create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/conversation-sync.js

@@ -0,0 +1,355 @@
+'use strict';
+
+// WP-5 (docs/shared-memory-every-machine-2026-10-31.html §5 D-3, D-11, §6.8): the storage half of
+// the conversation-history change feed — a version-vector addressed feed over
+// `conversation_item_clock` plus the one transaction that applies a page of it. Deliberately the
+// same shape as wall-e's brain replica (the Wall-E brain replica's brain-sync-v2 module), because D-3 is one
+// protocol over two stores.
+//
+//   readConversationVector(db)                      -> { instanceId, vector, seedDone }
+//   conversationChangesSince(db, { since, limit })  -> { entries, more, seedDone }
+//   applyConversationChanges(db, { sourceInstanceId, entries }) -> { ok, applied, skipped, vector }
+//
+// The entries are the SENDER's clock rows: the receiver keeps the sender's (origin, origin_seq)
+// verbatim, so a box-1 row relayed by the hub to box-2 still reads as box-1's, and a node never
+// takes its own rows back (it asks with its own maximum, and `origin === local` is skipped).
+//
+// The item half is committed through the store's OWN writer (commitConversationBatchV2) with
+// `replication: { origin, originSeqByKey }` — so the FTS triggers, the placement table, the
+// `conversation_projection_outbox_v2` event and the session generation bookkeeping all run exactly
+// as they do for a locally ingested item, which is what makes Wall-E's existing subscriber project
+// a replicated item with no subscriber change (AC-5b). Tombstones instead go through
+// deleteConversationItemsByStableKeyV2, which records the conversation_projection_deletes_v2 row
+// the subscriber's delete feed reads.
+
+const {
+  commitConversationBatchV2,
+  ensureConversationStoreV2,
+} = require('./conversation-store-v2');
+// WP-5 §6.8: the clock's read/stamp API lives in lib/conversation-item-clock.js (no DDL there).
+const {
+  localConversationInstanceId,
+  readConversationClockVector,
+  bumpConversationVv,
+  stampIncomingConversationClockV2,
+  conversationSeedState,
+} = require('./conversation-item-clock');
+// The receiver's delete lives beside purgeConversationV2 (the pinned item-table writer).
+const { deleteConversationItemsByStableKeyV2 } = require('./prompt-purge-v2');
+const { admitDurableText } = require('../../shared/conversation-admission');
+
+const DEFAULT_CHANGES_LIMIT = 2_000; // §6.8: one page is at most 2000 clock rows
+const MAX_CHANGES_LIMIT = 2_000;
+const MAX_APPLY_ENTRIES = 2_000;
+// The synthetic origin of the receiver path's ingest cursor. §6.8 names it `peer-sync:<origin>:<session>`.
+const PEER_SYNC_SOURCE_PREFIX = 'peer-sync:';
+const PEER_SYNC_SOURCE_FINGERPRINT = 'peer-sync';
+const PEER_SYNC_PARSER_VERSION = 1;
+
+function _string(value, max = 400) {
+  if (typeof value === 'string') return value.slice(0, max);
+  return value == null ? '' : String(value).slice(0, max);
+}
+
+function _parseSeq(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+
+function _ensure(db) {
+  ensureConversationStoreV2(db);
+}
+
+function _itemExists(db, sessionId, stableKey) {
+  return db.prepare(
+    'SELECT turn_id, kind, text, provenance, provider, model, created_at_ms, content_version, updated_at_ms,'
+    + ' source_event_digest, provider_message_digest FROM conversation_text_items_v2 WHERE session_id=? AND stable_key=?',
+  ).get(sessionId, stableKey) || null;
+}
+
+// A hidden placement (a superseded/tombstoned incumbent) is a delete on the wire: shipping its
+// tombstone position key would make the receiver store a live row at a position it never owned.
+function _positionOf(db, sessionId, stableKey) {
+  const row = db.prepare(
+    'SELECT position_key, visible FROM conversation_item_placement_v2 WHERE session_id=? AND stable_key=?',
+  ).get(sessionId, stableKey);
+  if (!row || Number(row.visible) !== 1) return null;
+  return row.position_key;
+}
+
+/** GET /api/sync/conversation/v2/vector — this node's id, its vector, and its seed verdict. */
+function readConversationVector(db) {
+  _ensure(db);
+  return {
+    instanceId: localConversationInstanceId(db),
+    vector: readConversationClockVector(db),
+    seedDone: conversationSeedState(db).done,
+  };
+}
+
+function _feedEntry(db, row) {
+  const origin = _string(row.origin_instance_id, 160);
+  const deleted = Number(row.deleted) ? 1 : 0;
+  const stableKey = _string(row.stable_key, 200);
+  const sessionId = _string(row.session_id, 200);
+  const item = deleted ? null : _itemExists(db, sessionId, stableKey);
+  // A clock that says "live" for a row that is gone is a race with a local delete: ship it as a
+  // delete. The peer's apply is idempotent, so the tombstone is harmless when it is already gone.
+  const isDeleted = deleted === 1 || !item;
+  return {
+    stableKey,
+    sessionId,
+    origin,
+    originSeq: Number(row.origin_seq) || 0,
+    deleted: isDeleted ? 1 : 0,
+    updatedAtMs: Number(row.updated_at_ms) || 0,
+    item: isDeleted ? null : {
+      turnId: item.turn_id,
+      kind: item.kind,
+      text: item.text,
+      provenance: item.provenance == null ? '' : item.provenance,
+      provider: item.provider,
+      model: item.model,
+      createdAtMs: Number(item.created_at_ms),
+      contentVersion: Number(item.content_version) || 1,
+      updatedAtMs: item.updated_at_ms == null ? null : Number(item.updated_at_ms),
+      sourceEventDigest: item.source_event_digest || '',
+      providerMessageDigest: item.provider_message_digest || '',
+      positionKey: _positionOf(db, sessionId, stableKey),
+    },
+  };
+}
+
+// Every clock row whose origin_seq is beyond `since`, ascending by (origin, origin_seq), filling one
+// page. Origin '' (a row this host could not address) is never shipped. `more` is true when ANY
+// origin still holds rows past this page.
+function conversationChangesSince(db, { since = {}, limit = DEFAULT_CHANGES_LIMIT } = {}) {
+  _ensure(db);
+  const requested = Math.floor(Number(limit) || 0) || DEFAULT_CHANGES_LIMIT;
+  const budget = Math.max(1, Math.min(MAX_CHANGES_LIMIT, requested));
+  const sinceMap = since && typeof since === 'object' && !Array.isArray(since) ? since : {};
+  const origins = db.prepare('SELECT origin_instance_id FROM conversation_vv ORDER BY origin_instance_id ASC').all()
+    .map((row) => String(row.origin_instance_id))
+    .filter((origin) => origin !== '');
+  const select = db.prepare(`
+    SELECT stable_key, session_id, origin_instance_id, origin_seq, updated_at_ms, deleted
+      FROM conversation_item_clock
+     WHERE origin_instance_id = ? AND origin_seq > ?
+     ORDER BY origin_seq ASC
+     LIMIT ?
+  `);
+  const probe = db.prepare('SELECT 1 AS hit FROM conversation_item_clock WHERE origin_instance_id = ? AND origin_seq > ? LIMIT 1');
+  const entries = [];
+  let pending = null;
+  for (const origin of origins) {
+    const after = Math.max(0, _parseSeq(sinceMap[origin]));
+    const remaining = budget - entries.length;
+    if (remaining <= 0) { pending = { origin, after }; break; }
+    const rows = select.all(origin, after, remaining);
+    for (const row of rows) entries.push(_feedEntry(db, row));
+    if (rows.length < remaining) continue; // this origin drained
+    const lastSeq = rows.length ? Number(rows[rows.length - 1].origin_seq) : after;
+    if (probe.get(origin, lastSeq)) { pending = { origin, after: lastSeq }; break; }
+  }
+  let more = false;
+  if (pending) {
+    const startAt = origins.indexOf(pending.origin);
+    for (let index = startAt; index < origins.length && !more; index += 1) {
+      const origin = origins[index];
+      const after = index === startAt ? pending.after : Math.max(0, _parseSeq(sinceMap[origin]));
+      more = !!probe.get(origin, after);
+    }
+  }
+  return { entries, more, seedDone: conversationSeedState(db).done };
+}
+
+// The wire item, reduced to exactly the keys admission accepts. `contentVersion`/`updatedAtMs`
+// travel on the entry (below) for observability; admitDurableText rejects unknown item fields.
+function _commitItem(entry) {
+  const item = entry.item || {};
+  return {
+    stableKey: _string(entry.stableKey, 200),
+    sessionId: _string(entry.sessionId, 200),
+    turnId: _string(item.turnId, 400),
+    kind: item.kind,
+    text: typeof item.text === 'string' ? item.text : String(item.text == null ? '' : item.text),
+    provenance: item.provenance == null ? '' : String(item.provenance),
+    provider: item.provider,
+    model: item.model == null ? null : String(item.model),
+    createdAtMs: Number(item.createdAtMs),
+    positionKey: _string(item.positionKey, 400),
+    sourceEventDigest: _string(item.sourceEventDigest, 64),
+    providerMessageDigest: _string(item.providerMessageDigest, 64),
+  };
+}
+
+function _isAdmissible(item) {
+  // Mirror the store's own pre-admission strip (conversation-store-v2 `_normalizeItems`): the two
+  // digests are recomputed/kept by the store and are NOT part of admission's item shape.
+  const probe = { ...item };
+  delete probe.sourceEventDigest;
+  delete probe.providerMessageDigest;
+  return admitDurableText(probe).action === 'persist_text';
+}
+
+/**
+ * POST /api/sync/conversation/v2/apply — one IMMEDIATE transaction for the whole page. Entries the
+ * vector already covers, this node's own origin, and malformed entries are skipped (and counted as
+ * "considered" so the sender stops re-offering them). Live entries are grouped by session and
+ * committed through the store's writer with `replication` set; tombstones are deleted with the
+ * Wall-E delete-feed row. The vector advances only inside this transaction.
+ */
+function applyConversationChanges(db, { sourceInstanceId, entries } = {}) {
+  _ensure(db);
+  const source = _string(sourceInstanceId, 160).trim();
+  if (!source) {
+    const error = new Error('conversation_sync_source_instance_required');
+    error.code = 'CONVERSATION_SYNC_SOURCE_REQUIRED';
+    throw error;
+  }
+  const list = Array.isArray(entries) ? entries : [];
+  if (list.length > MAX_APPLY_ENTRIES) {
+    const error = new Error('conversation_sync_entries_too_large');
+    error.code = 'CONVERSATION_SYNC_ENTRIES_TOO_LARGE';
+    throw error;
+  }
+  const localId = localConversationInstanceId(db);
+  const nowMs = Date.now();
+  let applied = 0;
+  let skipped = 0;
+  db.transaction(() => {
+    const seenThrough = db.prepare('SELECT max_seq FROM conversation_vv WHERE origin_instance_id = ?');
+    // Dedupe by stable key keeping the highest seq: a page is a compacted log, so one row per key.
+    const byKey = new Map();
+    for (const entry of list) {
+      const stableKey = _string(entry?.stableKey, 200).trim();
+      const sessionId = _string(entry?.sessionId, 200).trim();
+      const origin = _string(entry?.origin, 160).trim();
+      const originSeq = _parseSeq(entry?.originSeq);
+      if (!stableKey || !sessionId || !origin || !originSeq) { skipped += 1; continue; }
+      if (origin === localId) { skipped += 1; continue; } // echo guard (D-3): never take our own rows back
+      const seen = seenThrough.get(origin);
+      if (seen && Number(seen.max_seq) >= originSeq) { skipped += 1; continue; }
+      const prior = byKey.get(stableKey);
+      if (prior && prior.originSeq >= originSeq) { skipped += 1; continue; }
+      byKey.set(stableKey, { stableKey, sessionId, origin, originSeq, deleted: Number(entry?.deleted) ? 1 : 0, item: entry?.item || null });
+    }
+
+    const liveBySession = new Map(); // `${origin}\0${sessionId}` -> { origin, sessionId, items[], originSeqByKey }
+    const tombstonesBySession = new Map(); // `${origin}\0${sessionId}` -> { sessionId, keys[] }
+    const considered = new Map(); // origin -> highest seq considered
+    for (const entry of byKey.values()) {
+      considered.set(entry.origin, Math.max(considered.get(entry.origin) || 0, entry.originSeq));
+      if (entry.deleted) {
+        const key = `${entry.origin}\0${entry.sessionId}`;
+        if (!tombstonesBySession.has(key)) tombstonesBySession.set(key, { sessionId: entry.sessionId, keys: [] });
+        tombstonesBySession.get(key).keys.push(entry.stableKey);
+        continue;
+      }
+      const item = _commitItem(entry);
+      if (!_isAdmissible(item)) { skipped += 1; continue; }
+      const key = `${entry.origin}\0${entry.sessionId}`;
+      if (!liveBySession.has(key)) {
+        liveBySession.set(key, { origin: entry.origin, sessionId: entry.sessionId, provider: item.provider, items: [], originSeqByKey: {}, maxSeq: 0 });
+      }
+      const group = liveBySession.get(key);
+      group.items.push(item);
+      group.originSeqByKey[item.stableKey] = entry.originSeq;
+      group.maxSeq = Math.max(group.maxSeq, entry.originSeq);
+    }
+
+    for (const group of liveBySession.values()) {
+      const cursor = {
+        sourceId: `${PEER_SYNC_SOURCE_PREFIX}${group.origin}:${group.sessionId}`,
+        provider: group.provider,
+        sourceFingerprint: PEER_SYNC_SOURCE_FINGERPRINT,
+        byteOffset: group.maxSeq,
+        sourceSize: group.maxSeq,
+        parserVersion: PEER_SYNC_PARSER_VERSION,
+      };
+      const result = commitConversationBatchV2(db, {
+        items: group.items,
+        cursor,
+        replication: { origin: group.origin, originSeqByKey: group.originSeqByKey },
+        nowMs,
+      });
+      applied += Number(result.inserted || 0) + Number(result.corrected || 0);
+    }
+    for (const group of tombstonesBySession.values()) {
+      applied += deleteConversationItemsByStableKeyV2(db, { sessionId: group.sessionId, stableKeys: group.keys, nowMs });
+    }
+    // A tombstone keeps its SENDER's (origin, seq) so it stays addressable in that origin's stream
+    // and relays onward — including in the case where the receiver never held the item, which is
+    // exactly when compaction must still record "origin X has moved past this key".
+    for (const entry of byKey.values()) {
+      if (!entry.deleted) continue;
+      stampIncomingConversationClockV2(db, {
+        stableKey: entry.stableKey, sessionId: entry.sessionId, origin: entry.origin,
+        originSeq: entry.originSeq, nowMs,
+      });
+    }
+    // D-3 "seen through": every entry this call considered is now behind the vector, whether it was
+    // written, skipped as stale, or refused as malformed — re-offering it next tick would only grow
+    // the page budget.
+    for (const [origin, seq] of considered) bumpConversationVv(db, origin, seq);
+  }).immediate();
+  return { ok: true, applied, skipped, vector: readConversationClockVector(db) };
+}
+
+// ── WP-3 (docs/join-sync-followups-2-2026-11-01.html §5 R-10, §8 WP-3) ──────────────────────
+// The OWNER-side entry points for the three /api/sync/conversation/v2/* handlers. Every one of
+// them is a pure function of a DB handle: the route calls it via db.js's closed
+// DB_OWNER_MUTATION_ACTIONS map (runMutation -> workers/db-owner-worker.js), so the seed page,
+// the store DDL (`_ensure`) and the reads/writes all run on the owner worker's own connection
+// instead of the request thread — which the request-zone guard forbids
+// (lib/main-db-census.js, CTM_MAIN_DB_REQUEST_FORBIDDEN). That is the whole reason these exist:
+// /vector and /changes seeded synchronously on the main handle and 500'd on every member (I-2).
+// The payload shapes are unchanged (R-11); only where the work runs changed.
+
+// One bounded seed page per call, on the owner's handle. Never throws: a seed fault must not
+// take the feed down (the next call retries from the same cursor).
+function _seedOwnerPage(db, seedPageLimit) {
+  try {
+    return require('./conversation-store-v2').seedConversationClockPage(db, { limit: seedPageLimit });
+  } catch (error) {
+    // REPORT: seed fault — the feed still answers, and the next call retries from the same cursor.
+    console.warn('[conversation-sync] seed page failed: ' + (error && error.message ? error.message : error));
+    return { seeded: 0, done: false, afterItemId: 0 };
+  }
+}
+
+/** GET /api/sync/conversation/v2/vector owner half — seed one page, then this node's vector. */
+function ownerVector(db, { seedPageLimit } = {}) {
+  _seedOwnerPage(db, seedPageLimit);
+  return readConversationVector(db);
+}
+
+/** POST /api/sync/conversation/v2/changes owner half — seed one page, then one feed page. */
+function ownerChanges(db, { since, limit, seedPageLimit } = {}) {
+  _seedOwnerPage(db, seedPageLimit);
+  return conversationChangesSince(db, { since, limit });
+}
+
+/**
+ * POST /api/sync/conversation/v2/apply owner half. The over-cap case still throws with
+ * `code = 'CONVERSATION_SYNC_ENTRIES_TOO_LARGE'` (applyConversationChanges' own contract): the
+ * DB-owner transport carries `error.code` back verbatim (workers/db-owner-worker.js's
+ * _serializeError -> lib/db-owner-worker-client.js's _finishRequest), so the route can keep
+ * mapping it to 413 without a second in-band flag.
+ */
+function ownerApply(db, { sourceInstanceId, entries } = {}) {
+  return applyConversationChanges(db, { sourceInstanceId, entries });
+}
+
+module.exports = {
+  DEFAULT_CHANGES_LIMIT,
+  MAX_CHANGES_LIMIT,
+  MAX_APPLY_ENTRIES,
+  PEER_SYNC_SOURCE_PREFIX,
+  readConversationVector,
+  conversationChangesSince,
+  applyConversationChanges,
+  ownerVector,
+  ownerChanges,
+  ownerApply,
+};

package/template/coding-task-manager/lib/create/resolve-launch-params.js

@@ -51,17 +51,19 @@ const { locateClaudeSettingsArg } = require('../native-lead-settings-argv');
 const codexSandboxArgs = require('../codex-sandbox-args');
 const codexLaunchHealth = require('../codex-launch-health');
 const dbModule = require('../../db-owner-client');
-const { buildTelemetryEnv, sanitizeInheritedAgentEnv } = require('../agent-presets');
+const { buildTelemetryEnv, sanitizeInheritedAgentEnv, buildClaudeRendererLaunchEnv } = require('../agent-presets');
 const { sanitizeAnthropicAuth } = require('../sanitize-anthropic-auth');
 const { sanitizeOpenAiAuth } = require('../sanitize-openai-auth');
 // WP-2 (S-6): the D-1/D-2 sandbox env builder for a non-primary instance's launch env.
 const { buildSandboxCliEnv } = require('../../../shared/sandbox-cli-env');
 const { getPrivateSourceRecoveryEnvironment } = require('../lead-model-restore-reconciliation');
+// WP-2b: the ONE Claude `--session-id` reader, shared with the source runtime (D-5/D-6).
+const { claudeSessionIdArg } = require('../lead-switch-history-mode');
 const { getSession } = require('../../server-state');
 const { claudeMcpConfigArgs } = require('../lifecycle-wake-experiment');
 const { buildWorkerRoleArgs, WORKER_PROFILES } = require('./worker-role-profile');
 const {
-  workerDeniedToolsArgs, codexWorkerDenyArgs, workerClaudeSettingsArgs, workerSandboxArgs,
+  workerDeniedToolsArgs, codexWorkerDenyArgs, workerClaudeSettingsArgs, workerSandboxArgs, dshWorkerSandbox,
 } = require('../session-create/worker-launch-sandbox');
 
 function resolveCreateLaunchParams(ctx) {
@@ -174,6 +176,35 @@ function resolveCreateLaunchParams(ctx) {
       console.warn('[native-model-args] skipped:', e.message);
     }
   }
+
+  // --- OpenCode 2.x launch shape (R-1, R-2) ---
+  // docs/opencode-v2-model-switch-standalone-plugin-2026-10-30.html §5.1: a plain 2.x TUI attaches to a
+  // shared background service that ignores the tab's env/OPENCODE_CONFIG_CONTENT, so EVERY 2.x
+  // launch (fresh AND restore — a restore's argv comes from preparedLaunchPlan.args, built by
+  // lib/agent-capabilities.js's resumeSpec) runs its own private server via `--standalone`.
+  // R-2: CTM also chooses the 2.x session id, `ses_<CTM session UUID without dashes>`, the twin of
+  // Claude's deterministic `--session-id` injection below, so a restore has a precise `--session`.
+  // The line is the same peek rule as the model-args gate above (R-6): server.js's handleCreate
+  // has already awaited primeOpencodeLine() for an OpenCode launch before this argv is built, so
+  // this read is sync and fs-free. A v1 or null line leaves `args` byte-identical to before.
+  let _injectedOpencodeSessionId = null;
+  if (normalizeAgentType(createAgentType) === 'opencode') {
+    try {
+      const cli = require('../opencode-cli');
+      if (cli.peekOpencodeLine() === 'v2') {
+        if (!args.includes('--standalone')) args = ['--standalone', ...args];
+        const hasSessionArg = args.some(a => a === '--session' || a === '-s' || a === '--continue' || a === '-c'
+          || (typeof a === 'string' && a.startsWith('--session=')));
+        if (!hasSessionArg && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) {
+          const minted = `ses_${id.replace(/-/g, '')}`;
+          args = [...args, '--session', minted];
+          _injectedOpencodeSessionId = minted;
+        }
+      }
+    } catch (e) {
+      console.warn('[opencode-v2-launch] skipped:', e.message);
+    }
+  }
   if (createAgentType === 'codex' && codexResumeCwdGuardEnabled) {
     args = withCodexResumeCd(args, cwd);
   }
@@ -352,10 +383,23 @@ function resolveCreateLaunchParams(ctx) {
     const resume = preparedLaunchPlan?.resume || {};
     const providerThreadId = resume.providerResumeId || resume.providerResumeID || resume.sessionId || resume.agentSessionId || '';
     const routeId = msg._launchLeadRoute?.routeId || null;
+    // WP-2b (§5 D-5/D-6): a FRESH rollback of a never-prompted source is the one shape that carries
+    // neither a resume selector nor a model override. `freshRelaunch` is the record's own fact, so an
+    // older record (absent -> false) keeps today's exact resume-shaped rule -- including the empty
+    // provider thread it could never have matched.
+    const freshRelaunch = sourceRecoveryEnvironment.freshRelaunch === true;
+    // The launch's resolved thread: for a fresh rollback the plan has no resume selector at all, so ''
+    // is acceptable -- but the argv must then name the SOURCE's own thread through `--session-id`.
+    const threadMatches = freshRelaunch
+      ? providerThreadId === '' || providerThreadId === sourceRecoveryEnvironment.providerThreadId
+      : providerThreadId === sourceRecoveryEnvironment.providerThreadId;
+    const argvThreadMatches = !freshRelaunch || createAgentType !== 'claude'
+      || claudeSessionIdArg(args) === sourceRecoveryEnvironment.providerThreadId;
     if (!msg._isRestore || msg._leadModelTransition || sourceRecoveryEnvironment.ctmSessionId !== id
         || sourceRecoveryEnvironment.agent !== createAgentType
-        || sourceRecoveryEnvironment.providerThreadId !== providerThreadId
-        || sourceRecoveryEnvironment.modelId !== msg._launchModelOverride
+        || !threadMatches
+        || sourceRecoveryEnvironment.modelId !== String(msg._launchModelOverride || '')
+        || !argvThreadMatches
         || sourceRecoveryEnvironment.routeId !== routeId) {
       throw Object.assign(new Error('Captured source environment does not match the prepared recovery owner.'), {
         code: 'source_recovery_environment_owner_mismatch',
@@ -396,6 +440,12 @@ function resolveCreateLaunchParams(ctx) {
   // This adds OTEL_EXPORTER_OTLP_ENDPOINT → http://localhost:<PORT> for agents
   // that emit OTLP logs, plus CTM_SESSION_ID for our hook scripts to read.
   Object.assign(env, buildTelemetryEnv(id, cmd, PORT, env));
+  // WP-2 (docs/claude-restore-seed-alt-screen-trap-2026-10-27.html R-4, §8 WP-2): restate the
+  // user's own Claude renderer choice through Claude's own override, so a CTM crash-restore
+  // storm cannot silently flip it via the fullscreen boot canary. Runs AFTER the non-primary
+  // sandbox env rebuild above, so a dev/test instance reads the sandbox HOME's settings, never
+  // the real user's.
+  Object.assign(env, buildClaudeRendererLaunchEnv(cmd, env));
   if (createAgentType === 'codex') {
     try {
       const launchHealth = preparedLaunchPlan.maintenance?.codexHealth || { args, mcpReport: { disabled: [] } };
@@ -466,13 +516,10 @@ function resolveCreateLaunchParams(ctx) {
     && msg.titleIntent !== 'default' && !!requestedTitle;
   let title = requestedTitle;
   if (!title) {
-    const agentName = cmd.includes('claude') ? 'Claude Code'
-      : cmd.includes('codex') ? 'Codex'
-      : cmd.includes('gemini') ? 'Gemini'
-      : cmd.includes('opencode') ? 'OpenCode'
-      : cmd.includes('cursor') ? 'Cursor'
-      : cmd.includes('aider') ? 'Aider'
-      : null;
+    // S-3 (D-5): the product-facing title comes from the ONE detector; 'aider' stays a local fallback
+    // ('walle' and 'shell' still title as `Shell: <cwd>`, unchanged).
+    const AGENT_TITLE = { dsh: 'DeepSeek Harness', claude: 'Claude Code', codex: 'Codex', gemini: 'Gemini', opencode: 'OpenCode', cursor: 'Cursor' };
+    const agentName = AGENT_TITLE[detectAgentType(cmd)] || (cmd.includes('aider') ? 'Aider' : null);
     if (agentName) {
       const shortCwd = cwd.replace(serverConfig.HOME || '', '~');
       title = `${agentName}: ${shortCwd}`;
@@ -506,6 +553,9 @@ function resolveCreateLaunchParams(ctx) {
     claudeResumeId,
     isResumeLaunch,
     _injectedSessionId,
+    // R-2: deliberately NOT `_injectedSessionId` — that one drives Claude-only JSONL/project-dir
+    // side effects downstream in lib/session-create/provider-process.js. Only one can ever be set.
+    _injectedOpencodeSessionId,
     _approvalHookEnabled,
     _approvalHookToken,
     restoreSeedSnapshot,
@@ -696,7 +746,7 @@ function resolveWorkerLaunchParams(opts = {}) {
     agent, alias, model, token, proxyPort,
     briefPath, cwd, reportPath,
   } = opts;
-  if (agent !== 'claude' && agent !== 'codex') {
+  if (agent !== 'claude' && agent !== 'codex' && agent !== 'dsh') {
     throw new TypeError(`resolveWorkerLaunchParams: unsupported agent "${agent}"`);
   }
   if (!alias) throw new TypeError('resolveWorkerLaunchParams: alias required');
@@ -715,6 +765,40 @@ function resolveWorkerLaunchParams(opts = {}) {
     throw new TypeError(`resolveWorkerLaunchParams: unsupported worker profile "${workerProfile}"`);
   }
   const prompt = typeof opts.prompt === 'string' ? opts.prompt : buildWorkerPrompt({ briefPath, cwd, reportPath, profile: workerProfile });
+  // WP-14 (docs/deepseek-harness-acp-agent-2026-10-28.html §9b W-2): a dsh worker has NO argv. It is
+  // ONE ACP child (lib/acp/dsh-session-runtime.js) started from the create request's own resolved
+  // launch env (server.js `buildLaunchEnv` -> lib/session-create/dsh-session.js) and spoken to over
+  // ACP, so this branch returns the ACP START PARAMS instead of an argv:
+  //   * `env` — the worker's own proxy credential (ANTHROPIC_AUTH_TOKEN, the one key pi-ai's built-in
+  //     anthropic provider turns into `Authorization: Bearer …`, §6.6 OQ-1) plus the worker mark the
+  //     env strip reads (agent-presets.js) and the child's permission mode (W-9). The routed baseURL
+  //     is deliberately NOT here: the dsh route patch declares it (D-21/§6.6) and the runtime strips
+  //     the inherited provider keys, so the credential and the mark are all that travel.
+  //   * `acp` — the brief as the FIRST PROMPT, the report path, the routed pick and the MCP set
+  //     (WP-10 already materializes `mcpServers`; the dsh create path converts them to ACP entries).
+  // Sits BEFORE `workerSandboxArgs` precisely because that table's harness ternary is claude/codex only.
+  if (agent === 'dsh') {
+    const mcpServers = (opts.mcpServers && typeof opts.mcpServers === 'object' && !Array.isArray(opts.mcpServers))
+      ? opts.mcpServers
+      : {};
+    const { permissionMode } = dshWorkerSandbox({ profile: workerProfile });
+    return {
+      cmd: 'dsh',
+      args: [],
+      env: {
+        CTM_WORKER_AGENT: agent,
+        CTM_WORKER_TOKEN: token,
+        ANTHROPIC_AUTH_TOKEN: token,
+        DSH_PERMISSION_MODE: permissionMode,
+      },
+      acp: {
+        prompt, briefPath, cwd, reportPath,
+        routeAlias: alias, model,
+        mcpServers,
+        permissionMode,
+      },
+    };
+  }
   const port = Number(proxyPort);
   // WP-4 (delegate-codex-lessons §5 D-29): the lead posture's launch half. Absent posture =
   // today's argv exactly (no sandbox key, no extra args); a resolved posture adds the

package/template/coding-task-manager/lib/create/worker-role-profile.js

@@ -21,12 +21,12 @@ function normalizeWorkerRequest(opts = {}) {
   const invalid = (code, message) => { const error = new Error(message); error.code = code; throw error; };
   const agentInput = opts.agent;
   const harnessInput = opts.harness;
-  if (agentInput !== undefined && agentInput !== 'claude' && agentInput !== 'codex') invalid('agent_invalid', 'agent must be claude or codex');
-  if (harnessInput !== undefined && harnessInput !== 'claude-code' && harnessInput !== 'codex-cli') invalid('harness_invalid', 'harness must be claude-code or codex-cli');
-  const harnessAgent = harnessInput === 'codex-cli' ? 'codex' : harnessInput === 'claude-code' ? 'claude' : null;
+  if (agentInput !== undefined && agentInput !== 'claude' && agentInput !== 'codex' && agentInput !== 'dsh') invalid('agent_invalid', 'agent must be claude, codex or dsh');
+  if (harnessInput !== undefined && harnessInput !== 'claude-code' && harnessInput !== 'codex-cli' && harnessInput !== 'dsh-acp') invalid('harness_invalid', 'harness must be claude-code, codex-cli or dsh-acp');
+  const harnessAgent = harnessInput === 'codex-cli' ? 'codex' : harnessInput === 'claude-code' ? 'claude' : harnessInput === 'dsh-acp' ? 'dsh' : null;
   if (agentInput && harnessAgent && agentInput !== harnessAgent) invalid('harness_conflict', 'agent and harness identify different coding CLIs');
   const agent = harnessAgent || agentInput || 'claude';
-  const harness = harnessInput || (agent === 'codex' ? 'codex-cli' : 'claude-code');
+  const harness = harnessInput || (agent === 'codex' ? 'codex-cli' : agent === 'dsh' ? 'dsh-acp' : 'claude-code');
   const workerProfile = opts.workerProfile === undefined ? 'implementation' : opts.workerProfile;
   if (!WORKER_PROFILES.includes(workerProfile)) invalid('worker_profile_invalid', 'worker_profile must be legacy, implementation or review');
   return { agent, harness, workerProfile };

package/template/coding-task-manager/lib/create-intent-lease.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// WP-3 (docs/session-create-box-restart-and-git-lane-starvation-2026-10-30.html §5 D-4,
+// §6.3, §8, §9 S-9..S-11, S-17): a "create in flight" is invisible to the restart guard.
+// On 2026-10-30 at 02:20:31Z the MBP box's repo-root fleet-apply script restarted CTM 5 s
+// after the operator opened the new-session modal for that box, and the create failed.
+// fleet-apply polls GET /api/instance/update-gate, and the non-force POST /api/restart/ctm
+// refusal both read _restartGuardSnapshot, which summarized LIVE SESSIONS ONLY.
+//
+// This module is the missing signal: a short, in-process lease noted by the LOCAL create
+// handlers (the machine that would restart is the one that notes it -- a machine-routed
+// proxy branch must never note, or a hub would block its own restart for a box's create).
+// It is deliberately tiny: a clock, an expiry, and the last route/hop diagnostic.
+//
+// The lease is advisory only -- the guard turns it into a 409 (or a blocker row), and
+// ?force=true still overrides it exactly as it overrides a live session.
+
+const CREATE_INTENT_LEASE_MS = 120000;
+
+function createIntentLease({ now = Date.now, leaseMs = CREATE_INTENT_LEASE_MS } = {}) {
+  let until = 0;
+  let last = null; // { route, forwardedBy, at }
+  return {
+    note(route, forwardedBy = '') {
+      const t = now();
+      until = t + leaseMs;
+      last = { route: String(route || ''), forwardedBy: String(forwardedBy || ''), at: t };
+    },
+    active() {
+      return now() < until ? { ...last, untilMs: until } : null;
+    },
+  };
+}
+
+const processLease = createIntentLease();
+
+/** Note an in-flight create on THIS machine. `ctxOrReq` may be an HTTP req or a WS ctx. */
+function noteCreateIntent(route, ctxOrReq) {
+  let forwardedBy = '';
+  try {
+    forwardedBy = require('./remote-machine-create').forwardedByOf(ctxOrReq) || '';
+  } catch { /* expected: a hop-header read fault only loses the diagnostic field */ }
+  processLease.note(route, forwardedBy);
+}
+
+module.exports = {
+  CREATE_INTENT_LEASE_MS,
+  createIntentLease,
+  noteCreateIntent,
+  activeCreateIntent: () => processLease.active(),
+};