create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/coding-agent-models.js

@@ -40,20 +40,28 @@ const CTM_MODEL_SYNC_SIGNATURE_TTL_MS = Number(process.env.CTM_MODEL_SYNC_SIGNAT
 // WP1B criterion 5: the production read-pool batch. The hard page guard stays MAX_AGENT_MODEL_ITEMS.
 const MODEL_SYNC_BATCH_ITEMS = 8;
 
-// Walk a JSONL chunk backwards for the two per-session model facts Claude Code records:
+// Walk a JSONL chunk backwards for the per-session model facts Claude Code records:
 // `identity` (the `attachment.type === 'model'` record written at session start and on `/model` —
-// what the session was SET to, verbatim) and `turn` (the latest non-sidechain assistant row's
-// `message.model` — what actually SERVED). normalizeClaudeModelId refuses to invent a concrete id
-// for a bare alias literal such as "sonnet".
+// what the session was SET to, verbatim), `turn` (the latest non-sidechain assistant row's
+// `message.model` — what actually SERVED), and `failure` (the newest assistant row Claude Code
+// flagged with `isApiErrorMessage`, which is what a REFUSED turn looks like: `message.model` is
+// `<synthetic>` and `apiErrorStatus` carries the provider status when there was one).
+// normalizeClaudeModelId refuses to invent a concrete id for a bare alias literal such as "sonnet".
+//
+// WP-1/D-1: `failure` is recorded ONLY while `turn` is still null in this newest-first walk, so a
+// newer successful turn (which is reached first) clears it -- and a failure found first never stops
+// the scan before the older good turn is found. The refusal row still can never become `turn`:
+// `<synthetic>` keeps failing normalizeClaudeModelId.
 function _scanJsonlForClaudeModelInfo(raw) {
   const lines = raw.split('\n');
   let identity = null;
   let turn = null;
+  let failure = null;
   for (let i = lines.length - 1; i >= 0; i--) {
     const line = lines[i];
     if (!line || line[0] !== '{') continue;
     // Cheap pre-filter so we don't JSON.parse every user/system line.
-    if (line.indexOf('"model"') === -1 && line.indexOf('"attachment"') === -1) continue;
+    if (line.indexOf('"model"') === -1 && line.indexOf('"attachment"') === -1 && line.indexOf('"isApiErrorMessage"') === -1) continue;
     try {
       const rec = JSON.parse(line);
       if (!rec) continue;
@@ -74,12 +82,17 @@ function _scanJsonlForClaudeModelInfo(raw) {
         if (norm) {
           const effort = [rec.effort, rec.perTurnEffort].find((v) => typeof v === 'string' && v.trim());
           turn = { model: norm.id, context1m: norm.context1m, observedAtMs: atMs, effort: effort ? effort.trim() : null };
+        } else if (!failure && rec.isApiErrorMessage === true) {
+          failure = {
+            status: Number.isSafeInteger(rec.apiErrorStatus) ? rec.apiErrorStatus : null,
+            atMs, turnId: rec.uuid ?? null, requestId: rec.requestId ?? null,
+          };
         }
       }
       if (identity && turn) break;
     } catch { /* skip malformed line */ }
   }
-  return { identity, turn };
+  return { identity, turn, failure };
 }
 
 // Read just the TAIL of the transcript by default: the model lives in the most
@@ -117,9 +130,11 @@ function getClaudeCodeModelInfoFromJsonl(jsonlPath) {
 // The per-session Claude model truth (shape: claude-model-truth.js truthFromTranscriptFacts),
 // read ONLY from that session's own transcript. No global file is consulted: a `/model` switch in
 // one session must never relabel another (claude-model-truth-session-owned D-1).
+// WP-1: the third transcript fact (a refused turn) rides along as `lastTurnFailure`; it feeds the
+// lead-model switch's failure branch and NOTHING that names a model.
 function getClaudeSessionModelTruth({ jsonlPath } = {}) {
   const info = getClaudeCodeModelInfoFromJsonl(jsonlPath) || {};
-  return truthFromTranscriptFacts(info.identity || null, info.turn || null);
+  return truthFromTranscriptFacts(info.identity || null, info.turn || null, info.failure || null);
 }
 
 function openCodexStateDb(homeDir = process.env.HOME) {
@@ -194,9 +209,9 @@ function getCodexTurnContextModelFromJsonl(jsonlPath) {
 // OpenCode persists the model REALLY in use for each session in its own SQLite
 // store (~/.local/share/opencode/opencode.db, `session.model` as JSON
 // {id, providerID}), and rewrites it the instant the user switches models inside
-// the TUI. CTM only injects an opinionated launch default (`--model zai/glm-5.2`),
+// the TUI. CTM passes `--model` only for an explicit pick (and none otherwise),
 // so the model chip would otherwise lie whenever the session is actually running a
-// different model (e.g. the user picked Kimi). Read the live value back so the chip
+// different model (e.g. the user picked Kimi inside the TUI). Read the live value back so the chip
 // reflects the truth. Matched by working directory — CTM launches one OpenCode per
 // (worktree) cwd, and OpenCode records the absolute directory on the session row.
 function opencodeDataDbPath(homeDir = process.env.HOME, env = process.env) {
@@ -576,7 +591,7 @@ function createCodingAgentModelSync({
         }
       }
     }
-    if (changed && typeof broadcastSessionList === 'function') broadcastSessionList();
+    if (changed && typeof broadcastSessionList === 'function') broadcastSessionList(false, { reason: 'model-sync' });
   }
 
   // Off-main-loop variant of syncCodingSessionModels. The fs/DB-heavy resolution (claude JSONL
@@ -850,7 +865,7 @@ function createCodingAgentModelSync({
             && (agentType !== 'codex' || entry.titleSynced);
           if (complete) modelSyncState.cacheCompletedContext(context);
         }
-        if (changed && typeof broadcastSessionList === 'function') broadcastSessionList();
+        if (changed && typeof broadcastSessionList === 'function') broadcastSessionList(false, { reason: 'model-sync' });
       },
       { context: () => ({ results: persistedById.size, sessions: contexts.length }) },
     );
@@ -893,7 +908,7 @@ function createCodingAgentModelSync({
     }
     const fieldsChanged = _applyClaudeTruthFields(session, truth);
     if (resolvedChanged || fieldsChanged) _persistSessionModel(session, model || (session.model_id ? { model_id: session.model_id, model_provider: session.model_provider } : null)); // I-5: a hook changing only `selected` (opus -> opusplan, same resolved id) must still be written, or the alias/Plan-mode tag is lost on RESTART and the next sync tick sees no diff either
-    if ((resolvedChanged || fieldsChanged) && typeof broadcastSessionList === 'function') broadcastSessionList();
+    if ((resolvedChanged || fieldsChanged) && typeof broadcastSessionList === 'function') broadcastSessionList(false, { reason: 'claude-model-truth' });
     return { changed: observed.changed || resolvedChanged || fieldsChanged, view: observed.view };
   }
 

package/template/coding-task-manager/lib/coding-cli-skill-installer.js

@@ -6,8 +6,8 @@
 // wall-e/skills/_templates/<dir>/templates/<agent>/SKILL.md (+ VERSION and
 // released-sha256.json). _templates/ is a plain template store, never a runnable Wall-E skill
 // directory (skill-loader.js only enumerates skills/_bundled/). This module copies a template out
-// to the CLI's own skills root (<claude config dir>/skills/<name>/, $CODEX_HOME/skills/<name>/)
-// with the dpkg conffile rule, adapted to a daemon that cannot prompt:
+// to the CLI's own skills root (<claude config dir>/skills/<name>/, $CODEX_HOME/skills/<name>/,
+// $DSH_HOME/skills/<name>/) with the dpkg conffile rule, adapted to a daemon that cannot prompt:
 //
 //   * A copy is classified by the sha256 of the bytes on disk, never by version alone (D-3). The
 //     known set is the shipped released manifest (every template text ever released) plus the hash
@@ -53,11 +53,28 @@ const SOURCE = 'ctm-coding-cli-skill-installer';
 
 // name -> the _templates/<dir> that holds templates/<agent>/SKILL.md + VERSION + released-sha256.json.
 // The delegate skill's template dir is named delegate-worker (not "delegate") because it is a
-// templates-only store, never itself a runnable/user-invocable skill name.
-const MANAGED_SKILLS = Object.freeze({ delegate: 'delegate-worker' });
-const MANAGED_AGENTS = Object.freeze(['claude', 'codex']);
+// templates-only store, never itself a runnable/user-invocable skill name. `fleet-sync` (WP-4 of
+// fleet-origin-main-sync-skill-2026-10-31.html §6.6) keeps its own name; every consumer below keys
+// off this map (or `Object.hasOwn(MANAGED_SKILLS, name)`) rather than a single hardcoded skill.
+const MANAGED_SKILLS = Object.freeze({ delegate: 'delegate-worker', 'fleet-sync': 'fleet-sync' });
+// WP-12 (AC-12c): dsh (the DeepSeek Harness) joins the managed installers. Its root is $DSH_HOME/skills
+// (default ~/.dsh/skills) -- design doc deepseek-harness-acp-agent-2026-10-28 C-9/OQ-9.
+const MANAGED_AGENTS = Object.freeze(['claude', 'codex', 'dsh']);
 const MODES = Object.freeze(['boot', 'install', 'user']);
 
+// WP-12: the template dir a managed copy is read from is `templates/<TEMPLATE_AGENT[agent] || agent>/`.
+// dsh ships no template of its own yet (wall-e/skills/_templates/<dir>/templates/dsh/), and its skill
+// format IS Claude Code's -- YAML frontmatter + markdown at <name>/SKILL.md, which is exactly what dsh's
+// own skill filesystem reads (C-9/OQ-9) -- so a dsh install carries the claude text. Classification and
+// the released manifest use the same mapping, so a pristine dsh copy is `noop`/`update` and never a
+// permanent `create`. A dsh-specific template is a follow-up: when it lands, drop the entry below.
+const TEMPLATE_AGENT = Object.freeze({ dsh: 'claude' });
+
+function templateAgentFor(agent) {
+  assertAgent(agent);
+  return TEMPLATE_AGENT[agent] || agent;
+}
+
 function templateDirFor(name) {
   if (typeof name !== 'string' || !Object.hasOwn(MANAGED_SKILLS, name)) {
     throw new Error(`No bundled template for skill "${name}"`);
@@ -70,12 +87,16 @@ function assertAgent(agent) {
 }
 
 /** D-4. Absolute skills root for the agent. Throws on an unknown agent. The Codex root honours
- *  CODEX_HOME from the PASSED env (identical to codexHome() when env is process.env). */
+ *  CODEX_HOME from the PASSED env (identical to codexHome() when env is process.env); the dsh root
+ *  honours DSH_HOME the same way (WP-12, AC-12c). */
 function skillsRootFor(agent, { env = process.env, homeDir = os.homedir() } = {}) {
   assertAgent(agent);
   if (agent === 'claude') {
     return path.join(env.CLAUDE_CONFIG_DIR || path.join(homeDir, '.claude'), 'skills');
   }
+  if (agent === 'dsh') {
+    return path.join(env.DSH_HOME || path.join(homeDir, '.dsh'), 'skills');
+  }
   const home = env === process.env ? codexHome(homeDir) : (env.CODEX_HOME || path.join(homeDir, '.codex'));
   return path.join(home, 'skills');
 }
@@ -152,14 +173,16 @@ async function readBundledVersion(name) {
   return raw.trim();
 }
 
-/** The bundled SKILL.md for (name, agent) as raw bytes -- the exact bytes the installer writes. */
+/** The bundled SKILL.md for (name, agent) as raw bytes -- the exact bytes the installer writes. The
+ *  template dir is TEMPLATE_AGENT[agent] (dsh reads Claude Code's format; see TEMPLATE_AGENT). */
 async function readTemplateSkillMd(name, agent) {
-  return fsp.readFile(path.join(templateDirFor(name), 'templates', agent, 'SKILL.md'));
+  return fsp.readFile(path.join(templateDirFor(name), 'templates', templateAgentFor(agent), 'SKILL.md'));
 }
 
-/** The shipped released manifest {schema, claude:{sha:version}, codex:{...}}. A missing or
- *  malformed manifest throws: classifying without it would call every field copy `edited`. */
-async function readReleasedManifest(name = 'delegate') {
+/** The shipped released manifest {schema, claude:{sha:version}, codex:{...}} for one managed skill
+ *  (its name is required, exactly like readBundledVersion). A missing or malformed manifest throws:
+ *  classifying without it would call every field copy `edited`. */
+async function readReleasedManifest(name) {
   const raw = await fsp.readFile(path.join(templateDirFor(name), 'released-sha256.json'), 'utf8');
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== 'object') throw new Error('released-sha256.json is not an object');
@@ -241,7 +264,9 @@ async function buildPlan(agent, name, root, { isPrimary, realHome, log }) {
     ? rootRecord.skills[name] : null;
 
   // D-3: known set = released manifest (agent) U marker's own hash (schema 2) U the bundled text.
-  const known = new Map(Object.entries(mapOf(manifest[agent])));
+  // The manifest is keyed by the TEMPLATE agent, so a dsh copy of the claude text classifies the same
+  // way a claude copy does (TEMPLATE_AGENT).
+  const known = new Map(Object.entries(mapOf(manifest[templateAgentFor(agent)])));
   if (marker && marker.schema === 2) {
     // The marker is written BEFORE SKILL.md (D-6), so after a crash between the two the bytes on
     // disk are the text the marker replaced: previousSha256 keeps that old text pristine even when
@@ -441,6 +466,11 @@ module.exports = {
   planSkillInstall,
   applySkillInstall,
   syncManagedSkills,
-  // Exported for tests / diagnostics.
-  _internals: { compareVersions, sha256, readReleasedManifest, readMarker, readRootRecord, readBundledVersion, MARKER_FILE, ROOT_RECORD_FILE },
+  // Exported for tests / diagnostics, and for the other installer that shares this rule set:
+  // lib/agent-bundle/codex-install.js (D-14 Codex install-mode) reuses MARKER_FILE/ROOT_RECORD_FILE,
+  // readMarker, readRootRecord and writeRootRecord instead of growing a second copy of them.
+  _internals: {
+    compareVersions, sha256, readReleasedManifest, readMarker, readRootRecord, writeRootRecord,
+    readBundledVersion, templateAgentFor, MARKER_FILE, ROOT_RECORD_FILE,
+  },
 };

package/template/coding-task-manager/lib/coding-session-model-adapters.js

@@ -118,6 +118,19 @@ function claudeTurnCandidate(owner, rec, index) {
     effort: rec.effort ?? rec.perTurnEffort ?? null, turnId: rec.uuid ?? null, source: 'transcript:turn' };
 }
 
+/*
+ * WP-1/D-1: the newest assistant row Claude Code flagged with `isApiErrorMessage` -- what a REFUSED
+ * turn looks like (`message.model` is `<synthetic>`, so `claudeTurnCandidate` can never see it).
+ * The record predicate is the tail scan's (lib/coding-agent-models.js), plus the same root/owner
+ * filters every other Claude candidate applies. It carries NO model: `value` is empty by design.
+ */
+function claudeTurnFailureCandidate(owner, rec, index) {
+  if (!ownerOk(owner) || !validRecord(rec) || !claudeRootRecord(rec, owner)) return null;
+  if (rec.type !== 'assistant' || rec.isApiErrorMessage !== true) return null;
+  return { at: time(rec.timestamp), index, status: Number.isSafeInteger(rec.apiErrorStatus) ? rec.apiErrorStatus : null,
+    turnId: rec.uuid ?? null, requestId: rec.requestId ?? null, source: 'transcript:turn' };
+}
+
 function claudeIdentityObservations(owner, candidate) {
   const out = [];
   if (!candidate) return out;
@@ -137,16 +150,40 @@ function claudeTurnObservations(owner, candidate) {
   return out;
 }
 
+/*
+ * WP-1/D-1: a REFUSED turn, as a typed observation. `value` is the empty string on purpose -- there is
+ * no model to name -- so this cannot go through `observation()`, whose value bound is required. Every
+ * owner field is the same one every other observation carries; the status is the provider's own.
+ * lib/coding-session-model-state.js refuses the unknown kind, so this can never become model evidence.
+ */
+function claudeTurnFailureObservations(owner, candidate) {
+  const out = [];
+  if (!candidate || !ownerOk(owner)) return out;
+  out.push({
+    ctmSessionId: owner.ctmSessionId, agentType: owner.agentType, providerSessionId: owner.providerSessionId,
+    processGeneration: owner.processGeneration, kind: 'failed-turn', value: '', providerId: null,
+    selectionKind: null, effort: null, source: 'transcript:turn', observedAtMs: candidate.at,
+    sourceRevision: candidate.turnId == null ? null : String(candidate.turnId),
+    outcome: 'failed', apiErrorStatus: candidate.status,
+  });
+  return out;
+}
+
 function claudeModelObservations(owner, records) {
   const out = []; if (!ownerOk(owner) || !Array.isArray(records)) return out;
-  let identity = null; let turn = null;
+  let identity = null; let turn = null; let failure = null;
   records.forEach((rec, index) => {
     const identityCandidate = claudeIdentityCandidate(owner, rec, index);
     if (later(identity, identityCandidate)) identity = identityCandidate;
     const turnCandidate = claudeTurnCandidate(owner, rec, index);
     if (later(turn, turnCandidate)) turn = turnCandidate;
+    const failureCandidate = claudeTurnFailureCandidate(owner, rec, index);
+    if (later(failure, failureCandidate)) failure = failureCandidate;
   });
   out.push(...claudeIdentityObservations(owner, identity), ...claudeTurnObservations(owner, turn));
+  // Only a refusal NEWER than the newest successful turn (timestamp, then index) is still open: the
+  // completed-turn observation above keeps its own, unchanged meaning.
+  if (later(turn, failure)) out.push(...claudeTurnFailureObservations(owner, failure));
   return out;
 }
 
@@ -292,8 +329,11 @@ function opencodeModelObservations(owner, { sessionRow, assistantRows } = {}) {
   const sessionId = sessionModel ? bounded(sessionModel.id ?? sessionModel.modelID, true) : (encodedModel ? null : bounded(sessionRow.model, true));
   const sessionProvider = sessionModel?.providerID == null ? null : bounded(sessionModel.providerID, true);
   if (sessionId && (typeof sessionRow.model === 'string' || sessionModel)) {
+    // OpenCode 1.x writes `session.model` once, at creation, and bumps `time_updated` after every turn
+    // (observed on 1.19.5: a turn on m2/m3 leaves it m1, updated ~2 ms after the turn completed). Stamped
+    // with `time_updated`, this fact outranked every completed turn; it is as old as the session row.
     for (const kind of ['selection', 'resolved']) emit(out, [owner, kind, sessionId, sessionProvider, 'concrete', null,
-      'opencode:session-store', time(sessionRow.time_updated), null]);
+      'opencode:session-store', time(sessionRow.time_created ?? sessionRow.time_updated), null]);
   }
   let best = null;
   assistantRows.forEach((row, index) => {
@@ -319,6 +359,7 @@ module.exports = { claudeModelObservations, claudeHookModelObservations, codexMo
   // byte-identical to the one a whole-tail read would have produced.
   laterRank: later, isCodexRelatedRecord, codexThreadMatches,
   claudeIdentityCandidate, claudeTurnCandidate, claudeIdentityObservations, claudeTurnObservations,
+  claudeTurnFailureCandidate, claudeTurnFailureObservations,
   codexSettingsCandidate, codexSettingsObservations, codexTurnContextCandidate, codexTerminalCandidate,
   codexTurnObservations,
   // WP-0: the one shared "is this the reserved delegate alias?" predicate (see the doc comment above).

package/template/coding-task-manager/lib/coding-session-model-owner.js

@@ -6,7 +6,7 @@
 // See docs/model-sync-owner-wire-contract-2026-10-15.html §6.1 (D-1..D-4).
 const OWNER_CORE_KEYS = Object.freeze(['ctmSessionId', 'agentType', 'providerSessionId', 'processGeneration']);
 const OWNER_ROUTE_KEYS = Object.freeze(['profileFingerprint', 'factsRevision', 'routeId']);
-const OWNER_AGENT_TYPES = Object.freeze(['claude', 'codex', 'gemini', 'opencode']);
+const OWNER_AGENT_TYPES = Object.freeze(['claude', 'codex', 'gemini', 'opencode', 'dsh']);
 const OWNER_TEXT_CAP_BYTES = 256; // same cap as read-pool-model-collector safeText
 
 // Trimmed, non-empty string of ≤256 UTF-8 bytes, else null — the collector's safeText(value, 256) rule.

package/template/coding-task-manager/lib/coding-session-model-public.js

@@ -41,6 +41,12 @@ const HEALTH_STATUSES = Object.freeze(['current', 'restored', 'partial', 'unavai
 const HEALTH_REASONS = Object.freeze([
   'restored', 'owner_unavailable', 'scan_partial', 'no_model_evidence',
   'provider_read_failed', 'model_store_unavailable', 'invalid_observation', 'queue_full',
+  // WP-3 (§8/§9 S-12b): a LIVE OpenCode tab that has not been prompted yet — the publisher emits this
+  // instead of `owner_unavailable`; the shared presenter words it "waiting for the first prompt".
+  'opencode_presession',
+  // WP-8 (§9b M-8): the same word for a live DeepSeek Harness session whose ACP owner row is not
+  // bound yet (the child is up, the config options have not landed).
+  'dsh_presession',
 ]);
 const PUBLIC_EVENT_KEYS = Object.freeze([...EVENT_KEYS, 'id']);
 // The created-frame whitelist (server → client `created`), in the order §6 fixes it.
@@ -266,7 +272,7 @@ function buildCreatedSessionPayload({
 
 // The native CLI agents whose sessions have a LIVE-OWNER authority envelope. A durable startup-task
 // placeholder for one of these has no live owner yet, which is stated explicitly.
-const NATIVE_AGENT_TYPES = new Set(['claude', 'codex', 'gemini', 'opencode']);
+const NATIVE_AGENT_TYPES = new Set(['claude', 'codex', 'gemini', 'opencode', 'dsh']);
 
 /*
  * WP1C transport correction (c): resolve the ACTUAL CLI identity with the existing detector, applied to

package/template/coding-task-manager/lib/coding-session-model-runtime.js

@@ -37,7 +37,7 @@ const MODEL_PROVIDER_ENV_KEYS = Object.freeze(['HOME', 'CODEX_HOME', 'CTM_CODEX_
 const MODEL_SWITCH_EVENT_KEY = 'model_switch_event';
 // WP1C: the agent types whose sessions have a native CLI owner. Every other session (a shell, native
 // Wall-E chat) has no native owner at all and therefore publishes NO authority envelope.
-const NATIVE_AGENT_TYPES = new Set(['claude', 'codex', 'gemini', 'opencode']);
+const NATIVE_AGENT_TYPES = new Set(['claude', 'codex', 'gemini', 'opencode', 'dsh']); // WP-8 §9b M-5: 'dsh' has a native owner (bound from ACP config options at session start; no PTY, no argv model)
 
 function modelProviderEnv(session) { const source = session?._launchEnvOverrides; const result = {}; for (const key of MODEL_PROVIDER_ENV_KEYS) if (typeof source?.[key] === 'string') result[key] = source[key]; return result; }
 
@@ -225,6 +225,21 @@ function createCodingSessionModelRuntime({
     return agentType && NATIVE_AGENT_TYPES.has(agentType) ? agentType : null;
   }
 
+  /*
+   * WP-3 (design docs/opencode-lead-and-delegate-model-selection-2026-10-28.html §8 WP-3, §9 S-12b):
+   * a LIVE OpenCode 1.x tab that has not received its first prompt genuinely has no model owner —
+   * OpenCode creates its provider session (and therefore CTM's owner tuple) only on the first prompt.
+   * `owner_unavailable` is true there but unhelpful, so this distinct reason says what is actually
+   * happening. The scope is deliberately narrow: an OpenCode tab with a RUNNING process (a
+   * `ptyProcess` that is not a parked/`_restoreDeferred` placeholder). A parked OpenCode tab, an
+   * OpenCode tab with no process, every other native agent and the known-owner-without-a-health-record
+   * case all keep the established `owner_unavailable`. WP-8 §9b M-6: a LIVE dsh (DeepSeek Harness) session — a childless ACP child (`_acpProcess`, never a `ptyProcess`) — reports `dsh_presession` too.
+   */
+  function nullOwnerHealthReason(session, agentType) {
+    const live = !!session?.ptyProcess && session._restoreDeferred !== true, acp = !!session?._acpProcess && session._restoreDeferred !== true;
+    return agentType === 'dsh' ? (acp ? 'dsh_presession' : 'owner_unavailable') : agentType === 'opencode' && live ? 'opencode_presession' : 'owner_unavailable';
+  }
+
   // The CANONICAL owner, and the only live owner source: never a stored generation, a launch-plan
   // counter, a linked transcript list or a caller-supplied field.
   function canonicalOwnerOf(session) {
@@ -264,9 +279,12 @@ function createCodingSessionModelRuntime({
   function publicFields(session) {
     // A shell or native Wall-E chat session has NO native owner: it publishes no envelope at all, so
     // nothing downstream can mistake an explicit null owner for a native one.
-    if (!nativeAgentFor(session)) return null;
+    const agentType = nativeAgentFor(session);
+    if (!agentType) return null;
     const owner = canonicalOwnerOf(session);
-    if (!owner) return publicModelFields({ owner: null, health: { status: 'unavailable', reason: 'owner_unavailable', owner: null, lastSuccessRevision: null } });
+    // WP-3: a LIVE never-prompted OpenCode tab is the ONE null-owner case with its own reason; every
+    // other null-owner case keeps `owner_unavailable`.
+    if (!owner) return publicModelFields({ owner: null, health: { status: 'unavailable', reason: nullOwnerHealthReason(session, agentType), owner: null, lastSuccessRevision: null } });
     const entry = observationHealth.get(session) || null;
     const live = entry && sameOwner(entry.owner, owner) ? entry : null;
     const health = live
@@ -908,6 +926,7 @@ function createCodingSessionModelRuntime({
     committed = bound.changed === true;
     let revision = Number.isSafeInteger(bound.revision) ? bound.revision : finalState.revision;
     for (const observation of Array.isArray(result.observations) ? result.observations : []) {
+      if (observation?.kind === 'failed-turn') continue; // refused-turn evidence for the lead-model observer only, never model state
       if (!sameOwner(observation, owner)) { deferredReason = 'owner'; scanAborted = true; break; }
       if (!isCurrent(session, owner)) { deferredReason = 'superseded'; scanAborted = true; break; }
       // Correction 3: revalidate the captured switch lifetime immediately before EVERY owner
@@ -1490,7 +1509,7 @@ function createDurableModelResultApplier({ modelStateRuntime, isCurrent, isOwner
       if (entry.titleApplied && entry.title && entry.titleKind !== 'live') { const label = `Codex: ${entry.title}`; if (context.session.label !== label) { context.session.label = label; titleChanged = true; } }
       if (entry.titleSynced) cacheCompleted(context);
     }
-    if (titleChanged && typeof broadcastSessionList === 'function') broadcastSessionList();
+    if (titleChanged && typeof broadcastSessionList === 'function') broadcastSessionList(false, { reason: 'model-title-apply' });
     return { rerun: false };
   };
 }

package/template/coding-task-manager/lib/coding-session-model-scan.js

@@ -35,6 +35,7 @@ const transcriptSource = require('./transcript-source');
 const {
   laterRank,
   claudeIdentityCandidate, claudeTurnCandidate, claudeIdentityObservations, claudeTurnObservations,
+  claudeTurnFailureCandidate, claudeTurnFailureObservations,
   codexSettingsCandidate, codexSettingsObservations, codexTurnContextCandidate, codexTerminalCandidate,
   codexTurnObservations,
 } = require('./coding-session-model-adapters');
@@ -339,6 +340,13 @@ function runScan(run) {
     ops: run.ops, fd, readOptions: run.readOptions, stat,
     dev, ino, size, mtimeMs, headAnchor: null, nextRevision: prior ? prior.revision + 1 : 1,
     selection: null, completed: null, latestContext: null, latestContextPayload: null, turnContext: null,
+    /*
+     * WP-1b/D-1: `failure`/`failureRank` are the refused-turn slot's own pair. They mirror `completed`
+     * EXCEPT that no checkpoint carries them: a failure is emitted only for a candidate FOUND this
+     * tick, and it is compared against `completedRank` (this tick's winner or the acknowledged one) to
+     * decide whether it is still open.
+     */
+    failure: null, failureRank: null,
     sawContext: false, reachedBof: false, backfill: false, records: 0, iterations: 0, gapReason: null, eof: null,
     windowEvaluated: false, windowStart: 0, archiveRefused: false,
     edgeAt: baseEnd, edgeAnchor: null };
@@ -892,6 +900,17 @@ function reduceRecord(state, lane, record, start, end) {
       const candidate = { ...turn, start, end };
       if (laterRank(state.completedRank, candidate)) { state.completed = candidate; state.completedRank = candidate; }
     }
+    /*
+     * WP-1b/D-1: a REFUSED turn (assistant row with `isApiErrorMessage`, whose `<synthetic>` model
+     * `claudeTurnCandidate` can never name) keeps its OWN newest-wins slot, ranked by the SAME
+     * (timestamp, offset) order. It is emitted only while it is NEWER than `state.completedRank` -- see
+     * the emitter -- so a good turn after it wins and an acknowledged good turn still suppresses it.
+     */
+    const failure = claudeTurnFailureCandidate(owner, record, start);
+    if (failure) {
+      const candidate = { ...failure, start, end };
+      if (laterRank(state.failureRank, candidate)) { state.failure = candidate; state.failureRank = candidate; }
+    }
     return;
   }
   const terminal = codexTerminalCandidate(record);
@@ -1149,6 +1168,18 @@ function checkpointResult(state, lanes, inherited, blocked) {
   if (state.agentType === 'claude') {
     observations.push(...claudeIdentityObservations(state.owner, state.selection),
       ...claudeTurnObservations(state.owner, state.completed));
+    /*
+     * WP-1b/D-1: the refused-turn fact, under the rule the G2-5/G2-9 comment above states: `state.failure`
+     * is a CANDIDATE FOUND THIS TICK, so a tick that read no new bytes emits nothing and no observation is
+     * ever synthesized from a checkpoint ref (`state.failure` is deliberately not persisted). It is open
+     * only while it ranks LATER than `state.completedRank`, which is the newest completed turn of THIS tick
+     * or the one the checkpoint ACKNOWLEDGED (seeded at runScan from `state.acknowledged.completed`, see
+     * `state.completedRank = rankFromRef(state.acknowledged.completed)`) -- the same (timestamp, offset)
+     * order the whole-tail decoder `claudeModelObservations` applies to (timestamp, index).
+     */
+    if (laterRank(state.completedRank, state.failure)) {
+      observations.push(...claudeTurnFailureObservations(state.owner, state.failure));
+    }
   } else {
     observations.push(...codexSettingsObservations(state.owner, state.selection),
       ...codexTurnObservations(state.owner, state.completed));

package/template/coding-task-manager/lib/coding-session-model-state.js

@@ -23,6 +23,13 @@ const SOURCE_GROUPS = {
     resolved: ['opencode:session-store', 'opencode:plugin-model', 'db:restore'],
     'completed-turn': ['opencode:message', 'db:restore'],
   },
+  // DeepSeek Harness (ACP): the bridge's `configOptions` (session/new, session/resume,
+  // config_option_update) is both the selection and the resolved model; a settled turn confirms it.
+  dsh: {
+    selection: ['dsh:config-option', 'db:restore'],
+    resolved: ['dsh:config-option', 'db:restore'],
+    'completed-turn': ['dsh:turn', 'db:restore'],
+  },
 };
 
 function normalizedString(value, required = false) {