create-walle 0.10.2 → 0.10.3

package/template/wall-e/lib/mcp-integration.js

@@ -27,6 +27,8 @@ const {
   ClientConfigError,
   OPERATIONS,
   applySourceEdits,
+  asClient,
+  attributionOptions,
   buildOwnershipManifest,
   emptyJsonDocumentText,
   creationBoundaryEvidence,
@@ -59,6 +61,38 @@ const MCP_TARGETS = Object.freeze([
   { id: 'claude-desktop', tool: 'Claude Desktop', configPath: 'Library/Application Support/Claude/claude_desktop_config.json', detectPath: 'Library/Application Support/Claude', kind: 'json' },
 ]);
 
+// D-3: every ensure TARGET is worth NAMING when it refuses, so each MCP_TARGETS
+// id maps onto exactly one token of the leaf's fixed client vocabulary
+// (mcp-client-config.js CLIENT_CONFIG_CLIENTS); `asClient` carries that token
+// onto whatever owned refusal the target's capture/parse/plan raises. The
+// mapping is TOTAL over MCP_TARGETS on purpose — a new target id with no token
+// here fails the coverage test in
+// tests/client-config-error-attribution.test.js instead of inventing one, and
+// `_targetClient` refuses at runtime rather than returning an unmapped value.
+const MCP_TARGET_CLIENTS = Object.freeze({
+  'claude-code-user': 'claude-code',
+  'claude-code-project': 'claude-code',
+  codex: 'codex',
+  cursor: 'cursor',
+  windsurf: 'windsurf',
+  'claude-desktop': 'claude-desktop',
+});
+
+function _targetClient(target) {
+  const token = target ? MCP_TARGET_CLIENTS[target.id] : undefined;
+  // No token is a programming error, never a silently anonymous refusal.
+  if (!token) throw new TypeError('mcp-integration: unmapped MCP target id');
+  return token;
+}
+
+// D-3: the ensure boot lines (wall-e/server.js, CTM walle-mcp-auto-config.js)
+// print the message plus the bounded attribution an owned refusal carries.
+function ensureFailureMessage(err) {
+  const { client, refusal } = err && typeof err === 'object' ? attributionOptions(err) : {};
+  const parts = [client && `client=${client}`, refusal && `refusal=${refusal}`].filter(Boolean);
+  return `${err && err.message}${parts.length ? ` (${parts.join(', ')})` : ''}`;
+}
+
 const AGENT_INSTRUCTION_TARGETS = Object.freeze([
   {
     id: 'claude-code-instructions',
@@ -1588,10 +1622,10 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
     let primary = null;
     let failurePresent = false;
 
-    const jobFor = (physicalPath, logicalPath, source) => {
+    const jobFor = (physicalPath, logicalPath, source, client) => {
       let job = jobsByPhysical.get(physicalPath);
       if (!job) {
-        job = { physicalPath, logicalPath, source, members: [], plugin: null, pluginPlan: null, emitted: null, action: null };
+        job = { physicalPath, logicalPath, source, client, members: [], plugin: null, pluginPlan: null, emitted: null, action: null };
         jobsByPhysical.set(physicalPath, job);
         jobs.push(job);
         sources.push(source);
@@ -1606,10 +1640,13 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
           order.push({ kind: 'row', row: { kind: 'mcp_config', tool: target.tool, action: 'not_installed' } });
           continue;
         }
+        // D-3: this target's client token, so its capture/parse/plan refusal
+        // names the client instead of the anonymous boot line.
+        const client = _targetClient(target);
         if (target.kind === 'codex-toml') {
-          const plan = _planCodexTarget({
+          const plan = asClient(client, () => _planCodexTarget({
             target, logicalPath: paths.configPath, wallePort, opts: scopedOpts, context, allowMissing: true, sources,
-          });
+          }));
           if (plan.source) { jobs.push(Object.assign({ kind: 'toml', logicalPath: paths.configPath }, plan)); sources.push(plan.source); }
           order.push({ kind: 'single', plan });
           continue;
@@ -1618,12 +1655,12 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
         // logical aliases of one file share ONE captured original: no second
         // unregistered capture, and never two plans derived from two originals.
         // `assertNotReserved` is also the reserved pre-FD admission.
-        const groupingKey = assertNotReserved(paths.configPath, context);
-        const member = { target, logicalPath: paths.configPath, tombstoned: _isTombstoned(target, scopedOpts) };
+        const groupingKey = asClient(client, () => assertNotReserved(paths.configPath, context));
+        const member = { target, client, logicalPath: paths.configPath, tombstoned: _isTombstoned(target, scopedOpts) };
         let job = jobsByPhysical.get(groupingKey);
         if (!job) {
-          const source = captureClientConfigFile(paths.configPath, { mutexContext: context, allowMissing: true });
-          job = jobFor(source.targetPath, paths.configPath, source);
+          const source = asClient(client, () => captureClientConfigFile(paths.configPath, { mutexContext: context, allowMissing: true }));
+          job = jobFor(source.targetPath, paths.configPath, source, client);
         }
         job.members.push(member);
         order.push({ kind: 'json', job, target, logicalPath: paths.configPath });
@@ -1635,12 +1672,15 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
       const routing = _planSessionPluginRouting(scopedOpts);
       if (routing && routing.qualifiedNames.length) {
         const claudeJsonPath = path.join(homeDir, '.claude.json');
+        // …and it IS the Claude Code user config, so its refusals name that
+        // client too.
+        const pluginClient = MCP_TARGET_CLIENTS['claude-code-user'];
         let physical = claudeJsonPath;
         try { physical = fs.realpathSync(claudeJsonPath); } catch { physical = claudeJsonPath; }
         let job = jobsByPhysical.get(physical);
         if (!job) {
-          const source = captureClientConfigFile(claudeJsonPath, { mutexContext: context, allowMissing: true });
-          job = jobFor(source.targetPath, claudeJsonPath, source);
+          const source = asClient(pluginClient, () => captureClientConfigFile(claudeJsonPath, { mutexContext: context, allowMissing: true }));
+          job = jobFor(source.targetPath, claudeJsonPath, source, pluginClient);
         }
         job.plugin = routing;
         order.push({ kind: 'plugin', job, tool: 'Claude Code Plugin Routing', configPath: claudeJsonPath });
@@ -1654,7 +1694,10 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
         // _planCodexTarget and has no session-plugin stage to compose.
         if (!job.source || job.kind === 'toml') continue;
         let current = job.source.text === null ? emptyJsonDocumentText() : job.source.text;
-        let doc = parseClientConfig(current, { format: 'json' });
+        // D-3: the job's JSON parse and each member's plan are attributed to the
+        // client whose file this is (aliases of one physical document share the
+        // token, and its members must agree).
+        let doc = asClient(job.client, () => parseClientConfig(current, { format: 'json' }));
         // GEN8-F: same-physical aliases must AGREE. Each member's own opt-out is
         // evaluated separately (a tombstone for one client is never reported for
         // another), and a disagreement — one alias tombstoned while another wants
@@ -1687,13 +1730,13 @@ async function ensureMcpIntegrations(wallePort, opts = {}) {
         );
         const perMember = job.members.map((member) => ({
           member,
-          plan: _planOwnJsonEntryEdits(doc, current, {
+          plan: asClient(member.client, () => _planOwnJsonEntryEdits(doc, current, {
             expected,
             authority,
             ownHttpUrl,
             tombstoned: member.tombstoned === true,
             allowCommandTransition,
-          }),
+          })),
         }));
         // GEN9: aliases of one physical document must agree on the FULL desired
         // output (action AND the exact edits), not merely on the action name.
@@ -2000,6 +2043,8 @@ module.exports = {
   AGENT_INSTRUCTIONS_BEGIN,
   AGENT_INSTRUCTIONS_END,
   MCP_TARGETS,
+  MCP_TARGET_CLIENTS,
+  ensureFailureMessage,
   WALLE_SERVER_NAME,
   detectAgentMemoryInstructions,
   detectMcpIntegrations,

package/template/wall-e/lib/parent-death.js

@@ -156,10 +156,16 @@ function installParentDeathWatch(options = {}) {
     try { logger?.error?.(`[parent-death:${label}] failed to register disconnect listener`, err); } catch { /* expected: logger itself is best-effort here; nothing downstream depends on this line succeeding */ }
   }
 
+  // Reparenting is "ppid changed since install", not "ppid is 1": a macOS orphan goes to
+  // launchd (pid 1), but a Linux orphan goes to the nearest subreaper (`systemd --user`), so
+  // `=== 1` alone never fired there (design nightly-linux-host-portability-2026-10-27, WP-4b).
+  // A process launched with ppid 1 (under launchd) keeps it, so it is never "changed".
+  let initialPpid = null;
+  try { initialPpid = getPpid(); } catch { /* expected: unknown at install -- only === 1 can fire */ }
   interval = setIntervalImpl(() => {
     let ppid;
     try { ppid = getPpid(); } catch { return; }
-    if (ppid === 1) shutdown('ppid-reparented');
+    if (ppid === 1 || (initialPpid !== null && ppid !== initialPpid)) shutdown('ppid-reparented');
   }, pollMs);
   interval.unref?.();
 

package/template/wall-e/lib/scheduler-worker-jobs.js

@@ -151,8 +151,10 @@ async function runSchedulerJob(jobName, payload = {}) {
         ));
         break;
       case 'memory-consolidation':
-        result = await _measurePhase(phases, 'memoryConsolidation.run', () => (
-          require('../memory/consolidation').runMemoryConsolidation({ brain })
+        // shared-memory D-5: derived from replicated rows — the derivation home only. This worker path
+        // is what production runs (agent.js's run wrapper is bypassed when the job is worker-routed).
+        result = await _measurePhase(phases, 'memoryConsolidation.run', () => require('./derivation-home').runIfHome(
+          'memory-consolidation', () => require('../memory/consolidation').runMemoryConsolidation({ brain }),
         ));
         break;
       case 'think':
@@ -183,12 +185,12 @@ async function runSchedulerJob(jobName, payload = {}) {
         const generateFn = reflectFallbackOnly
           ? null
           : createDailySummaryGenerateFn({ model: modelOverride?.model || undefined });
-        result = await _measurePhase(phases, 'reflect.runOnce', () => require('../loops/reflect').runOnce({
+        result = await _measurePhase(phases, 'reflect.runOnce', () => require('./derivation-home').runIfHome('reflect', () => require('../loops/reflect').runOnce({
           generateFn,
           allowProviderFallback: true,
           fallbackReason: reflectFallbackOnly ? 'provider_backpressure' : '',
           forceSummary: payload.forceSummary === true,
-        }));
+        }))); // shared-memory D-5: derivation home only (see memory-consolidation above)
         break;
       }
       case 'backfill':

package/template/wall-e/llm/delegate-lead-prefs.js

@@ -35,10 +35,19 @@ function parentLookupUnavailable() {
   })), { code: LOOKUP_UNAVAILABLE_CODE });
 }
 
+// §9 S-16 (opencode-lead-and-delegate-model-selection-2026-10-28.html §8 WP-5): the ladder is keyed
+// by the LEAD's OWN agent -- the agent of the session row the parent lookup resolved -- never by the
+// worker harness the caller happens to ask for. The store is the ONE owner of the agent list, so a
+// lead agent joins this derivation by joining store.AGENTS (dsh did, WP-10/P-6).
+const STORE_AGENTS = new Set(store.AGENTS);
+
 // `needSession: false` (the call named its own route/model) skips the CTM lookup: only the agent
 // default is still read, for the route tie-break.
 async function readLeadDelegatePrefs({ db, agent, parentAgentSessionId, lookupParent, timeoutMs, needSession = true } = {}) {
-  const leadAgent = agent === 'codex' ? 'codex' : 'claude';
+  // The historical derivation from the caller's worker harness: a Codex worker means a Codex lead
+  // asked, anything else a Claude one. It STAYS the fallback -- it is the only signal available when
+  // the parent lookup did not answer (no lookup, an unreachable CTM, or an unresolved lead).
+  let leadAgent = agent === 'codex' ? 'codex' : 'claude';
   const raw = String(parentAgentSessionId || '').trim();
   let ctmSessionId = '';
   let parentResolution = 'unresolved';
@@ -68,6 +77,12 @@ async function readLeadDelegatePrefs({ db, agent, parentAgentSessionId, lookupPa
       // (an older CTM, or a lead that is not live) stays unknown rather than being inferred, and a
       // lookup that resolved NO session has no running lead to describe -- unknown either way.
       nativeSubagentLaunch = ctmSessionId ? nativeLaunchConstraints(found && found.native_subagent_launch) : UNKNOWN_NATIVE_LAUNCH;
+      // S-16: the resolved LIVE lead's own harness is the ladder's agent whenever it is one the store
+      // keys on -- an OpenCode lead reads default:opencode and a DeepSeek Harness lead default:dsh,
+      // exactly as they wrote them. A value this module cannot classify (an older CTM, or a lead
+      // whose agent is not projected) leaves the derivation above in place rather than inventing an
+      // agent -- which is why CTM must PROJECT `dsh` in native_subagent_launch.agent (D-24).
+      if (nativeSubagentLaunch && STORE_AGENTS.has(nativeSubagentLaunch.agent)) leadAgent = nativeSubagentLaunch.agent;
     }
   }
   // The session row is read exactly ONCE, and the raw-id fallback above shares this one read: the

package/template/wall-e/llm/delegate-vendor-default.js

@@ -5,16 +5,23 @@
 // a route or model outranks all three and is handled by resolveDelegateArgs itself.
 //
 // VENDOR_DEFAULT is the bottom rung: what a plain delegate uses when nothing is stored.
-// These two model literals live HERE and nowhere else in server code; the skill templates
-// ask Wall-E (walle_delegate_implementation answers lane:'native') instead of carrying
-// their own copy.
+// The claude/codex model literals live HERE and nowhere else in server code; the skill
+// templates ask Wall-E (walle_delegate_implementation answers lane:'native') instead of
+// carrying their own copy. OpenCode carries no literal at all -- its rung is `inherit`.
 const VENDOR_DEFAULT = Object.freeze({
   claude: Object.freeze({ lane: 'native', model: 'sonnet' }),
   codex: Object.freeze({ lane: 'native', model: 'gpt-5.6-terra' }),
+  // OpenCode's own built-in subagents (`general`, `explore`) run on the model of the primary agent
+  // that invoked them unless their own config names one (https://opencode.ai/docs/agents/), so the
+  // bottom rung is INHERIT -- CTM names no model literal here. opencode-lead-and-delegate-model-
+  // selection-2026-10-28.html §6.5: the projection turns an inherit rung into no `model` key at all.
+  opencode: Object.freeze({ lane: 'inherit', model: '' }),
 });
 
+// An unknown/absent agent keeps the historical claude fallback: every existing caller (a bare
+// delegate, a Codex lead with no stored row) must fold exactly as it did before opencode existed.
 function vendorDefaultFor(agent) {
-  return VENDOR_DEFAULT[agent === 'codex' ? 'codex' : 'claude'];
+  return VENDOR_DEFAULT[agent] || VENDOR_DEFAULT.claude;
 }
 
 function rungValue(pref) {
@@ -26,7 +33,7 @@ function rungValue(pref) {
 
 /**
  * @param {{session?:object|null, default?:object|null}} prefs  stored rows (null/absent = unset)
- * @param {'claude'|'codex'} agent
+ * @param {'claude'|'codex'|'opencode'} agent
  * @returns {{effective:{lane,model,route_id,identity_id,display,effort,source}, ladder:Array<{rung,value}>}}
  */
 function foldDelegateLadder(prefs, agent) {

package/template/wall-e/llm/model-roles.js

@@ -289,6 +289,6 @@ async function recordRoleUsage({ task, response, model, providerId = null, provi
   });
 }
 
-module.exports = { ROLES, TASK_ROLE, roleForTask, resolveRoleModel, completeForRole, recordRoleUsage };
+module.exports = { ROLES, TASK_ROLE, MAX_COMPLETION_TOKENS, roleForTask, resolveRoleModel, completeForRole, recordRoleUsage };
 // Test seam (non-enumerable, so the public surface stays the seven names above).
 Object.defineProperty(module.exports, '_detectFallbackFrom', { value: _detectFallbackFrom, enumerable: false });

package/template/wall-e/llm/native-delegate-selection.js

@@ -37,6 +37,10 @@
 // `kind:'routed'` model is the launch-time CONFIGURED TARGET snapshot: that launch's native role
 // forces the reserved worker alias and the live target may have moved since, so it describes what
 // was configured at launch, never the model a subagent actually consumed.
+//
+// ONE LEAD HARNESS HAS NO NATIVE LANE AT ALL: a DeepSeek Harness lead (D-24). CTM cannot pin the
+// model of dsh's own sub-agent tool, so its native answer is refused by the lead's own harness
+// before any pin is compared -- see DSH_LEAD_AGENT below.
 
 // Reason codes (the `error` field of a typed refusal; the MCP layer renders them as text).
 const NATIVE_SELECTION_REQUIRES_RELAUNCH = 'native_selection_requires_relaunch';
@@ -48,7 +52,24 @@ const RELAUNCH_NEXT_STEP = 'Relaunch the lead to apply its native pick, or expli
 // pick / vendor rung) and `unservable` (a pick CTM refused to install) are deliberately absent:
 // they pin nothing, so a requested model is not overridden by them.
 const PINNING_KINDS = new Set(['native', 'routed', 'inherit']);
-const KNOWN_AGENTS = new Set(['codex', 'claude']);
+// WP-5 (§9 S-20, opencode-lead-and-delegate-model-selection-2026-10-28.html §8): an OpenCode lead is
+// a live lead too, and its native helper runs on OpenCode, so its harness and its pin are reported
+// through exactly this sanitizer. The tool does NOT accept `opencode` as a worker harness (that
+// anti-goal is unchanged) -- see the harness comparison below for what that means. dsh joins the
+// same way (WP-10/P-6): its harness is reported here so D-24's refusal below can key on it.
+const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'dsh']);
+// The harnesses a caller can actually REQUEST through walle_delegate_implementation
+// (normalizeWorkerExecutionOptions). A lead harness outside this set (OpenCode) can never be equal
+// to a request, so comparing against it would report every native answer as a cross-harness
+// mismatch and hide the model/effort pin conflict this module exists to surface (AC-5c).
+const REQUESTABLE_HARNESSES = new Set(['codex', 'claude']);
+// D-24 (deepseek-harness-acp-agent-2026-10-28.html §5b, WP-10): a DeepSeek Harness lead delegates
+// through ROUTED WORKERS ONLY. CTM cannot pin the model of dsh's own sub-agent tool, so no native
+// answer describes anything a dsh lead could spawn: every native answer for it is the typed mismatch
+// refusal below -- never a Claude model, never a silent substitution, and never a fallback to
+// another lane. Unlike the OpenCode case there is no "same harness" native answer to preserve.
+const DSH_LEAD_AGENT = 'dsh';
+const DSH_ROUTED_ONLY_NEXT_STEP = 'A DeepSeek Harness lead delegates through routed workers only: name route/model (or route alone) to run an explicitly routed claude/codex worker.';
 // 'inherit' is the Claude native lane's own literal for "same model as the lead" (CTM's
 // resolveFromEffectivePref); a request for it matches an already-inheriting launch, so it is
 // never treated as a specific model a routed alias/FORCE would override.
@@ -67,9 +88,10 @@ function _token(value, max = MAX_TOKEN_LENGTH) {
 /**
  * The sanitized descriptor of a lead's applied native launch constraints. PURE.
  * @param {unknown} launch whatever arrived as native_subagent_launch (or nothing at all)
- * @returns {{state:'known',agent:'codex'|'claude',kind:string,model:string,effort:string|null}
- *   | {state:'unknown',agent?:'codex'|'claude'}} exactly these keys, nothing else: an unknown pin
- *   keeps the lead's own harness (`agent`) when it is known, and only `state` when it is not
+ * @returns {{state:'known',agent:'codex'|'claude'|'opencode'|'dsh',kind:string,model:string,effort:string|null}
+ *   | {state:'unknown',agent?:'codex'|'claude'|'opencode'|'dsh'}} exactly these keys, nothing else:
+ *   an unknown pin keeps the lead's own harness (`agent`) when it is known, and only `state` when it
+ *   is not
  */
 function nativeLaunchConstraints(launch) {
   if (!launch || typeof launch !== 'object' || Array.isArray(launch)) return { state: 'unknown' };
@@ -120,11 +142,36 @@ function checkNativeDelegateSelection({ launch, resolved, agent, effort } = {})
   const constraints = nativeLaunchConstraints(launch);
   const requestedAgent = agent === 'codex' || agent === 'claude' ? agent : '';
 
+  // D-24 FIRST, for EVERY native answer whose lead harness is dsh -- a known pin, an unknown one, or
+  // bare launch metadata alike (this module is only ever consulted for a native answer). There is no
+  // native configuration a DeepSeek Harness lead could run, so no pin comparison could ever make the
+  // answer acceptable: the refusal is the lead's own harness, not a conflict with what was asked
+  // for. Nothing is substituted -- the remedy is an explicitly routed worker.
+  if (constraints.agent === DSH_LEAD_AGENT) {
+    return {
+      ok: false,
+      constraints,
+      refusal: {
+        error: NATIVE_DELEGATE_HARNESS_MISMATCH,
+        // Only reported when the call actually named a worker harness: the refusal does not depend
+        // on one (a bare call is refused the same way), and an empty string would name nothing.
+        ...(requestedAgent ? { requested_agent: requestedAgent } : {}),
+        configured_agent: DSH_LEAD_AGENT,
+        reason: 'lead_routed_only',
+        next_step: DSH_ROUTED_ONLY_NEXT_STEP,
+      },
+    };
+  }
+
   // HARNESS FIRST, whenever the ACTUAL lead harness is known -- including an unknown pin, where
   // the harness is still a known fact. A native helper runs on the lead's own harness, so a
   // cross-harness request is the one refusal a relaunch cannot fix: the remedy is an explicitly
   // routed worker. Nothing about the pin is claimed by this refusal.
-  if (requestedAgent && constraints.agent && requestedAgent !== constraints.agent) {
+  //
+  // Only compared when the lead's harness is one the caller could have requested at all
+  // (REQUESTABLE_HARNESSES): an OpenCode lead's harness can never equal a request, and refusing
+  // there would mask the pin conflict with an unfixable-by-relaunch harness error (AC-5c).
+  if (requestedAgent && REQUESTABLE_HARNESSES.has(constraints.agent) && requestedAgent !== constraints.agent) {
     return {
       ok: false,
       constraints,
@@ -178,9 +225,10 @@ function checkNativeDelegateSelection({ launch, resolved, agent, effort } = {})
   // Codex native children get a role-file effort; a known NON-EMPTY effort the caller does not
   // ask for cannot be changed without a relaunch. An EMPTY configured effort is a known "no role
   // override", and an EMPTY requested effort means the call named none -- the CLI's own
-  // inheritance/default decides it, so neither is a claim about the other. Claude applies no
-  // native role effort at all, so Claude is never refused on effort; a NULL configured effort is
-  // unknown and never claimed equal to the requested one.
+  // inheritance/default decides it, so neither is a claim about the other. Only Codex installs a
+  // native role effort (Claude does not, and an OpenCode or DeepSeek Harness lead was answered
+  // above), so no other harness is refused on effort; a NULL configured effort is unknown and never
+  // claimed equal to the requested one.
   if (constraints.agent === 'codex' && (constraints.kind === 'native' || constraints.kind === 'routed')
       && constraints.effort && constraints.effort !== requestedEffort) {
     return {

package/template/wall-e/llm/worker-delegate-args.js

@@ -31,6 +31,15 @@ function isExactModelOnRoute(model, routes, route) {
   return Boolean(row && Array.isArray(row.models) && row.models.includes(model));
 }
 
+// WP-2 fix round 1 (§5 D-6): the one origin-refusal sentence tail, shared by the stored-pick
+// and default-rung branches so both read identically -- the route IS configured; this machine
+// just cannot dial its origin -- and both name the origin and when it was probed.
+function originRefusalClause(ex) {
+  const origin = ex.origin || 'unknown';
+  const checked = ex.checked_at ? `, checked ${ex.checked_at}` : '';
+  return `cannot be reached from this machine (origin ${origin}${checked}) -- name a route this machine can reach, or pick one in the model picker`;
+}
+
 // WP-1 §6.2, §9 S-2: renders a resolver failure ({ok:false, code, candidates?|tried?})
 // as a structured, readable tool error -- route ids and model ids only, never a
 // provider name or credential. The caller throws this so handleMcpMessage's generic
@@ -55,9 +64,16 @@ function delegateArgsError(code, payload) {
     // worker route feed at all (gone/not configured or carrying no enabled
     // models) -- say that, not "cannot serve agent X" (which reads as a
     // serve-time refusal of a route that exists).
-    detail = safe.cause === 'route_unavailable'
-      ? `The default route ${route} is unavailable right now (not in the worker route feed: no enabled models or not configured) -- name one of eligible[] as route/model`
-      : `The default route ${route} cannot serve agent ${safe.agent || ''} -- name one of eligible[] as route/model`;
+    // WP-2 fix round 1 (§5 D-6): an ORIGIN refusal is a third, different truth --
+    // the route IS configured and served, this machine just cannot dial its
+    // origin -- so it gets its own sentence rather than the "not in the feed" one.
+    const ex = Array.isArray(safe.excluded) ? safe.excluded[0] : null;
+    const originClause = ex && ex.reason === 'origin_unreachable' ? originRefusalClause(ex) : null;
+    detail = originClause
+      ? `The default route ${route} ${originClause}`
+      : safe.cause === 'route_unavailable'
+        ? `The default route ${route} is unavailable right now (not in the worker route feed: no enabled models or not configured) -- name one of eligible[] as route/model`
+        : `The default route ${route} cannot serve agent ${safe.agent || ''} -- name one of eligible[] as route/model`;
   } else if (code === 'delegate_pref_unresolvable') {
     const pref = safe.pref || {};
     // WP-0 (§5 D-1/D-2): the stored pick hit the health gate -- the sentence
@@ -68,6 +84,11 @@ function delegateArgsError(code, payload) {
     const ex = Array.isArray(safe.excluded) ? safe.excluded[0] : null;
     if (safe.cause === 'route_unavailable' && pref.route_id && ex && (ex.reason === 'circuit_open' || ex.reason === 'throttled')) {
       detail = `The stored ${safe.source || ''} delegate route "${pref.route_id}" ${ex.reason === 'throttled' ? 'is throttled' : 'has an open circuit'} (${retryPhrase(ex.retry_after_ms)}) -- wait, pick another route in the model picker, or name a model in the call`;
+    } else if (safe.cause === 'route_unavailable' && pref.route_id && ex && ex.reason === 'origin_unreachable') {
+      // WP-2 fix round 1 (§5 D-6): the route IS configured -- this machine cannot dial
+      // its origin. The "no longer configured" sentence below would be a lie here, and
+      // the lead needs to know WHICH origin and when it was probed.
+      detail = `The stored ${safe.source || ''} delegate route "${pref.route_id}" ${originRefusalClause(ex)}`;
     } else if (safe.cause === 'route_unavailable' && pref.route_id) {
       // D-7 (§6.4): a gone pref route_id names the route, not a model phrase -- the sentence
       // points at the picker where that id was written, never at a re-resolved model.
@@ -159,6 +180,16 @@ function routeHealthRefusal(route, model, identityCtx) {
   return null;
 }
 
+// WP-2 (§5 D-6): the second input to the health gate -- the box's OWN origin verdict for the stored
+// pick's route. Only an explicit `unreachable`/`no_server` refuses; `unknown`, a missing row, or no
+// availability at all is "no gate" (the delegation may still fail later as upstream_unready, which
+// is the pre-WP-2 behaviour). Explicit `model`/`route` arguments never pass through here (D-7).
+function originReachabilityRefusal(route, availability) {
+  const row = availability && Array.isArray(availability.routes) ? availability.routes.find((r) => r && r.id === route) : null;
+  if (!row || (row.reach !== 'unreachable' && row.reach !== 'no_server')) return null;
+  return { registry_id: route, reason: 'origin_unreachable', origin: row.origin || null, reach: row.reach, checked_at: availability.checkedAt || null };
+}
+
 // L-3: one offer per ROUTE (never one per model), at most MAX_ELIGIBLE_ROUTES, ordered so a lead
 // can pick from the top: keyed before keyless, direct providers before gateway integration rows,
 // then route id. A route has no per-route default model (only the per-agent default delegate
@@ -173,7 +204,10 @@ function eligibleRouteOffers(listing, agent, identityCtx = null) {
     if (seen.has(row.route) || row.models.length === 0) return false;
     seen.add(row.route);
     return true;
-  }).filter((row) => routeHealthRefusal(row.route, row.model || (row.models && row.models[0]) || '', identityCtx) === null);
+  }).filter((row) => routeHealthRefusal(row.route, row.model || (row.models && row.models[0]) || '', identityCtx) === null)
+    // WP-2 (§5 D-6): an offer the box's own origin probe calls unreachable is not an
+    // offer -- naming it back would round-trip to the same refusal.
+    .filter((row) => originReachabilityRefusal(row.route, identityCtx && identityCtx.availability) === null);
   const keyed = (row) => row.has_credential !== false;
   const rank = (row) => (keyed(row) ? 0 : 2) + (row.gateway === true ? 1 : 0);
   rows.sort((a, b) => rank(a) - rank(b) || (a.route < b.route ? -1 : a.route > b.route ? 1 : 0));
@@ -311,6 +345,26 @@ function resolveFromEffectivePref(effective, agent, listing, registryModels, ide
     }
     return unresolvablePref(effective, 'route_unavailable', { excluded, offers });
   }
+  // WP-2 (§5 D-6/D-7): the stored pick's route exists and serves the agent, but this
+  // machine's own origin probe says it cannot be reached -- refuse NOW with the same
+  // route_unavailable shape (and offers[] filtered by the same verdict), instead of
+  // letting CTM die later as a raw 503 upstream_unready, after launch work. The
+  // explicit path (resolveRoutedPair with caller-given route/model) never reaches here.
+  const originRefusal = originReachabilityRefusal(routeId, identityCtx && identityCtx.availability);
+  if (originRefusal) {
+    if (source === 'default') {
+      return {
+        ok: false, code: 'default_route_not_servable', source, agent, cause: 'route_unavailable',
+        default: { route: routeId, model: effective.model, agents: [] },
+        // WP-2 fix round 1: carry the WHY (this machine cannot reach the origin) and the
+        // origin itself -- without it the sentence could only say "unavailable right now",
+        // and the lead could not tell an unreachable origin from a route gone from the feed.
+        excluded: [originRefusal],
+        eligible: eligibleRouteOffers(listing, agent, identityCtx),
+      };
+    }
+    return unresolvablePref(effective, 'route_unavailable', { excluded: [originRefusal], offers: eligibleRouteOffers(listing, agent, identityCtx) });
+  }
   const resolved = resolveRoutedPair(agent, routeId, effective.model, listing, registryModels, identityCtx);
   if (!resolved.ok) {
     const { ok: _ok, code, ...detail } = resolved;
@@ -324,25 +378,36 @@ function resolveFromEffectivePref(effective, agent, listing, registryModels, ide
  * Precedence (lead-and-delegate-model-picker-ux-2026-10-08.html D-9): a route/model named in the
  * call > the lead's session pick > the default for its agent > the vendor default. Every success
  * names its rung as `source` ('explicit' | 'session' | 'default' | 'vendor') and its `lane`.
+ *
+ * §9 S-16 (opencode-lead-and-delegate-model-selection-2026-10-28.html §8 WP-5): `prefs.agent` is the
+ * LEAD's own agent (what readLeadDelegatePrefs resolved the parent session row to). It keys the
+ * LADDER; `args.agent` stays the worker HARNESS every resolved pair is checked against, so an
+ * OpenCode lead's stored default:opencode/session pick still launches a claude-code or codex-cli
+ * worker. An absent/unrecognized prefs.agent keeps today's derivation from args.agent exactly.
  * @param {{route?:string, model?:string, agent?:'claude'|'codex'}} args   caller-given delegate args
  * @param {{default:{route,model}, routes:Array}} listing   buildWorkerRoutesResult() shape
  * @param {Array} [registryModels]   GET /api/models/registry rows, forwarded to resolveWorkerModel
  * @param {object} [identityCtx]   resolveWorkerModel's identity-tier ctx
- * @param {{session?:object|null, default?:object|null}} [prefs]   stored delegate_model_prefs rows
+ * @param {{session?:object|null, default?:object|null, agent?:'claude'|'codex'|'opencode'}} [prefs]
+ *   stored delegate_model_prefs rows (+ the lead agent that keys them)
  * @returns {{ok:true, lane:'routed', route, model, source} | {ok:true, lane:'native', model, source}
  *   | {ok:false, code:'model_unknown'|'model_ambiguous'|'route_unavailable'|'default_route_not_servable'|'delegate_pref_unresolvable', ...}}
  */
 function resolveDelegateArgs(args, listing, registryModels, identityCtx, prefs) {
   const agent = args && args.agent === 'codex' ? 'codex' : 'claude';
+  // S-16: the ladder is the LEAD's; the harness is the WORKER's. An OpenCode lead folds
+  // default:opencode (or its own session rung) while the resolved worker harness stays claude/codex.
+  const ladderAgent = prefs && (prefs.agent === 'codex' || prefs.agent === 'claude' || prefs.agent === 'opencode')
+    ? prefs.agent : agent;
   const route = args && args.route;
   const model = args && args.model;
 
   if (!route && !model) {
-    const { effective } = foldDelegateLadder(prefs, agent);
+    const { effective } = foldDelegateLadder(prefs, ladderAgent);
     return resolveFromEffectivePref(effective, agent, listing, registryModels, identityCtx);
   }
   const resolved = resolveRoutedPair(agent, route, model, listing, registryModels, identityCtx);
   return resolved.ok ? { ...resolved, lane: 'routed', source: 'explicit' } : resolved;
 }
 
-module.exports = { resolveDelegateArgs, isExactModelOnRoute, delegateArgsError, routeThrottledError, briefRefusalError };
+module.exports = { resolveDelegateArgs, isExactModelOnRoute, delegateArgsError, routeThrottledError, briefRefusalError, originReachabilityRefusal };