null ? 0 : (nowMs - changedAt) / DAY_MS;
+    if (!_vetoOf(cell) && days >= EXPLORE_PROBE_AFTER_DAYS) {
+      return _verdict('probe', cellState, metrics, REASONS.EXPLORE_PROBE_AFTER);
     }
     return _verdict(cellState, cellState, metrics, null);
   }
-  return _verdict(cellState, cellState, metrics, null);
+
+  // probe: the next PROBE_N labelled rows that landed AFTER the probe started decide it.
+  const regime = _regimeRows(cell, outcomes);
+  const metrics = _watchMetrics(regime, watcherUsd);
+  const probeWindow = regime.filter(_isLabelledRow).slice(0, PROBE_N);
+  metrics.probed = probeWindow.length;
+  if (probeWindow.length < PROBE_N) return _verdict(cellState, cellState, metrics, null);
+  const precision = _ratio(probeWindow.filter((row) => row.label === 'useful').length, probeWindow.length);
+  if (precision >= WATCH_ON_ABOVE) return _verdict('on', cellState, metrics, REASONS.EXPLORE_PROBE_PASSED);
+  return _verdict('off', cellState, metrics, REASONS.EXPLORE_PROBE_FAILED);
 }
 
 // --- explore ----------------------------------------------------------------------
@@ -322,7 +363,7 @@ function evaluateCell(cell, trailingOutcomes, { now, leadBurstUsd, watcherUsd }
   if (kind === 'explore' || String(cell?.cell_key || '').startsWith('explore|')) {
     return _evaluateExplore(cell, outcomes, now, leadBurstUsd);
   }
-  return _evaluateWatch(cellState, outcomes, watcherUsd);
+  return _evaluateWatch(cell, outcomes, watcherUsd, now);
 }
 
 /** The metrics a short-circuited (vetoed) cell reports — same shape as its kind's. */

package/template/wall-e/lib/helper-rules/grade.js

@@ -25,13 +25,22 @@
 //   * an unparsed first reply earns ONE re-ask of the same pinned model with the parse error
 //     appended, and a second failure stores the raw reply so the failure is visible on the panel.
 // A cheaper judge is still never substituted (D-19).
+//
+// Round 3 WP-1 (§4 D-1..D-5): the budget, and the truth of a cut-off reply.
+//   * the output ceiling is the role API's own MAX_COMPLETION_TOKENS, not a hand-picked number
+//     (D-1) and no thinking/effort knob is configured (D-2);
+//   * a `max_tokens` stop is `grade_truncated`: the text is cut off, so it is never parsed and
+//     never re-asked (D-3);
+//   * an empty reply is `grade_empty` and earns NO re-ask, so an empty assistant turn can never
+//     reach the provider guard (D-4);
+//   * every unavailable sample carries the stop reason, and the call carries the explore row's
+//     worker id as `sessionId` so grader spend joins the cell (D-5).
 
 const fs = require('node:fs');
 const path = require('node:path');
 
 const EXPLORE_GRADE_EVERY = 5; // D-12: one in five completed hand-offs per cell
 const GRADE_TASK = 'explore-handoff-grade';
-const GRADE_MAX_TOKENS = 400;
 const GRADE_TIMEOUT_MS = 120000;
 const CARD_MAX_CHARS = 12000;
 const BRIEF_MAX_CHARS = 4000; // the brief's share of the card; the report keeps the rest
@@ -138,6 +147,11 @@ function _replyText(reply) {
   return _str(reply && reply.content);
 }
 
+/** D-3: `completeForRole` carries the provider's stop reason; a reply without one has none. */
+function _stopReasonOf(reply) {
+  return _str(reply && reply.stopReason) || null;
+}
+
 /**
  * D-8: a grader that wraps its JSON in one Markdown fence still yields its verdict. Only a fence
  * the reply STARTS with is stripped, and only its matching close — prose around the block is left
@@ -170,12 +184,19 @@ function _parseReply(reply) {
 
 /**
  * Grade one exploration hand-off. Never throws; returns { ok:false, error } on any failure, and
- * re-asks the same pinned model once when the first reply does not parse (D-8).
+ * re-asks the same pinned model once when the first reply does not parse (D-8). A truncated reply
+ * (round 3 D-3) is its own outcome and is never parsed or re-asked.
  * @param {{ brief?:string, brief_path?:string, report?:string, report_path?:string, last_message_path?:string, toolLog:[{tool:string, path:string}] }} card   clipped to CARD_MAX_CHARS (brief text, or read from brief_path; report text, or read from report_path/last_message_path)
- * @param {{ completeForRole: Function, graderModel: string, brain?: object }} deps
- * @returns {Promise<{ ok:true, sufficient:boolean, coverage:'all'|'most'|'little', inaccuracies:number, why:string } | { ok:false, error:string, raw?:string }>}
+ * @param {{ completeForRole: Function, graderModel: string, brain?: object, sessionId?: string|null }} deps
+ * @returns {Promise<{ ok:true, sufficient:boolean, coverage:'all'|'most'|'little', inaccuracies:number, why:string } | { ok:false, error:'grader_model_unset'|'grade_truncated'|'grade_empty'|'grade_unparsed'|string, stop_reason?:string|null, raw?:string }>}
  */
 async function gradeHandoff(card, deps = {}) {
+  // Round 3 D-1: the grader's output budget IS the role API's ceiling. The pinned judge always
+  // thinks, and thinking counts inside max_tokens, so the old 400 was consumed before the verdict
+  // was written (14/19 live calls stopped on `max_tokens`). Billing is per token used, so the
+  // higher ceiling costs only what the judge actually thinks. Required here, not at module top:
+  // lib/ holds no load-time reference into llm/ (lead-call-hook.js's lazy-seam rule).
+  const { MAX_COMPLETION_TOKENS } = require('../../llm/model-roles');
   const graderModel = _str(deps && deps.graderModel).trim();
   // An unset pin is not a reason to grade with something else (D-0): the sample is unavailable.
   if (!graderModel) return { ok: false, error: 'grader_model_unset' };
@@ -184,9 +205,12 @@ async function gradeHandoff(card, deps = {}) {
     task: GRADE_TASK,
     model: graderModel,
     system: RUBRIC,
-    maxTokens: GRADE_MAX_TOKENS,
+    maxTokens: MAX_COMPLETION_TOKENS,
     timeoutMs: GRADE_TIMEOUT_MS,
     temperature: 0,
+    // D-5: the explore row's worker id, so the grader's ledger row joins to the same cell the
+    // watcher spend is keyed by. A caller with no identity keeps today's NULL.
+    sessionId: deps.sessionId || null,
   };
   const userMessage = { role: 'user', content: _cardText(card) };
   let reply;
@@ -197,10 +221,21 @@ async function gradeHandoff(card, deps = {}) {
     // A call that never answered has no reply to re-ask about, so this is not retried.
     return { ok: false, error: _errorCode(err) };
   }
+  const firstStop = _stopReasonOf(reply);
+  // D-3: a `max_tokens` stop is a cut-off reply, not a verdict -- the text ends mid-object, so
+  // parsing it would fabricate a label and a re-ask at the same ceiling only truncates again.
+  if (firstStop === 'max_tokens') {
+    return { ok: false, error: 'grade_truncated', stop_reason: 'max_tokens', raw: _replyText(reply).slice(0, RAW_MAX_CHARS) };
+  }
   const first = _parseReply(reply);
   if (first.ok) return first;
   const firstRaw = _replyText(reply);
+  // D-4: an empty first reply earns NO re-ask. The D-8 retry re-sends the raw reply as the
+  // assistant turn, and an empty one is rejected locally (WALLE_EMPTY_PROVIDER_MESSAGES) before
+  // any network call -- so the sample is stored as empty, with the stop reason that explains it.
+  if (!firstRaw.trim()) return { ok: false, error: 'grade_empty', stop_reason: firstStop };
   let raw = firstRaw;
+  let stopReason = firstStop;
   try {
     // D-8: ONE bounded retry, the SAME pinned model and parameters, with the raw reply and the
     // parse error on the wire (the MLflow "single retry with a tightened prompt" form).
@@ -212,15 +247,21 @@ async function gradeHandoff(card, deps = {}) {
         { role: 'user', content: `Reply with the JSON object only. Parse error: missing ${first.missing.join(', ')}` },
       ],
     });
+    const retryStop = _stopReasonOf(retried);
+    if (retryStop === 'max_tokens') {
+      return { ok: false, error: 'grade_truncated', stop_reason: 'max_tokens', raw: _replyText(retried).slice(0, RAW_MAX_CHARS) };
+    }
     const parsed = _parseReply(retried);
     if (parsed.ok) return parsed;
     raw = _replyText(retried);
+    stopReason = retryStop;
   } catch {
     // REPORT: the retry itself failed -- the sample is still stored as an unparsed grade, carrying
     // the first raw reply, so the failure is visible rather than a silent hole in the rate.
     raw = firstRaw;
+    stopReason = firstStop;
   }
-  return { ok: false, error: 'grade_unparsed', raw: raw.slice(0, RAW_MAX_CHARS) };
+  return { ok: false, error: 'grade_unparsed', stop_reason: stopReason, raw: raw.slice(0, RAW_MAX_CHARS) };
 }
 
 /** D-12: every EXPLORE_GRADE_EVERY-th completed hand-off of a cell (its `helper_outcomes.seq`). */
@@ -231,11 +272,14 @@ function shouldGrade(seq) {
 /**
  * The persisted `helper_outcomes.grade_json` value: the four verdict fields, or `unavailable`.
  * D-8: an unparsed sample keeps the raw reply (≤ RAW_MAX_CHARS) so the panel can show WHY it
- * failed instead of an empty cell.
+ * failed instead of an empty cell. D-4: the stop reason is kept too (`max_tokens` reads as
+ * "budget", `end_turn` with no text as "the judge said nothing"), when the reply had one.
  */
 function gradeToJson(result) {
   if (!result || result.ok !== true) {
     const json = { unavailable: true, error: _str(result && result.error) || 'grade_failed' };
+    const stopReason = _str(result && result.stop_reason);
+    if (stopReason) json.stop_reason = stopReason;
     const raw = _str(result && result.raw);
     if (raw) json.raw = raw.slice(0, RAW_MAX_CHARS);
     return json;
@@ -265,7 +309,6 @@ module.exports = {
   CARD_MAX_CHARS,
   DEFAULT_GRADER_MODEL_KV,
   EXPLORE_GRADE_EVERY,
-  GRADE_MAX_TOKENS,
   GRADE_TASK,
   GRADE_TIMEOUT_MS,
   RAW_MAX_CHARS,

package/template/wall-e/lib/helper-rules/lead-call-hook.js

@@ -61,6 +61,13 @@ let openHandoffs = new Map(); // ctm_session_id -> { id, opened_at, brief_path }
 // repeated terminal reads of one worker from re-sending the same close.
 let closedWorkers = new Set();
 let lastWarnAt = 0;
+// D-8 (round 3): the three reasons watchModeFor (llm/worker-mcp-routing.js) returns null on. A null
+// means CTM's default `on` -- a full-rate watcher -- so the reason a worker with an off cell still
+// spent 40 watcher ticks has to be nameable, not inferred.
+const WATCH_FALLBACK_REASONS = Object.freeze(['unknown_worker', 'no_lead_workers', 'hook_error']);
+// Counters are per process since boot; `since` is the ISO time this module loaded (or last reset).
+let watchFallbackTally = new Map(); // reason -> count
+let watchFallbackSince = new Date().toISOString();
 
 // --- small helpers -----------------------------------------------------------------
 
@@ -102,6 +109,22 @@ function _warn(message) {
   console.warn(`[helper-rules] ${message}`);
 }
 
+// D-8: one fail-open fallback of the wait-watch decision, counted and named. A reason outside the
+// list is not a fallback this module knows about, so it is ignored (never silently added as a key).
+function noteWatchFallback(reason, workerId = null) {
+  if (!WATCH_FALLBACK_REASONS.includes(reason)) return;
+  watchFallbackTally.set(reason, (watchFallbackTally.get(reason) || 0) + 1);
+  _warn(`watch_mode_fallback reason=${reason} worker=${workerId || '-'}`);
+}
+
+/** D-8: a fresh copy of the per-reason fallback counts plus the window's start time. */
+function watchFallbackCounts() {
+  const counts = {};
+  for (const reason of WATCH_FALLBACK_REASONS) counts[reason] = watchFallbackTally.get(reason) || 0;
+  counts.since = watchFallbackSince;
+  return counts;
+}
+
 function _write(method, ...args) {
   const fail = (err) => _warn(`${method} failed: ${err && err.message ? err.message : err}`);
   try {
@@ -153,6 +176,8 @@ function _resetForTests() {
   openHandoffs = new Map();
   closedWorkers = new Set();
   lastWarnAt = 0;
+  watchFallbackTally = new Map();
+  watchFallbackSince = new Date().toISOString();
 }
 
 // --- the classification of one watcher decision --------------------------------------
@@ -354,7 +379,7 @@ function _toolLogOf(payload) {
   return Object.entries(counts).map(([tool, count]) => ({ tool, path: String(count) }));
 }
 
-function _trackHandoff(call, res, clientInfo, nowMs) {
+function _trackHandoff(call, res, clientInfo, nowMs, lead) {
   if (!res) return;
   if (call.tool === 'walle_delegate_implementation') {
     const ctmSessionId = _string(res.ctm_session_id).trim();
@@ -378,6 +403,9 @@ function _trackHandoff(call, res, clientInfo, nowMs) {
         opened_at: nowMs,
         harness: res.harness == null ? null : res.harness,
         brief_path: res.rendered_brief_path || null,
+        // D-5: the lead that owns this explore row, so a later lead-cost measurement can join the
+        // cell on it (helper_outcomes.lead_usd stays NULL).
+        lead_session_id: lead || null,
       }),
       label_version: LABEL_VERSION,
     });
@@ -409,7 +437,7 @@ function _trackHandoff(call, res, clientInfo, nowMs) {
   // The grade card is built HERE, while the terminal payload is in scope; the grade itself waits
   // for the row's seq, which only the close write can return.
   const toolLog = _toolLogOf(payload);
-  _writeThen('helperRulesCloseOutcomeByWorker', [workerId, { facts }], (result) => _gradeIfSampled(result, facts, toolLog));
+  _writeThen('helperRulesCloseOutcomeByWorker', [workerId, { facts }], (result) => _gradeIfSampled(result, facts, toolLog, workerId));
 }
 
 // --- the 1-in-5 spot check (WP-6, §6.5/D-19) -------------------------------------------
@@ -437,7 +465,7 @@ function _gradeDeps() {
 // Fire-and-forget: the close already landed, so a grader outage costs a sample, never the write.
 // S-3 (round 2): the store derives the label and returns it, so "was this a hand-off?" is read
 // from `result.labelled`, and the card carries the report/log PATHS (grade.js reads them).
-function _gradeIfSampled(result, facts, toolLog) {
+function _gradeIfSampled(result, facts, toolLog, workerId) {
   if (!result || result.closed !== true) return;
   if (!result.labelled || result.labelled.decision !== 'handoff') return; // only an accepted hand-off
   if (!shouldGrade(result.seq)) return; // D-12: every EXPLORE_GRADE_EVERY-th, in every cell state
@@ -459,7 +487,9 @@ function _gradeIfSampled(result, facts, toolLog) {
   }
   // REPORT: gradeHandoff turns a failed call into an unavailable sample, so the tail below only
   // covers a throw from the write itself -- both are fire-and-forget by contract.
-  gradeHandoff(card, { completeForRole: deps.completeForRole, graderModel: readGraderModel(deps.db), brain: deps.brain })
+  // D-5: the closing worker's id rides the grader call as `sessionId`, so the grader's ledger row
+  // joins the same cell the watcher spend is keyed by (round 2 WP-4a's convention).
+  gradeHandoff(card, { completeForRole: deps.completeForRole, graderModel: readGraderModel(deps.db), brain: deps.brain, sessionId: workerId })
     .then((grade) => _write('helperRulesSetGrade', id, gradeToJson(grade)))
     .catch((err) => _warn(`helperRulesSetGrade failed: ${err && err.message ? err.message : err}`));
 }
@@ -482,7 +512,7 @@ function _record(options) {
   _rememberDelegation(lead, call, res);
   _openWatcherOutcomes(lead, call, res, nowMs);
   _recordLateEnd(call, res, nowMs);
-  _trackHandoff(call, res, clientInfo, nowMs);
+  _trackHandoff(call, res, clientInfo, nowMs, lead);
 
   const ring = callsByLead.get(lead) || [];
   ring.push(call);
@@ -515,8 +545,11 @@ module.exports = {
   TERMINAL_STATUSES,
   WAIT_TOOLS,
   WARN_THROTTLE_MS,
+  WATCH_FALLBACK_REASONS,
   _resetForTests,
   leadWorkersOf,
+  noteWatchFallback,
   recordLeadToolCall,
+  watchFallbackCounts,
   workerRouteOf,
 };

package/template/wall-e/lib/helper-rules/store.js

@@ -625,14 +625,16 @@ function setCellState(d, cellKey, { state, user_veto, reason, evidence } = {}) {
  *   1. `sweepAbandoned` — D-10's 4 h TTL, so a row no lead ever closed stops occupying the window;
  *   2. `relabel` — D-5's recompute + D-6's one-time recovery (a no-op once the kv watermark is
  *      current, which is why it can ride the daily tick at all);
- *   3. the evaluator over every explore cell, as before — this is what advances `off → probe`.
+ *   3. the evaluator over every explore and wait-watch cell — this is what advances `off → probe`
+ *      for both kinds (WP-2: the wait-watch cell's probe timer needs the same daily clock the
+ *      explore cell's already had).
  * @returns {{cells: Array<{cell_key:string, state:string, changed:boolean}>, abandoned:number,
  *            relabelled:number}}
  */
 function dailyTick(d) {
   const abandoned = sweepAbandoned(d, {});
   const relabelled = relabel(d, {});
-  const keys = d.prepare("SELECT cell_key FROM helper_rule_cells WHERE kind = 'explore' OR cell_key LIKE 'explore|%'")
+  const keys = d.prepare("SELECT cell_key FROM helper_rule_cells WHERE kind IN ('explore','wait-watch') OR cell_key LIKE 'explore|%' OR cell_key LIKE 'wait-watch|%'")
     .all()
     .map((row) => row.cell_key);
   const run = d.transaction(() => keys.map((key) => evaluateAndApply(d, key)));