create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/ctm-session-context-api.js

@@ -1,6 +1,8 @@
 'use strict';
 
 const conversationChangeFeed = require('./conversation-change-feed');
+const SessionSearchUtils = require('../public/js/session-search-utils');
+const sessionContextLocator = require('./session-context-locator');
 
 let ctmSessionContext = null;
 let ctmSessionContextLoadError = null;
@@ -47,7 +49,13 @@ function makeSplitRoutingHandle(dbModule) {
   });
 }
 
-function handleCtmSessionContextApi(req, res, url, { db, dbModule, runHeavy, runMutation } = {}) {
+function handleCtmSessionContextApi(req, res, url, {
+  db, dbModule, runHeavy, runMutation,
+  // WP-2 (docs/cross-machine-session-context-2026-10-31.html §6.1): test seams for the hub owner
+  // resolver. Production passes neither — server.js (inside the file-size-frozen `handleApi`) is
+  // untouched and every default is lazy in lib/session-context-locator.js.
+  locatorDeps = {}, env = process.env,
+} = {}) {
   const rangeMatch = /^\/api\/sessions\/([^/]+)\/messages\/range$/.exec(url.pathname);
   // WP-0 (one-transcript-ingestor §6.1): the conversation change-feed routes live here
   // beside the session-memory reads. The guard must admit them or dispatch never reaches
@@ -129,8 +137,10 @@ function handleCtmSessionContextApi(req, res, url, { db, dbModule, runHeavy, run
         query: url.searchParams.get('q') || url.searchParams.get('query') || '',
         limit: url.searchParams.get('limit') || undefined,
       };
-      return serveHeavy('ctmSessionMemorySearch', args,
-        () => context.searchCtmSessions({ ...args, db }));
+      // WP-4 (§6.2/R-7): `scope=pool` (the default) fans the search out to every dialable member
+      // under one deadline and merges by RRF; `scope=local` keeps today's local-only answer.
+      const scope = url.searchParams.get('scope') || 'pool';
+      return serveSearchAnywhere({ args, scope, res, context, runHeavy, db, locatorDeps, env });
     }
 
     if ((url.pathname === '/api/ctm/session-memory/context' || rangeMatch) && req.method === 'GET') {
@@ -151,9 +161,25 @@ function handleCtmSessionContextApi(req, res, url, { db, dbModule, runHeavy, run
         format: url.searchParams.get('format') || 'messages',
         projection: url.searchParams.get('projection') || 'envelope',
       };
-      return serveHeavy('ctmSessionMemoryContext', args,
-        () => context.getCtmSessionContext({ ...args, db }),
-        { typedRangeStatus: true });
+      // WP-2 (§6.2/R-3): the RANGE route stays LOCAL-ONLY and unchanged — it keeps today's
+      // args verbatim (no `ref`, no `scope`) and never leaves this machine.
+      if (rangeMatch) {
+        return serveHeavy('ctmSessionMemoryContext', args,
+          () => context.getCtmSessionContext({ ...args, db }),
+          { typedRangeStatus: true });
+      }
+      // R-1 (§6.2): `ref` is any identity string parseSessionIdentityQuery understands — a
+      // `#session=<id>` link, `review=<id>`, or a bare uuid — merged into session_ids. The context
+      // route is answered by the hub owner resolver, which reads locally first and only leaves this
+      // machine on a local miss. `scope=pool` is the default; lib/session-context-locator.js is the
+      // single reader of the R-11 flag (an off flag skips both the owner forward and the probe).
+      const ref = String(url.searchParams.get('ref') || '').trim();
+      if (ref) {
+        const parsedRef = SessionSearchUtils.parseSessionIdentityQuery(ref);
+        if (parsedRef.sessionIds.length) args.session_ids = [...args.session_ids, ...parsedRef.sessionIds];
+      }
+      args.scope = url.searchParams.get('scope') || 'pool';
+      return serveContextAnywhere({ args, res, context, runHeavy, db, locatorDeps, env });
     }
 
     if (
@@ -300,6 +326,71 @@ function handleCtmSessionContextApi(req, res, url, { db, dbModule, runHeavy, run
   }
 }
 
+/**
+ * WP-2 (§6.2, R-3/R-5): answer `GET /api/ctm/session-memory/context` through the hub owner
+ * resolver. The local read is today's off-thread path (`runHeavy` when wired, `computeSync`
+ * otherwise), so a local hit is today's answer plus `location`; only a local MISS leaves this
+ * machine (one forwarded GET to the directory's owner, else a deadline-bounded parallel probe).
+ */
+function serveContextAnywhere({ args, res, context, runHeavy, db, locatorDeps, env }) {
+  const readLocal = (localArgs) => {
+    // `scope` is the locator's key, never a worker argument: the worker re-runs today's op.
+    const workerArgs = { ...localArgs };
+    delete workerArgs.scope;
+    const computeSync = () => context.getCtmSessionContext({ ...workerArgs, db });
+    if (typeof runHeavy !== 'function') return Promise.resolve().then(computeSync);
+    return Promise.resolve().then(() => runHeavy('ctmSessionMemoryContext', workerArgs, computeSync));
+  };
+  Promise.resolve()
+    .then(() => sessionContextLocator.readSessionContextAnywhere(
+      { args, excludeMachineId: '', env: env || process.env },
+      { ...locatorDeps, readLocal },
+    ))
+    .then((result) => {
+      const payload = asApiResult(result);
+      return respondJson(res, rangeHttpStatus(payload), payload);
+    })
+    .catch((err) => respondJson(res, 500, {
+      ok: false,
+      source: 'ctm-api',
+      authority: 'ctm',
+      reason: 'ctm_session_context_failed',
+      error: err.message,
+    }));
+  return true;
+}
+
+/**
+ * WP-4 (§6.2, R-7): answer `GET /api/ctm/session-memory/search` through the pool fan-out. The local
+ * search IS today's off-thread path (`runHeavy` when wired, `computeSync` otherwise) so a local-only
+ * read answers with today's rows — only the MERGE adds `machine_id`/`machine_name`/`rank`, and only
+ * when the pool is on does anything leave this machine (one `scope=local` GET per dialable member).
+ * A deferred local read (`null`) still renders today's deferred envelope.
+ */
+function serveSearchAnywhere({ args, scope, res, context, runHeavy, db, locatorDeps, env }) {
+  const searchLocal = (localArgs) => {
+    const computeSync = () => context.searchCtmSessions({ ...localArgs, db });
+    if (typeof runHeavy !== 'function') return Promise.resolve().then(computeSync);
+    return Promise.resolve().then(() => runHeavy('ctmSessionMemorySearch', localArgs, computeSync));
+  };
+  Promise.resolve()
+    .then(() => sessionContextLocator.searchSessionsAnywhere(
+      {
+        query: args.query, limit: args.limit, scope, env: env || process.env,
+      },
+      { ...locatorDeps, searchLocal },
+    ))
+    .then((result) => respondJson(res, 200, asApiResult(result)))
+    .catch((err) => respondJson(res, 500, {
+      ok: false,
+      source: 'ctm-api',
+      authority: 'ctm',
+      reason: 'ctm_session_context_failed',
+      error: err.message,
+    }));
+  return true;
+}
+
 async function handleMessageIndexBackfill({ body, res, context, db, dbModule }) {
   const limit = clampInt(body.limit, 100, 1, 1000);
   const chunkSize = clampInt(body.chunk_size ?? body.chunkSize, 250, 25, 2000);

package/template/coding-task-manager/lib/db-domain-tables.js

@@ -169,6 +169,7 @@ const TABLE_DOMAINS = Object.freeze({
   // intentionally base/firehose-resident so the preflight and its guarded
   // rows remain atomic across core/telemetry extraction.
   conversation_retained_history_guard_v2: 'firehose', conversation_projection_deletes_v2: 'firehose', conversation_store_epoch_v2: 'firehose', conversation_usage_turn_changes_v1: 'firehose', // v36 change feed; v41 usage turn-change outbox schema
+  conversation_item_clock: 'firehose', conversation_vv: 'firehose', conversation_local_seq: 'firehose', // v61 shared-memory replica clock: same file as conversation_text_items_v2
 
   // firehose — transcript row store + FTS + ingest cursors (lib/transcript-store.js)
   transcript_files: 'firehose',

package/template/coding-task-manager/lib/db-domains.js

@@ -262,6 +262,7 @@ const CTM_WRITE_OPS = Object.freeze([
   'commitConversationDelta', 'enrollConversationSource',
   'markConversationUpdatePublished', 'markConversationUpdateUnresolvable',
   'redriveConversationSourceDebt', 'recordResumeLineage', 'ackConversationChanges',
+  'conversationSyncVector', 'conversationSyncChanges', 'conversationSyncApply',
   //   Not in §9 table A (the gate is derived from the action REGISTRY, so it sees the
   //   14 extra actions the design's 205-action count predates — see the contract.js
   //   comment beside their OP_META rows). Both write/repair conversation-store tables

package/template/coding-task-manager/lib/db-owner-dispatch-probe.js

@@ -0,0 +1,32 @@
+'use strict';
+
+// WP-0c (docs/session-create-accept-then-complete-2026-11-01.html §6.5 D-13, AC-0e): the
+// low-over-signalled probe that workers/db-owner-worker.js _pump() calls after dequeuing a `low`
+// task. The work signal counts requests the main thread has issued, including ones that have not
+// reached the queue's lanes yet, so a signalled total above the queue's own ready high/urgent
+// depth means a `low` task was dispatched while higher-priority work was waiting.
+// A factory with no worker globals, so the decision and its 10 s emit window are unit-testable
+// without spawning the worker thread; read-only — it never reorders dispatch.
+const DISPATCH_PROBE_WINDOW_MS = 10 * 1000;
+function createLowOverSignalledProbe({ windowMs = DISPATCH_PROBE_WINDOW_MS, log = (line) => console.log(line) } = {}) {
+  let lastEmitAt = 0;
+  let suppressed = 0;
+  return function observeLowDispatch({ op, snapshot, queuedUrgent = 0, queuedHigh = 0, at = Date.now() }) {
+    if (!snapshot) return null;
+    const signalledHigh = Number(snapshot.interactivePending || 0);
+    const signalledUrgent = Number(snapshot.urgentPending || 0);
+    if (signalledHigh + signalledUrgent <= Number(queuedUrgent || 0) + Number(queuedHigh || 0)) return null;
+    if (lastEmitAt && at - lastEmitAt < windowMs) {
+      suppressed += 1;
+      return null;
+    }
+    const line = `[db-owner-dispatch] low-over-signalled op=${op} signalledHigh=${signalledHigh} signalledUrgent=${signalledUrgent} `
+      + `queuedHigh=${Number(queuedHigh || 0)} queuedUrgent=${Number(queuedUrgent || 0)} suppressed=${suppressed}`;
+    lastEmitAt = at;
+    suppressed = 0;
+    try { log(line); } catch { /* expected: a throwing injected log must not break dispatch */ }
+    return line;
+  };
+}
+
+module.exports = { DISPATCH_PROBE_WINDOW_MS, createLowOverSignalledProbe };

package/template/coding-task-manager/lib/db-owner-request-counts.js

@@ -0,0 +1,178 @@
+'use strict';
+
+// WP-0 M-5 (docs/hub-local-cpu-memory-burn-2026-10-31.html §3.5, §7 M-5). MEASUREMENT ONLY.
+//
+// After every hub boot the DB-owner worker absorbs a 1-2 min storm of expired requests
+// (200k-1.8M, mostly runtime-event / session-diagnostic writes) while catchUpTranscriptFiles
+// occupies the writer. Nothing on the client side says WHICH producers issue them, so these
+// counters attribute every request() attempt — including the ones REFUSED before they ever
+// reach the worker — to the minute it was issued: per worker op, and per runtime-event /
+// session-diagnostic NAME for the event writers.
+//
+// Stated bounds (enforced below, no I/O and no allocation beyond the current bucket):
+//   * a fixed ring of the last REQUEST_COUNT_RING_MINUTES one-minute buckets;
+//   * at most REQUEST_COUNT_KEY_MAX distinct op keys and REQUEST_COUNT_KEY_MAX distinct event
+//     keys per bucket — every further key folds into `_other`;
+//   * O(1) work per request (one clock read, one ring index, one map write).
+const REQUEST_COUNT_RING_MINUTES = 30;
+const REQUEST_COUNT_KEY_MAX = 64;
+const REQUEST_COUNT_KEY_CLIP = 80;
+// `refused` = the client never handed the op to the worker (quarantine, circuit breaker, worker
+// not running, worker died/recycled mid-flight). Non-timeout failures are `error`.
+const REQUEST_COUNT_OUTCOMES = Object.freeze(['ok', 'timeout', 'refused', 'error']);
+
+// Errors that mean "the client refused / could not reach the worker" rather than "the op ran
+// and failed" — the refused share of the boot storm.
+const REQUEST_REFUSED_CODES = new Set([
+  'CTM_DB_OWNER_OP_QUARANTINED',
+  'CTM_DB_OWNER_WORKER_DEGRADED',
+  'CTM_DB_OWNER_WORKER_DISABLED',
+  'CTM_DB_OWNER_WORKER_EXITED',
+  'CTM_DB_OWNER_WORKER_FATAL',
+  'CTM_DB_OWNER_WORKER_RECYCLED',
+  'CTM_DB_OWNER_ISOLATION_RECYCLED',
+  'CTM_DB_OWNER_CLOSED',
+  'CTM_DB_OWNER_CLOSING',
+]);
+
+function _requestCountOutcome(error) {
+  return error && REQUEST_REFUSED_CODES.has(error.code) ? 'refused' : 'error';
+}
+
+// Ops whose payload carries a runtime-event / session-diagnostic NAME. BOTH dispatch shapes
+// reach this client: the direct worker op (payload = { events | entries } — see
+// workers/db-owner-worker.js case 'appendRuntimeEventsBatch' and db.js flushSessionDiagnostics)
+// and the generic `runDbMutation` wrapper (payload = { action, args } — server.js's
+// configureOwnerMutations dispatch for db.js's appendRuntimeEvent/addSessionDiagnostic).
+// addSessionDiagnostic has no separate batch op: db.js's flushSessionDiagnostics IS its batch
+// form (its entries each carry the diagnostic name in `event`).
+const RUNTIME_EVENT_WRITE_OPS = new Set([
+  'appendRuntimeEvent',
+  'appendRuntimeEventsBatch',
+  'addSessionDiagnostic',
+  'flushSessionDiagnostics',
+]);
+
+function _eventNameText(value) {
+  if (typeof value !== 'string') return '';
+  const text = value.trim();
+  return text ? text.slice(0, REQUEST_COUNT_KEY_CLIP) : '';
+}
+
+// The NAME a runtime-event / diagnostic row is written under: `type` for ctm_runtime_events
+// (db.js normalizeRuntimeEvent) and `event` for session_diagnostics (db.js addSessionDiagnostic's
+// second argument, and a flush entry's `event`). Tolerates the object or the bare-string form.
+function _runtimeEventName(candidate) {
+  if (typeof candidate === 'string') return _eventNameText(candidate);
+  if (!candidate || typeof candidate !== 'object') return '';
+  return _eventNameText(candidate.type) || _eventNameText(candidate.event)
+    || _eventNameText(candidate.kind) || _eventNameText(candidate.name);
+}
+
+// Names contributed by ONE request, or null when this op is not an event/diagnostic write.
+// A batch contributes one entry per element. An unnamed write still counts, as 'unknown'.
+function _runtimeEventNamesFor(op, payload) {
+  if (!payload || typeof payload !== 'object') return null;
+  const action = op === 'runDbMutation' ? String(payload.action || '') : String(op || '');
+  if (!RUNTIME_EVENT_WRITE_OPS.has(action)) return null;
+  const args = Array.isArray(payload.args) ? payload.args : null;
+  const batch = Array.isArray(payload.events) ? payload.events
+    : (Array.isArray(payload.entries) ? payload.entries : null);
+  if (batch) return batch.map((item) => _runtimeEventName(item) || 'unknown');
+  if (args && Array.isArray(args[0])) {
+    return args[0].map((item) => _runtimeEventName(item) || 'unknown');
+  }
+  // Diagnostics take their name from the second db.js argument (the first is the session id);
+  // runtime events are the event object itself.
+  const single = action === 'addSessionDiagnostic'
+    ? (_runtimeEventName(payload.event) || _runtimeEventName(payload.kind) || _runtimeEventName(args?.[1]))
+    : (_runtimeEventName(payload.event) || _runtimeEventName(args?.[0]) || _runtimeEventName(payload));
+  return [single || 'unknown'];
+}
+
+function _minuteStartMs(nowMs) {
+  return Math.floor(nowMs / 60000) * 60000;
+}
+
+function _newOpCounts() {
+  return { requested: 0, ok: 0, timeout: 0, refused: 0, error: 0 };
+}
+
+// Fixed-size per-minute request counter. Takes its clock as an option so tests can drive
+// simulated minutes without sleeping (the client itself has no time injection).
+class DbOwnerRequestsPerMinute {
+  constructor(options = {}) {
+    this.enabled = options.enabled !== false;
+    this.now = typeof options.now === 'function' ? options.now : Date.now;
+    this.ringMinutes = Math.max(1, Math.trunc(Number(options.ringMinutes)) || REQUEST_COUNT_RING_MINUTES);
+    this.keyMax = Math.max(1, Math.trunc(Number(options.keyMax)) || REQUEST_COUNT_KEY_MAX);
+    this._buckets = [];
+  }
+
+  // The current minute's bucket, created on demand — at most one push + one eviction per
+  // minute boundary, so the per-request cost stays O(1).
+  _bucket() {
+    const minuteStartMs = _minuteStartMs(this.now());
+    const last = this._buckets[this._buckets.length - 1];
+    if (last && last.minuteStartMs === minuteStartMs) return last;
+    const bucket = { minuteStartMs, byOp: {}, byEvent: {}, opKeys: 0, eventKeys: 0 };
+    this._buckets.push(bucket);
+    while (this._buckets.length > this.ringMinutes) this._buckets.shift();
+    return bucket;
+  }
+
+  _opEntry(bucket, op) {
+    const key = String(op || 'unknown').slice(0, REQUEST_COUNT_KEY_CLIP);
+    const existing = bucket.byOp[key];
+    if (existing) return existing;
+    if (bucket.opKeys >= this.keyMax) {
+      if (!bucket.byOp._other) bucket.byOp._other = _newOpCounts();
+      return bucket.byOp._other;
+    }
+    const entry = _newOpCounts();
+    bucket.byOp[key] = entry;
+    bucket.opKeys += 1;
+    return entry;
+  }
+
+  _bumpEvent(bucket, name) {
+    const key = String(name || 'unknown').slice(0, REQUEST_COUNT_KEY_CLIP);
+    if (bucket.byEvent[key] !== undefined) {
+      bucket.byEvent[key] += 1;
+      return;
+    }
+    if (bucket.eventKeys >= this.keyMax) {
+      bucket.byEvent._other = (bucket.byEvent._other || 0) + 1;
+      return;
+    }
+    bucket.byEvent[key] = 1;
+    bucket.eventKeys += 1;
+  }
+
+  recordRequest(op, payload) {
+    if (!this.enabled) return;
+    const bucket = this._bucket();
+    this._opEntry(bucket, op).requested += 1;
+    const names = _runtimeEventNamesFor(op, payload);
+    if (!names) return;
+    for (const name of names) this._bumpEvent(bucket, name);
+  }
+
+  recordOutcome(op, outcome) {
+    if (!this.enabled) return;
+    const key = REQUEST_COUNT_OUTCOMES.includes(outcome) ? outcome : 'error';
+    this._opEntry(this._bucket(), op)[key] += 1;
+  }
+
+  // Oldest bucket first, the current minute last. Empty when the flag turns attribution off.
+  snapshot() {
+    if (!this.enabled) return [];
+    return this._buckets.map((bucket) => {
+      const byOp = {};
+      for (const [op, counts] of Object.entries(bucket.byOp)) byOp[op] = { ...counts };
+      return { minuteStartMs: bucket.minuteStartMs, byOp, byEvent: { ...bucket.byEvent } };
+    });
+  }
+}
+
+module.exports = { DbOwnerRequestsPerMinute, requestCountOutcome: _requestCountOutcome };

package/template/coding-task-manager/lib/db-owner-worker-client.js

@@ -17,6 +17,8 @@ const { createFailureRollup } = require('./db-owner-failure-rollup');
 const os = require('node:os');
 const fs = require('node:fs');
 const { hydrateCleanupError } = require('./worker-error-metadata');
+const { boolFlag } = require('./env-flags');
+const { DbOwnerRequestsPerMinute, requestCountOutcome: _requestCountOutcome } = require('./db-owner-request-counts');
 
 const activeClientsByDbPath = new Map();
 const cooperativeCapabilities = new WeakMap();
@@ -213,6 +215,8 @@ function _writerLabelForDbPath(dbPath) {
 // oldest entry is evicted first.
 const TIMED_OUT_MAX = 256;
 
+// WP-0 M-5 request counts per minute: lib/db-owner-request-counts.js.
+
 class CtmDbOwnerWorkerClient {
   constructor(options = {}) {
     if (!options.dbPath) throw new Error('CtmDbOwnerWorkerClient requires dbPath');
@@ -360,6 +364,12 @@ class CtmDbOwnerWorkerClient {
     };
     this._lastStatusAt = 0;
     this._statusWaiters = [];
+    // WP-0 M-5 (§3.5): per-minute request attribution. On by default IN SOURCE —
+    // CTM_PERF_ATTRIBUTION=0 disables it (read through lib/env-flags.js so this file keeps
+    // zero raw process.env reads of its own).
+    this._requestsPerMinute = new DbOwnerRequestsPerMinute({
+      enabled: boolFlag('CTM_PERF_ATTRIBUTION', true),
+    });
   }
 
   start() {
@@ -706,24 +716,27 @@ class CtmDbOwnerWorkerClient {
     const canLog = this.logger && typeof this.logger.warn === 'function';
     if (!canLog) return;
     const now = Date.now();
-    // `startedAt` is stamped by the worker's 'started' message if it arrived before the
-    // timeout; otherwise the request never started and the whole span is queue time.
+    // `startedAt` is the worker's 'started' stamp; without it the whole span is queue time, printed as
+    // `started=0 queueMs=<span> serviceMs=0` (WP-0c D-13: 2026-11-01's unstarted hub requests hid as serviceMs).
     const started = record.startedAt || 0;
-    const serviceMs = started ? Math.max(0, now - started) : Math.max(0, now - record.enqueuedAt);
-    const queueMs = started ? Math.max(0, started - record.enqueuedAt) : 0;
+    const serviceMs = started ? Math.max(0, now - started) : 0;
+    const queueMs = started ? Math.max(0, started - record.enqueuedAt) : Math.max(0, now - record.enqueuedAt);
     const lateByMs = Math.max(0, now - record.timedOutAt);
-    const result = msg.error
-      ? `error:${msg.error.code || 'unknown'}`
-      : 'ok';
+    const result = msg.error ? `error:${msg.error.code || 'unknown'}` : 'ok';
+    const span = started
+      ? `serviceMs=${Math.round(serviceMs)} queueMs=${Math.round(queueMs)} lateByMs=${Math.round(lateByMs)} result=${result} started=1`
+      : `started=0 queueMs=${Math.round(queueMs)} serviceMs=0 lateByMs=${Math.round(lateByMs)} result=${result}`;
     try {
       this.logger.warn(
-        `[db-owner-late] writer=${this.writer} op=${record.op} action=${record.action} ` +
-        `serviceMs=${Math.round(serviceMs)} queueMs=${Math.round(queueMs)} lateByMs=${Math.round(lateByMs)} result=${result}`
+        `[db-owner-late] writer=${this.writer} op=${record.op} action=${record.action} ` + span
       );
     } catch { /* expected: a throwing injected logger must not break the response path */ }
   }
 
   _recordTimeout(op) {
+    // WP-0 M-5: the request settled as a timeout (the timer path rejects directly, so this is
+    // the one place that sees the timed-out op).
+    this._requestsPerMinute.recordOutcome(op, 'timeout');
     this._consecutiveTimeouts += 1;
     if (this._consecutiveTimeouts >= this._degradeAfter) {
       const wasDegraded = this.isDegraded();
@@ -776,14 +789,29 @@ class CtmDbOwnerWorkerClient {
 
   async request(op, payload = {}, options = {}) {
     if (!op) throw new Error('DB owner worker request requires op');
-    if (options.signal?.aborted) throw _abortError(options.signal);
-    if (this._recyclePromise) await _awaitWithAbort(this._recyclePromise, options.signal);
+    // WP-0 M-5: count the ATTEMPT before any early throw below, so the requests this client
+    // refuses (quarantine / degraded / not running) are attributed to their producer too —
+    // they are a large share of the post-boot storm.
+    this._requestsPerMinute.recordRequest(op, payload);
+    if (options.signal?.aborted) {
+      this._requestsPerMinute.recordOutcome(op, 'error');
+      throw _abortError(options.signal);
+    }
+    if (this._recyclePromise) {
+      try {
+        await _awaitWithAbort(this._recyclePromise, options.signal);
+      } catch (error) {
+        this._requestsPerMinute.recordOutcome(op, _requestCountOutcome(error));
+        throw error; // RETHROW: attribution must not swallow a recycle/abort failure
+      }
+    }
     const sourceKey = sourceKeyForDbOwnerPayload(payload);
     const quarantine = this._opQuarantine.admit(op, sourceKey);
     if (!quarantine.allowed) {
       const err = new Error(`DB owner operation is cooling down after consecutive deadlines: ${op}`);
       err.code = 'CTM_DB_OWNER_OP_QUARANTINED';
       err.retryAfterMs = quarantine.retryAfterMs;
+      this._requestsPerMinute.recordOutcome(op, 'refused');
       throw err;
     }
     // Circuit breaker: when the worker is degraded, fail best-effort ops fast
@@ -793,11 +821,23 @@ class CtmDbOwnerWorkerClient {
     if (options.bestEffort && options.priority !== 'urgent' && this.isDegraded()) {
       const err = new Error(`DB owner worker degraded; skipped best-effort op: ${op}`);
       err.code = 'CTM_DB_OWNER_WORKER_DEGRADED';
+      this._requestsPerMinute.recordOutcome(op, 'refused');
       throw err;
     }
-    await _awaitWithAbort(this.start(), options.signal);
-    if (options.signal?.aborted) throw _abortError(options.signal);
-    if (!this._worker) throw new Error('DB owner worker is not running');
+    try {
+      await _awaitWithAbort(this.start(), options.signal);
+    } catch (error) {
+      this._requestsPerMinute.recordOutcome(op, _requestCountOutcome(error));
+      throw error; // RETHROW: attribution must not change a failed start into a success
+    }
+    if (options.signal?.aborted) {
+      this._requestsPerMinute.recordOutcome(op, 'error');
+      throw _abortError(options.signal);
+    }
+    if (!this._worker) {
+      this._requestsPerMinute.recordOutcome(op, 'refused');
+      throw new Error('DB owner worker is not running');
+    }
     const requestId = this._nextRequestId++;
     const timeoutMs = _durationMs(options.timeoutMs, this.requestTimeoutMs);
     const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : 0;
@@ -872,6 +912,7 @@ class CtmDbOwnerWorkerClient {
             this._invalidateRowCursorSources(sourceIds, { all: sourceIds.length === 0 });
           }
           this._status.pendingClientRequests = this._pending.size;
+          this._requestsPerMinute.recordOutcome(op, 'error');
           reject(_abortError(options.signal));
         };
         this._pending.get(requestId).abortHandler = abortHandler;
@@ -975,6 +1016,10 @@ class CtmDbOwnerWorkerClient {
       workSignal: this._workSignal.snapshot(),
       ingestAdmission: this._ingestAdmissionSignal.snapshot(),
       opQuarantine: this._opQuarantine.snapshot(),
+      // WP-0 M-5 (§3.5): the last 30 one-minute request buckets, oldest first. Reaches
+      // perf-summary (lib/perf-summary.js:196 passes this whole status through as
+      // workers.dbOwner) and the diagnostics routes with no change to either.
+      requestsPerMinute: this._requestsPerMinute.snapshot(),
       lastStatusAt: this._lastStatusAt,
       dbPath: this.dbPath,
       resourceLimits: { ...this.resourceLimits },
@@ -1062,6 +1107,9 @@ class CtmDbOwnerWorkerClient {
     if (pending.abortHandler) {
       pending.signal?.removeEventListener?.('abort', pending.abortHandler);
     }
+    // WP-0 M-5: the request settled on the worker's reply (or on a postMessage failure) —
+    // attribute it to the op the client recorded at request() time.
+    this._requestsPerMinute.recordOutcome(pending.op, error ? _requestCountOutcome(error) : 'ok');
     if (error) {
       const err = error instanceof Error ? error : new Error(String(error.message || error || 'DB owner worker request failed'));
       if (error.code) err.code = error.code;
@@ -1181,6 +1229,9 @@ class CtmDbOwnerWorkerClient {
       if (req.abortHandler) {
         req.signal?.removeEventListener?.('abort', req.abortHandler);
       }
+      // WP-0 M-5: a worker death / recycle / close rejects work the client had already
+      // accepted — "refused: not running", the other half of the storm's refusals.
+      this._requestsPerMinute.recordOutcome(req.op, 'refused');
       req.reject(err);
     }
   }
@@ -1355,4 +1406,7 @@ module.exports = {
   requestOnActiveDbOwner,
   getActiveClientForDbPath,
   startParentWedgeWatchdog,
+  // WP-0 M-5: exported so the ring/key-bound/flag behaviour can be unit-tested with an
+  // injected clock (the client itself spawns a worker and has no time injection).
+  DbOwnerRequestsPerMinute,
 };

package/template/coding-task-manager/lib/db-schema-source-files.js

@@ -40,6 +40,11 @@ const SCHEMA_SOURCE_FILES = Object.freeze([
   'lib/migrations/v53-session-model-intent.js',
   'lib/migrations/v54-session-lead-model.js',
   'lib/migrations/v56-host-samples-and-machine-pool.js',
+  'lib/migrations/v57-delegate-pref-mirror-opencode.js',
+  'lib/migrations/v58-subagent-launch-native-subagents.js',
+  'lib/migrations/v59-coding-session-model-state-dsh.js',
+  'lib/migrations/v60-delegate-pref-mirror-dsh.js',
+  'lib/migrations/v61-conversation-item-clock.js', // shared-memory WP-5: conversation replica clock
   'lib/migrations/v29-usage-accounting.js', 'lib/migrations/v30-usage-reporting.js', 'lib/migrations/v36-conversation-projection-deletes.js',
   '../shared/usage-store.js', '../shared/usage-reporting-schema.js',
   'lib/delete-ctm-session-saga.js',

package/template/coding-task-manager/lib/deferred-restore-attempt.js

@@ -165,8 +165,12 @@ function captureDeferredRestoreLaunchOwnership(sourceSession) {
     if (Object.hasOwn(launchContext, 'providerThreadId') && launchContext.providerThreadId !== null
         && !sourceThreadIdentities(sourceSession, recipe).has(launchContext.providerThreadId)) return null;
   }
-  const launchEnvironment = capturePrivateSourceEnvironment(
-    Object.hasOwn(sourceSession, '_launchEnvOverrides') ? sourceSession._launchEnvOverrides : null);
+  // §5 D-7: a session whose launch environment the host could not capture parks as unavailable, not as a
+  // captured environment re-read off a roots-only override set. Every other state keeps today's capture.
+  const launchEnvironment = sourceSession._launchEnvOverridesCaptureState === 'unavailable'
+    ? Object.freeze({ state: 'unavailable', values: null })
+    : capturePrivateSourceEnvironment(
+      Object.hasOwn(sourceSession, '_launchEnvOverrides') ? sourceSession._launchEnvOverrides : null);
   const leadRoute = sourceSession.lead_route && typeof sourceSession.lead_route === 'object'
     ? copyCapturedData(sourceSession.lead_route, copyState) : null;
   const leadRouteTokenOwnership = sourceSession._leadRouteTokenOwnership

package/template/coding-task-manager/lib/feature-manifest.js

@@ -989,6 +989,10 @@ const FEATURES = [
   { id: "ctm_ctm_opencode_import_slice_size", env: "CTM_OPENCODE_IMPORT_SLICE_SIZE", owner: "ctm-core-team", stage: "ops", tunable: true, default: 1, since: "2026-08-24", expires: null, note: "numeric tunable" },
   // numeric-tunable suffix/read shape; 1 site(s); first: server.js:9929
   { id: "ctm_ctm_opencode_import_worker_timeout_ms", env: "CTM_OPENCODE_IMPORT_WORKER_TIMEOUT_MS", owner: "ctm-core-team", stage: "ops", tunable: true, default: 5, since: "2026-08-24", expires: null, note: "numeric tunable" },
+  // spawn-env carrier for the OpenCode 1.x switch relaunch (WP-5); 1 site(s); first: lib/opencode-v1-plugin/model-carrier.mjs:19
+  { id: "ctm_ctm_opencode_switch_model", env: "CTM_OPENCODE_SWITCH_MODEL", owner: "ctm-core-team", stage: "ops", defaultOn: true, since: "2026-10-30", expires: null, note: "genuine config" },
+  // spawn-env carrier for the OpenCode 1.x switch relaunch (WP-5); 1 site(s); first: lib/opencode-v1-plugin/model-carrier.mjs:20
+  { id: "ctm_ctm_opencode_switch_session", env: "CTM_OPENCODE_SWITCH_SESSION", owner: "ctm-core-team", stage: "ops", defaultOn: true, since: "2026-10-30", expires: null, note: "genuine config" },
   // !== '0' comparison found; 1 site(s); first: lib/conversation-commit-kernel.js:179
   { id: "ctm_ctm_order_key_migration", env: "CTM_ORDER_KEY_MIGRATION", owner: "ctm-core-team", stage: "stable", defaultOn: true, since: "2026-08-24", expires: null },
   // !== '0' comparison found; 1 site(s); first: server.js:13369