create-walle 0.10.2 → 0.10.3

package/template/wall-e/shared/sqlite-file-set.js

@@ -0,0 +1,39 @@
+'use strict';
+
+// One SQLite database file is really a SET: the base file plus the sidecars SQLite creates
+// beside it — a rollback journal (`-journal`) or, in WAL mode, `-wal` + `-shm`. A write that
+// dies partway (ENOSPC, a terminated process, a failed online backup) can strand ANY of them,
+// and a stray sidecar is worse than useless: a `-wal` with no base, or a base with a stale
+// `-wal`, is garbage no reader can recover.
+//
+// Canonical: coding-task-manager/lib/sqlite-file-set.js — byte-identical copy at
+// wall-e/shared/sqlite-file-set.js. Two copies because a standalone Wall-E install has no CTM
+// checkout (wall-e/agent.js loads CTM libs only as optional), so each package requires its own;
+// tests/sqlite-file-set-parity.test.js fails the moment the two drift.
+//
+// Design: coding-task-manager/docs/temp-file-leaks-disk-full-2026-10-25.html §5 D-5.
+
+/** The base name plus every sidecar of one SQLite database file, in unlink order. */
+const SQLITE_SIDECARS = Object.freeze(['', '-journal', '-wal', '-shm']);
+
+/** Unlink `p` and each SQLite sidecar of `p` (`-journal`, `-wal`, `-shm`).
+ * ENOENT is the normal case — a sidecar only exists while a writer holds it — and is ignored;
+ * any other failure (EACCES, EISDIR, EPERM, …) is rethrown rather than swallowed, because a
+ * file set that survived cleanup is exactly the disk leak this helper exists to prevent.
+ * Returns the number of files actually removed. */
+function removeSqliteFileSet(p, fsModule = require('fs')) {
+  if (!p) return 0;
+  let removed = 0;
+  for (const suffix of SQLITE_SIDECARS) {
+    try {
+      fsModule.unlinkSync(`${p}${suffix}`);
+      removed += 1;
+    } catch (err) {
+      if (err && err.code === 'ENOENT') continue; // HANDLE: sidecar absent — nothing to reclaim
+      throw err; // RETHROW: a real unlink failure must not be swallowed
+    }
+  }
+  return removed;
+}
+
+module.exports = { SQLITE_SIDECARS, removeSqliteFileSet };

package/template/wall-e/shared/storage/contract.js

@@ -783,6 +783,9 @@ const OP_META = {
   recordResumeLineage: { kind: 'write', equality: 'exact', domain: 'firehose', tables: ['session_resume_lineage'] },
   // WP-0 change feed: the ACK is a write on the firehose file (db.js:19895).
   ackConversationChanges: { kind: 'write', equality: 'exact', domain: 'firehose', tables: ['conversation_projection_outbox_v2', 'conversation_projection_deletes_v2'] },
+  conversationSyncVector: { kind: 'write', equality: 'exact', domain: 'firehose', tables: ['conversation_item_clock', 'conversation_vv', 'conversation_local_seq'] },
+  conversationSyncChanges: { kind: 'write', equality: 'exact', domain: 'firehose', tables: ['conversation_item_clock', 'conversation_vv', 'conversation_local_seq'] },
+  conversationSyncApply: { kind: 'write', equality: 'exact', domain: 'firehose', tables: ['conversation_text_items_v2', 'conversation_item_placement_v2', 'conversation_item_clock', 'conversation_vv'] },
   // --- core (session identity, user content, runtime control state; latency-critical) ---
   updateRuntimeInputEnvelope: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_runtime_input_envelopes'] },
   upsertRuntimeRouteSnapshot: { kind: 'write', equality: 'exact', domain: 'core', tables: ['ctm_runtime_route_snapshots'] },

package/template/wall-e/skills/_templates/delegate-worker/VERSION

@@ -1 +1 @@
-4.7.0
+4.10.0

package/template/wall-e/skills/_templates/delegate-worker/released-sha256.json

@@ -8,6 +8,7 @@
     "120cc88fa7b15ca0b75cf68873cde02bf56f867331e45a545589062b87127a89": "4.6.0",
     "14d6d156625905d0b7ed12dea1c2131edc62146f61b6f9fd187a422773d7f300": "4.4.0",
     "24a429b3c1b3651cad34317fd74d574ddb2f4863252b60db0d6b3b76050607f5": "3.8.0",
+    "2ecdb1decba4e62cdece71d04f9cc7efb24fff090f354a8454556f4fef48ce67": "4.9.0",
     "31e405815c6010db8a90897d69b6448dfd4c3b21cc464e5b447ab43e60f6c69e": "3.1.0",
     "3a45ab5330bd7788c847f270e017780e247a47c9733bfda056e0712bf620c4c7": "3.2.0",
     "3c1cbc22b9bae7b43ffb137dc4b0016f060dbb40f0af7e1781a3a529ab8cb37c": "3.9.0",
@@ -26,6 +27,7 @@
     "c5c66a11c5262014f58b127c4b7e21e0cfaf1179f2678ee6dc6a922d27362cbe": "4.2.0",
     "c9e6f75ab694bbd66c841979fe2468db2c57177d6cfc18ea4eb97e034e5d98dc": "4.7.0",
     "d9d6e3687ff5f626258f0b629e74829719df82bfcc25e079456bdd667e30abb8": "3.2.1",
+    "e1319535a212b2742b0f30ab8cb4da2e633731ab18178ccb140c763a41b8b659": "4.8.0",
     "e22741fb1233863289757660b546691b7bfd70d21f3f641d82b743324c335f9c": "3.4.0",
     "eba2b4dea2eb856fe3933be618730f75f8fc3c38c554e3a6063438bafa41d368": "4.6.0",
     "f9f97478a323efc6a9a936c2ea4731d85b1a778cfc3a476889c6883ec0a35051": "4.3.0"
@@ -40,10 +42,13 @@
     "3e5db71601f075a303a1a7442cc1fbac11a37362e60fd25b717e86b180c177cc": "4.7.0",
     "3ea78bdc6c5cd377e01b2061f63a4586e4859159f5c771eafea7ca0e984c8969": "4.2.0",
     "4461f6ebdf10398b6529bff84f3cd3b4145f2935fd3a5f0f1efe38ab52b2c871": "4.6.0",
+    "4539af0aa8583e4fa2c110ac0cb63c4020daf828c6f644df21b5d8121a802dd7": "4.9.0",
+    "52f3939669f3e745353e1258b8af10b3e1f5e7a4cf3c5bf28f9a7a7c1c88f678": "4.9.0",
     "56a9df7b9a49e7a47abadfa6c026ee599bf12f6a3cc5fc9370bfdc776f46e835": "3.4.0",
     "576083d2286162eed343150f0a28305863fb7773960f2618ddb033c6d2e1f306": "3.8.0",
     "5f9eb74ee52154661e2d572269b121b45d5d76e42989a091fa83086ba5eef3ec": "4.6.0",
     "60a96b080de8243321fb68c76d664d5be9cb9983c3088e64b31da8b53b8bca5b": "4.3.0",
+    "634db6600a0e3e226853bdbc4d04f1eab55c8a618b34d4882928a8f955b1face": "4.10.0",
     "75be2666f123930e7f655ad03ed6e18b512c8349bc1cca8af7a92699616e1074": "3.2.1",
     "7de463c9f1647140a636b5155c2291c2df207e088d109ca7db6d16d2591fd948": "3.5.0",
     "7ed8beb72c6dba2f61ffd3361372979c7d44d3a03ed4356aa575793a01990554": "4.5.0",
@@ -58,6 +63,7 @@
     "e1a85b80e419b38459a45c5d6c4884931b97b10a1e4e6a352af626f7a40dcd9d": "4.0.0",
     "ec5795da484f31c96c1ceca74fc10431d274232b8f7124707ea07a373fc759b6": "3.9.0",
     "efbffbadfbd8f04114c383d9b6e17812bee91f6d24c5ac39922a0fa7b3126e95": "4.1.0",
-    "f0ae3c1202b2c2e84aa18ed4da5d4e2f519b81f3517b0dc7df81f1e4190fc257": "3.2.0"
+    "f0ae3c1202b2c2e84aa18ed4da5d4e2f519b81f3517b0dc7df81f1e4190fc257": "3.2.0",
+    "ff749fae03d3521960c55b9ddaa014543c54f2f645f6c29d4ad653fc022b9615": "4.8.0"
   }
 }

package/template/wall-e/skills/_templates/delegate-worker/templates/claude/SKILL.md

@@ -32,7 +32,7 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
   - `lane: "native"` — Wall-E launched nothing; spawn the helper yourself. Call the Agent tool with `subagent_type: "general-purpose"`, `model: <result.model>` (when `result.model` is `"inherit"`, omit `model`: the helper then runs on the lead's own model), `effort: <result.effort>` only when `result.effort` is non-empty, and a prompt that says only: read the brief at `<brief path>` first, follow it, and write the report to `<report path>`. Before calling, check the Agent runtime tool's supported worker models. Use `result.model` only when it is supported; if unavailable, state that and request a supported choice instead of substituting another model. Keep the lead's model and auth unchanged. Report the model and its `source` (`session` = your session pick, `default` = your stored Claude default, `vendor` = the vendor default).
   - `lane: "routed"` (or a worker result carrying `ctm_session_id`) — Wall-E launched a routed worker from the stored pick. Do not call it again; continue with the routed lane's wait and review steps below, and report the actual route, model, harness, and `source`.
   - `delegate_pref_unresolvable` — the stored pick no longer resolves. Show the stored pick (`pref.model`), its `source`, and the `cause`, then stop. Offer to name a model for this task or to reset the pick in the picker, and wait for the user's word. Never fall back to another model silently.
-  - `walle_delegate_implementation` unavailable or Wall-E unreachable — say so, and tell the user their stored pick could not be read. Only after telling them, the native lane may then run without a `model` override (the CLI's own default sub-agent model); otherwise wait for the user's word. Never claim the pick was honoured.
+  - `walle_delegate_implementation` unavailable or Wall-E unreachable — say so, and tell the user their stored pick could not be read. "Unavailable" here means only that the tool is not mounted, or the call returned no JSON-RPC result (a transport error). Only in that case, after telling them, the native lane may then run without a `model` override (the CLI's own default sub-agent model); otherwise wait for the user's word. Never claim the pick was honoured. A returned error code (caller_*, worker_not_owned, delegate_pref_unresolvable, route_*, model_*) is a refusal, not unavailability: report it and wait for the user's word; never spawn a native helper because of a refusal.
 - **Model phrase → routed lane.** Call `walle_delegate_implementation({ brief_path, cwd, model: "<phrase>", agent: "claude", worker_profile: 'implementation' })`. `agent` selects the CLI harness, never the model identity. The Wall-E MCP proxy supplies your caller identity for you; never pass an identity argument. Wall-E resolves the explicit model/route phrase against the registry and the result names the `route` and `model` actually used; report the actual route, model, and harness returned. If the user also named where it runs, pass it as `route` or write it into the phrase after `on`: an exact route id (`on <route-id>`, e.g. `"glm 5.2 fp8 on portkey-int-example-modal"`), a class (`on portkey` for any Portkey-served route, `on direct` for a vendor-direct route), a connector type (`on modal`, `on bedrock`, `on vertex`), or tenant words (`on team-test`). A qualifier inside the phrase wins over the `route` argument. The result's `chosen.reason` starts with `pinned` when the qualifier was honoured; report the actual route it chose, since a class or type may cover several routes. Do not silently choose an alternate model or a quantized variant. The result's `source` is `explicit`.
 - If the result is `model_ambiguous`, show the candidates (or, for a phrase that named a family with several distinct models, the candidate identities) and stop. If it is `model_unknown`, `route_not_servable`, `codex_home_symlinked`, or `walle_delegate_implementation` is unavailable, say so and do not substitute a model silently or claim delegation occurred. You may offer an alternative (another route, or the native lane) and wait for the user's word.
 - If the result is `route_unavailable`, the model is known but every one of its routes is currently unhealthy (circuit open, throttled, or not servable for this agent) — show `excluded[]`'s reasons (and `retry_after_ms` where present) and `offers[]` (variant/backup routes you could name explicitly, e.g. the fp8 tenant Modal routes when the direct route is down), then wait for the user's word before retrying on a named offer. Never silently pick an offer yourself. When `excluded[]` carries reason `route_not_found`, the word after `on` matched no route id, class, connector type or tenant token — `excluded[0].tried` lists the tiers and `offers[]` names the routes that exist; show them and wait for the user's word.
@@ -43,7 +43,7 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
 
 - A provisional report while the process is alive is not completion. On clean terminal `exited`, a readable `report_source:'final_result'` or `last_message` is usable evidence even without a report file; inspect it and tests/diff without claiming the report file existed. On terminal `failed`, report `failure.class` and `failure.code`. Quota holds stop retries until a trustworthy reset or a separately verified generation readiness probe; no model substitution.
 - A 400 `brief_references_missing_paths` / `brief_placeholder_unknown` means the brief is wrong, not the worker: fix the named paths and redelegate.
-- Caller-door refusals are identity and authority checks, not worker failures — do not retry the same call and do not work around them: `caller_unresolved` — "Delegate from inside a CTM-launched lead session; the Wall-E stdio proxy supplies your identity." `caller_unauthenticated` — "This route needs the CTM runtime bearer; call it through the Wall-E MCP tools, not directly." `worker_not_owned` — "Only the lead that created this worker can resume or wait on it; ask that lead, or delegate your own worker." When `caller_unauthenticated` carries `data.cause`, report the cause — `proxy_token_missing`: "The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) at boot and before each CTM Codex launch; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand." `non_loopback_daemon`: "The Wall-E daemon for this session is not on loopback, and the runtime bearer is only sent to a loopback daemon (F1b-1). Routed delegation needs a local Wall-E; use the native lane or a CTM-launched session on this host." — then tell the user the session must be restarted and wait for their word; never retry the call, never edit config.toml, never switch to another lane silently.
+- Caller-door refusals are identity and authority checks, not worker failures — do not retry the same call and do not work around them: `caller_unresolved` — "Delegate from inside a CTM-launched lead session; the Wall-E stdio proxy supplies your identity." `caller_unauthenticated` — "This route needs the CTM runtime bearer; call it through the Wall-E MCP tools, not directly." `worker_not_owned` — "Only the lead that created this worker can resume or wait on it; ask that lead, or delegate your own worker." When `caller_unauthenticated` carries `data.cause`, report the cause — `proxy_token_missing`: "The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) when Wall-E starts; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand." `non_loopback_daemon`: "The Wall-E daemon for this session is not on loopback, so routed delegation is unavailable from here. Tell the user and wait for their word; do not substitute a native helper." — then tell the user the session must be restarted and wait for their word; never retry the call, never edit config.toml, never switch to another lane silently.
 
 ## Lead: read-only review work
 
@@ -64,7 +64,7 @@ Give the worker these requirements in its brief:
 - Implement the scoped change and run the relevant focused tests. For a regression, demonstrate the failure before the fix where practical.
 - Resolve harness problems only inside your owned files. If a needed edit falls outside them, or a ratchet lint fails on an owned file, stop and report the file and the required change; never compact or refactor to satisfy a lint. Starting a server or proposing a fix is not completion.
 - Return the changed files, explanation, exact test commands and outcomes, evidence artifacts, and unresolved concerns. Distinguish passed, failed, skipped, and unmeasured checks.
-- Do not commit, merge, push, deploy, restart shared services, or run aggregate repository gates unless the lead explicitly assigns an authorized action.
+- Do not commit, merge, push, deploy, restart shared services, or run aggregate repository gates unless the lead explicitly assigns an authorized action. A worker may run `land submit` only when its brief says so.
 - This is a subtask, not final task sign-off. The lead owns repository-wide verification; do not independently start duplicate full-suite runs.
 
 Use additional workers only for independent, useful subtasks with clear ownership. Avoid overlapping edits and shared browser artifact directories.
@@ -83,7 +83,7 @@ Use additional workers only for independent, useful subtasks with clear ownershi
 - Personally read the final diff and relevant surrounding code. Review correctness, simplicity, security, compatibility, and whether the tests exercise the actual failure.
 - Inspect the evidence, not just the worker's summary. A test that never reached its assertion, skipped, or only checked a stub is not proof of the intended behavior.
 - Send concrete findings back to the same worker for correction and focused retesting — `walle_resume_worker({ ctm_session_id, message })` on the routed lane, or resume the same Agent on the native lane. Routed resume starts a new process generation on the same provider transcript with new auth. `accepted` proves process start only: poll for actual agent consumption/new generation activity and the terminal report. A recorded envelope or stale report alone is not success. Report busy, missing-transcript, and quota failures explicitly. The budget is a bounded lease that CTM renews while the worker progresses; never raise it yourself. Review the resulting changes again; retain responsibility for the final decision.
-- Once the implementation is stable, own and run the required aggregate checks. Coordinate these with commit hooks and other workers to avoid unnecessary concurrent or repeated suites. Never bypass required checks.
+- Once the implementation is stable, own and run the required aggregate checks. To integrate, commit and run `land submit`; the queue serializes gates, so never start a second gate for the same tip. Never bypass required checks.
 - If the user requested a commit or integration, use `tl-commit` after review and verification, honoring the requested target such as local `main`. This skill alone does not authorize commits, pushes, deployment, or service restarts.
 - Sign off only when required work is complete and blocking findings are resolved. Report what changed, what was verified, any material limitations, and the actual integration/deployment state. Do not claim a locally committed fix is live without verifying activation.
 - Report the `execution_profile` the result returned (route, model, harness, and the five limits with their sources) in the delegation summary.

package/template/wall-e/skills/_templates/delegate-worker/templates/codex/SKILL.md

@@ -27,10 +27,10 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
 ## Lead: choose the lane
 
 - **No model phrase → ask Wall-E which lane.** First call `walle_delegate_implementation({ brief_path, cwd, agent: "codex", worker_profile: 'implementation' })` WITHOUT `model` or `route`. The Wall-E MCP proxy supplies your caller identity for you; never pass an identity argument. Wall-E applies the lead's delegate pick (the session pick, then the stored default for this agent, then the vendor default) and the result names the `lane` and the `source` that decided. Branch on the result:
-  - `lane: "native"` — Wall-E launched nothing; spawn the helper yourself. Call `spawn_agent` with `model: <result.model>` (when `result.model` is `null`, omit `model`), `reasoning_effort: <result.effort>` only when `result.effort` is non-empty, `fork_turns: "none"`, a short `task_name`, and a prompt that says only: read the brief at `<brief path>` first, follow it, and write the report to `<report path>`. Then `wait_agent`. Call `spawn_agent` with `result.model` even when the `spawn_agent` tool description does not list it: Codex lists only the first 5 picker-visible models there, but `spawn_agent` accepts every model in the catalog (codex-rs/core/src/agent/child_config.rs, `MAX_SPAWN_AGENT_MODEL_OVERRIDES = 5`, `find_spawn_agent_model_name`). Only an `Unknown model` error from `spawn_agent` proves a model is unavailable; then state the refusal and request a supported choice instead of substituting another model. Keep the lead's model and auth unchanged; `fork_turns: "none"` preserves the no-parent-history briefing. Report the model and its `source` (`session` = your session pick, `default` = your stored Codex default, `vendor` = the vendor default).
+  - `lane: "native"` — Wall-E launched nothing; spawn the helper yourself. Call `spawn_agent` with `model: <result.model>` (when `result.model` is `null`, omit `model`), `reasoning_effort: <result.effort>` only when `result.effort` is non-empty, `fork_turns: "none"`, a short `task_name`, and a prompt that says only: read the brief at `<brief path>` first, follow it, and write the report to `<report path>`. Then `wait_agent`. Call `spawn_agent` with `result.model` even when the `spawn_agent` tool description does not list it: Codex lists only the first 5 picker-visible models there, but `spawn_agent` accepts every model in the catalog (codex-rs/core/src/agent/child_config.rs, `MAX_SPAWN_AGENT_MODEL_OVERRIDES = 5`, `find_spawn_agent_model_name`). Only an `Unknown model` error from `spawn_agent` proves a model is unavailable; then state the refusal and request a supported choice instead of substituting another model. Keep the lead's model and auth unchanged; `fork_turns: "none"` preserves the no-parent-history briefing. Report the model and its `source` (`session` = your session pick, `default` = your stored Codex default, `vendor` = the vendor default). If spawn_agent answers unsupported call, this session was launched with native sub-agents off because the saved pick is a routed worker; use walle_delegate_implementation and never retry the spawn.
   - `lane: "routed"` (or a worker result carrying `ctm_session_id`) — Wall-E launched a routed worker from the stored pick. Do not call it again; continue with the routed lane's wait and review steps below, and report the actual route, model, harness, and `source`.
   - `delegate_pref_unresolvable` — the stored pick no longer resolves. Show the stored pick (`pref.model`), its `source`, and the `cause`, then stop. Offer to name a model for this task or to reset the pick in the picker, and wait for the user's word. Never fall back to another model silently.
-  - `walle_delegate_implementation` unavailable or Wall-E unreachable — say so, and tell the user their stored pick could not be read. Only after telling them, the native lane may then run without a `model` override (the CLI's own default sub-agent model); otherwise wait for the user's word. Never claim the pick was honoured.
+  - `walle_delegate_implementation` unavailable or Wall-E unreachable — say so, and tell the user their stored pick could not be read. "Unavailable" here means only that the tool is not mounted, or the call returned no JSON-RPC result (a transport error). Only in that case, after telling them, the native lane may then run without a `model` override (the CLI's own default sub-agent model); otherwise wait for the user's word. Never claim the pick was honoured. A returned error code (caller_*, worker_not_owned, delegate_pref_unresolvable, route_*, model_*) is a refusal, not unavailability: report it and wait for the user's word; never spawn a native helper because of a refusal.
 - **Model phrase → routed lane.** Call `walle_delegate_implementation({ brief_path, cwd, model: "<phrase>", agent: "codex", worker_profile: 'implementation' })`. `agent` selects the CLI harness, never the model identity. The Wall-E MCP proxy supplies your caller identity for you; never pass an identity argument. Wall-E resolves the explicit model/route phrase against the registry and the result names the `route` and `model` actually used; report the actual route, model, and harness returned. If the user also named where it runs, pass it as `route` or write it into the phrase after `on`: an exact route id (`on <route-id>`, e.g. `"glm 5.2 fp8 on portkey-int-example-modal"`), a class (`on portkey` for any Portkey-served route, `on direct` for a vendor-direct route), a connector type (`on modal`, `on bedrock`, `on vertex`), or tenant words (`on team-test`). A qualifier inside the phrase wins over the `route` argument. The result's `chosen.reason` starts with `pinned` when the qualifier was honoured; report the actual route it chose, since a class or type may cover several routes. Do not silently choose an alternate model or a quantized variant. The result's `source` is `explicit`.
 - If the result is `model_ambiguous`, show the candidates (or, for a phrase that named a family with several distinct models, the candidate identities) and stop. If it is `model_unknown`, `route_not_servable`, `codex_home_symlinked`, or `walle_delegate_implementation` is unavailable, say so and do not substitute a model silently or claim delegation occurred. You may offer an alternative (another route, `agent: "codex"` → `agent: "claude"` to run the same model under the Claude harness, or the native lane) and wait for the user's word.
 - If the result is `route_unavailable`, the model is known but every one of its routes is currently unhealthy (circuit open, throttled, or not servable for this agent) — show `excluded[]`'s reasons (and `retry_after_ms` where present) and `offers[]` (variant/backup routes you could name explicitly, e.g. the fp8 tenant Modal routes when the direct route is down), then wait for the user's word before retrying on a named offer. Never silently pick an offer yourself. When `excluded[]` carries reason `route_not_found`, the word after `on` matched no route id, class, connector type or tenant token — `excluded[0].tried` lists the tiers and `offers[]` names the routes that exist; show them and wait for the user's word.
@@ -41,13 +41,13 @@ Write a self-contained brief to a scratch path inside the worktree (never commit
 
 - A provisional report while the process is alive is not completion. On clean terminal `exited`, a readable `report_source:'final_result'` or `last_message` is usable evidence even without a report file; inspect it and tests/diff without claiming the report file existed. On terminal `failed`, report `failure.class` and `failure.code`. Quota holds stop retries until a trustworthy reset or a separately verified generation readiness probe; no model substitution.
 - A 400 `brief_references_missing_paths` / `brief_placeholder_unknown` means the brief is wrong, not the worker: fix the named paths and redelegate.
-- Caller-door refusals are identity and authority checks, not worker failures — do not retry the same call and do not work around them: `caller_unresolved` — "Delegate from inside a CTM-launched lead session; the Wall-E stdio proxy supplies your identity." `caller_unauthenticated` — "This route needs the CTM runtime bearer; call it through the Wall-E MCP tools, not directly." `worker_not_owned` — "Only the lead that created this worker can resume or wait on it; ask that lead, or delegate your own worker." When `caller_unauthenticated` carries `data.cause`, report the cause — `proxy_token_missing`: "The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) at boot and before each CTM Codex launch; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand." `non_loopback_daemon`: "The Wall-E daemon for this session is not on loopback, and the runtime bearer is only sent to a loopback daemon (F1b-1). Routed delegation needs a local Wall-E; use the native lane or a CTM-launched session on this host." — then tell the user the session must be restarted and wait for their word; never retry the call, never edit config.toml, never switch to another lane silently.
+- Caller-door refusals are identity and authority checks, not worker failures — do not retry the same call and do not work around them: `caller_unresolved` — "Delegate from inside a CTM-launched lead session; the Wall-E stdio proxy supplies your identity." `caller_unauthenticated` — "This route needs the CTM runtime bearer; call it through the Wall-E MCP tools, not directly." `worker_not_owned` — "Only the lead that created this worker can resume or wait on it; ask that lead, or delegate your own worker." When `caller_unauthenticated` carries `data.cause`, report the cause — `proxy_token_missing`: "The Wall-E MCP server for this session was started without WALL_E_API_TOKEN, so it cannot present the CTM runtime bearer. Wall-E rewrites the managed Codex [mcp_servers."wall-e"] block (env_vars) when Wall-E starts; restart this session so Codex respawns the MCP server with the token. Do not edit config.toml by hand." `non_loopback_daemon`: "The Wall-E daemon for this session is not on loopback, so routed delegation is unavailable from here. Tell the user and wait for their word; do not substitute a native helper." — then tell the user the session must be restarted and wait for their word; never retry the call, never edit config.toml, never switch to another lane silently.
 
 ## Lead: read-only review work
 
 - Census, research, spec-compliance review and code-quality review are read-only work. Ask Wall-E for a `review` worker instead of spawning a helper: call `walle_delegate_implementation({ brief_path, cwd, agent: "codex", worker_profile: 'review' })` without `model` or `route`. The brief has no `## Files owned` section (CTM refuses one with `review_brief_owns_files`); it names what to read and the questions to answer, and asks for findings with file:line evidence.
 - `lane: "routed"`: the worker cannot change workspace files or run tests. A Codex-harness review worker runs in a read-only sandbox and ends `exited` with `report_source: 'last_message'` — read its report text from the status; a Claude-harness review worker has read tools plus its report file only and ends `report_ready`. Run tests and gates yourself.
-- `lane: "native"`: Wall-E launched nothing; spawn a read-only helper (`spawn_agent`) for the review as before.
+- `lane: "native"`: Wall-E launched nothing; spawn a read-only helper (`spawn_agent`) for the review as before. If spawn_agent answers unsupported call, this session was launched with native sub-agents off because the saved pick is a routed worker; use walle_delegate_implementation and never retry the spawn.
 - Either way you own the verdict: check each claim against the code before acting on it. A review worker's lease does not renew (renewal needs file writes); resume it if it needs more, and a resume cannot change its profile.
 
 ## Lead: waiting
@@ -62,7 +62,7 @@ Give the worker these requirements in its brief:
 - Implement the scoped change and run the relevant focused tests. For a regression, demonstrate the failure before the fix where practical.
 - Resolve harness problems only inside your owned files. If a needed edit falls outside them, or a ratchet lint fails on an owned file, stop and report the file and the required change; never compact or refactor to satisfy a lint. Starting a server or proposing a fix is not completion.
 - Return the changed files, explanation, exact test commands and outcomes, evidence artifacts, and unresolved concerns. Distinguish passed, failed, skipped, and unmeasured checks.
-- Do not commit, merge, push, deploy, restart shared services, or run aggregate repository gates unless the lead explicitly assigns an authorized action.
+- Do not commit, merge, push, deploy, restart shared services, or run aggregate repository gates unless the lead explicitly assigns an authorized action. A worker may run `land submit` only when its brief says so.
 - This is a subtask, not final task sign-off. The lead owns repository-wide verification; do not independently start duplicate full-suite runs.
 
 Use additional workers only for independent, useful subtasks with clear ownership. Avoid overlapping edits and shared browser artifact directories.
@@ -81,7 +81,7 @@ Use additional workers only for independent, useful subtasks with clear ownershi
 - Personally read the final diff and relevant surrounding code. Review correctness, simplicity, security, compatibility, and whether the tests exercise the actual failure.
 - Inspect the evidence, not just the worker's summary. A test that never reached its assertion, skipped, or only checked a stub is not proof of the intended behavior.
 - Send concrete findings back to the same worker for correction and focused retesting — `walle_resume_worker({ ctm_session_id, message })` on the routed lane, or `send_message` to the same spawned agent on the native lane. Routed resume starts a new process generation on the same provider transcript with new auth. `accepted` proves process start only: poll for actual agent consumption/new generation activity and the terminal report. A recorded envelope or stale report alone is not success. Report busy, missing-transcript, and quota failures explicitly. The budget is a bounded lease that CTM renews while the worker progresses; never raise it yourself. Review the resulting changes again; retain responsibility for the final decision.
-- Once the implementation is stable, own and run the required aggregate checks. Coordinate these with commit hooks and other workers to avoid unnecessary concurrent or repeated suites. Never bypass required checks.
+- Once the implementation is stable, own and run the required aggregate checks. To integrate, commit and run `land submit`; the queue serializes gates, so never start a second gate for the same tip. Never bypass required checks.
 - If the user requested a commit or integration, use `tl-commit` after review and verification, honoring the requested target such as local `main`. This skill alone does not authorize commits, pushes, deployment, or service restarts.
 - Sign off only when required work is complete and blocking findings are resolved. Report what changed, what was verified, any material limitations, and the actual integration/deployment state. Do not claim a locally committed fix is live without verifying activation.
 - Report the `execution_profile` the result returned (route, model, harness, and the five limits with their sources) in the delegation summary.

package/template/wall-e/skills/_templates/fleet-sync/VERSION

@@ -0,0 +1 @@
+1.2.1

package/template/wall-e/skills/_templates/fleet-sync/released-sha256.json

@@ -0,0 +1,16 @@
+{
+  "schema": 1,
+  "note": "Generated by bin/delegate-skill-released-hashes.js --write. Do not edit by hand.",
+  "claude": {
+    "09cd341db1ae10190a6e5e66051de44be8e35e086179f74c5d42f5eb5f10de03": "1.1.0",
+    "25f25695f47e6d60ed0d79f3e20024708abb7bce9441289d422166520bb7bb06": "1.2.1",
+    "8ae4f7ab8b2b020f04496563600ed1701c3a985e55d2fdae38243a0a140634e4": "1.2.0",
+    "8be0424c598a25bbfea9a48d9dbf2662bd43640ede6e57e9b60e5a9833ac1b7c": "1.0.0"
+  },
+  "codex": {
+    "431f32fc0db5bcc34ef22701e8973821f7077b5127b2e439028a57c715cef2b7": "1.2.0",
+    "56a08801f83e153dfab6f374f356cb9e3f92b5135ff3047c8ab24673b7bc8778": "1.2.1",
+    "b565aaae2c997b3d118d54b83f68e3f86da095949e207e9af64fb753b5317de6": "1.0.0",
+    "b6064b483ecc364568201fb129c7802d959ff7df59efb93c8c23301e3cb5eda2": "1.1.0"
+  }
+}

package/template/wall-e/skills/_templates/fleet-sync/templates/claude/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: fleet-sync
+description: Sync this machine's tools-repo main with origin in one command — pull, merge (gated) when both sides moved, push, and schedule the CTM restart for when the box is idle. Use when the user says "/fleet-sync", "sync main", "pull and push", "get latest", "push to origin", or when work just landed on local main and should reach the other boxes.
+---
+
+# Fleet sync
+
+One command keeps this box's `main` and `origin/main` the same: `land sync`. It is the only
+supported way to pull, merge or push `main` on any box (hub, MacBook Pro, Spark).
+Invoke with `/fleet-sync` (`$fleet-sync` is the Codex form).
+
+## Do
+
+1. From the repo root (the main checkout or any worktree of it):
+   ```
+   export PATH="$(dirname "$(bash bin/node-bin.sh)"):$PATH"
+   node coding-task-manager/bin/land.js sync --wait --json
+   ```
+2. Read the verdict and report it in one line, plus `origin` ahead/behind from
+   `node coding-task-manager/bin/land.js status --json` and the restart state:
+   | verdict | meaning |
+   |---|---|
+   | `in_sync` | nothing to do |
+   | `pulled` | main fast-forwarded to origin (no gate needed) |
+   | `pushed` | this box's own commits reached origin |
+   | `published` | origin and local were merged, the merge passed the gate, and that exact commit was pushed |
+   | `publish_contended` | another box kept pushing first; report it — do not retry by hand |
+   | `conflict` / `gate_failed` | resolve it yourself, in this session — step 3 |
+   | `publish_failed` | git refused the push (auth/network); report git's message verbatim |
+   | `sync_not_configured` | this repo has no `.ctm.json#landing.publish`; say so |
+3. On `conflict` or `gate_failed`, resolve it here; do not stop at a report. The user ran this
+   skill in this session, so this session owns the fix even if CTM also opened a
+   `fleet-sync: resolve <sha>` tab. Do not stop or kill that session; if it already committed a
+   resolution on its `sync/origin-<sha>` branch, review and use that instead of redoing it.
+   1. Run `node coding-task-manager/bin/land.js resolve <jobId> --claim --json` first, so CTM's
+      follower does not open a second resolver for this job. Then
+      `node coding-task-manager/bin/land.js inspect <jobId> --json` gives `base` (local main) and
+      `tip` (origin); read its `gateLog` for the failing check.
+   2. In a fresh worktree on a new branch from local `main` (symlink each project's `node_modules`
+      from the main checkout, run `bash bin/install-hooks.sh`): `git merge --no-ff <tip>`.
+   3. Resolve every conflict keeping BOTH sides' intent; for append-only ledgers keep every row and
+      regenerate generated files with the command `.ctm.json` names — never hand-merge a baseline.
+      Fix each gate failure at its root (a real bug gets fixed; a stale entry left by the merge
+      gets removed) and rerun the failing check until it passes.
+   4. Commit through the normal hook (never `--no-verify`), then
+      `node coding-task-manager/bin/land.js resolve <jobId> --worktree "$PWD" --wait --json`.
+   5. Run step 1 again. Repeat from 3.1 on a new `conflict`/`gate_failed`; stop after 3 rounds and
+      report what still fails.
+4. Restart: never ask CTM to restart now. `land sync` schedules the idle restart itself; report
+   "restart pending — waits until no session is active" when main moved.
+
+## Never
+
+- `git pull`, `git merge origin/main`, `git push` (any form, especially `--force`), or moving `main` by hand.
+- `--no-verify`, skipping or shortening the gate.
+- `POST /api/restart/ctm?force=true`, `launchctl` against `com.walle.server`/`com.ctm.*`, killing CTM.
+- Running it from the box-gate clone (`~/ws/tools-ci/...`) or pushing from a side branch.
+- Starting any GitHub or Claude login. If push auth is missing, report `land doctor` output and stop.
+
+## When something looks wrong
+
+`node coding-task-manager/bin/land.js doctor --json` checks hooks, the main-branch guard, the remote,
+and non-interactive push auth. Report its failing checks; do not fix hooks or credentials yourself
+unless the user asks.

package/template/wall-e/skills/_templates/fleet-sync/templates/codex/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: fleet-sync
+description: Sync this machine's tools-repo main with origin in one command — pull, merge (gated) when both sides moved, push, and schedule the CTM restart for when the box is idle. Use when the user says "$fleet-sync", "sync main", "pull and push", "get latest", "push to origin", or when work just landed on local main and should reach the other boxes.
+---
+
+# Fleet sync
+
+One command keeps this box's `main` and `origin/main` the same: `land sync`. It is the only
+supported way to pull, merge or push `main` on any box (hub, MacBook Pro, Spark).
+Invoke with `$fleet-sync` (`/fleet-sync` is the Claude Code form).
+
+## Do
+
+1. From the repo root (the main checkout or any worktree of it):
+   ```
+   export PATH="$(dirname "$(bash bin/node-bin.sh)"):$PATH"
+   node coding-task-manager/bin/land.js sync --wait --json
+   ```
+2. Read the verdict and report it in one line, plus `origin` ahead/behind from
+   `node coding-task-manager/bin/land.js status --json` and the restart state:
+   | verdict | meaning |
+   |---|---|
+   | `in_sync` | nothing to do |
+   | `pulled` | main fast-forwarded to origin (no gate needed) |
+   | `pushed` | this box's own commits reached origin |
+   | `published` | origin and local were merged, the merge passed the gate, and that exact commit was pushed |
+   | `publish_contended` | another box kept pushing first; report it — do not retry by hand |
+   | `conflict` / `gate_failed` | resolve it yourself, in this session — step 3 |
+   | `publish_failed` | git refused the push (auth/network); report git's message verbatim |
+   | `sync_not_configured` | this repo has no `.ctm.json#landing.publish`; say so |
+3. On `conflict` or `gate_failed`, resolve it here; do not stop at a report. The user ran this
+   skill in this session, so this session owns the fix even if CTM also opened a
+   `fleet-sync: resolve <sha>` tab. Do not stop or kill that session; if it already committed a
+   resolution on its `sync/origin-<sha>` branch, review and use that instead of redoing it.
+   1. Run `node coding-task-manager/bin/land.js resolve <jobId> --claim --json` first, so CTM's
+      follower does not open a second resolver for this job. Then
+      `node coding-task-manager/bin/land.js inspect <jobId> --json` gives `base` (local main) and
+      `tip` (origin); read its `gateLog` for the failing check.
+   2. In a fresh worktree on a new branch from local `main` (symlink each project's `node_modules`
+      from the main checkout, run `bash bin/install-hooks.sh`): `git merge --no-ff <tip>`.
+   3. Resolve every conflict keeping BOTH sides' intent; for append-only ledgers keep every row and
+      regenerate generated files with the command `.ctm.json` names — never hand-merge a baseline.
+      Fix each gate failure at its root (a real bug gets fixed; a stale entry left by the merge
+      gets removed) and rerun the failing check until it passes.
+   4. Commit through the normal hook (never `--no-verify`), then
+      `node coding-task-manager/bin/land.js resolve <jobId> --worktree "$PWD" --wait --json`.
+   5. Run step 1 again. Repeat from 3.1 on a new `conflict`/`gate_failed`; stop after 3 rounds and
+      report what still fails.
+4. Restart: never ask CTM to restart now. `land sync` schedules the idle restart itself; report
+   "restart pending — waits until no session is active" when main moved.
+
+## Never
+
+- `git pull`, `git merge origin/main`, `git push` (any form, especially `--force`), or moving `main` by hand.
+- `--no-verify`, skipping or shortening the gate.
+- `POST /api/restart/ctm?force=true`, `launchctl` against `com.walle.server`/`com.ctm.*`, killing CTM.
+- Running it from the box-gate clone (`~/ws/tools-ci/...`) or pushing from a side branch.
+- Starting any GitHub or Claude login. If push auth is missing, report `land doctor` output and stop.
+
+## When something looks wrong
+
+`node coding-task-manager/bin/land.js doctor --json` checks hooks, the main-branch guard, the remote,
+and non-interactive push auth. Report its failing checks; do not fix hooks or credentials yourself
+unless the user asks.

package/template/wall-e/tools/chrome-automation.js

@@ -6,6 +6,12 @@ const CHROME_CANDIDATES = Object.freeze([
   '/Applications/Chromium.app/Contents/MacOS/Chromium',
   '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
   '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser',
+  // Linux (design nightly-linux-host-portability-2026-10-27 D-7): the distro and snap layouts.
+  '/usr/bin/google-chrome-stable',
+  '/usr/bin/google-chrome',
+  '/usr/bin/chromium',
+  '/usr/bin/chromium-browser',
+  '/snap/bin/chromium',
 ]);
 
 // Wall-E uses throwaway browser profiles. Chromium's macOS test launcher uses

package/template/wall-e/training/setup-cuda-train-env.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # One-time setup for the DGX Spark (CUDA/GB10) training venv.
-# Run this ON the Spark host (e.g. `ssh spark@dgx-spark` then run it), or
-# from the Mac: ssh spark@dgx-spark 'bash -s' < wall-e/training/setup-cuda-train-env.sh
+# Run this ON the Spark host (e.g. `ssh dgx-spark` then run it), or
+# from the Mac: ssh dgx-spark 'bash -s' < wall-e/training/setup-cuda-train-env.sh
 #
 # Creates ~/.cuda-train-env with the PyTorch/PEFT/bitsandbytes stack that
 # cuda_qlora_launch.py needs. Idempotent: re-running upgrades in place.

package/template/wall-e/workers/brain-owner-worker.js

@@ -259,10 +259,24 @@ const CUSTOM_BRAIN_CALLS = { agentRunShadowOperation: (args) => require('../runt
   // D-7 review fix (WP-2, F1): same function loops/brain-write.js's direct (RW)
   // path calls — see wall-e/loops/brain-custom-writes.js for what/why.
   commitThinkExtraction: (args) => require('../loops/brain-custom-writes').commitThinkExtraction(args[0]),
-  // multi-machine WP-5: brain sync outbox page / batch apply on the owner's own db handle.
-  brainSyncOutbox: (args) => require('../http/sync-api').listBrainOutbox(brain.getDb(), args[0] || {}),
-  brainSyncApplyEntries: (args) => require('../http/sync-api').applyBrainSyncEntries(brain.getDb(), args[0] || {}),
-  brainSyncPrune: (args) => require('../http/sync-api').pruneBrainOutbox(brain.getDb(), args[0] || {}),
+  // shared-memory WP-0 §6.3: the v2 clock seed walk, on the owner's own db handle.
+  brainSyncClockSeed: (args) => require('../loops/brain-custom-writes').brainSyncClockSeed(args[0] || {}), // shared-memory WP-0 §6.3
+  // shared-memory WP-1 §6.4: the v2 change feed and apply; the module is
+  // brain/brain-sync-v2.js (a storage module, no HTTP). WP-6/migration 104 retired the
+  // v1 outbox trio that used to sit here.
+  brainSyncV2Vector: (args) => require('../brain/brain-sync-v2').readVector(brain.getDb()),
+  brainSyncV2Changes: (args) => require('../brain/brain-sync-v2').changesSince(brain.getDb(), args[0] || {}),
+  brainSyncV2Apply: (args) => require('../brain/brain-sync-v2').applyChanges(brain.getDb(), args[0] || {}),
+  brainSyncV2MemberVector: (args) => require('../brain/brain-sync-v2').recordMemberVector(brain.getDb(), args[0] || {}),
+  brainSyncV2PruneTombstones: (args) => require('../brain/brain-sync-v2').pruneTombstones(brain.getDb(), args[0] || {}),
+  brainSyncV2Digest: (args) => require('../brain/brain-sync-v2').digest(brain.getDb(), args[0] || {}),
+  // shared-memory WP-4 §6.7: the join trio + the import job's step — all on the owner's own
+  // connection. createJoinSnapshot runs where the backup API runs; joinImportStep writes the four
+  // replicated tables with the sentinel on (see loops/brain-custom-writes.js).
+  brainSyncV2JoinSnapshot: (args) => require('../brain/brain-join').createJoinSnapshot({ db: brain.getDb(), ...(args[0] || {}) }),
+  brainSyncV2JoinImport: (args) => require('../brain/brain-join').startJoinImport(brain.getDb(), args[0] || {}),
+  brainSyncV2JoinStatus: (args) => require('../brain/brain-join').joinStatus(brain.getDb()),
+  brainSyncV2JoinStep: (args) => require('../brain/brain-join').joinImportStep(brain.getDb(), args[0] || {}),
   backfillClassifyBatch: (args) => require('../loops/brain-custom-writes').backfillClassifyBatch(args[0]),
   backfillEntityLinkBatch: (args) => require('../loops/brain-custom-writes').backfillEntityLinkBatch(args[0], args[1]),
   commitEntityLinks: (args) => require('../loops/brain-custom-writes').commitEntityLinks(args[0]),

package/template/wall-e/workers/mcp-gateway-process.js

@@ -535,8 +535,8 @@ function main() {
     // WALLE_MCP_GATEWAY_ORPHAN_PPID_POLL_MS is a test-only override (default
     // 5000ms) — an adoption clears `orphanedAtMs` but NOT the OS-level ppid
     // reparenting that already happened on the first real parent death, so
-    // the very next tick of THIS poll re-detects ppid===1 and calls
-    // markOrphaned() again. That is exactly the "a later parent-gone
+    // the very next tick re-detects the changed ppid (1 on macOS, the subreaper on Linux) and
+    // calls markOrphaned() again. That is exactly the "a later parent-gone
     // re-enters orphan grace" cycle the WP-3 brief asks for — a fast poll
     // interval here just lets tests observe a re-orphan cycle without a
     // multi-second real-time wait.
@@ -544,11 +544,11 @@ function main() {
       const raw = Number(process.env.WALLE_MCP_GATEWAY_ORPHAN_PPID_POLL_MS);
       return Number.isFinite(raw) && raw > 0 ? raw : 5000;
     })();
-    orphanPpidPoll = setInterval(() => {
+    orphanPpidPoll = setInterval(((installPpid) => () => { // nightly-linux-host-portability WP-4b
       let ppid;
       try { ppid = process.ppid; } catch { return; }
-      if (ppid === 1) markOrphaned('ppid-reparented');
-    }, ppidPollMs);
+      if (ppid === 1 || ppid !== installPpid) markOrphaned('ppid-reparented');
+    })(process.ppid), ppidPollMs);
     orphanPpidPoll.unref?.();
     // Checks at least twice per grace window (and at least every 30s) so a
     // short test-only grace override (WALLE_MCP_GATEWAY_ORPHAN_GRACE_MS)