create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/conversation-freshness-diagnostics.js

@@ -0,0 +1,280 @@
+'use strict';
+
+// Landing-throughput WP-6 shard S14 (design doc §5 D-10 "move-only", §6 "Shard module
+// seam"): the conversation-freshness diagnostics pair (_conversationFreshnessDiagnostics plus its
+// private helper _conversationPermanentStaleSnapshot) moves out of server.js VERBATIM into this
+// module behind the same configure(deps) seam as lib/api/session-attach.js and
+// lib/terminal-attach-geometry.js (S6), lib/walle-history-serve.js (S8),
+// lib/codex-rollout-history.js (S9), lib/terminal-input-prepared.js (S10), lib/idle-notify.js
+// (S11), lib/session-park.js (S12) and lib/terminal-draft-operation.js (S13). It registers NO
+// route and NO socket handler: server.js keeps the one pass-through call site as
+// conversationFreshnessDiagnostics._conversationFreshnessDiagnostics(id) (inside
+// apiDiagnosticsConversationFreshness) and this configure() seam. Bodies are identical to the
+// server.js declarations except for the `_deps.` prefix on every identifier that used to resolve
+// to a server.js top-level binding (D-10 rule 1), proven by `node bin/move-only-check.js`.
+// Two inline `require('./lib/...')` calls are rebased to this module's own `require('./...')`
+// (S8 precedent: one move-only DIFF per rebased require -- the remainder is proven by re-running
+// against a copy with `sed "s#require('\./#require('./lib/#g"` applied).
+//
+// The module deliberately lives at lib/conversation-freshness-diagnostics.js and NOT under lib/ws/:
+// this is the read-only /api/diagnostics/conversation-freshness view, not a ws-router handler.
+//
+// Injected deps, per function:
+//   _conversationFreshnessDiagnostics: _conversationFreshnessDebtSnapshot, _coopScheduler, _ctmDbWorker, _jsonlWatcher, _resolveCanonicalRowSources, _sessionMessageRowsHwm, _sessionRowsFreshnessForSource, crypto, dbModule, getConversationImportConvergenceStats, historySourceSupport, listSelfLinkedConversationPartitions, path, providerAdapterKind
+//   _conversationPermanentStaleSnapshot: _conversationPermanentStale, _conversationPermanentStaleCount
+//
+// Mutable module state (D-10 rule 2 / S9 lesson 7): _coopScheduler, _ctmDbWorker, _jsonlWatcher and
+// _conversationPermanentStaleCount are server.js `let`s, so each is injected as a GETTER -- never a
+// copy. No moved body ASSIGNS a server.js top-level binding, so this seam carries no get/set pair.
+// _conversationPermanentStale (a `const` Map) and every function dep are by-value references.
+// Calls between the two moved functions stay direct (no `_deps.`).
+
+let _deps = null;
+
+function configure(deps = {}) {
+  _deps = deps;
+}
+
+function _conversationFreshnessDiagnostics(requestedId) {
+  const id = String(requestedId || '').trim();
+  const resolution = _deps._resolveCanonicalRowSources(id);
+  const sourceIds = [
+    id,
+    resolution?.canonicalSessionId,
+    ...(Array.isArray(resolution?.sources) ? resolution.sources.map(s => s.id) : []),
+  ].filter(Boolean);
+  const uniqueSourceIds = [...new Set(sourceIds)];
+  const db = _deps.dbModule.getDb();
+  const sources = (Array.isArray(resolution?.sources) ? resolution.sources : []).map((source) => {
+    const rowHwm = _deps._sessionMessageRowsHwm(source.id);
+    let freshness = null;
+    try { freshness = _deps._sessionRowsFreshnessForSource(id, source.id, { knownRowCount: rowHwm.rowCount }); } catch {}
+    return {
+      id: source.id,
+      rank: source.rank || 0,
+      reason: source.reason || '',
+      resolverRowCount: source.rowCount || 0,
+      resolverRowMaxTimestamp: source.rowMaxTimestamp || '',
+      rowHwm,
+      freshness,
+    };
+  });
+
+  const transcriptFiles = [];
+  const seenFiles = new Set();
+  for (const sourceId of uniqueSourceIds) {
+    let rows = [];
+    try {
+      rows = db.prepare(`
+        SELECT jsonl_path, agent_session_id, ctm_session_id, provider, size, offset, mtime_ms, status, last_error, updated_at
+          FROM transcript_files
+         WHERE ctm_session_id = ? OR agent_session_id = ?
+         ORDER BY updated_at DESC, jsonl_path
+         LIMIT 50
+      `).all(sourceId, sourceId);
+    } catch {}
+    for (const row of rows) {
+      const key = String(row.jsonl_path || '');
+      if (!key || seenFiles.has(key)) continue;
+      seenFiles.add(key);
+      const size = Number(row.size || 0);
+      const offset = Number(row.offset || 0);
+      transcriptFiles.push({
+        locatorBasename: _deps.path.basename(key),
+        locatorHash: _deps.crypto.createHash('sha256').update(key).digest('hex'),
+        agentSessionId: row.agent_session_id || '',
+        ctmSessionId: row.ctm_session_id || '',
+        provider: row.provider || '',
+        size,
+        offset,
+        lagBytes: Math.max(0, size - offset),
+        mtimeMs: Number(row.mtime_ms || 0),
+        status: row.status || '',
+        lastError: row.last_error || '',
+        updatedAt: row.updated_at || '',
+      });
+    }
+  }
+
+  let rowBackfillCursor = null;
+  try {
+    rowBackfillCursor = db.prepare(`
+      SELECT ctm_session_id, max_event_id, updated_at, last_scanned, last_inserted, last_error
+        FROM transcript_row_backfill_cursors
+       WHERE ctm_session_id = ?
+    `).get(resolution?.canonicalSessionId || id) || null;
+  } catch {}
+
+  let worker = null;
+  try { worker = _deps._ctmDbWorker ? _deps._ctmDbWorker.getStatus?.() : null; } catch {}
+  let publicationDebt = { pending: 0, oldestCommittedAt: '', oldestAgeMs: 0 };
+  try {
+    const debt = db.prepare(`
+      SELECT COUNT(*) AS pending, MIN(committed_at) AS oldest_committed_at
+        FROM conversation_update_outbox
+       WHERE published_at IS NULL
+    `).get();
+    const oldestCommittedAt = String(debt?.oldest_committed_at || '');
+    publicationDebt = {
+      pending: Number(debt?.pending || 0),
+      oldestCommittedAt,
+      oldestAgeMs: oldestCommittedAt ? Math.max(0, Date.now() - Date.parse(`${oldestCommittedAt}Z`)) : 0,
+    };
+  } catch {}
+  let kernelSources = [];
+  let projection = null;
+  let migration = null;
+  let rangeProtocol = null;
+  try {
+    const canonicalId = resolution?.canonicalSessionId || id;
+    const sourceRows = db.prepare(`
+      SELECT source_id, provider, adapter_kind, generation, source_version,
+             observed_hwm, committed_hwm, continuation_json, parser_version, state, last_error
+        FROM conversation_sources WHERE canonical_session_id=? ORDER BY source_id
+    `).all(canonicalId);
+    const memberQuery = db.prepare(`
+      SELECT member_id, locator_hash, locator_basename, fingerprint, member_role,
+             generation, byte_cursor, partial_line, observed_size, observed_mtime_ms, committed_hwm
+        FROM conversation_source_members WHERE source_id=? ORDER BY member_id
+    `);
+    kernelSources = sourceRows.map((row) => ({
+      sourceId: row.source_id,
+      provider: row.provider,
+      adapter: row.adapter_kind,
+      writer: 'conversation-commit-kernel',
+      generation: Number(row.generation || 0),
+      sourceVersion: Number(row.source_version || 0),
+      observedHwm: (() => { try { return JSON.parse(row.observed_hwm || '{}'); } catch { return {}; } })(),
+      committedHwm: (() => { try { return JSON.parse(row.committed_hwm || '{}'); } catch { return {}; } })(),
+      continuationPending: !!row.continuation_json,
+      parserVersion: Number(row.parser_version || 0),
+      state: row.state,
+      lastError: row.last_error || '',
+      members: memberQuery.all(row.source_id).map((member) => ({
+        memberId: member.member_id,
+        locatorHash: member.locator_hash,
+        locatorBasename: member.locator_basename,
+        fingerprint: member.fingerprint,
+        role: member.member_role,
+        generation: Number(member.generation || 0),
+        byteCursor: Number(member.byte_cursor || 0),
+        observedSize: Number(member.observed_size || 0),
+        observedMtimeMs: Number(member.observed_mtime_ms || 0),
+        partialLinePending: !!member.partial_line,
+        committedHwm: (() => { try { return JSON.parse(member.committed_hwm || '{}'); } catch { return {}; } })(),
+      })),
+    }));
+    projection = db.prepare('SELECT * FROM conversation_projection_state WHERE ctm_session_id=?').get(canonicalId) || null;
+    migration = db.prepare('SELECT * FROM conversation_migration_state WHERE provider=?').get('provider-source-enrollment') || null;
+    rangeProtocol = require('./conversation-page-v3')
+      .readConversationV3Diagnostics(db, canonicalId);
+    rangeProtocol.metrics = require('./conversation-range-metrics').snapshot(canonicalId);
+  } catch {}
+  const sourceComplete = (source) => {
+    if (!source || source.state !== 'active' || source.continuationPending) return false;
+    if (JSON.stringify(source.observedHwm || {}) !== JSON.stringify(source.committedHwm || {})) return false;
+    if (source.adapter !== 'append-log' && source.adapter !== 'compound-log') return true;
+    const currentMembers = source.members.filter((member) => member.generation === source.generation);
+    return currentMembers.length > 0 && currentMembers.every((member) => (
+      !member.partialLinePending && member.byteCursor >= member.observedSize
+    ));
+  };
+  let aliasPartitions = [];
+  try {
+    // One predicate: the adoption module owns "which agent ids hold a stranded v2 partition".
+    aliasPartitions = _deps.listSelfLinkedConversationPartitions(db, _deps.dbModule.getDomainDb('core'), { limit: 100 })
+      .map((p) => ({ agentSessionId: p.agentSessionId, ownerCtmSessionId: p.ownerCtmSessionId, rowCount: p.placements }));
+  } catch {}
+  let detectedProvider = '';
+  try {
+    const canonicalId = resolution?.canonicalSessionId || id;
+    // ctm_sessions + agent_sessions are both core.
+    detectedProvider = String(_deps.dbModule.getDomainDb('core').prepare(`
+      SELECT provider FROM ctm_sessions WHERE id=?
+      UNION ALL
+      SELECT provider FROM agent_sessions WHERE ctm_session_id=? OR agent_session_id=?
+      LIMIT 1
+    `).get(canonicalId, canonicalId, id)?.provider || '').trim().toLowerCase();
+  } catch {}
+  // S-19: pass the SAME adapterKind the runtime ingest path would derive
+  // (providerAdapterKind) rather than leaving adapterKind blank — a blank
+  // adapterKind makes historySourceSupport accept ANY registered adapter for
+  // the provider, which can report "supported" for a provider/adapter
+  // combination the runtime path would actually reject, making this
+  // diagnostic disagree with reality.
+  const sourceSupport = kernelSources.length > 0
+    ? _deps.historySourceSupport(kernelSources[0].provider, kernelSources[0].adapter)
+    : (detectedProvider
+      ? _deps.historySourceSupport(detectedProvider, _deps.providerAdapterKind(detectedProvider))
+      : { provider: '', status: 'history_source_unclassified', supported: false });
+  const sourceSetVersion = kernelSources.reduce((total, source) => total + Number(source.sourceVersion || 0), 0);
+  const migrationComplete = !migration || !!migration.completed_at;
+  const projectionComplete = !!projection
+    && projection.state === 'ready'
+    && Number(projection.source_set_version || 0) === sourceSetVersion
+    && kernelSources.length > 0
+    && kernelSources.every(sourceComplete)
+    && migrationComplete
+    && aliasPartitions.length === 0;
+  return {
+    ok: true,
+    generatedAt: Date.now(),
+    requestedId: id,
+    canonicalSessionId: resolution?.canonicalSessionId || id,
+    sources,
+    transcriptFiles,
+    totalLagBytes: transcriptFiles.reduce((n, row) => n + Number(row.lagBytes || 0), 0),
+    rowBackfillCursor,
+    convergence: {
+      main: typeof _deps.getConversationImportConvergenceStats === 'function'
+        ? _deps.getConversationImportConvergenceStats(id)
+        : null,
+      worker: null,
+    },
+    worker,
+    watcherRoots: _deps._jsonlWatcher?.rootHealthSnapshot?.() || [],
+    render: {
+      rowCount: _deps._sessionMessageRowsHwm(resolution?.canonicalSessionId || id).rowCount,
+      projectionEpoch: Number(projection?.projection_epoch || 0),
+      latestRowHwm: Number(projection?.latest_row_hwm || 0),
+    },
+    providerSources: kernelSources,
+    historySource: sourceSupport,
+    projectionComplete,
+    projection,
+    migration,
+    rangeProtocol,
+    rowOwnership: {
+      writer: 'conversation-commit-kernel',
+      aliasPartitionCount: aliasPartitions.length,
+      aliasRows: aliasPartitions.reduce((total, row) => total + Number(row.rowCount || 0), 0),
+      aliasPartitions,
+    },
+    publicationDebt,
+    coopJobs: _deps._coopScheduler ? _deps._coopScheduler.statusReport() : [],
+    freshnessDebt: _deps._conversationFreshnessDebtSnapshot(),
+    permanentStaleTripwire: _conversationPermanentStaleSnapshot(),
+  };
+}
+
+function _conversationPermanentStaleSnapshot() {
+  const items = [];
+  for (const [sessionId, item] of _deps._conversationPermanentStale.entries()) {
+    items.push({
+      sessionId,
+      firstAt: item.firstAt || 0,
+      loggedAt: item.loggedAt || 0,
+      state: item.state || '',
+      count: item.count || 0,
+      renderableTailBytes: item.renderableTailBytes || 0,
+      evidence: item.evidence || null,
+    });
+  }
+  return { count: _deps._conversationPermanentStaleCount, active: items };
+}
+
+module.exports = {
+  configure,
+  _conversationFreshnessDiagnostics,
+  _conversationPermanentStaleSnapshot,
+};

package/template/coding-task-manager/lib/conversation-item-clock.js

@@ -0,0 +1,261 @@
+'use strict';
+
+// WP-5 (docs/shared-memory-every-machine-2026-10-31.html §5 D-3, §6.8): the per-origin change
+// clock over the conversation store. Every inserted/corrected item gets one clock row carrying
+// (origin_instance_id, origin_seq) — the compacted log lib/conversation-sync.js serves as a
+// version-vector-addressed feed. `conversation_vv` is "seen through"; `conversation_local_seq`
+// is this host's monotonic allocator. Text table untouched (the brief's DDL is additive).
+//
+// HELPERS ONLY — no DDL lives here. The three clock tables are declared by migration v61
+// (lib/migrations/v61-conversation-item-clock.js, the sanctioned lib/migrations/** home), which
+// lib/conversation-store-v2.js reaches through ensureConversationItemClockSchema so a store built
+// outside the ladder (a bare fixture, a fresh boot) still gets them — the same shape
+// lib/conversation-turn-index.js uses for v31's turn index. Keeping the DDL out of that store is
+// what keeps conversation-store-v2.js under its ddl-outside-runner ratchet; keeping it out of HERE
+// is what lets this module sit BELOW db.js without a require cycle.
+//
+// The replica RECEIVER's delete is NOT here: it lives beside purgeConversationV2 in
+// lib/prompt-purge-v2.js, because it is the same "delete items by stable key + record the feed +
+// rebuild the turn index" operation, and that module is already the pinned writer of the
+// conversation item tables (tests/conversation-store-v2.test.js's writer gate). Keeping it there
+// keeps this module DDL-free AND free of raw item-table writes.
+
+// WP-5 §6.8: one seed page is at most this many items (the brief's default).
+const CONVERSATION_SEED_PAGE_LIMIT = 5_000;
+
+// The seed walk's resumable cursor lives in the host-local `settings` kv (never replicated, D-7).
+const CONVERSATION_SEED_CURSOR_KEY = 'conversation_clock_seed.cursor';
+
+// A process-level override for this CTM's instance id. Production leaves it null and the store
+// reads `instance_identity` (the row db.js's boot mint writes); tests set it so a bare in-memory
+// store has a deterministic origin without a boot sequence.
+let _instanceIdOverride = null;
+
+// The production seam for the same question: a resolver db.js registers at module scope (it is the
+// one module that owns `getCurrentHostedInstanceIdStrict`, and its handle routing knows where the
+// `instance_identity` row physically lives). Null until then, and '' is a valid answer.
+let _instanceIdResolver = null;
+
+function setConversationInstanceIdForTests(instanceId) {
+  _instanceIdOverride = instanceId ? String(instanceId).trim() : null;
+}
+
+// `fn` is a zero-arg function returning this CTM's instance id (or a falsy value); null clears it.
+function setConversationInstanceIdResolver(fn) {
+  _instanceIdResolver = typeof fn === 'function' ? fn : null;
+}
+
+// This CTM's own instance id — the value that addresses everything this node ORIGINATES. Same
+// source the rest of the firehose DB uses for `origin_instance_id` (db.js's boot mint writes the
+// `instance_identity` row); '' means "this host, before the identity was known" (never shipped —
+// D-3), and a caller with no such row can pin one with setConversationInstanceIdForTests.
+//
+// Deliberately NOT falling back to lib/instance-identity-access here: that module sits ABOVE db.js
+// (it reads its identity through `require('../db')`), and db.js requires the conversation store —
+// reaching for it would put this module back above db.js and close a dependency-lint cycle
+// (lib/conversation-item-clock -> lib/instance-identity-access -> db.js -> lib/conversation-store-v2).
+//
+// So the fallback is a RESOLVER SEAM instead of an import. The clock's own tables are read from the
+// same handle as the identity row, so a handle that can read one can read the other — but only on a
+// single-file install. On a DOMAIN-SPLIT install the clock tables are firehose (task-manager.db)
+// while `instance_identity` is core (core.db), so the same-handle read above finds no table and
+// every origin would be ''. db.js (which sits ABOVE this module and already requires the store, so
+// no new edge is created) registers `() => getCurrentHostedInstanceIdStrict()` — the identity
+// accessor lib/instance-identity-access.js itself uses, routed through getDomainDb('core') — and
+// this module calls it only when the same-handle read came up empty. Tests may set the override or
+// the resolver; both are process-wide and must be restored in after().
+function localConversationInstanceId(db) {
+  if (_instanceIdOverride) return _instanceIdOverride;
+  try {
+    const row = db.prepare('SELECT instance_id FROM instance_identity LIMIT 1').get();
+    const id = String(row?.instance_id || '').trim();
+    if (id) return id;
+  } catch { /* expected: a store without the instance_identity table (bare fixture) */ }
+  if (_instanceIdResolver) {
+    try {
+      const resolved = _instanceIdResolver();
+      // A non-string (an object, a number, undefined) is NOT an instance id — take nothing from it.
+      if (typeof resolved === 'string') {
+        const id = resolved.trim();
+        if (id) return id;
+      }
+    } catch { /* expected: identity not readable yet (pre-initDb, or no core handle) — origin stays '' */ }
+  }
+  return ''; // REPORT: no readable identity — items stay unaddressable (origin '') rather than mislabelled
+}
+
+function _tableExists(db, name) {
+  return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=?").get(name);
+}
+
+// Allocate `count` consecutive local seqs; seqs start at 1. Caller owns the transaction.
+function _takeLocalSeqs(db, count) {
+  const row = db.prepare('SELECT next_seq FROM conversation_local_seq WHERE id=1').get();
+  const start = row && Number.isSafeInteger(Number(row.next_seq)) && Number(row.next_seq) > 0
+    ? Number(row.next_seq) : 1;
+  db.prepare(`
+    INSERT INTO conversation_local_seq(id, next_seq) VALUES (1, ?)
+    ON CONFLICT(id) DO UPDATE SET next_seq=excluded.next_seq
+  `).run(start + count);
+  return start;
+}
+
+// "Seen through": monotonic per origin, exactly like the brain's _bumpVv.
+function _bumpConversationVv(db, originInstanceId, seq) {
+  const origin = String(originInstanceId || '').trim();
+  const value = Number(seq);
+  if (!origin || !Number.isSafeInteger(value) || value <= 0) return;
+  db.prepare(`
+    INSERT INTO conversation_vv(origin_instance_id, max_seq) VALUES (?, ?)
+    ON CONFLICT(origin_instance_id) DO UPDATE SET max_seq=MAX(max_seq, excluded.max_seq)
+  `).run(origin, value);
+}
+
+function _stampConversationClock(db, { stableKey, sessionId, originInstanceId, originSeq, nowMs, deleted }) {
+  db.prepare(`
+    INSERT INTO conversation_item_clock
+      (stable_key, session_id, origin_instance_id, origin_seq, updated_at_ms, deleted)
+    VALUES (?,?,?,?,?,?)
+    ON CONFLICT(stable_key) DO UPDATE SET
+      session_id=excluded.session_id,
+      origin_instance_id=excluded.origin_instance_id,
+      origin_seq=excluded.origin_seq,
+      updated_at_ms=excluded.updated_at_ms,
+      deleted=excluded.deleted
+  `).run(String(stableKey), String(sessionId), String(originInstanceId || ''),
+    Number(originSeq) || 0, Number(nowMs) || 0, deleted ? 1 : 0);
+}
+
+// The receiver's tombstone clock row: the sender's (origin, origin_seq) with deleted=1, so the
+// delete stays addressable in its origin's stream and relays onward (D-3). No local seq is spent.
+function stampIncomingConversationClockV2(db, { stableKey, sessionId, origin, originSeq, nowMs = Date.now() } = {}) {
+  const key = String(stableKey || '').trim();
+  const originId = String(origin || '').trim();
+  const seq = Number(originSeq);
+  if (!key || !originId || !Number.isSafeInteger(seq) || seq <= 0) return false;
+  _stampConversationClock(db, {
+    stableKey: key, sessionId, originInstanceId: originId, originSeq: seq, nowMs, deleted: true,
+  });
+  _bumpConversationVv(db, originId, seq);
+  return true;
+}
+
+function _readConversationVv(db) {
+  const vector = {};
+  for (const row of db.prepare('SELECT origin_instance_id, max_seq FROM conversation_vv ORDER BY origin_instance_id ASC').all()) {
+    vector[String(row.origin_instance_id)] = Number(row.max_seq) || 0;
+  }
+  return vector;
+}
+
+// The tombstone half of a purge: a purged key must keep an addressable clock row (deleted=1)
+// under THIS host's origin so peers learn to delete it. Local seqs, local vv bump, one row per key.
+function stampConversationTombstonesV2(db, { sessionId, stableKeys = [], nowMs = Date.now() } = {}) {
+  const keys = [...new Set((Array.isArray(stableKeys) ? stableKeys : []).map((k) => String(k)).filter(Boolean))];
+  if (!keys.length) return 0;
+  const localId = localConversationInstanceId(db);
+  // No identity, no stamping (the same rule the ingest path applies — lib/conversation-store-v2.js
+  // skips `!origin`): a row at origin '' is unaddressable AND permanently so, because nothing ever
+  // revisits a key that already has a clock row. Spend no seq, write no row, say so.
+  if (!localId) return 0;
+  let start = 1;
+  db.transaction(() => {
+    start = _takeLocalSeqs(db, keys.length);
+    keys.forEach((stableKey, index) => {
+      _stampConversationClock(db, {
+        stableKey, sessionId, originInstanceId: localId, originSeq: start + index, nowMs, deleted: true,
+      });
+    });
+    _bumpConversationVv(db, localId, start + keys.length - 1);
+  })();
+  return keys.length;
+}
+
+function conversationSeedState(db) {
+  try {
+    const row = db.prepare('SELECT value FROM settings WHERE key=?').get(CONVERSATION_SEED_CURSOR_KEY);
+    if (!row || row.value == null) return { done: false, afterItemId: 0 };
+    const parsed = JSON.parse(String(row.value));
+    return { done: parsed?.done === true, afterItemId: Number(parsed?.afterItemId) || 0 };
+  } catch {
+    return { done: false, afterItemId: 0 }; // expected: no cursor yet (or a bare fixture without `settings`)
+  }
+}
+
+function _writeConversationSeedState(db, state) {
+  db.prepare(`
+    INSERT INTO settings(key, value) VALUES (?, ?)
+    ON CONFLICT(key) DO UPDATE SET value=excluded.value
+  `).run(CONVERSATION_SEED_CURSOR_KEY, JSON.stringify(state));
+}
+
+// One bounded, resumable page of the one-time seed for items that predate the clock. Stamps a
+// clock row at THIS host's origin (local seq) for every item that has none, writes NO outbox row
+// (seeding is not a user-visible change — test (g)), and advances the item_id cursor. Never boot
+// work: the hub/member round drives it until done.
+function seedConversationClockPage(db, { limit = CONVERSATION_SEED_PAGE_LIMIT } = {}) {
+  if (!_tableExists(db, 'conversation_item_clock') || !_tableExists(db, 'conversation_text_items_v2')) {
+    return { seeded: 0, done: true, afterItemId: 0 };
+  }
+  const budget = Math.max(1, Math.min(CONVERSATION_SEED_PAGE_LIMIT, Number(limit) || CONVERSATION_SEED_PAGE_LIMIT));
+  const state = conversationSeedState(db);
+  if (state.done) return { seeded: 0, done: true, afterItemId: state.afterItemId };
+  const localId = localConversationInstanceId(db);
+  // No readable identity ⇒ stamp NOTHING: not the rows, not the cursor. Seeding at origin '' would
+  // take seqs and write clock rows for all N items, and the walk never revisits a key that already
+  // has one — so a single premature page would make the whole store permanently unaddressable
+  // (the live domain-split symptom: 16,482 items, zero clock rows, nothing on the feed). Returning
+  // done:false without opening a transaction leaves the cursor untouched, so the very next call
+  // after the identity becomes readable seeds the same items at the REAL origin.
+  if (!localId) return { seeded: 0, done: false, afterItemId: state.afterItemId };
+  const nowMs = Date.now();
+  let seeded = 0;
+  let afterItemId = state.afterItemId;
+  db.transaction(() => {
+    const rows = db.prepare(`
+      SELECT i.item_id, i.stable_key, i.session_id
+        FROM conversation_text_items_v2 i
+        LEFT JOIN conversation_item_clock c ON c.stable_key = i.stable_key
+       WHERE i.item_id > ? AND c.stable_key IS NULL
+       ORDER BY i.item_id ASC
+       LIMIT ?
+    `).all(afterItemId, budget);
+    if (rows.length) {
+      const start = _takeLocalSeqs(db, rows.length);
+      rows.forEach((row, index) => {
+        _stampConversationClock(db, {
+          stableKey: row.stable_key, sessionId: row.session_id,
+          originInstanceId: localId, originSeq: start + index, nowMs, deleted: false,
+        });
+      });
+      _bumpConversationVv(db, localId, start + rows.length - 1);
+      seeded = rows.length;
+      afterItemId = Number(rows[rows.length - 1].item_id);
+    }
+    // More work remains when this page was full or a later item still lacks a clock.
+    const pending = db.prepare(`
+      SELECT 1 AS hit FROM conversation_text_items_v2 i
+        LEFT JOIN conversation_item_clock c ON c.stable_key = i.stable_key
+       WHERE i.item_id > ? AND c.stable_key IS NULL LIMIT 1
+    `).get(afterItemId);
+    _writeConversationSeedState(db, { done: !pending, afterItemId });
+  })();
+  return { seeded, done: conversationSeedState(db).done, afterItemId };
+}
+
+module.exports = {
+  CONVERSATION_SEED_PAGE_LIMIT,
+  setConversationInstanceIdForTests,
+  setConversationInstanceIdResolver,
+  localConversationInstanceId,
+  readConversationClockVector: _readConversationVv,
+  bumpConversationVv: _bumpConversationVv,
+  stampIncomingConversationClockV2,
+  stampConversationTombstonesV2,
+  conversationSeedState,
+  seedConversationClockPage,
+  // Internal stamping primitives the conversation store's writer calls inside its own transaction.
+  _takeLocalSeqs,
+  _stampConversationClock,
+  _bumpConversationVv,
+};

package/template/coding-task-manager/lib/conversation-source-registry.js

@@ -93,6 +93,11 @@ const PROVIDER_ADAPTERS = Object.freeze({
   'claude-desktop': Object.freeze(['snapshot']),
   cursor: Object.freeze(['database-snapshot']),
   opencode: Object.freeze(['database-snapshot']),
+  // S-25 (docs/deepseek-harness-acp-agent-2026-10-28.html, WP-3 after OQ-2): the DeepSeek Harness's
+  // CTM-owned transcript (lib/acp/dsh-transcript.js) is Claude-shaped JSONL, so its history ingest
+  // rides the same compound-log lane as claude. Without this entry providerAdapterKind('dsh') is ''
+  // and isLogAdapterProvider() rejects the file before it can be parsed.
+  dsh: Object.freeze(['compound-log']),
 });
 
 function _flagEnabled(name) {

package/template/coding-task-manager/lib/conversation-store-v2.js

@@ -17,6 +17,12 @@ const {
 const DEFAULT_READ_LIMIT = 500;
 const MAX_READ_LIMIT = 2_000;
 
+// WP-5 §6.8: the clock's tables are migration v61's; its helpers are lib/conversation-item-clock.js.
+const {
+  localConversationInstanceId, _takeLocalSeqs, _stampConversationClock, _bumpConversationVv, seedConversationClockPage,
+} = require('./conversation-item-clock');
+const { ensureConversationItemClockSchema } = require('./migrations/v61-conversation-item-clock');
+
 // These triggers keep the external-content FTS index in sync; table rebuilds recreate them transactionally (v25 migration).
 const CONVERSATION_FTS_TRIGGERS_DDL = `
     CREATE TRIGGER IF NOT EXISTS conversation_text_v2_ai
@@ -169,6 +175,8 @@ function ensureConversationStoreV2(db) {
 
     ${CONVERSATION_FTS_TRIGGERS_DDL}
   `);
+  // WP-5 §6.8: reached here too, so a store built outside the ladder still has the clock tables.
+  ensureConversationItemClockSchema({ getDb: () => db });
   ensureTurnIndexSchema(db);
   const textColumns = new Set(db.prepare('PRAGMA table_info(conversation_text_items_v2)').all().map((row) => row.name));
   if (!textColumns.has('source_event_digest')) {
@@ -436,6 +444,8 @@ function partitionReplacedRemovals(removals, admittedIdentities) {
   return { removals: removals.filter((r) => !isReplaced(r)), replaced: removals.filter(isReplaced) };
 }
 
+// The receiver's delete (deleteConversationItemsByStableKeyV2) moved to lib/prompt-purge-v2.js.
+
 function commitConversationBatchV2(db, batch = {}) {
   if (!db) throw new TypeError('db is required');
   if (!_tableExists(db, 'conversation_text_items_v2')
@@ -788,6 +798,38 @@ function commitConversationBatchV2(db, batch = {}) {
       outboxChanges += 1;
     }
 
+    // WP-5 §6.8: stamp the per-origin clock for every live/tombstoned key this batch changed. The
+    // ordinary writer stamps THIS host's origin with fresh local seqs; the receiver path
+    // (`batch.replication = { origin, originSeqByKey }`) keeps the SENDER's origin/seq instead, so a
+    // re-served row stays addressable in its origin's stream and this node never re-authors it (no echo).
+    if (changed.size) {
+      const replication = batch.replication && typeof batch.replication === 'object' ? batch.replication : null;
+      const originSeqByKey = replication && replication.originSeqByKey && typeof replication.originSeqByKey === 'object'
+        ? replication.originSeqByKey : null;
+      const keys = [...changed.keys()];
+      const localId = localConversationInstanceId(db);
+      const localStart = replication ? 0 : _takeLocalSeqs(db, keys.length);
+      const ceiling = new Map(); // origin -> highest seq stamped by this batch
+      keys.forEach((stableKey, index) => {
+        const change = changed.get(stableKey);
+        const incoming = originSeqByKey ? Number(originSeqByKey[stableKey]) : NaN;
+        const replicated = !!replication && Number.isSafeInteger(incoming) && incoming > 0;
+        // A replication batch keeps only the sender's origin/seq; a key with no incoming seq is a
+        // local divergence this node already owns, so it is left to its own writer rather than
+        // re-authored here under a fabricated origin.
+        if (replication && !replicated) return;
+        const origin = replicated ? String(replication.origin || '') : localId;
+        const seq = replicated ? incoming : localStart + index;
+        if (!origin || !(seq > 0)) return;
+        _stampConversationClock(db, {
+          stableKey, sessionId: change.sessionId, originInstanceId: origin,
+          originSeq: seq, nowMs, deleted: change.kind === 'deleted',
+        });
+        ceiling.set(origin, Math.max(ceiling.get(origin) || 0, seq));
+      });
+      for (const [origin, seq] of ceiling) _bumpConversationVv(db, origin, seq);
+    }
+
     const generationSessionIds = new Set(items.map((entry) => entry.item.sessionId));
     for (const removal of removals) generationSessionIds.add(removal.sessionId);
     if (snapshotSessionId) generationSessionIds.add(snapshotSessionId);
@@ -1043,4 +1085,6 @@ module.exports = {
   readConversationItemsV2,
   searchConversationItemsV2,
   verifyConversationFtsV2,
+  // WP-5 §6.8: re-exported for callers that still reach the seed through the store (lib/memory-sync.js).
+  seedConversationClockPage,
 };